vpnaccess
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
vpnaccess [2023/07/08 02:27] dmick remove Py2 steps; new-client works in Py3 |
vpnaccess [2026/08/17 21:14] (current) djgalloway |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== VPN Access ====== | ====== VPN Access ====== | ||
| ===== Requesting Access ===== | ===== Requesting Access ===== | ||
| - | To request access to the Sepia lab, | ||
| - | - Generate login credentials by following directions under **VPN Client Access** below. | ||
| - | - [[http://tracker.ceph.com/projects/lab/issues/new?issue[tracker_id]=3|File a ticket]]. Select **Sepia Lab Access Request** for the Issue Template. | ||
| - | For details on our particular OpenVPN server setup, see [[services:openvpn|OpenVPN]]. | + | Visit https://onboarding.sepia.ceph.com/ |
| - | + | ||
| - | ===== VPN Client Access ===== | + | |
| - | Follow the instructions corresponding to your workstation's operating system below. | + | |
| - | + | ||
| - | **NOTE:** You will need VPN credentials for each machine/workstation you intend to connect to the Sepia VPN. **Client credentials can not be used on more than one machine at a time!** | + | |
| - | + | ||
| - | + | ||
| - | ==== Linux ==== | + | |
| - | <code> | + | |
| - | sudo [apt-get|yum] install openvpn | + | |
| - | + | ||
| - | sudo mkdir -p /run/openvpn | + | |
| - | + | ||
| - | ## Fedora 28 and later | + | |
| - | cd /etc/openvpn/client | + | |
| - | + | ||
| - | ## All others | + | |
| - | cd /etc/openvpn | + | |
| - | + | ||
| - | ## filedump.ceph.com is temporarily unavailable; contact akraitma@redhat.com or dmick@redhat.com regarding this file - sepia-vpn-client.tar.gz | + | |
| - | wget https://filedump.ceph.com/sepia-vpn-client.tar.gz | + | |
| - | sudo tar zxvf sepia-vpn-client.tar.gz | + | |
| - | + | ||
| - | + | ||
| - | # Generate client credentials | + | |
| - | # USER should be your desired username and HOST should describe your workstation | + | |
| - | # e.g., dgalloway@thinkpad | + | |
| - | + | ||
| - | sudo ./sepia/new-client USER@HOST | + | |
| - | + | ||
| - | # Submit the command output in your ticket | + | |
| - | # After you've been notified in your ticket that access has been granted, | + | |
| - | + | ||
| - | sudo service openvpn restart | + | |
| - | OR | + | |
| - | sudo systemctl restart openvpn@sepia | + | |
| - | OR | + | |
| - | sudo systemctl restart openvpn-client@sepia | + | |
| - | + | ||
| - | # Try all 3. One of them should work. | + | |
| - | # Whichever works, enable the systemd service | + | |
| - | + | ||
| - | sudo systemctl enable openvpn@sepia | + | |
| - | OR | + | |
| - | sudo systemctl enable openvpn-client@sepia | + | |
| - | </code> | + | |
| - | + | ||
| - | === Linux Gotchas === | + | |
| - | You may need to edit ''user'' and ''group'' in ''/etc/openvpn/sepia/client.conf'' depending on what user the service runs as. This could be ''nobody'', ''nogroup'', or ''openvpn''. | + | |
| - | + | ||
| - | <code> | + | |
| - | sed -i 's/nobody/openvpn/g' /etc/openvpn/sepia/client.conf || sed -i 's/nobody/openvpn/g' /etc/openvpn/client/sepia/client.conf | + | |
| - | sed -i 's/nogroup/openvpn/g' /etc/openvpn/sepia/client.conf || sed -i 's/nogroup/openvpn/g' /etc/openvpn/client/sepia/client.conf | + | |
| - | </code> | + | |
| - | + | ||
| - | ---- | + | |
| - | + | ||
| - | If you're using OpenVPN for any other VPN connection (e.g., Red Hat's), you may need to change the ''dev'' name in ''/etc/openvpn/sepia/client.conf''. See below. | + | |
| - | + | ||
| - | <code> | + | |
| - | # ERASE | + | |
| - | dev tun | + | |
| - | + | ||
| - | # REPLACE WITH | + | |
| - | dev sepia0 | + | |
| - | dev-type tun | + | |
| - | </code> | + | |
| - | + | ||
| - | ---- | + | |
| - | + | ||
| - | If the ''new-client'' script throws an error about ''/usr/bin/python'' not being found, run: | + | |
| - | + | ||
| - | <code> | + | |
| - | sudo sed -i 's|/usr/bin/python|/usr/bin/python3|g' sepia/new-client | + | |
| - | </code> | + | |
| - | + | ||
| - | === Troubleshooting === | + | |
| - | Please disable SELinux on rhel clients | + | |
| - | + | ||
| - | To troubleshoot your VPN connection, try running the following command to determine where the connection is failing: | + | |
| - | + | ||
| - | <code> | + | |
| - | openvpn --config /etc/openvpn/sepia.conf --cd /etc/openvpn --verb 5 | + | |
| - | OR | + | |
| - | openvpn --config /etc/openvpn/client/sepia.conf --cd /etc/openvpn/client --verb 5 | + | |
| - | </code> | + | |
| - | + | ||
| - | ==== Fedora NetworkManager GUI ==== | + | |
