\documentclass[letterpaper]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{ÈçºÎÉèÖÃ¡°ÐéÄâË½ÓÐÍøÂ·(VPN)¡±}
\author{×÷Õß: Arpad Magosanyi $<$mag@bunuel.tii.matav.hu$>$\\ 
ÒëÕß: ½¯´óÎ° $<$dawei@sinica.edu.tw$>$}
\date{v0.2, 7 August 1997
·­ÒëÍê³ÉÈÕÆÚ: 20 Feb 1999}
\abstract{ÈçºÎ½¨Á¢ÐéÄâË½ÓÐÍøÂ·(Virtual Private Network)¡£}


\begin{document}
\maketitle

\section{¸üÕý}



'no controlling tty problem' -$>$ -o 'BatchMode yes' ÊÇÓÉ Zot O'Connor 
$<$zot@crl.com$>$ Ëù¸üÕý¡£

ºËÐÄ 2.0.30 µÄ¾¯¸æÑ¶Ï¢£¬ÊÇÓÉ mag Ëù¸üÕý¡£




\section{ÍÆ¼ö¹ã¸æ}

Õâ·ÝÎÄ¼þÊÇ Linux VPN howto£¬ËüÊÕ¼¯ÁËÈçºÎÔÚ Linux (ÒÔ¼°Ò»°ãµÄ UNIX) ÉÏ½¨Á¢
Ò»¸öÐéÄâ±£»¤Ê½ÍøÂ·µÄÏà¹Ø×ÊÑ¶¡£




\subsection{°æÈ¨ÉùÃ÷}



Õâ·ÝÎÄ¼þÊÇ Linux HOWTO ¼Æ»®µÄÒ»²¿·Ö¡£ËüµÄ°æÈ¨ÉùÃ÷ÈçÏÂ£º³ý·ÇÌØ±ðËµÃ÷£¬Linux 
HOWTO ÎÄ¼þµÄ°æÈ¨¹éÊôËûÃÇ¸÷×ÔµÄ×÷ÕßËùÓÐ¡£Linux HOWTO ÎÄ¼þµÄÈ«²¿»ò²¿·Ö£¬¿ÉÒÔ
Ê¹ÓÃÈÎºÎÎïÀí»òµç×ÓÐÎÊ½µÄÃ½ÌåÀ´¸´ÖÆÓëÉ¢²¼£¬Ö»ÒªÕâ¸ö°æÈ¨ÉùÃ÷±»±£ÁôÔÚÃ¿·Ý¿½±´
ÖÐ¡£ÉÌÒµÐÐÎªµÄÔÙÉ¢²¼ÊÇ±»ÔÊÐí¶øÇÒÊÜ»¶Ó­µÄ£»µ«ÊÇ£¬ÈÎºÎµÄÉ¢²¼ÐÐÎª×÷Õß¶¼Ï£ÍûÄÜ
±»¸æÖª¡£ËùÓÐ·­Òë¡¢ÑÜÉúµÄ¹¤×÷¡¢»òºÏ²¢ÈÎºÎ Linux HOWTO ÎÄ¼þµÄ¾Û¼¯¹¤×÷£¬¶¼±ØÐë
ÊÜµ½Õâ¸ö°æÈ¨ÉùÃ÷µÄ±£»¤¡£Ò²¾ÍÊÇËµ£¬Äã²»¿ÉÒÔ´Ó HOWTO ÑÜÉú³öÒ»·ÝÎÄ¼þ£¬È»áá¶ÔÕâ
·ÝÑÜÉúÎÄ¼þµÄÉ¢²¼Ç¿¼ÓÉÏÆäËûÏÞÖÆÌõ¼þ¡£³ý·ÇÔÚÒ»Ð©ÌØ¶¨µÄ×´¿öÏÂ£¬²Å»áÔÊÅµÕâÐ©ÏÞÖÆ
Ìõ¼þ£»ÇëÁªÂç Linux HOWTO µÄÐ­µ÷ÈË£¬ËûµÄµØÖ·ÈçÏÂ¡£¼ò¶øÑÔÖ®£¬ÎÒÃÇÏ£ÍûÄÜ¹»¾¡¿É
ÄÜÍ¸¹ý¸÷ÖÖ¹ÜµÀ£¬À´ÍÆ¶¯Õâ¸ö×ÊÑ¶µÄÉ¢²¼¹¤×÷¡£È»¶ø£¬ÎÒÃÇÒ²Ï£Íû±£Áô HOWTO ÎÄ¼þµÄ
°æÈ¨£¬ÒÔ¼°Èç¹ûÓÐÈÎºÎ¶Ô HOWTOs µÄÔÙÉ¢²¼¼Æ»®Ò²Ï£ÍûÄÜ¹»±»Í¨Öªµ½¡£Èç¹ûÓÐÈÎºÎÒÉÎÊ
£¬ÇëÁªÂç Linux HOWTO Ð­µ÷ÈË Tim Bynum£¬ËûµÄµç×ÓÓÊ¼þµØÖ·ÊÇ 
linux-howto@sunsite.unc.edu ¡£




\subsection{ÃâÔðÉùÃ÷}



Ò»ÈçÍù³££º±¾ÎÄ¶ÔÄãËùÔì³ÉµÄÈÎºÎÎ£º¦£¬×÷ÕßÒ»¸Å²»¸ºÔðÈÎ¡£ÕýÈ·µÄÌõÎÄ£¬Çë²ÎÔÄ
GNU GPL 0.1.1 µÄÏà¹Ø²¿·Ö¡£




\subsection{Ö£ÖØÉùÃ÷}



ÎÒÃÇËùÃæÁÙµÄÊÇ°²È«ÐÔµÄÎÊÌâ£ºÈç¹ûÄãÃ»ÓÐÐÎ³ÉÒ»¸öºÃµÄ°²È«²ßÂÔ£¬ÒÔ¼°×öºÃÏà¹ØµÄÅäÌ×
´ëÊ©£¬Äã½«ÎÞ·¨»ñµÃÕæÕýµÄ°²È«¡£




