Anand Patil's Blog is dedicated to sharing the knowledge and resources in a broad range of categories in the area of system administration...
Friday, June 28, 2013
Thursday, June 27, 2013
How to Install Cygwin Offline in Windows 7
Here are instructions assuming you want to install Cygwin on a windows computer with no Internet connection. I assume that you have access to another computer with an Internet connection. Start on the connected computer:
cygwin is Linux environment and command-line interface for Windows |
To know completely about cygwin click here.
Cygwin uses a small setup file to download the large setup file from the mirrors.
You can install cygwin in 2 ways.
- 1. Install cygwin online.
- 2. Install cygwin offline.
- 1. Download the cygwin setup file from here.
- 2. Run the downloaded setup file as an administrator.
- 3. Click "Next".
- 4. Select "Download Without Installing" and then "Next"
- 5. Select the local folder in which you should place your setup files by clicking "Browse.."
- 6. Select the folder to download offline installer files and then "OK"
- 7. Choose your internet connection method which by default is 'Direct Connection'.
- 8. Select the mirrors from which site your setup file should be from and click "Next".
- 9. Wait for the original set up file to be downloaded.
- 10.Choose the packages you want and click "Next"
- 11.Wait for the download to complete. It may take 5-10 Minutes depending your connection speed and selected mirror.
- 12.Click "Finish".
- That's it!! Now you have offline installar to install cygwin offline.On the target computer, run "setup.exe"Copy downloaded directory, along with the "setup.exe" program, over to your target computerOn the target computer, run "setup.exe"When the setup asks "Choose a download source", choose Install From Local DirectoryComplete setup as usual. No Internet access is required.
Wednesday, June 26, 2013
10 tips for Online social networking safety
Social networking websites like MySpace, Facebook, Twitter, and Windows Live Spaces are services people can use to connect with others to share information like photos, videos, and personal messages. As the popularity of these social sites grows, so do the risks of using them. Hackers, spammers, virus writers, identity thieves, and other criminals follow the traffic.
Read these tips to help protect yourself when you use social networks:
- Use caution when you click links that you receive in messages from your friends on your social website. Treat links in messages on these sites as you would links in email messages. (For more information, see Approach links in email with caution and Click Fraud: Cybercriminals want you to 'like' it.)
- Know what you've posted about yourself. A common way that hackers break into financial or other accounts is by clicking the "Forgot your password?" link on the account login page. To break into your account, they search for the answers to your security questions, such as your birthday, home town, high school class, or mother's middle name. If the site allows, make up your own password questions, and don't draw them from material anyone could find with a quick search.
- Don't trust that a message is really from who it says it's from. Hackers can break into accounts and send messages that look like they're from your friends, but aren't. If you suspect that a message is fraudulent, use an alternate method to contact your friend to find out. This includes invitations to join new social networks. For more information, see Scammers exploit Facebook friendships.
- To avoid giving away email addresses of your friends, do not allow social networking services to scan your email address book. When you join a new social network, you might receive an offer to enter your email address and password to find out if your contacts are on the network. The site might use this information to send email messages to everyone in your contact list or even everyone you've ever sent an email message to with that email address. Social networking sites should explain that they're going to do this, but some do not.
- Type the address of your social networking site directly into your browser or use your personal bookmarks. If you click a link to your site through email or another website, you might be entering your account name and password into a fake site where your personal information could be stolen. For more tips about how to avoid phishing scams, see Email and web scams: How to help protect yourself.
- Be selective about who you accept as a friend on a social network. Identity thieves might create fake profiles in order to get information from you.
- Choose your social network carefully. Evaluate the site that you plan to use and make sure you understand the privacy policy. Find out if the site monitors content that people post. You will be providing personal information to this website, so use the same criteria that you would to select a site where you enter your credit card.
- Assume that everything you put on a social networking site is permanent. Even if you can delete your account, anyone on the Internet can easily print photos or text or save images and videos to a computer.
- Be careful about installing extras on your site. Many social networking sites allow you to download third-party applications that let you do more with your personal page. Criminals sometimes use these applications to steal your personal information. To download and use third-party applications safely, take the same safety precautions that you take with any other program or file you download from the web.
- Think twice before you use social networking sites at work. For more information, see Be careful with social networking sites, especially at work.
Monday, March 25, 2013
How to configure OPEN VPN Server in Windows System
First Step is to Downloading and installing the software.
- Download the installer for windows server from here and run it on the your windows computer.
