Source: OpenVPN official documentation
OpenVPN daemons (JSON format):
./sacli VPNStatus
Show the number of users currently connected to the VPN:
./sacli VPNSummary
Show the status of internal Access Server services:
./sacli status
Stop internal Access Server services:
./sacli stop
Start/restart internal Access Server services:
./sacli start
The ‘start’ command is smart in the sense that if the Access Server
is already running, and you modified the configuration via
the Config DB, only those services whose parameters are changed
will be restarted. Note that if you modify any parameters in
the Access Server bootstrap configuration file
(/usr/local/openvpn_as/etc/as.conf), you will need to do a full unix
restart in order for those settings to take effect.
Also note that the start/stop commands above don’t actually start or
stop the Access Server daemon itself, only internal services
within the daemon. To start/stop the access server daemon itself,
use the traditional unix syntax:
Start the Access Server daemon:
/etc/init.d/openvpnas start
Stop the Access Server daemon:
/etc/init.d/openvpnas stop
Restart the Access Server daemon:
/etc/init.d/openvpnas restart
Source: npm
Splits OpenVPN (.ovpn) files into separate files for private key, user+ca certificates and tls-auth key, for use with network-manager in debian/ubuntu.
openvpn-config-splitter can be installed using npm:
# NPM:
npm install -g openvpn-config-splitter
# Install globally
$ npm install -g openvpn-config-splitter
# Run it, specifying your unsplit OpenVPN configuration file
$ ovpnsplit path/to/some/config.ovpn
# Config is now split into separate files, new configuration
# linking to the split files has been generated
$ ls path/to/some
ca.crt client.key client.ovpn client.split.ovpn ta.key user.crt
var fs = require('fs'),
configPath = '/some/path/to',
splitter = require('openvpn-config-splitter');
var paths = {
'caCert': configPath + '/openvpn-ca.crt',
'userCert': configPath + '/openvpn-user.crt',
'privateKey': configPath + '/openvpn-private.key',
'tlsAuth': configPath + '/openvpn-tls.key'
};
fs.readFile(configPath + '/config.ovpn', function(err, originalConfig) {
if (err) {
console.error('Could not read file (' + err.path + ')');
process.exit(1);
}
splitter.split(originalConfig, paths, function(err, parts, missing) {
if (err) {
console.error(err);
process.exit(1);
}
/**
* `parts` now contain the matched parts of the config + new config
* (caCert, userCert, privateKey, tlsAuth, config)
*
* `missing` is an array containing the parts that were NOT found -
* use this if you want to warn the user or fall back if you require
* a specific part to be present
*/
// Want to write the split files?
splitter.writeToFiles(parts, paths, function(err) {
if (err) {
console.log(err);
process.exit(1);
}
console.log('Hooray, we split the files and wrote them to disk!');
});
});
});# Modify this file accordingly for your specific requirement.
# http://www.thegeekstuff.com
# 1. Delete all existing rules
iptables -F
# 2. Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# 3. Block a specific ip-address
#BLOCK_THIS_IP="x.x.x.x"
#iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
Lire la suite...
Reverse SSH is a technique that can be used to access systems (that are behind a firewall) from the outside world.
As you already know SSH is a network protocol that supports cryptographic communication between network nodes. Using this protocol, you can do a secure remote login, secure copy from/to a remote machine etc.
You’ll typically do the following to connect to a remote server securely using ssh command.
$ ssh [your-account-login]@[server-ip]
What is Reverse SSH?
SSH is very good tool to access remote machine or server securely. But, the problem arises when you try to connect to a remote server which is behind a firewall and this firewall denies any incoming connection or data transfer request that has no prior outgoing request. This means that only those connections would be allowed which are initiated by the remote server machine. This is a real problem for those who want to access this server machine remotely. Lire la suite…