\subsection{¹¦ÀÍ}



¸ÐÐ»ËùÓÐÌá¹©¹¤¾ß³ÌÊ½¸ø±¾ÎÄÊ¹ÓÃµÄÈËÊË¡£

¸ÐÐ» Zot O'Connor $<$zot@crl.com$>$ ²»½öÖ¸Õý¡°no controlling tty¡±µÄÎÊÌâ£¬¶øÇÒ
»¹Ìá¹©ÁË½â¾ö·½·¨¡£




\subsection{±¾ÎÄµÄÏÖ¿ö}



ÔÚÔÄ¶Á±¾ÎÄÇ°£¬ÄãÓ¦¸ÃÒÑ¾ß±¸ÍêÕûµÄ IP ¹ÜÀíÖªÊ¶£¬ÖÁÉÙÒª¶Ô¡°·À»ðÇ½(firewall)¡±¡¢ppp
¡¢ºÍ ssh £¬µÈÖªÊ¶£¬ÓÐÒ»Ð©ÁË½â¡£Èç¹ûÄãÒªÉè¶¨Ò»¸ö VPN »·¾³£¬ÎÞÂÛÈçºÎÒ»¶¨µÃÖªµÀÕâÐ©
¶«Î÷¡£ÎÒÖ»ÊÇ½«ÎÒµÄ¾­ÑéÐ´ÏÂÀ´ £¬ÒÔÃâÈÕááÍü¼ÇÏà¹ØµÄÄÚÈÝ¡£ËùÒÔ£¬ÎÒÏàÐÅÒ»¶¨»áÓÐ°²È«
µÄÂ©¶´´æÔÚ¡£ÎªÁËÇå³þÆð¼û£¬ÎÒÊÔÖøÒÔÖ÷»úÉèÖÃÎªÂ·ÓÉÆ÷·½Ê½£¬¶ø²»ÊÇÒÔ·À»ðÇ½µÄ·½Ê½£¬À´
ËµÃ÷Õû¸öÄÚÈÝ£¬Ï£Íû´ó¼ÒÇáÇáËÉËÉ¾ÍÄÜ¹»ÁË½â±¾ÎÄ¡£




\subsection{Ïà¹ØÎÄ¼þ}

\begin{itemize}
\item µµ°¸ /usr/doc/HOWTO/Firewall-HOWTO ÉÏµÄ Linux Firewall-HOWTO ÎÄ¼þ
\item µµ°¸ /usr/doc/HOWTO/PPP-HOWTO.gz ÉÏµÄ Linux PPP-HOWTO ÎÄ¼þ  
\item Ä¿Â¼ /usr/doc/ssh/* ÖÐµÄ  ssh ÎÄ¼þ  
\item Linux ¡°ÍøÂ·¹ÜÀíÖ¸Òý(Network Admins' Guide)¡± 
\item ¹ú¼Ò±ê×¼¼°¼¼ÊõÎ¯Ô±»á (National Institute Standards and Technology£¬¼òÐ´Îª
NIST) ÔÚµçÄÔ°²È«·½ÃæµÄ³ö°æÆ·£¬Çë²Î¿¼ÍøÖ· http://csrc.ncsl.nist.gov/nistpubs/  
\item ¡°·À»ðÇ½Í¨ÐÅÂÛÌ³(Firewall list)¡± (majordomo@greatcircle.com)  
\end{itemize}





\section{½éÉÜ}



ÓÉì¶ÍøÂ·°²È«ÎÊÌâÈÕÒæÊÜµ½ÖØÊÓ£¬ËùÒÔ£¬·À»ðÇ½µÄ¼¼ÊõÔ½À´Ô½¹ã·ºµØ±»Ó¦ÓÃÔÚ£¬Íø¼ÊÍøÂ·
ºÍ¡°¹«Ë¾ÄÚ²¿ÍøÂ·(intranet)¡±ÉÏ£¬·À»ðÇ½ÄÜÁ¦µÄÓÅÁÓ£¬¶Ô VPN µÄ°²È«ÐÔÓÐÖø¾Ù×ãÇáÖØµÄ
Ó°Ïì¡£ÕâÖ»ÊÇÎÒ¸öÈËµÄÌå»á¡£»¶Ó­´ó¼ÒÌá³ö×Ô¼ºµÄ¿´·¨¡£




\subsection{ÃüÃû¹ßÀý}



ÎÒ½«»áÊ¹ÓÃµ½¡°Ö÷·À»ðÇ½(master firewall)¡±ºÍ¡°´Î·À»ðÇ½(slave firewall)¡±ÕâÁ½¸ö×¨
ÓÐÃû³Æ£¬È»¶ø£¬VPN µÄ½¨ÖÃÓëÖ÷ÆÍÊ½¼Ü¹¹Ö®¼äÃ»ÓÐÈÎºÎ¹ØÁªÐÔ¡£ÎÒÖ»ÊÇ°ÑËüÃÇ¿´³É£¬Á½¶ËÔÚ
½¨Á¢Á¬ÏßÊ±£¬ËüÊÇ¸öÖ÷¶¯µÄ²ÎÓëÕß»ò±»¶¯µÄ²ÎÓëÕß¡£·¢Æð½¨Á¢Á¬ÏßµÄÖ÷»ú£¬»á±»µ±×÷Ö÷·À»ð
Ç½£»È»¶ø£¬±»¶¯µÄ²ÎÓëÕß£¬¾Í»á±»µ±×÷´Î·À»ðÇ½¡£




