VPN unter Linux/en: Unterschied zwischen den Versionen

ZIM HilfeWiki - das Wiki
(Die Seite wurde neu angelegt: „{{translated page |origin=VPN unter Linux |lang=en |translated title=VPN on Linux }} VPN (Virtual Private Network) is needed if you want to use your computer f…“)
 
(38 dazwischenliegende Versionen von 6 Benutzern werden nicht angezeigt)
Zeile 4: Zeile 4:
 
|translated title=VPN on Linux
 
|translated title=VPN on Linux
 
}}
 
}}
−
VPN (Virtual Private Network) is needed if you want to use your computer from outside the university to access services that are only accessible within the university network. VPN guarantees secure access to the university network from other networks (dial-up via other providers, external company or university networks).
 
  
−
==  What needs to be done?==
+
{{ambox
−
* To use OpenVPN, you must first download a [[Netzwerkzertifikate|etwork certificate]].
+
|type=notice
−
* Use your package manager to install OpenVPN version >2.4 and the OpenVPN support for the network manager.
+
|text=Linux is only rudimentarily supported by the ZIM. Info is addressed to "professionals". Use at your own risk.
−
* Download the configuration file:
+
}}
−
<iframe key="infoboard" width="600" height="320" path="vpn-config/index.php?group=uni&os=lin" />
 
−
* Importieren Sie die Konfigurationsdatei  '''"OpenVPN-UPB-NG_*.ovpn"''' und das Nutzerzertifikat in den Networkmanager.
 
−
* Verbinden Sie sich per OpenVPN mit der Universität.
 
  
−
* VPN unter Linux konfigurieren
+
<bootstrap_alert color=warning>
−
== Schritt-für-Schritt-Anleitung ==
+
&#9888; If you receive an error message such as <code>Decoding PKCS12 failed. Probably wrong password or unsupported/legacy encryption</code> or similar when connecting:<br>
−
=== Netzwerkzertifikat erstellen ===
+
Do not adjust your OpenSSL configuration! Instead, create a new certificate in version 2 (AES-256 container). Details below. Adjusting the OpenSSL configuration can create security risks.
−
Um OpenVPN nutzen zu können, müssen Sie zunächst ein [[Netzwerkzertifikate|persönliches Netzwerkzertifikat]] installieren.  
+
</bootstrap_alert>
  
−
Wenn Sie das WLAN "eduroam" benutzen, ist das Zertifikat bereits auf Ihrem Rechner installiert.
+
You need a VPN (Virtual Private Network) if you want to use services from your computer at home that are only accessible within the university network. VPN ensures secure access to the university network from external networks (dial-up via other providers, external company or university networks).
 +
<br><br>
  
−
=== VPN unter Linux konfigurieren ===
+
These instructions are based on Ubuntu 22.04.2 LTS. Other distributions may work in a similar way. We cannot offer instructions for every distribution.
−
Laden Sie die Konfigurationsdatei herunter, wählen Sie hierzu das VPN mit dem Sie sich verbinden wollen aus und klicken Sie auf Download.
 
−
Im Normalfall sollte "Uni-VPN (Standard)" die richtige Wahl sein, sollten Sie jedoch Probleme mit der Verbindung haben, versuchen Sie es mit "Uni-VPN-TCP" noch einmal.
 
−
<iframe key="infoboard" width="600" height="320" path="vpn-config/index.php?group=uni&os=lin" />
 
  
−
Es wird mindestens die Version '''OpenVPN 2.4''' benötigt.
+
==Simultaneous connections==
 +
<bootstrap_alert color=info>
 +
<span style='font-size:30px;'>&#128712;</span>
 +
<br>
 +
Do you want to connect your laptop and your mobile phone to the VPN in addition to your PC? You can set up VPN connections on multiple devices. However, each person can only establish one connection per VPN at the same time.
 +
</bootstrap_alert>
  
−
== Verbindung über den Netzwerkmanager von Ubuntu ==
+
<bootstrap_accordion>
−
Es gibt auch die Möglichkeit, die Verbindung über den Netzwerkmanager von Ubuntu einzurichten.
+
<bootstrap_panel heading="What does that mean?" color="info">
 +
'''Uni-VPN'''
 +
* If you use the Uni-VPN, you can only establish one connection at a time.
 +
* You cannot establish a connection to the Uni-VPN on another device at the same time.
 +
* You must disconnect the existing connection first.
  
