Dieses Wiki ist ein Archiv bis 2023. Das aktuelle Wiki findet sich unter https://wiki.hamburg.ccc.de/

Difference between revisions of "ChaosVPN:DebianHowto"

From CCCHHWiki
Jump to: navigation, search
m (4. Devise a network-nick)
m (The easiest way: Using our ChaosVPN Debian-Repository)
 
(68 intermediate revisions by 8 users not shown)
Line 1: Line 1:
 
[[ChaosVPN|Back]]
 
[[ChaosVPN|Back]]
  
<div style="border:3px solid black; text-align:center; color:red;"><b>THIS DOCUMENTATION NEEDS TO BE UPDATED FOR CHAOSVPN 2.0!</b></div>
+
{{Template:ChaosVPNBanner}}
  
 
= QUICK HOWTO FOR DEBIAN USER =
 
= QUICK HOWTO FOR DEBIAN USER =
  
== 0. Install necessary helper programs ==
+
== Install Software ==
 +
 
 +
== Install necessary helper programs ==
  
 
needed to use the chaosvpn client:
 
needed to use the chaosvpn client:
  
  # apt-get install iproute
+
  # apt-get install tinc iproute2
  
 
needed to compile the chaosvpn-client if not using a precreated debian package for it:
 
needed to compile the chaosvpn-client if not using a precreated debian package for it:
  
  # apt-get install build-essential debhelper devscripts git-core libcurl4-openssl-dev
+
  # apt-get install build-essential git bison flex libssl-dev zlib1g-dev debhelper devscripts
  
== 1. Install tinc ==
+
(see below for downloadable pre-created packages)
 +
 
 +
=== Install tinc ===
  
 
  # apt-get install tinc
 
  # apt-get install tinc
  
Either the package from Debian unstable, or my lenny backport of [http://debian.sdinet.de/lenny/sdinet/tinc/ http://debian.sdinet.de/lenny/sdinet/tinc/]
+
You need either the package from Debian squeeze/unstable, or a backport like from [http://debian.sdinet.de/squeeze/sdinet/tinc/ http://debian.sdinet.de/squeeze/sdinet/tinc/] or http://backports.debian.org/
  
This should be at least version 1.0.10.
+
Preferred for better security is tinc 1.1+, but may work with 1.0.10 or later.
  
Or visit [http://tinc.nl.linux.org/ http://tinc.nl.linux.org/], download and build yourself -
+
Or visit [http://tinc-vpn.org/ http://tinc-vpn.org/], download and build yourself -
 
at a minimum ./configure, specify the parameter --sysconfdir=/etc, and check the binary in the script
 
at a minimum ./configure, specify the parameter --sysconfdir=/etc, and check the binary in the script
 
   
 
   
If the tinc installation gives the following error:
+
== Install our ChaosVPN program ==
  
> ./MAKEDEV: don't know how to make device "tun"
+
=== The easiest way: Using our ChaosVPN Debian-Repository ===
  
Then create the device by hand:
+
Add the following lines to your /etc/apt/sources.list:
  
# mkdir -p /dev/net
+
  deb http://debian.sdinet.de/ stable chaosvpn
# mknod /dev/net/tun c 10 200
+
  deb-src http://debian.sdinet.de/ stable chaosvpn
# chown root:root /dev/net/tun
 
# chmod 600 /dev/net/tun
 
  
== 2. Create config directory ==
+
Instead of "stable" you should directly choose your distribution with "stretch", "jessie" or "wheezy" and so on. (Because there is no guarantee that stable/unstable points to the current stable/unstable release.)
  
# mkdir -p /etc/tinc/chaos
+
Make the Repository-Key known:
  
== 3. Generate keys ==
+
  apt-get update
 +
  apt-get install debian-sdinet-keyring
  
# tincd -n chaos --generate-keys=2048
+
Answer "y" to the one warning about unauthenticated content.
  
and press return a few times...
+
Run apt-get update a second time to associate the packages with the new key:
  
== 4. Devise a network-nick ==
+
  apt-get update
  
This is the name of the network endpoints/gatewways, not necessarily the users,
+
Finally install the ChaosVPN software:
it may even be more gateways per user.
 
  
Used below where <nodename> is.
+
  apt-get install chaosvpn
  
Please use only characters a-z, 0-9 and _ in it.
+
Install Done, proceed to next step some pages below.
  
== 5. Hostname ==
+
PS: The repositories may also be usable for Ubuntu, but that has not been tested at all.
  