- Install OpenVPN on each client. (This step can be skipped for now and done at any convenient time)
Configuring Certificates and Keys
Preparatory Steps
- After finishing installation process, Navigate to the C:\Program Files\OpenVPN\easy-rsa folder in the command prompt:
- Initialize the OpenVPN configuration:
init-config
- Open the vars.bat file in a text editor:
notepad vars.bat
- Edit the following lines in vars.bat, replacing "IN", "CA," etc. with your company's information:
set KEY_COUNTRY=IN set KEY_PROVINCE=CA set KEY_CITY=Bangalore set KEY_ORG=Apacheinfotech set KEY_EMAIL=webadmin@apacheinfotech.com
- Save the file and exit notepad.
- Run the following commands:
vars
clean-all
Building Certificates and Keys
- The certificate authority (CA) certificate and key:
build-ca
- When prompted, enter your country, etc. These will have
default values, which appear in brackets. For your "Common Name," a good
choice is to pick a name to identify your company's Certificate
Authority. For example, "OpenVPN-CA":
Country Name (2 letter code IN for india) [IN]: State or Province Name (full name) [CA]: Locality Name (eg, city) [Bangalore]: Organization Name (eg, company) [ApacheInfotech]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []:OpenVPN-CA Email Address [admin@apacheinfotech.com]:
- When prompted, enter your country, etc. These will have
default values, which appear in brackets. For your "Common Name," a good
choice is to pick a name to identify your company's Certificate
Authority. For example, "OpenVPN-CA":
- The server certificate and key:
build-key-server server
- When prompted, enter the "Common Name" as "server"
- When prompted to sign the certificate, enter "y"
- When prompted to commit, enter "y"
- Client certificates and keys:
- For each client, choose a name to identify that computer, such as "arun-laptop" in this example.
build-key arun-laptop
- When prompted, enter the "Common Name" as the name you have chosen (e.g. "arun-laptop")
- Repeat this step for each client computer that will connect to the VPN.
- Generate Diffie Hellman parameters (This is necessary to set up the encryption)
build-dh
Configuration Files
- Find the sample configuration files:
Start Menu -> All Programs -> OpenVPN -> OpenVPN Sample Configuration Files
Server Config File
- Open server.ovpn
- Find the following lines:
ca ca.crt cert server.crt key server.key
dh dh1024.pem
- Edit them as follows:
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
- Save the file as C:\Program Files\OpenVPN\easy-rsa\server.ovpn
Client Config Files
This is similar to the server configuration- Open client.ovpn
- Find the following lines:
ca ca.crt cert client.crt key client.key
- Edit them as follows:
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\arun-laptop.crt" key "C:\\Program Files\\OpenVPN\\config\\arun-laptop.key"
- Notice that the name of the client certificate and key files depends upon the Common Name of each client.
- Edit the following line, replacing
"my-server-1" with your server's public Internet IP Address or Domain
Name
remote my-server-1 1194
- Save the file as C:\Program Files\OpenVPN\easy-rsa\arun-laptop.ovpn (in this example. Each client will need a different, but similar, config file depending upon that client's Common Name.)
Copying the Server and Client Files to Their Appropriate Directories
- Copy these files from C:\Program Files\OpenVPN\easy-rsa\ to C:\Program Files\OpenVPN\config\ on the server:
ca.crt dh1024.pem server.crt server.key server.ovpn
- Copy these files from C:\Program
Files\OpenVPN\easy-rsa\ on the server to C:\Program
Files\OpenVPN\config\ on each client (arun-laptop, in this example):
ca.crt arun-laptop.crt arun-laptop.key arun-laptop.ovpn
Starting OpenVPN
- On both client and server, run OpenVPN from:
Start Menu -> All Programs -> OpenVPN -> OpenVPN GUI
- Double click the icon which shows up in the system tray to initiate the connection. The resulting dialog should close upon a successful start.
Further Considerations / Troubleshooting
Firewall Configuration
If you have connection problems, make sure to set a rule on your server's firewall allowing incoming traffic on UDP port 1194.Port Forwarding
If your server is behind a router, you will need to forward the port chosen for OpenVPN (in this example UDP 1194) to the server. Consult your router's documentation for details on this.To set up port forwarding, you will likely need to set up the server with a static local IP address instead of the default dynamic (changing) IP. Make sure to choose a static IP address that is not in the range your router might assign as a dynamic IP, but is within the router's subnet (usually 192.168.0.xxx , 10.0.0.xxx , or similar).