−
Zur Verwendung des Networkmanagers muss das vorher erstellte Netzwerkzertifikat entpackt werden:
+
'''Group VPN'''
 +
* If you use a group VPN, you cannot establish a second VPN connection to this group VPN on another device at the same time.
 +
* You must disconnect the existing connection first.
  
−
: <code>$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_OPVPN.crt.pem -clcerts -nokeys </code>
+
* However, you can connect to the Uni VPN or another group VPN on another device at the same time.
−
: <code>$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_OPVPN.key.pem -nocerts -nodes </code>
+
</bootstrap_panel>
 +
</bootstrap_accordion>
  
−
Die beiden neuen Dateien werden mit dem Netzwerkzertifikat an einen sicheren Ort im Benutzerverzeichnis kopiert.  
+
== What do I need to do? ==
 +
* Download personal network certificate.
 +
* Download configuration file:
 +
<iframe key="vpnconfig" width="600" height="450" path="/openvpn/en/?group=uni&os=linux&redirect=1"/>
 +
* Save network certificate and configuration file in a fixed folder.
 +
* Rename network certificate.
 +
* Set up VPN.
  
 +
== Step-by-step instructions ==
 +
=== Create certificate ===
 +
You need a network certificate for the VPN connection. If you already have a certificate for Eduroam, you can use that and skip this step.
 +
<br>
 +
Open the service portal and log in with your university account.
 +
* http://sp.upb.de
 +
<br>
  
−
Dazu müssen die erst die notwendigen Pakete mittels Terminal installiert werden:
+
* Go to '''User management''' and then to '''Network settings'''.
−
: <code># sudo apt-get install openvpn network-manager-openvpn network-manager-openvpn-gnome</code>
+
<br clear=all>
  
−
Mit Hilfe der Network Managers (Netwerkverbindungen) lässt sich eine neue VPN-Verbindung
+
[[File:Eduroam-unter-android-4.png|links|mini|ohne|350px]]
−
erstellen. Dazu muss auf „Hinzufügen“ geklickt werden.
+
<br>
 +
* Click on '''"Create new certificate"'''.
 +
<br clear=all>
  
−
[[Datei:VPN_Unter_Linux_01.png]]
+
[[Datei:Netzwerkzertifikat-container-v2.png|links|mini|ohne|350px]]
 +
<br>
 +
* Give the certificate a unique name (e.g. Laptop VPN)
 +
* Select '''Version 2''' as the file format.
 +
* Then click on '''"Send new certificate"'''.
 +
<br clear=all>
  
 +
[[Datei:Netzwerkzertifikat-download.png|links|mini|ohne|350px]]
 +
<br>
 +
* A new network certificate has been created for you.
 +
* First copy the '''import password''' to the clipboard.
 +
* Now click on '''"Download network certificate"'''.
 
<br clear=all>
 
<br clear=all>
  
 +
=== Configuring VPN under Linux ===
 +
Download the configuration file, select the VPN you want to connect to and click on Download.
 +
Normally, "Uni-VPN (Standard)" should be the right choice, but if you have problems with the connection, try "Uni-VPN-TCP" again.<span style="color:green"> Note:</span> You can click on '''"Download"''' here and download your configuration file. This is not a screenshot ;-)
 +
<center><iframe key="vpnconfig" width="600" height="450" path="/openvpn/en/?group=uni&os=linux&redirect=1"/>
 +
</center>
 +
<br clear=all>
 +
<bootstrap_accordion>
 +
<bootstrap_panel heading="Route all Internet traffic through the tunnel?">
 +
* Accessing online resources may require that you route all network traffic through the tunnel.
 +
* You do not need this option for pure access to network drives.
 +
</bootstrap_panel>
 +
</bootstrap_accordion>
  
−
[[Datei:Konfiguration importieren.png|links|300px]]
+
===Create folder===
 +
* Create a folder and place the network certificate and configuration file there.
 +
** On distributions that use SELinux (e.g. RedHad, Fedora, CentOS etc.) you need to make sure that the location has the correct labels
 +
** These can be checked with <code>ls -laZ PATH</code> and need a label in the form of <code>unconfined_u:object_r:home_cert_t:s0</code>
 +
** By default the directory <code>~/.cert/</code> should have the correct labels for the network certificate
 +
** Debian/Ubuntu based distributions normally '''do not''' use SELinux and should therefore not be affected by this
 +
* Choose the location carefully - you must not move or rename the folder later.
 +
* Rename the network certificate to <code>Network_Certificate.p12</code>
 +
 
