vpnaccess
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
vpnaccess [2018/06/29 15:59] djgalloway |
vpnaccess [2026/08/17 21:14] (current) djgalloway |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== VPN Access ====== | ====== VPN Access ====== | ||
| ===== Requesting Access ===== | ===== Requesting Access ===== | ||
| - | To request access to the Sepia lab, | ||
| - | - Generate login credentials by following directions under **VPN Client Access** below. | ||
| - | - [[http://tracker.ceph.com/projects/lab/issues/new?issue[tracker_id]=3|File a ticket]]. Select **Sepia Lab Access Request** for the Issue Template. | ||
| - | For details on our particular OpenVPN server setup, see [[services:openvpn|OpenVPN]]. | + | Visit https://onboarding.sepia.ceph.com/ |
| - | + | ||
| - | ===== VPN Client Access ===== | + | |
| - | Follow the instructions corresponding to your workstation's operating system below. | + | |
| - | + | ||
| - | **NOTE:** You will need VPN credentials for each machine/workstation you intend to connect to the Sepia VPN. **Client credentials can not be used on more than one machine at a time!** | + | |
| - | + | ||
| - | ==== Linux ==== | + | |
| - | <code> | + | |
| - | sudo [apt-get|yum] install openvpn | + | |
| - | cd /etc/openvpn | + | |
| - | wget http://ceph.com/sage/sepia-vpn-client.tar.gz | + | |
| - | sudo tar zxvf sepia-vpn-client.tar.gz | + | |
| - | + | ||
| - | # Generate client credentials | + | |
| - | # USER should be your desired username and HOST should describe your workstation | + | |
| - | # e.g., dgalloway@thinkpad | + | |
| - | + | ||
| - | sudo ./sepia/new-client USER@HOST | + | |
| - | + | ||
| - | # Submit the command output in your ticket | + | |
| - | # After you've been notified in your ticket that access has been granted, | + | |
| - | + | ||
| - | sudo service openvpn restart | + | |
| - | OR | + | |
| - | sudo systemctl restart openvpn@sepia | + | |
| - | + | ||
| - | # If you have a /etc/openvpn/client/ directory, you may need to: | + | |
| - | + | ||
| - | sudo mv /etc/openvpn/sepia* /etc/openvpn/client/ | + | |
| - | + | ||
| - | # before you can run openvpn-client@sepia.service. | + | |
| - | # This is because the OpenVPN systemd unit file looks in /etc/openvpn/client/ for configuration files by default. | + | |
| - | </code> | + | |
| - | + | ||
| - | === Linux Gotchas === | + | |
| - | You may need to modify ''user'' and ''group'' in ''/etc/openvpn/sepia/client.conf'' depending on what user the service runs as. This could be ''nobody'', ''nogroup'', or ''openvpn''. | + | |
| - | + | ||
| - | <code> | + | |
| - | - user nobody | + | |
| - | - group nogroup | + | |
| - | + user openvpn | + | |
| - | + group openvpn | + | |
| - | </code> | + | |
| - | + | ||
| - | If you're using OpenVPN for any other VPN connection (e.g., Red Hat's), you may need to change the ''dev'' name in ''/etc/openvpn/sepia/client.conf''. See below. | + | |
| - | + | ||
| - | <code> | + | |
| - | - dev tun | + | |
| - | + dev sepia0 | + | |
| - | + dev-type tun | + | |
| - | </code> | + | |
| - | + | ||
| - | === Troubleshooting === | + | |
| - | To troubleshoot your VPN connection, try running the following command to determine where the connection is failing: | + | |
| - | + | ||
| - | <code> | + | |
| - | openvpn --config /etc/openvpn/sepia.conf --cd /etc/openvpn --verb 5 | + | |
| - | </code> | + | |
| - | + | ||
| - | ==== Fedora NetworkManager GUI ==== | + | |
| - | + | ||
| - | - Make sure you've followed all the prerequisite steps [[vpnaccess#linux|here]] | + | |
| - | - Right click the NetworkManager icon | + | |
