Openvpn is an open source software, allows us to create a Virtual Private Network.

1. Installing openvpn

install these packages openvpn openssh-server openssl:

laptop:~$ sudo apt-get install openvpn openssh-server openssl

Now the ssh server is installed we can control it and access to it from anywhere on the web using the IP and port 22.

In reality 22 is for SSH The best port for OpenVPN (http://www.iana.org/assignments/port-numbers) is 1194.

There is special web interfaces to can interact and configure openVPN through a browser like webmin,

so we should install apache, php and mysql with this command:

laptop:~$ sudo apt-get install apache2 mysql-server-5.0 libapache2-mod-php5 php5 php5-common php5-mysql

To install webmin:

laptop:~$ sudo apt-get install webmin

2. VPN configuration:

The openvpn use Private Key Infrastructure (PKI):

1. One Public key for server and Private keys for each client.

2. It uses Certification for more security each Certification is valid for one couple (Server, Client)

The authentication With OpenVPN is a bidirectional, means the sever identify the client before trusting on and client identify the server too.

Key Generation:

To generate a Key we can use scripts provided by OpenVPN

We create openvpn/ in /home to manipulate and create keys there:

laptop:~$ sudo cp /usr/share/doc/openvpn/examples/easy-rsa /home/openvpn/ -R

All commands are in /home/openvpn/2.0/ file

laptop:~$ cd /home/openvpn/2.0

Edit vars file:

laptop:~$ sudo nano vars ————–// (nano is a text editor you can use others: gedit, …)

Setup these variables KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL

EX:

export KEY_COUNTRY=DZ

export KEY_PROVINCE=ALGER

export KEY_CITY=alger

export KEY_ORG=alger

export KEY_EMAIL=xxxxxxxxx@xxx.dz

* We can find other variables like:

* KEY_SIZE by default set to 1024 in some countries there is limit that you

should respect for this KEY_SIZE you can’t go over the limitation.

* CA_EXPIRE : In how many days your certification will expire?

Save and close (in nano ctrl+x)

To set these variables we run this:

laptop:~$ . ./vars ——————– //first dot isn’t a mistake

We should clean all existing certification we have to not have conflits (run this command):

laptop:~$ sudo ./clean-all ———————-// will delete /home/openvpn/2.0/keys

If you do’nt have certification set before nothing will be done.

Now we create our Certification and key with CA (master Certification Authority) with this command:

laptop:~$ sudo ./build-ca

The certification now are created in keys directory: ca.crt ca.key

Generate a certification and key to the SERVER:

laptop:~$ sudo ./build-key-server SERVER ——————- //we suppose that server’s named SERVER

When common name is required type the name OS the server (here SERVER)

Generate certification and key for client:

laptop:~$ sudo ./build-key client1

when common name is required type the name of the client (client1)

this common name MUST be different if you have many clients.

To protect your key with a password use ./build-key-pass instead of ./build-key

NB: We were able to generate the client key on its own end to avoid transfer through the network

Diffie Hellman parameters should be generated for the openvpn server:

laptop:~$ sudo ./build-dh

these parameters are copied in keys directory dh1024.pem

So now all Certifications and keys are in /home/openvpn/2.0/keys directory:

name Utile for Role Secret

ca.crt servers and all clients root Certification CA no

ca.key key signing the machine (both) root key CA yes

dh1024.pem server Diffie Hellman parameters no

SERVER.crt server server certification no

SERVER.key server server key yes

client1.crt Client1 Client1 certification no

client1.key Client1 Client1 key yes

We copy files to the client machines using a secured tunel

3. Creation of the file configuration for clients and server

There is samples of this configuration in /usr/share/doc/openvpn/examples/sample-config-files/ client.conf and server.conf.gz

1. Server configuration:

We should gunzip the server.conf.gz

laptop:~$ sudo gunzip server.conf.gz

and then copy this file to /home/openvpn using:

laptop:~$ sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/

Edit server.conf:

laptop:~$ sudo nano /home/openvpn/server.conf

this would create a VPN with virtual interface and listen to the connections in 1194 port and distribute

virtual addresses to clients that connect through 10.8.0.0/24

By default this server.conf is useful but we can set more parameters(directives) like (IP, PORT, KEY_SIZE etc…)

Client configuration and server one must be coherent.

1. Client configuration:

Edit the client.conf:

laptop:~$ sudo nano /home/openvpn/client.conf

Verify the name of certification and key of each client:

ca ca.crt

cert client.crt

key client.key

Go to the remote parameter and set up the server IP

remote my-server-1 1194

save the file

Now we verify if client parameters if they correspond to the server one:

dev (tun ou tap)

proto (udp ou tcp)

comp-lzo

fragment

4. Starting the VPN:

4.1. Before we start we should copy all file in keys directory and .conf to /etc/openvpn:

4.1.1 SERVER:

laptop:~$ sudo cp /home/openvpn/keys/SERVER.crt /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/SERVER.key /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/dh1024.pem /etc/openvpn

laptop:~$ sudo cp /home/openvpn/server.conf /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/ca.crt /etc/openvpn

4.1.2 Client:

laptop:~$ sudo cp /home/openvpn/keys/client1.crt /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/client1.key /etc/openvpn

laptop:~$ sudo cp /home/openvpn/keys/ca.crt /etc/openvpn

laptop:~$ sudo cp /home/openvpn/client1.conf /etc/openvpn

4.2 Start the server:

laptop:~$ cd /etc/openvpn

laptop:/etc/openvpn$ sudo openvpn server.conf

4.3 Start the client1:

aptop:~$ cd /etc/openvpn

laptop:/etc/openvpn$ sudo openvpn client1.conf

4.4 Test the VPN:

From the client terminal try to ping the server which has the 10.8.0.1 by default:

ping 10.8.0.1

To can communicate with other client through the network with the VPN you have to uncomment the client-to-client parameter in server.conf
and then you would be able to ping the other clients.