The gateway may have a DynDNS (or similar) hostname pointing to a dynamic IP, or a static hostname/fixed IP.
+
PPS: The repositories are available for i386 (Intel+AMD x86 32bit) and amd64 (Intel+AMD x86 64bit) - users of other architectures will have to compile the chaosvpn client on their own.
  
Used below where <clienthost> is.
+
=== The alternate easy way: Use a pre-compiled Debian package. ===
  
== 6. Mail haegar@ccc.de the info ==
+
Download the pre-compiled Debian package from
  
I need the following info:
+
For Debian Unstable / Sid:     http://debian.sdinet.de/sid/sdinet/chaosvpn/
 +
For Debian Stable / Wheezy:    http://debian.sdinet.de/stable/sdinet/chaosvpn/
  
[<nodename>]
+
Fetch the newest *.deb file for your architecture from the correct directory above.
gatewayhost=<clienthost>
+
The files ending in _i386.deb are for 32bit installs, the files ending in _amd64.deb are for 64bit installs (both intel and amd).
  This should be the external name or ip address of the client host, not a VPN address.
 
  If the client is not reachable over the internet leave it out and set hidden=1 below.
 
  .
 
network=<ipv4 subnet in the vpn>
 
network6=<ipv6 subnet in the vpn>
 
  this may be more than one, IPv4 or IPv6
 
  .
 
  These subnets must be unique in our vpn,
 
  simply renumber your home network (or use something like NETMAP) with a network block that is still free.
 
  .
 
  Please use the list of assigned networks on [[ChaosVPN]], and add yourself there.
 
  
owner=
+
If there are no pre-existing files for your Debian Release and/or Architecture you need to skip to the alternative of self compiling below.
  Admin of the VPN gateway, with email address - a way to contact the responsible
 
  person in case of problems with your network link.
 
  
  key
+
  # wget http://debian.sdinet.de/lenny/sdinet/chaosvpn/chaosvpn_2.0~rc9-0.0~deb50_i386.deb
  rsa-public-key - contents of /etc/tinc/chaos/rsa_key.pub
+
(Replace link with correct file, the above is outdated and the correct changes from time to time as new packages get released)
  
optional the following details:
+
Make sure the dependencies are already installed (most likely they are, the required library version numbers are most likely different):
  
  port=655
+
  # apt-get install tinc libssl0.9.8 zlib1g perl-base
  if not specified tinc works on tcp+udp port 655
 
  it is better if everyone chooses a random port for this.
 
  either this specified port or port 655 needs to accept TCP and UDP traffic from outside.
 
  
use-tcp-only=1
+
Install the newly downloaded package:
  "I don't do udp, we only use suboptimal tcp"
 
  
  hidden=1
+
  # dpkg -i chaosvpn_2*.deb
  "I cannot accept inbound tunnel connections, I can only connect out."
 
  (e.g. behind a NAT)
 
  
indirectdata=1
+
The software should now be installed, continue with step 10 below.
  "I cannot accept inbound udp data packets, I can only send out."
 
  (e.g. behind a NAT)
 
  
silent=1
+
=== Alternative: compile yourself from our git repository ===
  "I cannot connect out, but you can connect to me."
 
  
== 7. Awaiting Response ==
+
Always needed to compile:
  
== 8. goto 6 unless $success ==
+
  # git clone git://github.com/ryd/chaosvpn.git
 
== 9. chaosvpn-client download and compile ==
 
 
 
** TODO: THIS PART NEEDS TO BE EXPANDED **
 
 
 
  # git checkout git://github.com/ryd/chaosvpn.git
 
 
  # cd chaosvpn
 
  # cd chaosvpn
  
way 1: just compile and install:
+
==== way 1: create a git snapshot debian package ====
  
  # make
+
  # make deb
  # sudo make install
+
  perhaps it throws an error about missing build dependencies, install these and retry.
 
+
  # sudo dpkg -i ../chaosvpn_2.0*.deb
way 2: create debian package and install this:
+
  install the generated package file, replace filename above with real name.
 +
  it is also possible to copy the generated .deb package to a different machine of the same
 +
  architecture and install it there - no need to have a full compile environment
 +
  on your router/firewall.
 +
 
 +
==== way 2: create debian package and install this ====
  
 
  # debuild
 
  # debuild
Line 132: Line 112:
 
   install the generated package file, replace filename above with real name.
 
   install the generated package file, replace filename above with real name.
  