\section{¿ªÊ¼½¨ÖÃ}




\subsection{¹æ»®}



ÔÚÄã¿ªÊ¼Éè¶¨ÏµÍ³Ç°£¬ÄãÓ¦¸ÃÒªÏÈÁË½âÒ»ÏÂÍøÂ·Á¬½ÓµÄÏ¸½Ú¡£ÏÖÔÚ£¬ÎÒ¼Ù¶¨ÄãÓÐÁ½¸ö·À»ðÇ½
£¬¸÷±£»¤Ò»¸ö¹«Ë¾ÄÚ²¿ÍøÂ·¡£ËùÒÔ£¬ÏÖÔÚÃ¿¸ö·À»ðÇ½Ó¦¸Ã»áÓÐÁ½¸öÍøÂ·½çÃæ£¨ÖÁÉÙ£©¡£ÄÃÒ»
ÕÅÖ½£¬Ð´ÏÂËüÃÇµÄ IP Î»Ö·ºÍÍøÂ·ÕÚÕÖ¡£Ã¿¸ö VPN µÄ·À»ðÇ½£¬½«»áÊ¹ÓÃµ½Êý¸ö IP Î»Ö·Çø
¶Î¡£ÕâÐ© IP Î»Ö·Çø¶Î£¬Ó¦¸ÃÉè¶¨ÔÚÄã¹«Ë¾ÏÖÓÐµÄ×ÓÍøÂ·µÄ¡õÎ§ÒÔÍâ¡£ÎÒ½¨ÒéÊ¹ÓÃ¡°Ë½ÓÐ¡±
IP Î»Ö·Çø¶ÎµÄ¡õÎ§¡£ÈçÏÂËùÊ¾£º

\begin{itemize}
\item 10.0.0.0 - 10.255.255.255  
\item 172.16.0.0 - 172.31.255.255  
\item 192.168.0.0 - 192.168.255.255  
\end{itemize}


ÎªÁËËµÃ÷£¬´Ë´¦ÎÒ¾ÙÁËÒ»¸öÉè¶¨µÄ°¸Àý£ºÓÐÁ½Ì¨ bastion {[}Òë×¢] Ö÷»ú£¬·Ö±ð±»³ÆÎª fellini
ºÍ polanski¡£ËüÃÇ¸÷ÓÐÒ»¸ö½çÃæÁ¬½ÓÍø¼ÊÍøÂ· (-out)£¬Ò»¸ö½çÃæÁ¬½Ó¹«Ë¾ÄÚ²¿ÍøÂ· (-in)
£¬ÒÔ¼°£¬Ò»¸ö½çÃæÁ¬½Ó VPN (-vpn)¡£ËùÓÐµÄ IP Î»Ö·ºÍÍøÂ·ÕÚÕÖ£¬ÈçÏÂ£º

\begin{itemize}
\item fellini-out: 193.6.34.12 255.255.255.0  
\item fellini-in: 193.6.35.12 255.255.255.0  
\item fellini-vpn: 192.168.0.1 µã¶Ôµã
\item polanski-out: 193.6.36.12 255.255.255.0  
\item polanski-in: 193.6.37.12 255.255.255.0  
\item polanski-vpn: 192.168.0.2 µã¶Ôµã
\end{itemize}


Òë×¢£º bastion ÊÇÖ¸±©Â¶ÔÚ¹«Ë¾ÍøÂ·Íâ²¿µÄ·À»ðÇ½Õ¢µÀ¡£

ËùÒÔÎÒÃÇÓÐ¸ö¼Æ»®¡£




\subsection{ËÑ¼¯¹¤¾ß}



Äã½«»áÐèÒª
\begin{itemize}
\item Linux ·À»ðÇ½
\item ºËÐÄ
\item ·Ç³£ÉÙµÄÉè¶¨
\item ipfwadm ³ÌÊ½ 
\item fwtk ³ÌÊ½  
\item VPN ËùÊ¹ÓÃµÄ¹¤¾ß
\item ssh ³ÌÊ½ 
\item pppd ³ÌÊ½ 
\item sudo ³ÌÊ½ 
\item pty-redir ³ÌÊ½  
\end{itemize}


Ä¿Ç°Ê¹ÓÃµÄ°æ±¾£º
\begin{itemize}
\item ºËÐÄ£º 2.0.29 ¡£ÇëÊ¹ÓÃÎÈ¶¨µÄºËÐÄ£¬¶øÇÒ£¬±ØÐë±È 2.0.20 »¹ÐÂ£¬ÒòÎª ping'o'death
µÄ´íÎó¡£ÔÚ×«Ð´±¾ÎÄÊ±£¬×îááÒ»¸öÎÈ¶¨µÄºËÐÄÊÇ°æ±¾ 2.0.30£¬µ«ÊÇËüÓÐÒ»Ð©´íÎó¡£Èç¹û
£¬ÄãÏëÒªÊ¹ÓÃ×îÐÂ°æºËÐÄËùÌá¹©£¬¼È¿ìÓÖ¿áµÄÍøÂ·³ÌÊ½Âë£¬Äã×Ô¼º¿ÉÒÔ³¢ÊÔ¿´¿´£¬°æ±¾
2.0.30 ¶ÔÎÒ¶øÑÔ£¬ÒÑ¾­ºÜºÃÓÃÁË¡£
\item »ù±¾µÄ×÷ÒµÏµÍ³£ºÎÒ±È½ÏÏ²»¶ Debian Ëù·¢ÐÐµÄ°æ±¾¡£Äã¾ø¶ÔÊ¹ÓÃ²»µ½ÈÎºÎ´óÐÍµÄ
ÈíÌåÌ×¼þ£¬µ±È»£¬Ò²°üº¬ sendmail ÔÚÄÚ¡£ÄãÒ²¾ø¶Ô²»ÄÜÏñÆäËüµÄ UNIX Ö÷»úÒ»Ñù£¬ÔÊÐí
telnet¡¢ftp¡¢ºÍ 'r' ÃüÁî£¬µÈ¹¦ÄÜµÄÊ¹ÓÃ¡£
\item ipfwadm ³ÌÊ½£º ÎÒÊ¹ÓÃµÄÊÇ 2.3.0¡£ 
\item fwtk ³ÌÊ½£º ÎÒÊ¹ÓÃµÄÊÇ 1.3¡£ 
\item ssh ³ÌÊ½£º $>$= 1.2.20¡£½Ï¾ÉµÄ°æ±¾£¬ÏÂ²ãµÄÐ­¶¨»áÓÐÎÊÌâ¡£
\item pppd ³ÌÊ½£º ÎÒ²âÊÔµÄÊÇ 2.2.0f£¬µ«ÊÇÎÒÎÞ·¨È·¶¨ËüÊÇ·ñ°²È«£¬Õâ¾ÍÊÇÎªÊ²÷áÎÒ»á
½«ËüµÄ setuid Î»ÔªÄÃµô£¬²¢Í¸¹ý sudo À´Ö´ÐÐËüµÄÔ­Òò¡£
\item sudo ³ÌÊ½£º ÎÒËùÖªµÀµÄ×îÐÂ°æ±¾ÊÇ 1.5.2¡£ 
\item pty-redir ³ÌÊ½£º ÕâÊÇÎÒÐ´¡£ÇëÖÁ
ftp://ftp.vein.hu/ssa/contrib/mag/pty-redir-0.1.tar.gz È¡µÃ¡£ÏÖÔÚµÄ°æ±¾ÊÇ
0.1 ¡£Èç¹ûÊ¹ÓÃÉÏÓÐÈÎºÎÎÊÌâ£¬ÇëÀ´ÐÅ¸æÖª¡£ 
\end{itemize}