Running OpenVPN as a Service
Running OpenVPN as a service will allow:- OpenVPN to be run from a non-administrator account.
- OpenVPN to be started automatically on system startup. This is often preferred on the server machine, as well as any machines which will be constantly connected to the server.
- Run the Windows Service administrative tool:
- Press Windows Key + R
- Type "services.msc" and press Enter.
services.msc
- Find the OpenVPN service, and set its Startup Type to "automatic."
- Optionally, start the service now.
Security Tips
- Transmit all needed files(such as certificates & keys) to the client computers using a secure means such as a USB drive (email is not always a secure means).
- Choose a port other than UDP 1194, and replace the port number wherever this guide mentions UDP port 1194.
Cloning OpenVPN Servers
If including OpenVPN in a cloned server build you will find that all servers will have the same MAC address for the TAP device. This will cause packet loss across the network. Standard methods of changing the IP address from scripts do not work on the TAP device, to resolve this delete and recreate the TAP device using the scripts included with OpenVPN:C:\Program Files\OpenVPN\bin\deltapall C:\Program Files\OpenVPN\bin\addtapYou will then have to rename the connection to match the entry in the config file.
Subscribe to:
Posts (Atom)
Advanced Windows RUN Commands for system administrator
Accessibility Controls- access.cpl
Add Hardware Wizard- hdwwiz.cpl
Add/Remove Programs- appwiz.cpl
Administrative Tools- control admintools
Automatic Updates- wuaucpl.cpl
Bluetooth Transfer Wizard- fsquirt
Calculator- calc
Certificate Manager- certmgr.msc
Character Map- charmap
Check Disk Utility- chkdsk
Clipboard Viewer- clipbrd
Command Prompt- cmd
Component Services- dcomcnfg
Computer Management- compmgmt.msc
timedate.cpl- ddeshare
Device Manager- devmgmt.msc
Direct X Control Panel (If Installed)*- directx.cpl
Direct X Troubleshooter- dxdiag
Disk Cleanup Utility- cleanmgr
Disk Defragment- dfrg.msc
Disk Management- diskmgmt.msc
Disk Partition Manager- diskpart
Display Properties- control desktop
Display Properties- desk.cpl
Display Properties (w/Appearance Tab Preselected)- control color
Dr. Watson System Troubleshooting Utility- drwtsn32
Driver Verifier Utility- verifier
Event Viewer- eventvwr.msc
File Signature Verification Tool- sigverif
Findfast- findfast.cpl
Folders Properties- control folders
Fonts- control fonts
Fonts Folder- fonts
Free Cell Card Game- freecell
Game Controllers- joy.cpl
Group Policy Editor (XP Prof)- gpedit.msc
Hearts Card Game- mshearts
Iexpress Wizard- iexpress
Indexing Service- ciadv.msc
Internet Properties- inetcpl.cpl
IP Configuration (Display Connection Configuration) ipconfig /all
IP Configuration (Display DNS Cache Contents) ipconfig /displaydns
IP Configuration (Delete DNS Cache Contents)- ipconfig /flushdns
IP Configuration (Release All Connections)- ipconfig /release
IP Configuration (Renew All Connections)- ipconfig /renew
IP Configuration (Refreshes DHCP & Re-Registers DNS)- ipconfig /registerdns
IP Configuration (Display DHCP Class ID)- ipconfig /showclassid
IP Configuration (Refreshes DHCP & Re-Registers DNS)- ipconfig /registerdns
IP Configuration (Display DHCP Class ID)- ipconfig /showclassid
IP Configuration (Modifies DHCP Class ID)- ipconfig /setclassid
Java Control Panel (If Installed)- jpicpl32.cpl
Java Control Panel (If Installed)- javaws
Keyboard Properties- control keyboard
Local Security Settings- secpol.msc
Local Users and Groups- lusrmgr.msc