 +
[[Datei:Vpn-unter-linux-01.png|links|mini|ohne|350px|Folder for VPN]]
 +
<br>
 +
* This is what the contents of the folder should look like.
 +
<br clear=all>
 +
 
 +
===Set up VPN===
 +
[[Datei:Vpn-unter-linux-02.png|links|mini|ohne|350px|Network]]
 +
<br>
 +
* Click on the '''"Network symbol"'''.
 +
* Then click on '''"Settings"'''.
 +
<br clear=all>
 +
 
 +
[[File:Vpn-unter-linux-03.png|left|mini|without|350px|Add VPN]]
 +
<br>
 +
* In the VPN area, click on the <code>+</code> to add.
 +
<br clear=all>
 +
 
 +
[[Datei:Vpn-unter-linux-04.png|links|mini|ohne|350px|Import from file]]
 +
<br>
 +
* Select '''"Import from file..."'''.
 +
<br clear=all>
  
−
<br><br>
+
[[Datei:Vpn-unter-linux-05.png|links|mini|ohne|350px|Configuration file]]
−
Im nächsten Fenster muss der Verbindungstyp OpenVPN augewählt werden.
+
<br>
 +
* Open the folder we just created.
 +
* Select the '''"Configuration file"'''.
 +
* Then click '''"Open"'''.
 
<br clear=all>
 
<br clear=all>
  
−
[[Datei:Zertikate einstellen.png|links|300px]]
+
[[Datei:Vpn-unter-linux-06.png|links|mini|ohne|350px|VPN settings]]
 +
<br>
 +
* The VPN settings have been imported from the configuration file.
 +
* Enter the '''"Import password"''' for the network certificate. (1)
 +
* Then click on '''"Add"'''. (2)
 +
<br clear=all>
  
−
Anschließend müssen die eben entpackten Zertifikate ausgewählt werden. Das Feld CA-Zertifikat sollte automatisch gefüllt werden.
+
[[Datei:Vpn-unter-linux-07.png|links|mini|ohne|350px|Connect VPN]]
 +
<br>
 +
* You can connect to the VPN by clicking on the switch.
 +
<br clear=all>
  
−
Falls das Feld CA-Zertifikat nicht automatisch ausgefüllt wird, sollte man die Konfigurationsdatei "'''openvpn-upb-ng-lin.ovpn"''' in "'''openvpn-upb-ng-lin.pem'''" umbenennen und diese zusätzlich in den Ordner mit den Zertifikaten legen. Danach können Sie die Datei als CA-Zertifikat auswählen.
+
===Connect VPN===
 +
[[Datei:Vpn-unter-linux-08.png|links|mini|ohne|350px|Connect VPN]]
 +
<br>
 +
* Or establish the connection via the network menu.
 +
<br clear=all>
  
 +
===Disconnect VPN===
 +
[[Datei:Vpn-unter-linux-09.png|links|mini|ohne|350px|Disconnect VPN]]
 +
<br>
 +
* You can disconnect the VPN connection via the network menu.
 
<br clear=all>
 
<br clear=all>
  
 +
==Unpack container==
 +
If there are problems using the certificate in its container format with the export password provided, it may help to unpack the container into certificate and key.
 +
<br>
 +
These problems occur, for example, with the old container format under distributions that use OpenSSL 3 or newer. Here you can either unpack the previous container (in order to reference the key and certificate directly) or request a new certificate with the new container format in the service portal.
 +
<br>
  
 +
The OpenSSL version can be checked as follows:
 +
<pre>$ openssl version</pre>
  
−
[[Datei:VPN_Unter_Linux_05.png|links|400px|mini|Abgeschlossene Einrichtung]] <br><br>
+
The container can be unpacked as follows:
−
Nach dem Speichern lässt sich die VPN-Verbindung über das obere Systemleiste aktivierven.
+
<pre>
 +
$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_cert.pem -clcerts -nokeys
 +
$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_key.pem -nocerts -nodes
 +
</pre>
  