\subsection{±àÒëÓë°²×°}



ÄãÏÖÔÚµÄ¹¤×÷²»ÊÇ±àÒë¾ÍÊÇ°²×°ËùËÑ¼¯µ½µÄ¹¤¾ß¡£ ²¢²ÎÔÄÆä£¨ÒÔ¼° firewall-howto£©
ÏêÏ¸µÄËµÃ÷ÎÄ¼þ¡£ÏÖÔÚ£¬ÎÒÃÇÒÑ¾­°²×°ºÃÕâÐ©¹¤¾ßÁË¡£ 




\subsection{ÆäËü×ÓÏµÍ³µÄÉè¶¨}



Éè¶¨·À»ðÇ½ÒÔ¼°ÆäËüµÄÏîÄ¿¡£Äã±ØÐëÔÚÁ½Ì¨·À»ðÇ½Ö÷»úÖ®¼ä£¬ÔÊÐí ssh ×ÊÁÏµÄÁ÷Í¨¡£Õâ
ÊÇÖ¸£¬Ö÷·À»ðÇ½»áÓÐÍøÂ·Á¬Ïßµ½´Î·À»ðÇ½µÄ²º 22¡£ÔÚ´Î·À»ðÇ½ÉÏÆô¶¯ sshd£¬À´ÑéÖ¤ÊÇ·ñ
ÔÊÐíÄã¡°µÇÈë(login)¡±¡£Õâ¸ö²½ÖèÉÐÎ´²âÊÔ¹ý£¬Çë¸æËßÎÒÄãµÄ²âÊÔ½á¹û¡£




\subsection{Éè¶¨ VPN µÄÊ¹ÓÃÕßÕÊ»§}



ÒÔÄãÈÕ³£Ê¹ÓÃµÄ¹¤¾ß£¨ÀýÈç£¬vi¡¢mkdir¡¢chown¡¢chmod£©ÔÚ´Î·À»ðÇ½ÉÏ½¨Á¢Ò»¸öÊ¹ÓÃÕßÕÊ
»§£¬ÄãÒ²¿ÉÒÔÔÚÖ÷·À»ðÇ½ÉÏ½¨Á¢Ò»¸öÊ¹ÓÃÕßÕÊ»§£¬µ«ÊÇ£¬ÎÒÈÏÎªÔÚ¿ª»ú½×¶ÎÉè¶¨Á¬Ïß¾Í¿ÉÒÔ
ÁË£¬ËùÒÔ£¬Ê¹ÓÃÔ­Ê¼µÄ root ÕÊ»§¾ÍÒÑ×ã¹»¡£ÓÐÈÎºÎÈË¿ÉÒÔÎªÎÒÃÇËµÃ÷Ò»ÏÂ£¬ÔÚÖ÷·À»ðÇ½ÉÏ
Ê¹ÓÃ root ÕÊ»§£¬»áÓÐÊ²÷áÎ£ÏÕÐÔ£¿




\subsection{Îª master ÕÊ»§£¬²úÉúÒ»¸ö ssh key }



Äã¿ÉÒÔÊ¹ÓÃ ssh-keygen ³ÌÊ½¡£Èç¹û£¬ÄãÒª×Ô¶¯ÉèÖÃ VPN£¬Äã¿ÉÒÔÉè¶¨Ò»¸öÃ»ÓÐÃÜÂëµÄ
¡°Ë½ÈËÔ¿³×(private key)¡±¡£




\subsection{Îª slave ÕÊ»§£¬ÉèÖÃ×Ô¶¯µÄ ssh µÇÈë»·¾³¡£}



ÔÚ´Î·À»ðÇ½ÖÐ£¬¸´ÖÆÄã¸Õ²Å²úÉúµÄ¡°¹«¹²Ô¿³×(public key)¡±µ½£¬Ê¹ÓÃÕßÕÊ»§ slave ÖÐ
µÄ .ssh/authorized\_keys µµ°¸Àï£¬²¢ÇÒ£¬Éè¶¨µµ°¸µÄÊ¹ÓÃÈ¨ÏÞ£¬ÈçÏÂ£º

\begin{verbatim}
drwx------ 2 slave slave 1024 Apr 7 23:49 ./  
drwx------ 4 slave slave 1024 Apr 24 14:05 ../  
-rwx------ 1 slave slave 328 Apr 7 03:04 authorized_keys  
-rw------- 1 slave slave 660 Apr 14 15:23 known_hosts  
-rw------- 1 slave slave 512 Apr 21 10:03 random_seed  
\end{verbatim}