Logs You Out Of Windows- logoff
Microsoft Chat- winchat
Minesweeper Game- winmine
Mouse Properties- control mouse
Mouse Properties- main.cpl
Network Connections- control netconnections
Network Connections- ncpa.cpl
Network Setup Wizard- netsetup.cpl
Notepad- notepad
Nview Desktop Manager (If Installed)- nvtuicpl.cpl
Object Packager- packager
ODBC Data Source Administrator- odbccp32.cpl
On Screen Keyboard- osk
Opens AC3 Filter (If Installed)- ac3filter.cpl
Password Properties- password.cpl
Performance Monitor- perfmon.msc
Performance Monitor- perfmon
Phone and Modem Options- telephon.cpl
Power Configuration- powercfg.cpl
Printers and Faxes- control printers
Printers Folder- printers
Private Character Editor- eudcedit
Quicktime (If Installed)- QuickTime.cpl
Regional Settings- intl.cpl
Registry Editor- regedit
Registry Editor- regedit32
Remote Desktop- mstsc
Removable Storage- ntmsmgr.msc
Removable Storage Operator Requests- ntmsoprq.msc
Resultant Set of Policy (XP Prof)- rsop.msc
Scanners and Cameras- sticpl.cpl
Scheduled Tasks- control schedtasks
Security Center- wscui.cpl
Services- services.msc
Shared Folders- fsmgmt.msc
Shuts Down Windows- shutdown
Sounds and Audio- mmsys.cpl
Spider Solitare Card Game- spider
SQL Client Configuration- cliconfg
System Configuration Editor- sysedit
System Configuration Utility- msconfig
System File Checker Utility (Scan Immediately)- sfc /sc
Run Line Commands
BCKGZM.EXE – Backgammon
CHKRZM.EXE – Checkers
CONF.EXE – NetMeeting
DIALER.EXE – Phone Dialer
HELPCTR.EXE – Help and Support
HRTZZM.EXE – Internet Hearts
HYPERTRM.EXE – HyperTerminal
ICWCONN1.EXE – Internet Connection Wizard
IEXPLORE.EXE – Internet Explorer
INETWIZ.EXE – Setup Your Internet Connection
INSTALL.EXE – User’s Folder
MIGWIZ.EXE – File and Settings Transfer Wizard
MOVIEMK.EXE – Windows Movie Maker
MPLAYER2.EXE – Windows Media Player Version 6.4.09.1120
MSCONFIG.EXE – System Configuration Utility
MSIMN.EXE – Outlook Express
MSINFO32.EXE – System Information
MSMSGS.EXE – Windows Messenger
MSN6.EXE – MSN Explorer
PBRUSH.EXE – Paint
PINBALL.EXE – Pinball
RVSEZM.EXE – Reversi
SHVLZM.EXE – Spades
TABLE30.EXE – User’s Folder
WAB.EXE – Windows Address Book
WABMIG.EXE – Address Book Import Tool
WINNT32.EXE – User’s Folder
WMPLAYER.EXE – Windows Media Player
WRITE.EXE – Wordpad
ACCWIZ.EXE – Accessibility Wizard
CALC.EXE – Calculator
CHARMAP.EXE – Character Map
CLEANMGR.EXE – Disk Space Cleanup Manager
CLICONFG.EXE – SQL Client Configuration Utility
CLIPBRD.EXE – Clipbook Viewer
CLSPACK.EXE – Class Package Export Tool
CMD.EXE – Command Line
CMSTP.EXE – Connection Manager Profile Installer
CONTROL.EXE – Control Panel
DCOMCNFG.EXE – Component Services
DDESHARE.EXE – DDE Share
DRWATSON.EXE – Doctor Watson v1.00b
DRWTSN32.EXE – Doctor Watson Settings
DVDPLAY.EXE – DVD Player
DXDIAG.EXE – DirectX Diagnostics
EUDCEDIT.EXE – Private Character Editor
EVENTVWR.EXE – Event Viewer
EXPLORER.EXE – Windows Explorer
FREECELL.EXE – Free Cell
FXSCLNT.EXE – Fax Console
FXSCOVER.EXE – Fax Cover Page Editor
FXSEND.EXE – MS Fax Send Note Utility
IEXPRESS.EXE – IExpress 2.0
LOGOFF.EXE – System Logoff
MAGNIFY.EXE – Microsoft Magnifier
MMC.EXE – Microsoft Management Console
MOBSYNC.EXE – Microsoft Synchronization Manager
MPLAY32.EXE – Windows Media Player version 5.1
MSHEARTS.EXE – Hearts
MSPAINT.EXE – Paint
MSTSC.EXE – Remote Desktop Connection
NARRATOR.EXE – Microsoft Narrator
NETSETUP.EXE – Network Setup Wizard
NOTEPAD.EXE – Notepad
NSLOOKUP.EXE – NSLookup Application
NTSD.EXE – Symbolic Debugger for Windows 2000
ODBCAD32.EXE – ODBC Data Source Administrator