| - | - **Edit Connections** | + | |
| - | - Click the + symbol | + | |
| - | - Select **Import a saved VPN configuration** from the bottom | + | |
| - | - Click **Create** | + | |
| - | - Browse to ''/etc/openvpn/sepia/client.conf'' | + | |
| - | - Enter your the first line in ''/etc/openvpn/sepia/secret'' (e.g., ''USER@HOST'') under **User name** | + | |
| - | - Enter the second line in your ''/etc/openvpn/sepia/secret'' file for **Password** | + | |
| - | + | ||
| - | + | ||
| - | ==== Mac/OS X ==== | + | |
| - | Tunnelblick and Viscosity are two clients known to work with the Sepia VPN. | + | |
| - | + | ||
| - | === Tunnelblick **UNTESTED** === | + | |
| - | - Download and untar the Sepia VPN client [[http://ceph.com/sage/sepia-vpn-client.tar.gz|tarball]] <code> | + | |
| - | mkdir /etc/openvpn | + | |
| - | cd /etc/openvpn | + | |
| - | wget http://ceph.com/sage/sepia-vpn-client.tar.gz | + | |
| - | sudo tar zxvf sepia-vpn.client.tar.gz | + | |
| - | + | ||
| - | # Generate client credentials | + | |
| - | # USER should be your desired username and HOST should describe your workstation | + | |
| - | # e.g., dgalloway@thinkpad | + | |
| - | + | ||
| - | sudo ./sepia/new-client USER@HOST | + | |
| - | + | ||
| - | # Submit the output of this command in your ticket</code> | + | |
| - | - Replace the line ''auth-user-pass sepia/secret'' with just ''auth-user-pass'' in client.conf | + | |
| - | - Follow [[https://tunnelblick.net/cConfigT.html|Tunnelblick's instructions]] for adding the config | + | |
| - | - When prompted for user/pass, enter username USER@HOST as above, and for password use the secret contents of the file ''/etc/openvpn/sepia/secret''. | + | |
| - | - Save to your keychain if you wish | + | |
| - | + | ||
| - | === Viscosity === | + | |
| - | + | ||
| - | - Download http://ceph.com/sage/Sepia.visz | + | |
| - | - Download http://ceph.com/sage/sepia-vpn-client.tar.gz | + | |
| - | - Import the Sepia.visz config into Viscosity | + | |
| - | - Extract sepia-vpn-client.tar.gz | + | |
| - | - Save ''sepia/ca.crt'' somewhere | + | |
| - | - Run ''sudo ./sepia/new-client USER@HOST'' | + | |
| - | - Replace ''USER@HOST'' with your desired username and machine description. (e.g., dgalloway@laptop) | + | |
| - | - In Viscosity, under the Authentication tab, set: | + | |
| - | - **Authentication:** SSL/TLS Client | + | |
| - | - Check **Use Username/Password authentication** | + | |
| - | - **CA:** to the ca.crt file you saved earlier | + | |
| - | - **Tls-Auth:** ta.key | + | |
| - | - When connecting to the VPN for the first time, | + | |
| - | - Enter your ''USER@HOST'' combination as the username | + | |
| - | - Enter the second line of ''sepia/secret'' as the password | + | |
| - | - Save the credentials to your keychain | + | |
| - | - You can now delete any downloaded and created files (except ca.crt) | + | |
| - | + | ||
| - | ===== A Note About DNS ===== | + | |
| - | Due to complexities around adding nameservers to various Linux distro VPN clients, our OpenVPN server does not use the [[https://openvpn.net/index.php/open-source/documentation/howto.html#dhcp|dhcp-option DNS]] option. | + | |
| - | + | ||
| - | Instead, we serve our private DNS records publicly. Your machine should be able to resolve hostnames under the ''sepia.ceph.com'' subdomain automatically. | + | |
| - | + | ||
| - | If you're using dnsmasq, you can add ''server=/sepia.ceph.com/172.21.0.1'' to ''/etc/dnsmasq.conf''. | + | |
vpnaccess.1530287965.txt.gz · Last modified: 2018/06/29 15:59 by djgalloway
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