ÆäÖÐ£¬µÚÒ»ÐÐÊÇ \~{}slave/.ssh£¬µÚ¶þÐÐÊÇ \~{}slave¡£




\subsection{¼ÓÇ¿ ssh ÔÚ bastion Ö÷»úÉÏµÄ°²È«ÐÔ¡£}



Çë°´ÕÕÎÒÔÚ sshd\_conf ÉÏµÄÉè¶¨£º

\begin{verbatim}
PermitRootLogin no  
IgnoreRhosts yes  
StrictModes yes  
QuietMode no  
FascistLogging yes  
KeepAlive yes  
RhostsAuthentication no  
RhostsRSAAuthentication no  
RSAAuthentication yes  
PasswordAuthentication no  
PermitEmptyPasswords no 
\end{verbatim}


ÃÜÂëÈÏÖ¤(PasswordAuthentication)±»¹Ø±ÕÁË£¬ËùÒÔ£¬ÄãÖ»ÓÐÊ¹ÓÃÊÚÈ¨¹ýµÄ key£¬²ÅÄÜ¹»
Íê³ÉµÇÈëµÄ¶¯×÷¡££¨µ±È»£¬ÄãÒ²ÒÑ¾­¹Ø±ÕÁË£¬telnet Óë  'r' ÃüÁî£©¡£ 




\subsection{ÔÊÐí ppp µÄÖ´ÐÐ£¬ºÍÕâÁ½¸öÕÊ»§µÄÂ·ÓÉ¡£}



µ±ÄãµÄ master ÕÊ»§ÊÇ root Ê±£¨ÒÔÎÒµÄÀý×Ó¶øÑÔ£©£¬Äã²»±Ø×öÈÎºÎÊÂÇé¡£ÖÁì¶ slave 
ÕÊ»§£¬Ôò»áÔÚÄãµÄ /etc/sudoers µÄµµ°¸ÖÐ³öÏÖÒ»ÐÐ£º

\begin{verbatim}
Cmnd_Alias VPN=/usr/sbin/pppd,/usr/local/vpn/route  
slave ALL=NOPASSWD: VPN  
\end{verbatim}


ÕýÈçÄãËù¿´µ½µÄ£¬ÎÒÔÚ´Î·À»ðÇ½Ö÷»úÉÏ£¬Ê¹ÓÃÁËÒ»Ð©ÃüÁî¸å(scripts)£¬À´Éè¶¨ ppp ºÍÂ·ÓÉ±í¡£




\subsection{×«Ð´ÃüÁî¸å³ÌÊ½}



ÔÚÖ÷·À»ðÇ½Ö÷»úÉÏ£¬ÎÒÊ¹ÓÃÁËÒ»¸ö³ÉÊìµÄÆôÊ¼ÃüÁî¸å£º
\begin{verbatim}
#! /bin/sh
# ³ÌÊ½¼Ü¹¹  Õâ¸öµµ°¸ÊÇ¸ö½¨Á¢ÔÚ /etc/init.d/ Ä¿Â¼ÏÂµÄÃüÁî¸åÊµÀý¡£
#               ÄãÓ¦¸ÃÔÚ /etc/init.d Ä¿Â¼ÏÂÊ¹ÓÃÕâ¸öÃüÁî¸å¡£
#
#               ×÷Õß Miquel van Smoorenburg <miquels@cistron.nl>.
#               Debian GNU/Linux ÐÞ¶©°æ×÷Õß
#               Ian Murdock <imurdock@gnu.ai.mit.edu>.
#
# °æ±¾:               @(#)skeleton  1.6  11-Nov-1996  miquels@cistron.nl
#

PATH=/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/bin/X11/:
PPPAPP=/home/slave/ppp
ROUTEAPP=/home/slave/route
PPPD=/usr/sbin/pppd
NAME=VPN
REDIR=/usr/local/bin/pty-redir
SSH=/usr/bin/ssh
MYPPPIP=192.168.0.1
TARGETIP=192.168.0.2
TARGETNET=193.6.37.0
MYNET=193.6.35.0
SLAVEWALL=polanski-out
SLAVEACC=slave

test -f $PPPD || exit 0

set -e

case "$1" in
  start)
        echo setting up vpn
        $REDIR $SSH -o 'Batchmode yes' -t -l $SLAVEACC $SLAVEWALL sudo $PPPAPP >/tmp/device
        TTYNAME=`cat /tmp/device`
echo tty is $TTYNAME
        sleep 10s
        if [ ! -z $TTYNAME ]
        then
        $PPPD $TTYNAME ${MYPPPIP}:${TARGETIP}
        else
                echo FAILED!
                logger "vpn setup failed"
        fi
        sleep 5s
        route add -net $TARGETNET gw $TARGETIP
        $SSH -o 'Batchmode yes' -l $SLAVEACC $SLAVEWALL sudo $ROUTEAPP
    ;;
  stop)
        ps -ax | grep "ssh -t -l $SLAVEACC " | grep -v grep | awk '{print $1}' | xargs kill
    ;;
  *)
    # echo "Usage: /etc/init.d/$NAME {start|stop|reload}"
    echo "Usage: /etc/init.d/$NAME {start|stop}"
    exit 1
    ;;
esac

exit 0
 
\end{verbatim}


slave ÕÊ»§¿ÉÒÔÊ¹ÓÃÃüÁî¸åÀ´Éè¶¨Â·ÓÉ (/usr/local/vpn/route)£º     
\begin{verbatim}
#!/bin/bash  
/sbin/route add -net 193.6.35.0 gw 192.168.0.1  
\end{verbatim}