OSK.EXE – On Screen Keyboard
OSUNINST.EXE – Windows Uninstall Utility
PACKAGER.EXE – Object Packager
PERFMON.EXE – Performance Monitor
PROGMAN.EXE – Program Manager
RASPHONE.EXE – Remote Access Phonebook
REGEDIT.EXE – Registry Editor
REGEDT32.EXE – Registry Editor
RESET.EXE – Resets Session
RSTRUI.EXE – System Restore
RTCSHARE.EXE – RTC Application Sharing
SFC.EXE – System File Checker
SHRPUBW.EXE – Create Shared Folder
SHUTDOWN.EXE – System Shutdown
SIGVERIF.EXE – File Signature Verification
SNDREC32.EXE – Sound Recorder
SNDVOL32.EXE – Sound Volume
SOL.EXE – Solitaire
SPIDER.EXE – Spider Solitaire
SYNCAPP.EXE – Create A Briefcase
SYSEDIT.EXE – System Configuration Editor
SYSKEY.EXE – SAM Lock Tool
TASKMGR.EXE – Task Manager
TELNET.EXE – MS Telnet Client
TSSHUTDN.EXE – System Shutdown
TOURSTART.EXE – Windows Tour Launcher
UTILMAN.EXE – System Utility Manager
USERINIT.EXE – My Documents
VERIFIER.EXE – Driver Verifier Manager
WIAACMGR.EXE – Scanner and Camera Wizard
WINCHAT.EXE – Windows for Workgroups Chat
WINHELP.EXE – Windows Help Engine
WINHLP32.EXE – Help
WINMINE.EXE – Minesweeper
WINVER.EXE – Windows Version Information
WRITE.EXE – WordPad
WSCRIPT.EXE – Windows Script Host Settings
WUPDMGR.EXE – Windows Update
ACCESS.CPL – Accessibility Options
APPWIZ.CPL – Add or Remove Programs
DESK.CPL – Display Properties
HDWWIZ.CPL – Add Hardware Wizard
INETCPL.CPL – Internet Explorer Properties
INTL.CPL – Regional and Language Options
JOY.CPL – Game Controllers
MAIN.CPL – Mouse Properties
MMSYS.CPL – Sounds and Audio Device Properties
NCPA.CPL – Network Connections
NUSRMGR.CPL – User Accounts
ODBCCP32.CPL – ODBC Data Source Administrator
POWERCFG.CPL – Power Options Properties
SYSDM.CPL – System Properties
TELEPHON.CPL – Phone and Modem Options
TIMEDATE.CPL – Date and Time Properties
CERTMGR.MSC – Certificates
CIADV.MSC – Indexing Service
COMPMGMT.MSC – Computer Management
DEVMGMT.MSC – Device Manager
DFRG.MSC – Disk Defragmenter
DISKMGMT.MSC – Disk Management
EVENTVWR.MSC – Event Viewer
FSMGMT.MSC – Shared Folders
LUSRMGR.MSC – Local Users and Groups
NTMSMGR.MSC – Removable Storage
NTMSOPRQ.MSC – Removable Storage Operator Requests
PERFMON.MSC – Performance Monitor
SERVICES.MSC – Services
WMIMGMT.MSC – Windows Management Infrastructure
How to Install Cygwin Offline in Windows 7
Here are instructions assuming you want to install Cygwin on a windows computer with no Internet connection. I assume that you have access to another computer with an Internet connection. Start on the connected computer:
cygwin is Linux environment and command-line interface for Windows |
To know completely about cygwin click here.
Cygwin uses a small setup file to download the large setup file from the mirrors.
You can install cygwin in 2 ways.
- 1. Install cygwin online.
- 2. Install cygwin offline.
- 1. Download the cygwin setup file from here.
- 2. Run the downloaded setup file as an administrator.
- 3. Click "Next".
- 4. Select "Download Without Installing" and then "Next"
- 5. Select the local folder in which you should place your setup files by clicking "Browse.."
- 6. Select the folder to download offline installer files and then "OK"
- 7. Choose your internet connection method which by default is 'Direct Connection'.
- 8. Select the mirrors from which site your setup file should be from and click "Next".
- 9. Wait for the original set up file to be downloaded.
- 10.Choose the packages you want and click "Next"
- 11.Wait for the download to complete. It may take 5-10 Minutes depending your connection speed and selected mirror.
