Translations by EAdam

source vars

./clean-all

./build-dh

./pkitool --initca

./pkitool --server server

cd keys

openvpn --genkey --secret ta.key

sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/

Client Certificates

The VPN client will also need a certificate to authenticate itself to the server. To create the certificate, enter the following in a terminal:

./pkitool hostname

Replace <emphasis>hostname</emphasis> with the actual hostname of the machine connecting to the VPN.

Copy the following files to the client:

Remember to adjust the above file names for your client machine's <emphasis>hostname</emphasis>.

It is best to use a secure method to copy the certificate and key files. The <application>scp</application> utility is a good choice, but copying the files to removable media then to the client, also works well.

Now configure the <application>openvpn</application> server by creating <filename>/etc/openvpn/server.conf</filename> from the example file. In a terminal enter:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/

sudo gzip -d /etc/openvpn/server.conf.gz

<emphasis>local</emphasis>: is the IP address of the bridge interface.

<emphasis>server-bridge</emphasis>: needed when the configuration uses bridging. The <emphasis>172.18.100.101 255.255.255.0</emphasis> portion is the bridge interface and mask. The IP range <emphasis>172.18.100.105 172.18.100.200</emphasis> is the range of IP addresses that will be assigned to clients.

<emphasis>push</emphasis>: are directives to add networking options for clients.

<emphasis>user and group</emphasis>: configure which user and group the <application>openvpn</application> daemon executes as.

Replace all IP addresses and domain names above with those of your network.

Next, create a couple of helper scripts to add the <emphasis>tap</emphasis> interface to the bridge. Create <filename>/etc/openvpn/up.sh</filename>:

#!/bin/sh BR=$1 DEV=$2 MTU=$3 /sbin/ifconfig $DEV mtu $MTU promisc up /usr/sbin/brctl addif $BR $DEV

And <filename>/etc/openvpn/down.sh</filename>:

#!/bin/sh BR=$1 DEV=$2 /usr/sbin/brctl delif $BR $DEV /sbin/ifconfig $DEV down

Then make them executable:

sudo chmod 755 /etc/openvpn/down.sh

sudo chmod 755 /etc/openvpn/up.sh

After configuring the server, restart <application>openvpn</application> by entering:

sudo /etc/init.d/openvpn restart

Client Configuration

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn

Now edit <filename>/etc/openvpn/client.conf</filename> changing the following options:

dev tap remote vpn.example.com 1194 cert hostname.crt key hostname.key tls-auth ta.key 1

Replace <emphasis>vpn.example.com</emphasis> with the hostname of your VPN server, and <emphasis>hostname.*</emphasis> with the actual certificate and key filenames.

Finally, restart <application>openvpn</application>:

You should now be able to connect to the remote LAN through the VPN.

See the <ulink url="http://openvpn.net/">OpenVPN</ulink> website for additional information.

Also, Pakt's <ulink url="http://www.packtpub.com/openvpn/book">OpenVPN: Building and Integrating Virtual Private Networks</ulink> is a good resource.

You are now ready to install a <emphasis>Guest</emphasis> operating system. Installing a virtual machine follows the same process as installing the operating system directly on the hardware. You either need a way to automate the installation, or a keyboard and monitor will need to be attached to the physical machine.

Here is the command with all the options discussed above:

Accessing Subversion repository via WebDAV protocol with SSL encryption (https://) is similar to http:// except that you must install and configure the digital certificate in your Apache2 web server. To use SSL with Subversion add the above Apache2 configuration to <filename>/etc/apache2/sites-available/default-ssl</filename>. For more information on setting up Apache2 with SSL see <xref linkend="https-configuration"/>.

You can install a digital certificate issued by a signing authority. Alternatively, you can install your own self-signed certificate.

Applications that open ports can include an <application>ufw</application> profile, which details the ports needed for the application to function properly. The profiles are kept in <filename role="directory">/etc/ufw/applications.d</filename>, and can be edited if the default ports have been changed.

net/ipv4/ip_forward=1

net/ipv6/conf/default/forwarding=1

Similar to <application>ufw</application>, the first step is to enable IPv4 packet forwarding by editing <filename>/etc/sysctl.conf</filename> and uncomment the following line

The Exim4 does not use the above aliases to forward mails to Mailman, as it uses a <emphasis>discover</emphasis> approach. To suppress the aliases while creating the list, you can add <emphasis>MTA=None</emphasis> line in Mailman configuration file, <filename>/etc/mailman/mm_cfg.py</filename>.