二. OpenVPN 服务端安装过程

    1. 用 SecureCRT 登录到 host, 进入根目录 代码:

cd / 

    2. 下载 LZO，解压到lzo-2.02.
    地址: http://www.oberhumer.com/opensource/lzo/download/ 代码:

wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.02.tar.gz 

    3. 下载 OpenVPN, 解压到openvpn-2.0.5
    地址: http://openvpn.net/download.html 代码:

wget http://openvpn.net/release/openvpn-2.0.5.tar.gz 

    4. 安装 LZO 代码:

5. cd /lzo-2.02
6. ./configure
7. make
8. make check
make install 

    9. 安装 OpenVPN
    代码:

10. cd /openvpn-2.0.5
11. ./configure 

    12. # 或用指定dir: (注:下述命令, 应该在一行写完. 为了方便显示, 这里分成了四行)

13. # ./configure --with-lzo-headers=/usr/local/include
14. # --with-lzo-lib=/usr/local/lib
15. # --with-ssl-headers=/usr/local/include/openssl
16. # --with-ssl-lib=/usr/local/lib
17. make
18. make install
19. 生成证书Key
初始化 PKI
(如果没有 export 命令也可以用 setenv [name] [value] 命令) 

    代码:

20. cd /openvpn-2.0.5/easy-rsa
21. export D=`pwd`
22. export KEY_CONFIG=$D/openssl.cnf
23. export KEY_DIR=$D/keys
24. export KEY_SIZE=1024
25. export KEY_COUNTRY=CN
26. export KEY_PROVINCE=GD
27. export KEY_CITY=SZ
28. export KEY_ORG="dvdmaster"
export KEY_EMAIL="support@cooldvd.com"
Build: 

    代码:

./clean-all
./build-ca

Generating a 1024 bit RSA private key
................++++++
........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [dvdmaster]:
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:server 
Email Address [support@cooldvd.com]:
# 建立 server key 代码: 代码:
./build-key-server server

Generating a 1024 bit RSA private key
......++++++
....................++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [dvdmaster]:
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:server 
Email Address [support@cooldvd.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:dvdmaster
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows 
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'dvdmaster'
organizationalUnitName:PRINTABLE:'dvdmaster'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:15:31 2016 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

#生成客户端 key
代码:
./build-key client1
Generating a 1024 bit RSA private key
.....++++++
......++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [dvdmaster]:
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:client1 #重要: 每个不同的 client 生成的证书, 名字必须不同. 
Email Address [support@cooldvd.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:dvdmaster
Using configuration from /openvpn-2.0.5/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows 
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'dvdmaster'
organizationalUnitName:PRINTABLE:'dvdmaster'
commonName :PRINTABLE:'client1'
emailAddress :IA5STRING:'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:22:00 2016 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated 

    依次类推生成其他客户端证书/key
    代码:

./build-key client2
./build-key client3 

    注意在进入 Common Name (eg, your name or your server's hostname) []: 的输入时, 每个证书输入的名字必须不同.

    29. build: 代码:

30.
./build-dh 

    31. 将 keys 下的所有文件打包下载到本地
    代码:

32. tar -cf mykeys.tar /openvpn-2.0.5/easy-rsa/keys
cp mykeys.tar /home/dvdmastersys/public_html/mykeys.tar
将 mykeys.tar 移到 web public(绝对路径因人而异) 上, 然后用 http://www.a.com/mykeys.tar 方式将其下载到本地保存, 然后将其从server删除: 代码: 
rm /home/dvdmastersys/public_html/mykeys.tar
也可以用其他方法把 key file搞到本地，例如 ftp. 

    33. 创建服务端配置文件
    从样例文件创建:
    代码:

34. cd $dir/sample-config-files/ # 进入源代码解压目录下的sample-config-files子目录
35. cp server.conf /usr/local/etc # cp服务器配置文件到/usr/local/etc
vi /usr/local/etc/server.conf 

    36. 创建客户端配置文件
    代码:

37. cd $dir/sample-config-files/ #进入源代码解压目录下的sample-config-files子目录
38. cp client.conf /usr/local/etc #cp客户端配置文件到/usr/local/etc
vi /usr/local/etc/client.conf 

    39. 启动Openvpn: openvpn [server config file] 代码:

/usr/local/sbin/openvpn --config /usr/local/etc/server.conf