- 12.Click "Finish".
- That's it!! Now you have offline installar to install cygwin offline.On the target computer, run "setup.exe"Copy downloaded directory, along with the "setup.exe" program, over to your target computerOn the target computer, run "setup.exe"When the setup asks "Choose a download source", choose Install From Local DirectoryComplete setup as usual. No Internet access is required.
10 tips for Online social networking safety
Social networking websites like MySpace, Facebook, Twitter, and Windows Live Spaces are services people can use to connect with others to share information like photos, videos, and personal messages. As the popularity of these social sites grows, so do the risks of using them. Hackers, spammers, virus writers, identity thieves, and other criminals follow the traffic.
Read these tips to help protect yourself when you use social networks:
- Use caution when you click links that you receive in messages from your friends on your social website. Treat links in messages on these sites as you would links in email messages. (For more information, see Approach links in email with caution and Click Fraud: Cybercriminals want you to 'like' it.)
- Know what you've posted about yourself. A common way that hackers break into financial or other accounts is by clicking the "Forgot your password?" link on the account login page. To break into your account, they search for the answers to your security questions, such as your birthday, home town, high school class, or mother's middle name. If the site allows, make up your own password questions, and don't draw them from material anyone could find with a quick search.
- Don't trust that a message is really from who it says it's from. Hackers can break into accounts and send messages that look like they're from your friends, but aren't. If you suspect that a message is fraudulent, use an alternate method to contact your friend to find out. This includes invitations to join new social networks. For more information, see Scammers exploit Facebook friendships.
- To avoid giving away email addresses of your friends, do not allow social networking services to scan your email address book. When you join a new social network, you might receive an offer to enter your email address and password to find out if your contacts are on the network. The site might use this information to send email messages to everyone in your contact list or even everyone you've ever sent an email message to with that email address. Social networking sites should explain that they're going to do this, but some do not.
- Type the address of your social networking site directly into your browser or use your personal bookmarks. If you click a link to your site through email or another website, you might be entering your account name and password into a fake site where your personal information could be stolen. For more tips about how to avoid phishing scams, see Email and web scams: How to help protect yourself.
- Be selective about who you accept as a friend on a social network. Identity thieves might create fake profiles in order to get information from you.
- Choose your social network carefully. Evaluate the site that you plan to use and make sure you understand the privacy policy. Find out if the site monitors content that people post. You will be providing personal information to this website, so use the same criteria that you would to select a site where you enter your credit card.
- Assume that everything you put on a social networking site is permanent. Even if you can delete your account, anyone on the Internet can easily print photos or text or save images and videos to a computer.
- Be careful about installing extras on your site. Many social networking sites allow you to download third-party applications that let you do more with your personal page. Criminals sometimes use these applications to steal your personal information. To download and use third-party applications safely, take the same safety precautions that you take with any other program or file you download from the web.
- Think twice before you use social networking sites at work. For more information, see Be careful with social networking sites, especially at work.
How to configure OPEN VPN Server in Windows System
First Step is to Downloading and installing the software.
- Download the installer for windows server from here and run it on the your windows computer.
- Install OpenVPN on each client. (This step can be skipped for now and done at any convenient time)
Configuring Certificates and Keys
Preparatory Steps
- After finishing installation process, Navigate to the C:\Program Files\OpenVPN\easy-rsa folder in the command prompt:
- Initialize the OpenVPN configuration:
init-config
- Open the vars.bat file in a text editor:
notepad vars.bat
- Edit the following lines in vars.bat, replacing "IN", "CA," etc. with your company's information:
set KEY_COUNTRY=IN set KEY_PROVINCE=CA set KEY_CITY=Bangalore set KEY_ORG=Apacheinfotech set KEY_EMAIL=webadmin@apacheinfotech.com
- Save the file and exit notepad.