== 10. Customize configfile ==
+
==== way 3: just compile and install the raw binary ====
 +
 
 +
# make
 +
# sudo make install
 +
 
 +
== Create config directory ==
 +
 
 +
# mkdir -p /etc/tinc/chaos
 +
 
 +
== Get your new node added to the central configuration ==
 +
 
 +
{{Template:ChaosVPNMailit}}
 +
 +
== Customize configfile ==
 +
 
 +
<b>FIXME</b> to be expanded
  
 
/etc/tinc/chaosvpn.conf
 
/etc/tinc/chaosvpn.conf
Line 138: Line 133:
 
In the top part are the variables.
 
In the top part are the variables.
  
== 11. script in /etc/ppp/ip-up to autostart, or to restart from time to time via cron ==
+
change
 +
 
 +
$my_peerid to the network nick from step 4
 +
$my_vpn_ip to an ip address in your network range, like 172.31.x.1
 +
 
 +
== Enable Starting of ChaosVPN ==
 +
 
 +
If you installed ChaosVPN through our Debian packages it is not started by default.
 +
 
 +
To enable this edit the file /etc/default/chaosvpn and change the RUN= line to RUN="yes"
 +
 
 +
After all changes (re-)start the chaosvpn client:
 +
 
 +
# /etc/init.d/chaosvpn start
 +
 
 +
If you made everything correct there should now be a tinc daemon running, and the output of 'route -n' should show lots of routes pointing to the new 'chaos_vpn' network interface.
 +
 
 +
== script automatic starting at boottime ==
 +
 
 +
if you built/installed a debian package and installed it the init.d part is already setup, if you installed it manually with "make install" you have to do it yourself. As a template for your own script you can use from inside your git checkout
 +
 
 +
# cp debian/init.d /etc/init.d/chaosvpn
 +
# cp debian/default /etc/default/chaosvpn
 +
# update-rc.d chaosvpn defaults
 +
 
  
 
and with luck, it will function beautifully! ;)
 
and with luck, it will function beautifully! ;)
Line 146: Line 165:
 
tons ;)
 
tons ;)
 
test in particular, and adjust docs for other linux distros, and perhaps even with *bsd
 
test in particular, and adjust docs for other linux distros, and perhaps even with *bsd
 +
 +
[[Category:ChaosVPN]]

Latest revision as of 21:42, 23 January 2018

Back

Note:
ChaosVPN is a VPN to connect Hackers and Hackerspaces - it does NOT provide anonymous internet access!
For this look at tor or other similar services.

It will also not help you to reach domains like .rdos, .lll, .clos or any other strange things supposed to be available on the "dark web".

Alternative: If you prefer BGP, you can also connect via https://dn42.net/, we are interconnected.

QUICK HOWTO FOR DEBIAN USER

Install Software

Install necessary helper programs

needed to use the chaosvpn client:

# apt-get install tinc iproute2

needed to compile the chaosvpn-client if not using a precreated debian package for it:

# apt-get install build-essential git bison flex libssl-dev zlib1g-dev debhelper devscripts

(see below for downloadable pre-created packages)

Install tinc

# apt-get install tinc

You need either the package from Debian squeeze/unstable, or a backport like from http://debian.sdinet.de/squeeze/sdinet/tinc/ or http://backports.debian.org/

Preferred for better security is tinc 1.1+, but may work with 1.0.10 or later.

Or visit http://tinc-vpn.org/, download and build yourself - at a minimum ./configure, specify the parameter --sysconfdir=/etc, and check the binary in the script

Install our ChaosVPN program

The easiest way: Using our ChaosVPN Debian-Repository

Add the following lines to your /etc/apt/sources.list:

 deb http://debian.sdinet.de/ stable chaosvpn
 deb-src http://debian.sdinet.de/ stable chaosvpn

Instead of "stable" you should directly choose your distribution with "stretch", "jessie" or "wheezy" and so on. (Because there is no guarantee that stable/unstable points to the current stable/unstable release.)

Make the Repository-Key known:

 apt-get update
 apt-get install debian-sdinet-keyring

Answer "y" to the one warning about unauthenticated content.

Run apt-get update a second time to associate the packages with the new key:

 apt-get update

Finally install the ChaosVPN software:

 apt-get install chaosvpn

Install Done, proceed to next step some pages below.

PS: The repositories may also be usable for Ubuntu, but that has not been tested at all.

PPS: The repositories are available for i386 (Intel+AMD x86 32bit) and amd64 (Intel+AMD x86 64bit) - users of other architectures will have to compile the chaosvpn client on their own.

The alternate easy way: Use a pre-compiled Debian package.

Download the pre-compiled Debian package from

For Debian Unstable / Sid:      http://debian.sdinet.de/sid/sdinet/chaosvpn/
For Debian Stable / Wheezy:     http://debian.sdinet.de/stable/sdinet/chaosvpn/

Fetch the newest *.deb file for your architecture from the correct directory above. The files ending in _i386.deb are for 32bit installs, the files ending in _amd64.deb are for 64bit installs (both intel and amd).