 +
The two new files are copied to a safe location in the user directory with the network certificate.
 +
When unpacking the old container format, an additional parameter <code>-legacy</code> is required under OpenSSL 3, otherwise this will be refused.
 +
 +
==Edit configuration==
 +
If you do not select the certificates via the GUI, but use the configuration file via the command line, you must ensure that the files are named appropriately for the configuration file. If you have unpacked the container, you must adjust the configuration file accordingly.<br>
 +
 +
'''Configuration file without changes'''
 +
<pre>
 +
#### Betriebssystemanpassungen für Linux ####################
 +
 +
pkcs12 Network_Certificate.p12
 +
resolv-retry 5
 +
auth-nocache
 +
# oder getrennt:
 +
# cert Network_Certificate_cert.pem
 +
# key Network_Certificate_key.pem
 +
</pre>
 +
 +
'''If you have unpacked the container in certificate and key:'''
 +
<pre>
 +
#### Betriebssystemanpassungen für Linux ####################
 +
 +
# pkcs12 Network_Certificate.p12
 +
resolv-retry 5
 +
auth-nocache
 +
# oder getrennt:
 +
cert Network_Certificate_cert.pem
 +
key Network_Certificate_key.pem
 +
</pre>
 +
 +
 +
==Check VPN==
 +
You can check the VPN function by calling:
 +
: [https://go.upb.de/ip https://go.upb.de/ip]
 +
Your IP is displayed there and whether you are on the university network.
 +
 +
[[Datei:OpenVPN verbunden - go_ip.png|mitte|400px|mini|ohne|Example: Existing connection to the university network.]]
 
<br clear=all>
 
<br clear=all>
 +
 +
==See also==
 +
* [[Netzwerk]]
 +
* [[VPN Problembehandlung]]

Version vom 27. Februar 2025, 21:58 Uhr

Die deutsche Version finden Sie auf der Seite VPN unter Linux

You need a VPN (Virtual Private Network) if you want to use services from your computer at home that are only accessible within the university network. VPN ensures secure access to the university network from external networks (dial-up via other providers, external company or university networks).

These instructions are based on Ubuntu 22.04.2 LTS. Other distributions may work in a similar way. We cannot offer instructions for every distribution.

Simultaneous connections[Bearbeiten | Quelltext bearbeiten]

Uni-VPN

  • If you use the Uni-VPN, you can only establish one connection at a time.
  • You cannot establish a connection to the Uni-VPN on another device at the same time.
  • You must disconnect the existing connection first.

Group VPN

  • If you use a group VPN, you cannot establish a second VPN connection to this group VPN on another device at the same time.
  • You must disconnect the existing connection first.
  • However, you can connect to the Uni VPN or another group VPN on another device at the same time.

What do I need to do?[Bearbeiten | Quelltext bearbeiten]

  • Download personal network certificate.
  • Download configuration file:

  • Save network certificate and configuration file in a fixed folder.
  • Rename network certificate.
  • Set up VPN.

Step-by-step instructions[Bearbeiten | Quelltext bearbeiten]

Create certificate[Bearbeiten | Quelltext bearbeiten]

You need a network certificate for the VPN connection. If you already have a certificate for Eduroam, you can use that and skip this step.
Open the service portal and log in with your university account.


  • Go to User management and then to Network settings.


Eduroam-unter-android-4.png


  • Click on "Create new certificate".


Netzwerkzertifikat-container-v2.png


  • Give the certificate a unique name (e.g. Laptop VPN)
  • Select Version 2 as the file format.
  • Then click on "Send new certificate".


Netzwerkzertifikat-download.png


  • A new network certificate has been created for you.
  • First copy the import password to the clipboard.
  • Now click on "Download network certificate".


Configuring VPN under Linux[Bearbeiten | Quelltext bearbeiten]

Download the configuration file, select the VPN you want to connect to and click on Download. Normally, "Uni-VPN (Standard)" should be the right choice, but if you have problems with the connection, try "Uni-VPN-TCP" again. Note: You can click on "Download" here and download your configuration file. This is not a screenshot ;-)


  • Accessing online resources may require that you route all network traffic through the tunnel.
  • You do not need this option for pure access to network drives.

Create folder[Bearbeiten | Quelltext bearbeiten]

  • Create a folder and place the network certificate and configuration file there.
    • On distributions that use SELinux (e.g. RedHad, Fedora, CentOS etc.) you need to make sure that the location has the correct labels
    • These can be checked with ls -laZ PATH and need a label in the form of unconfined_u:object_r:home_cert_t:s0
    • By default the directory ~/.cert/ should have the correct labels for the network certificate
    • Debian/Ubuntu based distributions normally do not use SELinux and should therefore not be affected by this
  • Choose the location carefully - you must not move or rename the folder later.
  • Rename the network certificate to Network_Certificate.p12
Folder for VPN


  • This is what the contents of the folder should look like.