- Run the following commands:
vars
clean-all
Building Certificates and Keys
- The certificate authority (CA) certificate and key:
build-ca
- When prompted, enter your country, etc. These will have
default values, which appear in brackets. For your "Common Name," a good
choice is to pick a name to identify your company's Certificate
Authority. For example, "OpenVPN-CA":
Country Name (2 letter code IN for india) [IN]: State or Province Name (full name) [CA]: Locality Name (eg, city) [Bangalore]: Organization Name (eg, company) [ApacheInfotech]: Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []:OpenVPN-CA Email Address [admin@apacheinfotech.com]:
- When prompted, enter your country, etc. These will have
default values, which appear in brackets. For your "Common Name," a good
choice is to pick a name to identify your company's Certificate
Authority. For example, "OpenVPN-CA":
- The server certificate and key:
build-key-server server
- When prompted, enter the "Common Name" as "server"
- When prompted to sign the certificate, enter "y"
- When prompted to commit, enter "y"
- Client certificates and keys:
- For each client, choose a name to identify that computer, such as "arun-laptop" in this example.
build-key arun-laptop
- When prompted, enter the "Common Name" as the name you have chosen (e.g. "arun-laptop")
- Repeat this step for each client computer that will connect to the VPN.
- Generate Diffie Hellman parameters (This is necessary to set up the encryption)
build-dh
Configuration Files
- Find the sample configuration files:
Start Menu -> All Programs -> OpenVPN -> OpenVPN Sample Configuration Files
Server Config File
- Open server.ovpn
- Find the following lines:
ca ca.crt cert server.crt key server.key
dh dh1024.pem
- Edit them as follows:
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
- Save the file as C:\Program Files\OpenVPN\easy-rsa\server.ovpn
Client Config Files
This is similar to the server configuration- Open client.ovpn
- Find the following lines:
ca ca.crt cert client.crt key client.key
- Edit them as follows:
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\arun-laptop.crt" key "C:\\Program Files\\OpenVPN\\config\\arun-laptop.key"
- Notice that the name of the client certificate and key files depends upon the Common Name of each client.
- Edit the following line, replacing
"my-server-1" with your server's public Internet IP Address or Domain
Name
remote my-server-1 1194
- Save the file as C:\Program Files\OpenVPN\easy-rsa\arun-laptop.ovpn (in this example. Each client will need a different, but similar, config file depending upon that client's Common Name.)
Copying the Server and Client Files to Their Appropriate Directories
- Copy these files from C:\Program Files\OpenVPN\easy-rsa\ to C:\Program Files\OpenVPN\config\ on the server:
ca.crt dh1024.pem server.crt server.key server.ovpn
- Copy these files from C:\Program
Files\OpenVPN\easy-rsa\ on the server to C:\Program
Files\OpenVPN\config\ on each client (arun-laptop, in this example):
ca.crt arun-laptop.crt arun-laptop.key arun-laptop.ovpn
Starting OpenVPN
- On both client and server, run OpenVPN from:
Start Menu -> All Programs -> OpenVPN -> OpenVPN GUI
- Double click the icon which shows up in the system tray to initiate the connection. The resulting dialog should close upon a successful start.
Further Considerations / Troubleshooting
Firewall Configuration
If you have connection problems, make sure to set a rule on your server's firewall allowing incoming traffic on UDP port 1194.Port Forwarding
If your server is behind a router, you will need to forward the port chosen for OpenVPN (in this example UDP 1194) to the server. Consult your router's documentation for details on this.To set up port forwarding, you will likely need to set up the server with a static local IP address instead of the default dynamic (changing) IP. Make sure to choose a static IP address that is not in the range your router might assign as a dynamic IP, but is within the router's subnet (usually 192.168.0.xxx , 10.0.0.xxx , or similar).
Running OpenVPN as a Service
Running OpenVPN as a service will allow:- OpenVPN to be run from a non-administrator account.
- OpenVPN to be started automatically on system startup. This is often preferred on the server machine, as well as any machines which will be constantly connected to the server.
- Run the Windows Service administrative tool:
- Press Windows Key + R
- Type "services.msc" and press Enter.
services.msc
- Find the OpenVPN service, and set its Startup Type to "automatic."
- Optionally, start the service now.
Security Tips
- Transmit all needed files(such as certificates & keys) to the client computers using a secure means such as a USB drive (email is not always a secure means).
- Choose a port other than UDP 1194, and replace the port number wherever this guide mentions UDP port 1194.
Cloning OpenVPN Servers
If including OpenVPN in a cloned server build you will find that all servers will have the same MAC address for the TAP device. This will cause packet loss across the network. Standard methods of changing the IP address from scripts do not work on the TAP device, to resolve this delete and recreate the TAP device using the scripts included with OpenVPN:C:\Program Files\OpenVPN\bin\deltapall C:\Program Files\OpenVPN\bin\addtapYou will then have to rename the connection to match the entry in the config file.
Subscribe to:
Posts (Atom)