¶øÆä .ppprc µÄÄÚÈÝ£¬ÈçÏÂ£º
\begin{verbatim}
passive  
\end{verbatim}





\section{ÈÃÎÒÃÇ¼ìÊÓÖ´ÐÐµÄ½á¹û£º}



master »áµÇÈëµ½ slave ÕÊ»§Àï¡¢Æô¶¯ pppd¡¢ÒÔ¼°£¬½«ËùÓÐµÄ×ÊÁÏÖØµ¼ÖÁ±¾»úµÄ pty£¨
ÐéÄâÖÕ¶Ë»ú£©¡£Õû¸öÖ´ÐÐÁ÷³ÌÈçÏÂ£º

\begin{itemize}
\item ÅäÖÃÒ»¸öÐÂµÄ pty  
\item Í¸¹ý ssh µÇÈë slave ÕÊ»§ 
\item ÔÚ slave ÕÊ»§ÖÐÖ´ÐÐ pppd 
\item master ÔÚ±¾»úµÄ pty Ö´ÐÐ pppd   
\item ²¢ÇÒÔÚÓÃ»§¶ËÉè¶¨Â·ÓÉ±í¡£  
\end{itemize}


´Ë´¦ÎÒÃÇ¿¼ÂÇµ½ÁËÊ±ÐòµÄÎÊÌâ£¨²»ÊÇÌ«ÑÏ¸ñµÄÒªÇó£©£¬Õâ¾ÍÊÇÎªÊ²÷áÎÒÃÇ»áÊ¹ÓÃµ½
'sleep 10s' Õâ¸öÐðÊöµÄÔ­Òò¡£




\section{ÖøÊÖÖ´ÐÐ¡£}




\subsection{µÇÈë}



ÏÖÔÚ£¬ÄãÓ¦¸ÃÒÑ¾­²âÊÔ¹ý ssh ÊÇ·ñÄÜ¹»Õý³£µØ¹¤×÷¡£Èç¹û£¬slave ¾Ü¾øÄãµÇÈë£¬ÇëÔÄ¶Á
¼ÇÂ¼µµ¡£Ò²ÐíÊÇµµ°¸Ê¹ÓÃÈ¨ÏÞ»ò sshd £¬ÔÚÉè¶¨ÉÏµÄÎÊÌâ¡£




\subsection{Æô¶¯ ppp }



µÇÈëµ½ slave ÕÊ»§£¬²¢Ö´ÐÐ£º
\begin{verbatim}
sudo /usr/sbin/pppd passive  
 
\end{verbatim}

´ËÊ±£¬Èç¹û¹¤×÷Õý³£ÄãÓ¦¸Ã»á¿´µ½Ò»Ð©ÂÒÂë¡£¼ÙÉè£¬Ã»ÓÐ³öÏÖÂÒÂë£¬²»ÊÇ sudo ¾ÍÊÇ pppd
ÓÐÎÊÌâ¡£Çë²Î¿¼£¬¼ÇÂ¼µµ¡¢{\itshape /etc/ppp/options\/} ¡¢ºÍ {\itshape .ppprc \/}£¬µÈµµ°¸
£¬ÒÔ±ãÕÒ³öÊÇÄÇ¸öÃüÁî³öÁËÎÊÌâ¡£ÎÊÌâÅÅ³ýáá£¬½« 'passive' Õâ¸ö×ÖÐ´µ½ .ppprc Àï£¬È»
ááÔÙÊÔÒ»´Î¡£ÒÔÑ¹ÏÂ enter¡¢'\~{}'¡¢ºÍ '\^{}Z'µÈ°´¼üµÄ·½Ê½£¬Çå³ýÓ©Ä»ÉÏµÄÂÒÂë£¬¼ÌÐø
¹¤×÷¡£ÏÖÔÚ£¬ÄãÓ¦¸Ã»á¿´µ½ master µÄ¡°ÊäÈëÌáÊ¾·ûºÅ(prompt)¡±£¬È»ááÖ´ÐÐ kill \%1
¡£Èç¹ûÄãÏëÖªµÀ¸ü¶àÓÐ¹Ø¡°ÒÝ³ö×ÖÔª(escape character)¡±µÄËµÃ÷£¬Çë²ÎÔÄ¡°µ÷Õû(tuning)¡±
ÄÇÒ»½Ú¡£




\subsection{Ò»´ÎÍê³ÉÁ½¸ö¶¯×÷}



µ±È»£¬ÄãÒ²¿ÉÒÔÕâ÷á×ö

\begin{verbatim}
ssh -l slave polanski sudo /usr/sbin/pppd 
 
\end{verbatim}


Èç¹û¹¤×÷Õý³££¬Ëü¾Í»áµ±ÖøÄãµÄÃæ£¬´«ËÍÒ»Ð©¿´ËÆÂÒÂëµÄ×ÊÁÏ¡£




\subsection{Pty µÄÖØµ¼¹¦ÄÜ}



Õâ´Î£¬ÎÒÃÇÊÔÖøÖØµ¼ÉÏÃæµÄ¶¯×÷£º
\begin{verbatim}
/usr/local/bin/pty-redir /usr/bin/ssh -l slave polanski sudo /usr/sbin/pppd  
 
\end{verbatim}


ºÃ³¤µÄ¾ä×Ó£¬²»ÊÇÂð£¿ÄãÓ¦¸ÃÊ¹ÓÃ ssh Ö´ÐÐµµµÄÍêÈ«Â·¾¶Ãû³Æ£¬ÎªÁË°²È«µÄÀíÓÉ£¬pty-redir
³ÌÊ½Ö»ÔÊÐíÄãÊ¹ÓÃÕâÖÖ·½Ê½¡£ÏÖÔÚ£¬Äã»áÍ¸¹ýÕâ¸ö³ÌÊ½È¡µÃÒ»¸ö×°ÖÃÃû³Æ¡£¼ÙÉè£¬ÄãÈ¡µÃµÄ
ÊÇ {\itshape /dev/ttyp0 \/} ¡£Äã¿ÉÒÔÊ¹ÓÃ ps ÃüÁîÀ´¼ìÊÓÄ¿Ç°µÄ×´¿ö¡£ÇëÕÒÑ° 'p0' Õâ¸ö×°
ÖÃµÄÏà¹ØÐðÊö¡£