Set up VPN[Bearbeiten | Quelltext bearbeiten]

Network


  • Click on the "Network symbol".
  • Then click on "Settings".


Add VPN


  • In the VPN area, click on the + to add.


Import from file


  • Select "Import from file...".


Configuration file


  • Open the folder we just created.
  • Select the "Configuration file".
  • Then click "Open".


VPN settings


  • The VPN settings have been imported from the configuration file.
  • Enter the "Import password" for the network certificate. (1)
  • Then click on "Add". (2)


Connect VPN


  • You can connect to the VPN by clicking on the switch.


Connect VPN[Bearbeiten | Quelltext bearbeiten]

Connect VPN


  • Or establish the connection via the network menu.


Disconnect VPN[Bearbeiten | Quelltext bearbeiten]

Disconnect VPN


  • You can disconnect the VPN connection via the network menu.


Unpack container[Bearbeiten | Quelltext bearbeiten]

If there are problems using the certificate in its container format with the export password provided, it may help to unpack the container into certificate and key.
These problems occur, for example, with the old container format under distributions that use OpenSSL 3 or newer. Here you can either unpack the previous container (in order to reference the key and certificate directly) or request a new certificate with the new container format in the service portal.

The OpenSSL version can be checked as follows: 

$ openssl version

The container can be unpacked as follows: 

$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_cert.pem -clcerts -nokeys
$ openssl pkcs12 -in Network_Certificate.p12 -out Network_Certificate_key.pem -nocerts -nodes

The two new files are copied to a safe location in the user directory with the network certificate. When unpacking the old container format, an additional parameter -legacy is required under OpenSSL 3, otherwise this will be refused.

Edit configuration[Bearbeiten | Quelltext bearbeiten]

If you do not select the certificates via the GUI, but use the configuration file via the command line, you must ensure that the files are named appropriately for the configuration file. If you have unpacked the container, you must adjust the configuration file accordingly.

Configuration file without changes 

#### Betriebssystemanpassungen für Linux ####################

pkcs12 Network_Certificate.p12
resolv-retry 5
auth-nocache
# oder getrennt:
# cert Network_Certificate_cert.pem
# key Network_Certificate_key.pem

If you have unpacked the container in certificate and key: 

#### Betriebssystemanpassungen für Linux ####################

# pkcs12 Network_Certificate.p12
resolv-retry 5
auth-nocache
# oder getrennt:
cert Network_Certificate_cert.pem
key Network_Certificate_key.pem


Check VPN[Bearbeiten | Quelltext bearbeiten]

You can check the VPN function by calling:

https://go.upb.de/ip

Your IP is displayed there and whether you are on the university network.

Example: Existing connection to the university network.


See also[Bearbeiten | Quelltext bearbeiten]

Zentrum für Informations- und Medientechnische Dienste der Universität Paderborn (ZIM) - Ehemals IMT

Virtuelle privates Netzwerk; über eine bestehende Internetverbindung wird der Rechner virtuell an einen anderen Ort gesetzt und bekommt alle Zugriffsmöglichkeiten, als ob er vor Ort wäre. Nifty!

Education Roaming - WLAN-Netzwerk, das an der Universität Paderborn und an vielen weiteren Institutionen weltweit genutzt werden kann. Zugang zu einem Eduroam-Netzwerk, gewährt Zugang zu allen Eduroam-Netzwerken (WLAN).

Bei Fragen oder Problemen wenden Sie sich bitte telefonisch oder per E-Mail an uns:

Tel. IT: +49 (5251) 60-5544 • Tel. Medien: +49 (5251) 60-2821 • E-Mail: zim@uni-paderborn.de

Wir sind umgezogen. Sie finden das Notebook-Café gemeinsam mit dem Servicecenter Medien in H1.201.

Wir sind zu folgenden Zeiten erreichbar:

Mo - Do Fr
Vor-Ort-Support 08:30 - 16:00 08:30 - 14:00
Telefonsupport 08:30 - 16:00 08:30 - 14:00
Servicecenter Medien 08:00 - 16:00 08:00 - 14:30



Abgerufen von „https://hilfe.uni-paderborn.de/index.php?title=VPN_unter_Linux/en&oldid=38246“
Cookies helfen uns bei der Bereitstellung des ZIM HilfeWikis. Bei der Nutzung vom ZIM HilfeWiki werden die in der Datenschutzerklärung beschriebenen Cookies gespeichert.
Weitere Informationen