Luigi Zanderighi

I recently upgraded my laptop with a brand new SSD, my first two impressions are: much much faster, much much instable.
Yes that’s right, instable. My first try with SSD is was with a HANA SSD 8G (model: HLSM008G), does’t work on linux. I bought this drive on ebay just to make some tries with an economic disk, and eventually install it for use with mythtv as boot disk. Never do this, never buy HANA if you plan to use it on linux. It simply doesn’t even install you get a kernel panic. As I see now the product has been removed from ebay.

My second try is a OCZ Agility II, installed on my htpc with mythtv. On the same pc i had two 500GB HDD and an optical drive. One of the two HDD’s randomly freezes at boot time with the OCZ installed. That means 2 boot every 3 this HDD could not be mounted. I had to remove it. The second issue with the same OCD Agility where some occasionally errors syncing the journal with consequent remount in ro exactly while watching the clue scene of a film. Googling around i found somebody saying that the journal does not have sense in a SSD. In fact if the system crashes the check time on an SSD is ridiculous, so the benefits are irrelevant. So i removed the journal and the issue seem to be gone.

Meanwhile I bought a second OCZ Vertex II for my laptop, work grate, but for performance reasons I decided to remove the journal from ext4. To do so I needed to mount the disk in ro mode.
Easy:

sodo mount -o remount,ro /dev/sda1

No way!! Even booting the system in maintanace mode mount cannot remount in ro if disk is busy.

So it is some more complicate, this is what I had to do:

• nano /etc/fstab
• UUID=… / ext4 ro,errors=remount-ro 0 1
• reboot

After reboot:

• tune2fs -O ^has_journal /dev/sda1
• mount -o remount,rw /dev/sda1
• nano /etc/fstab
• remove ro option

Linux is always a step behind.

Configurazione generale della rete

Ipotizziamo una rete interna che utilizza gli IP 192.168.6.X. Nella rete interna abbiamo un router al indirizzo 192.168.6.1 e un server DNS per la intranet all’indirizzo 192.168.6.2.

Il server che vogliamo utilizzare per la VPN utilizza l’IP interno 192.168.6.102 ed è visibile dall’esterno su un ip pubblico a cui è assegnata una voce sul DNS pubblico es: vpnserver.mylan.com

Una considerazione prima di procedere. A chi si collega alla rete tramite VPN viene assegnato un IP, occorre quindi prestare attenzione con non vi siano problemi di instradamento o conflitto di IP. Per la VPN scegliamo quindi di usare un set di IP completamente diverso rispetto a quelli della intranet, es 10.8.0.X.

Sul router occore quindi aggiungere una route sul router:

route add 10.8.0.0 192.168.7.102

Configurazioni sul server VPN (vpnserver.mylan.com 192.168.7.102)

modprobe tun
echo "tun" >> /etc/modules
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -p udp –dport 1194 -s 10.0.0.0/24 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT

Sul router

Certificati e chiavi

Occore generare una serie di certificati e chiavi. A meno che non abbiate un contratto con un Certification Authority occorre generare una chiave e un certificato ‘self-signed’ anche per la Certification autority.

Certificati CA

mkdir ca
openssl genrsa -out ca/ca.key
openssl req -new -key ca/ca.key -out ca/ca.req
openssl x509 -req -in ca/ca.req -signkey ca/ca.key -out ca/ca.cert

Cerficati Server

mkdir server
openssl genrsa -out server/server.key
openssl req -new -key server/server.key -out server/server.req
openssl x509 -req -in server/server.req -CA ca/ca.cert -CAkey ca/ca.key -CAcreateserial -out server/server.cert
openssl dhparam -out server/dh1024.pem 1024

Certificati client

mkdir client
openssl genrsa -out client/client.key
openssl req -new -key client/client.key -out client/client.req
openssl x509 -req -in client/client.req -CA ca/ca.cert -CAkey ca/ca.key -CAcreateserial -out client/client.cert

Generazione chiavi TSL

openssl genrsa -out server.key
openssl req -new -key server.key -out rich.ser
openssl x509 -req -in rich.ca -signkey server.key –out server.cert
openssl x509 -req -in rich.ser -CA ca.cert -CAkey ca.key -CAcreateserial -out ser.cert
openssl dhparam -out dh.pem 1024

Per ogni client:

openssl genrsa -out client.key
openssl req -new -key client.key -out rich.cli

Server.conf

port 1194
proto udp
dev tun
ca ./ca/ca.cert
cert ./server/server.cert
key ./server/server.key
dh ./server/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.7.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
tls-server

Client.conf

client
dev tun
proto udp
remote 89.96.215.134
resolv-retry infinite
nobind
persist-key
persist-tun
ca ./ca/ca.cert
cert ./client/client-luigi.cert
key ./clinet/client-luigi.key
comp-lzo
verb 4
port 1194