To interact with amazon S3, we have many languages we can use as well as python. I chose python because it’s a scripting language. That means we don’t need to compile and we don’t need a virtual machine to run it, only an interpreter is needed.

There is some ready tools to interact with amazon S3 I found S3cmd it’s made with python and there is many methods within.

Installing S3cmd (nb: commands are in red color)

Its better to be root to have all permissions Laptop:~$ sudo -i

Take the zip file and copy it somewhere for example /home/Your_Directory/

1.To copy ———————————– Laptop:~# cp s3cmd-0.9.9.91 /home/Your_Directory

2. Decompress the file. —————- Laptop:~# unzip s3cmd.zip

3. Move to s3cmd folder .————— Laptop:~# cd s3cmd-0.9.9.91

4. Change setup.py mod to can execute it. Laptop:~/s3cmd-0.9.9.91# chmod +x setup.py

5. Run the setup file with this command. Laptop:~/s3cmd-0.9.9.91# ./setup.py

6. During the installation enter your access key and secret one, and choose secured connection.

Now s3cmd is installed and your connection with s3 account is set, so you can transfer files to and from s3 account there is many commands you can use to can use them you should be in s3cmd folder, I verified most of the code and it uses methods provided by amazon s3 developers.

The command that allows you to transfer from your server (linux) to amazon s3 is :

s3cmd-0.9.9.91#./s3cmd put Local_File s3://BUCKET_Name/Other_Files_In_Bucket

But this command will transfer “Local_File” to the bucket so if we have another new file within and we use the same command, the whole “Local_File” would be transferred too, so we loose in data transfer.

BUT if we use a sync command we can synchronize a local file with a remote one, it means that if we have a local folder and we add files in it step by step this command allows us to transfer only missing files to the remote file, this is how we minimize data transfer, so for example everyday we have a new tar.gz file added to our local file and our backup would be done everyday,

The command is :
3cmd-0.9.9.91# ./s3cmd sync /home/Your_Directory/local_file/ s3://BUCKET_Name/Remote_File

Every time we run this command it copies only missing files.

Automation of our transfer with sync command:

In linux OS we can automate execution of commands by adding them to a special file which has a specific (easy) syntax.
To access to this file we use this command ——— 3cmd-0.9.9.91# crontab -e

Our file is open now, we can insert any command to be executed at any time or day or month.

A sample line is so —————- * * * * * Command_to_execute

if we want to run any linux command for example at 3:59 PM we edit our line as follow
59 15 * * * Command_to_run

Suppose that we have our tar.gz files already in a Local_File and we want to transfer them to the Remote_File with sync command everyday at 3:00 am, the line would be:

0 3 * * * Path_Where_s3cmd_Folder_is/./s3cmd sync /home/Your-Directory/Local_File/ s3://BUCKET/Remote_File/

1. Setup More than one IP address for one network interface:

The file which contains descriptions of the network interfaces on Ubuntu or debian is /etc/nework/interfaces
A network interface (material) by default is referenced by eth0 so if you have more than one it would be eth1 eth2,
etc… so to setup a virtual ip we should create a virtual network interface, the name of this one would be as follows
eth0:1, eth0:2 etc… to create this interface we should add some lines to the
/etc/network/interfaces file to discribe this interface

NB: modifying this file need the superuser privilages

laptop:/$ sudo nano /etc/network/interfaces

We add this lines

auto eth0:1 //——————-we have one eth0 and we add another virtual interface refered by :1
iface eth0:1 inet static //——-this interface would use a static IP We can use dhcp as well
address 192.168.1.34 //——— IP we want to assign
netmask 255.255.255.0 //——— The netmask IP
broadcast 192.168.1.255 //——– Broadcast IP
gateway 192.168.1.1 //——– Gateway (router or…)

Save the file

As you can see this is a simple text file, so right now the network interface isn’t set yet because this
configuration isn’t applied

To set it we should restart our network interface by using this command with superuser privilages:

laptop:/$ sudo /etc/init.d/networking restart

Your interface is set

To verify if it works you can ping the address you assigned by useing this command

laptop:/$ ping [IP_you_assigned]

_______________________________________________________________________________________

2. There is a second method we can use is not permanent which means if you restart your machine or your interface
it would be deleted.

To do it we have to use the binary file /sbin/ip

To add a virtual IP we use this command:

laptop:/$ sudo /sbin/ip addr add [IP_you_want_to_add]/24 dev eth0

Here we don’t need to restart our network interface cause it’s not a simple file it a binary file it’s applied by
this command.

To check that your change works you can ping the new address using this command:

laptop:/$ sudo ping [IP_address_you_added]

You can also verify the new IP has been added by using the ifconfig command as shown below:

laptop:/$ ifconfig eth0:1
eth0:1 Link encap:Ethernet HWaddr 00:26:b9:11:34:16
inet addr:192.168.3.22 Bcast:192.168.3.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
Interrupt:19 Base address:0xa000

This will show you that the address you assigned is actually on the correct interface.