\subsection{Õâ¸ö×°ÖÃÉÏÃæ£¬»áÓÐÐ©Ê²÷á¶«Î÷£¿}



ÊÔÖøÖ´ÐÐ
\begin{verbatim}
/usr/sbin/pppd /dev/ttyp0 local 192.168.0.1:192.168.0.2  
 
\end{verbatim}


À´½¨Á¢Á¬Ïß¡£È»áá£¬¼ìÊÓ ifconfig ÃüÁîµÄÊä³ö½á¹û£¬¿´ÊÇ·ñÒÑ¾­½¨Á¢ÁËÕâ¸ö×°ÖÃ£¬È»áá
£¬Ê¹ÓÃ ping À´¼ì²éÄãµÄÐéÄâÍøÂ·¡£




\subsection{Éè¶¨Â·ÓÉ}



³ýÁËÉè¶¨Ö÷·À»ðÇ½Ö÷»úµÄÂ·ÓÉ£¬´Î·À»ðÇ½Ö÷»úÒ²ÒªÉè¶¨¡£ÏÖÔÚ£¬ÄãÓ¦¸ÃÄÜ¹»´Ó¹«Ë¾µÄÒ»¸ö
ÄÚ²¿ÍøÂ·ÉÏµÄÖ÷»ú£¬ping µ½ÆäËüÄÚ²¿ÍøÂ·ÉÏµÄÖ÷»ú¡£½ÓÖø£¬Éè¶¨¶îÍâµÄ·À»ðÇ½¹æÔò¡£ÏÖ
ÔÚ£¬ÄãÒÑ¾­ÓµÓÐÁË VPN µÄ»·¾³£¬Äã¿ÉÒÔÉè¶¨¹«Ë¾Á½¸öÄÚ²¿ÍøÂ·Ö®¼äµÄÁ¬½Ó¹æÔò¡£






\section{µ÷Õû}




\subsection{Éè¶¨µÄµ÷Õû}



ÕýÈçÎÒËùËµµÄ£¬Õâ·ÝÎÄ¼þÖ»ÊÇÎÒ¸öÈËÉè¶¨ VPN µÄ±¸ÍüÂ¼¶øÒÑ¡£Éè¶¨ÖÐÓÐ²¿·ÖµÄÄÚÈÝ£¬ÎÒ»¹
Î´²âÊÔ¹ý¡£µÈµ½ÎÒ²âÊÔ¹ýáá£¬»á¸øËüÃÇÕýÈ·µÄ¶¨Î»£¬»òÓÐÈÎºÎÈË¸æËßÎÒ¡°ËüÊÇÈçºÎ¹¤×÷µÄ¡±
¡£ÓÐ¸ö×îÖØÒªµÄÊÂÇé´ó¼Ò±ØÐëÃú¼ÇÔÚÐÄ£¬ppp ÍøÂ·Á¬ÏßÉÐÎ´Ê¹ÓÃ 8-bit¡£ÎÒ×Ô¼ºÒ²¾õµÃ ssh
»ò pty µÄÉè¶¨£¬Ò»¶¨»¹ÓÐÒª¼ÓÇ¿µÄµØ·½¡£ÔÚ ssh µÄÉè¶¨ÖÐ£¬Ê¹ÓÃÁË¡°ò¦»¯·ûºÅ(tilde)¡±
(\~{}) ×ÖÔª×öÎªÒÝ³ö×ÖÔª¡£Ëü¿ÉÒÔÍ£Ö¹»ò¼õ»ºÁ½¶ËÖ®¼äµÄÍ¨Ñ¶£¬µ±ÈÎºÎµÄ¡°ÐÂÐÐ·ûºÅ-
ò¦»¯·ûºÅ(newline-tilde)¡±ÒÝ³öË³ÐòµÄ³öÏÖ£¬»áÊ¹µÃ ssh Ìøµ½ÊäÈëÌáÊ¾·ûºÅµÄÄ£Ê½¡£ssh 
µÄÎÄ¼þÉÏËµ£º $<$ ÔÚ´ó²¿·ÖµÄÏµÍ³ÉÏ£¬ÈôÉè¶¨²»Ê¹ÓÃÒÝ³ö×ÖÔª£¬Ôò¾ÍËãÊÇÄãÊ¹ÓÃÁË tty
£¬Ò²»áÔì³ÉÍ¨Ñ¶¶Ô»°µÄÍ¸Í¨»¯¡£$>$ Õâ¸ö¹¦ÄÜÏà¶Ôì¶ ssh µÄÑ¡Ïî±ê¼ÇÊÇ '{\itshape -e\/}'
£¬ÄãÒ²¿ÉÒÔÔÚÉè¶¨µµÖÐÉè¶¨Ëü¡£ 




\subsection{Æµ¿íÓë°²È«Ë­ÖØÒª}



²»ÂÛ½¨ÖÃÈÎºÎµÄÐéÄâÍøÂ·£¬¶¼»áÀË·ÑµôÊµ¼Ê×ÊÔ´¡£VPN »á³ÔµôÆµ¿íºÍ¼ÆËãµÄ×ÊÔ´¡£ÄãµÄÄ¿±ê
Ó¦¸ÃÊÇÈçºÎÈ¡µÃË«Ó®µÄ¾ÖÃæ¡£Äã¿ÉÒÔÊ¹ÓÃ '-C' ¿ª¹Ø»ò 'CompressionLevel' Ñ¡Ïî£¬À´µ÷Õû
Ëü¡£ÄãÒ²ÒÔ³¢ÊÔÊ¹ÓÃÁíÒ»ÖÖ¼ÓÃÜ·¨£¬µ«ÊÇ£¬ÎÒ²¢²»½¨ÒéÕâ÷á×ö¡£Ò²Çë×¢Òâ£¬Èç¹ûÄãÊ¹ÓÃÔ½¸ß
µÄÑ¹ËõµÈ¼¶£¬Äã´«ËÍ×ÊÁÏµÄÀ´»ØÊ±¼ä¾ÍÔ½³¤¡£»¶Ó­Ìá¹©ÈÎºÎÏà¹ØµÄ²âÊÔ±¨¸æ¡£