| - | + | ||
| - | - Make sure you've followed all the prerequisite steps [[vpnaccess#linux|here]] | + | |
| - | - Right click the NetworkManager icon | + | |
| - | - **Edit Connections** | + | |
| - | - Click the + symbol | + | |
| - | - Select **Import a saved VPN configuration** from the bottom | + | |
| - | - Click **Create** | + | |
| - | - Browse to ''/etc/openvpn/sepia/client.conf'' | + | |
| - | - Enter your the first line in ''/etc/openvpn/sepia/secret'' (e.g., ''USER@HOST'') under **User name** | + | |
| - | - Enter the second line in your ''/etc/openvpn/sepia/secret'' file for **Password** | + | |
| - | + | ||
| - | + | ||
| - | ==== Fedora Network Manager GUI -- Fedora 34 ==== | + | |
| - | + | ||
| - | This procedure was confirmed to work on Fedora 34 on 14 July 2021. | + | |
| - | + | ||
| - | - Make sure you've followed all the prerequisite steps [[vpnaccess#linux|here]] | + | |
| - | - Right click the NetworkManager icon | + | |
| - | - Select **Settings** --> **Network** | + | |
| - | - Click the **+** symbol under VPN | + | |
| - | - Select **Import from file...** from the bottom | + | |
| - | - Browse to ''/etc/openvpn/client/sepia.conf'' | + | |
| - | - Enter your the first line in ''/etc/openvpn/client/sepia/secret'' (e.g., ''USER@HOST'') under **User name** | + | |
| - | - Enter the second line in your ''/etc/openvpn/client/sepia/secret'' file for **Password** | + | |
| - | + | ||
| - | ==== Mac/OS X ==== | + | |
| - | Tunnelblick and Viscosity are two clients known to work with the Sepia VPN. | + | |
| - | + | ||
| - | === Tunnelblick **UNTESTED** === | + | |
| - | - Download and untar the Sepia VPN client [[https://filedump.ceph.com/sepia-vpn-client.tar.gz|tarball]] <code> | + | |
| - | mkdir /etc/openvpn | + | |
| - | cd /etc/openvpn | + | |
| - | wget https://filedump.ceph.com/sepia-vpn-client.tar.gz | + | |
| - | sudo tar zxvf sepia-vpn.client.tar.gz | + | |
| - | + | ||
| - | # Generate client credentials | + | |
| - | # USER should be your desired username and HOST should describe your workstation | + | |
| - | # e.g., dgalloway@thinkpad | + | |
| - | + | ||
| - | sudo ./sepia/new-client USER@HOST | + | |
| - | + | ||
| - | # Submit the output of this command in your ticket</code> | + | |
| - | - Replace the line ''auth-user-pass sepia/secret'' with just ''auth-user-pass'' in client.conf | + | |
| - | - Follow [[https://tunnelblick.net/cConfigT.html|Tunnelblick's instructions]] for adding the config | + | |
| - | - When prompted for user/pass, enter username USER@HOST as above, and for password use the secret contents of the file ''/etc/openvpn/sepia/secret''. | + | |
| - | - Save to your keychain if you wish | + | |
| - | + | ||
| - | === Viscosity === | + | |
| - | + | ||
| - | - Download https://filedump.ceph.com/Sepia.visz | + | |
| - | - Download https://filedump.ceph.com/sepia-vpn-client.tar.gz | + | |
| - | - Import the Sepia.visz config into Viscosity | + | |
| - | - Extract sepia-vpn-client.tar.gz | + | |
| - | - Save ''sepia/ca.crt'' somewhere | + | |
| - | - Run ''sudo ./sepia/new-client USER@HOST'' | + | |
| - | - Replace ''USER@HOST'' with your desired username and machine description. (e.g., dgalloway@laptop) | + | |
| - | - In Viscosity, under the Authentication tab, set: | + | |
| - | - **Authentication:** SSL/TLS Client | + | |
| - | - Check **Use Username/Password authentication** | + | |
| - | - **CA:** to the ca.crt file you saved earlier | + | |
| - | - **Tls-Auth:** ta.key | + | |
| - | - When connecting to the VPN for the first time, | + | |
| - | - Enter your ''USER@HOST'' combination as the username | + | |
| - | - Enter the second line of ''sepia/secret'' as the password | + | |
| - | - Save the credentials to your keychain | + | |
| - | - You can now delete any downloaded and created files (except ca.crt) | + | |
| - | + | ||
| - | ===== A Note About DNS ===== | + | |
| - | Due to complexities around adding nameservers to various Linux distro VPN clients, our OpenVPN server does not use the [[https://openvpn.net/index.php/open-source/documentation/howto.html#dhcp|dhcp-option DNS]] option. | + | |
| - | + | ||
| - | Instead, we serve our private DNS records publicly. Your machine should be able to resolve hostnames under the ''sepia.ceph.com'' subdomain automatically. | + | |
| - | + | ||
| - | If you're using dnsmasq, you can add ''server=/sepia.ceph.com/172.21.0.1'' to ''/etc/dnsmasq.conf''. | + | |
vpnaccess.1688783246.txt.gz · Last modified: 2023/07/08 02:27 by dmick
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