\section{·ÖÎöÒ×ÊÜ¹¥»÷µÄÈõµã}



ÎÒÊÔÖøÔÚ´Ë´¦ËµÃ÷Ò»ÏÂ£¬Õâ¸öÌØ±ðµÄÉè¶¨ºÍ VPNs Ò»°ãÓÐÄÇÐ©Ò×ÊÜ¹¥»÷µÄÈõµã¡£ÈÈ³ÏµØ»¶Ó­
¸÷Î»·¢±íÈÎºÎÒâ¼û¡£
\begin{itemize}
\item sudo ³ÌÊ½£ºÎÒ³ÐÈÏ£¬ÎÒ¹ý¶ÈµØÊ¹ÓÃÁË sudo¡£ÎÒÉîÐÅÄ¿Ç°ËüÈÔÈ»±ÈÊ¹ÓÃ setuid bits
»¹°²È«¡£Linux ÉÏÈÔÈ»Ã»ÓÐºÃµÄ´æÈ¡¿ØÖÆ»úÖÆ£¬ÊÇ¸ö²»ÕùµÄÊÂÊµ¡£Ö»ÓÐµÈµ½ÏàÈÝ POSIX.6 
±ê×¼µÄºËÐÄÕýÊ½·¢ÐÐÁË$<$ http://www.xarius.demon.co.uk/software/posix6/$>$¡£¸ü
Ôã¸âµÄÊÇ£¬ÎÒ¾ÓÈ»Í¸¹ý sudo À´ºô½ÐÖ´ÐÐ shell µÄÃüÁî¸å³ÌÊ½¡£ÊµÔÚÔã¸âÍ¸ÁË¡£ÄãÓÐÈÎºÎ
½¨Òé÷á£¿
\item pppd ³ÌÊ½£ºËüÒ²»áÊ¹ÓÃ suid root (Òë×¢) µÄÖ´ÐÐ·½Ê½¡£Äã¿ÉÒÔÍ¸¹ýÊ¹ÓÃÕßµÄ .ppprc
À´Éè¶¨Ëü¡£ÁôÐÄ£¬Ëü¿ÉÄÜ»áÓÐ¡°»º³åÇø³¬ÏÞÔË×ª(buffer overrun)¡±µÄ×´¿ö·¢Éú¡£µ×ÏÞÊÇ
£º¾¡¿ÉÄÜµØ±£»¤ÄãµÄ slave ÕÊ»§µÄ°²È«ÐÔ¡£
\item ssh ³ÌÊ½£ºµ±ÐÄ£¬ssh ÔÚ 1.2.20 ÒÔÇ°µÄ°æ±¾ÓÐ°²È«µÄÂ©¶´¡£¸üÔã¸âµÄÊÇ£¬ÎÒÃÇµÄ
Éè¶¨ÊÇ£¬µ±ÎÒÃÇ¶Ô master ÕÊ»§µÄ°²È«ÐÔ×ö³öÁËÈÃ²½£¬Ïà¶ÔµØ£¬Ò²ÆúÊØÁË slave ÕÊ»§µÄ°²
È«µ×ÏÞ£¬¶øÇÒ£¬ÎÒÃÇÊ¹ÓÃÁËÁ½¸öÍ¸¹ý sudo Æô¶¯µÄ³ÌÊ½£¬Ò²´ó¿ªÁË¹¥»÷Ö®ÃÅ¡£ÄÇÊÇÒòÎª£¬Îª
ÁËÄÜ¹»×Ô¶¯Éè¶¨ VPN£¬ÎÒÃÇÑ¡ÔñÈÃ master Ê¹ÓÃÃ»ÓÐÃÜÂëµÄ¡°Ë½ÈËÔ¿³×(secret key)¡±¡£
\item firewall ³ÌÊ½£º bastion Ö÷»úÉÏµÄ·À»ðÇ½£¬Èô¹æÔòÉè¶¨µÄ²»Ç¡µ±£¬¾ÍµÈì¶ÊÇ´ó¿ª¹«
Ë¾ÄÚ²¿ÍøÂ·µÄ·½±ãÖ®ÃÅ¡£ÎÒ½¨Òé´ó¼ÒÊ¹ÓÃ IP¡°Î±×°(Masquerading)¡±µÄ¼¼Êõ£¨´ËÊ±£¬¾ÍËãÊÇ
Â·ÓÉÉè¶¨²»ÕýÈ·£¬ËùÔì³ÉµÄÓ°ÏìÒ²ÊÇÎ¢²»×ãµÀµÄ£©£¬ÒÔ¼°£¬ÔÚ VPN µÄ½çÃæÉÏ×öÑÏ¸ñµÄ¿ØÖÆ
¡£
\end{itemize}


Òë×¢£º 
suid root ÊÇÖ¸ÈÎºÎÖ´ÐÐ¸Ã³ÌÊ½µÄÈË£¬ÔÚÖ´ÐÐµÄµ±Ê±»áÈ¡µÃ root µÄÈ¨ÏÞ¡£ÆäÖÐ£¬suid£¨
Éè¶¨Ê¹ÓÃÕßÊ¶±ð´úÂë£©ÊÇÖ¸Éè¶¨µµ°¸ÊôÐÔµÄµÚ 11 ¸öÎ»Ôª£¬ÈÃÖ´ÐÐ¸Ãµµ°¸µÄÈË£¬³ÉÎªµµ°¸µÄ
ÓµÓÐÕß¡£



\end{document}