If there are no pre-existing files for your Debian Release and/or Architecture you need to skip to the alternative of self compiling below.

# wget http://debian.sdinet.de/lenny/sdinet/chaosvpn/chaosvpn_2.0~rc9-0.0~deb50_i386.deb
(Replace link with correct file, the above is outdated and the correct changes from time to time as new packages get released)

Make sure the dependencies are already installed (most likely they are, the required library version numbers are most likely different):

# apt-get install tinc libssl0.9.8 zlib1g perl-base

Install the newly downloaded package:

# dpkg -i chaosvpn_2*.deb

The software should now be installed, continue with step 10 below.

Alternative: compile yourself from our git repository

Always needed to compile:

# git clone git://github.com/ryd/chaosvpn.git
# cd chaosvpn

way 1: create a git snapshot debian package

# make deb
 perhaps it throws an error about missing build dependencies, install these and retry.
# sudo dpkg -i ../chaosvpn_2.0*.deb
 install the generated package file, replace filename above with real name.
 it is also possible to copy the generated .deb package to a different machine of the same
 architecture and install it there - no need to have a full compile environment
 on your router/firewall.
 

way 2: create debian package and install this

# debuild
 Answer the "This package has a Debian revision number but there does not seem to be
 an appropriate original tar file or .orig directory in the parent directory" with "y"
# sudo dpkg -i ../chaosvpn_2.0*.deb
 install the generated package file, replace filename above with real name.

way 3: just compile and install the raw binary

# make
# sudo make install

Create config directory

# mkdir -p /etc/tinc/chaos

Get your new node added to the central configuration

Devise a network-nick and a unique IP range you will be using

This network-nick or sometimes called nodename is the name of the network endpoint/gateway where the vpn software will be running,
not necessarily the name of the user, there may even be more than one gateway per user.

Used below where <nodename> is.

Please use only characters a-z, 0-9 and _ in it. Note that only lowercase letters are supported.

Second please select an unused IPv4 range out of IP Range, and write yourself down in that wiki page to mark your future range as in-use.
Please select from the correct ranges, 172.31.*.* for Europe, and 10.100.*.* for North America and elsewhere.

Repeat: Please do not forget to add yourself to the list at IP Range to mark your range as used.

Used below where <ipv4 subnet in the vpn> is.

The usage of IPv6 networks is also possible, but we do not have a central range for this (yet),
you may specify an IPv6 range you received from your (tunnel) provider to be reachable over the VPN,
or a private IPv6 ULA (Unique Local Address) network described in RFC4193.
For more info about ULA and a network-range generator please also see http://www.sixxs.net/tools/grh/ula/ .

Used below where <ipv6 subnet in the vpn> is.

Hostname

The gateway may have a DynDNS (or similar) hostname pointing to a dynamic IP, or a static hostname/fixed IP.

Better supply a hostname than a raw IP address even if it is static, so you can change it youself and do not need to contact us when needed. (Perhaps something like chaosvpn.yourdomain.example)

Used below where <clienthost> is.

Generate keys

Generate keys with tinc 1.1+

# tinc --net=chaos init <nodename>

Replace <nodename> with the name your new node should get.

**FIXME** need some way that "tinc init" puts the public key into the seperate files and not only into the generated hosts file, which our chaosvpn daemon overwrites.

generate public/private RSA and ECDSA keypairs with

# tinc --net=chaos generate-keys 2048

press Enter 4 times and backup the files /etc/tinc/chaos/ecdsa_key.priv, ecdsa_key.pub, rsa_key.priv and rsa_key.pub on an external device.

Generate keys with tinc 1.0.xx

create chaos config folder with

# mkdir /etc/tinc/chaos/

generate public/private keypairs with

# tincd --net=chaos --generate-keys=2048

press Enter 2 times and backup the files /etc/tinc/chaos/rsa_key.priv and rsa_key.pub on an external device.

Mail us your Infos

  • send via email to chaosvpn-join@hamburg.ccc.de

We need the following info - but please be so kind and also add a short description of you/your space and your motivation to join chaosvpn - or at least make us laugh. :)

(Please remove all lines starting with # from the email, they are just descriptions)

[<nodename>]

sponsor=
# Name a person/nickname/nodename or organisation/hackerspace already on ChaosVPN that will
# vouch for you getting access.

gatewayhost=<clienthost>
# This should be the external hostname or ip address of the client host, not a VPN address.
# If the client is not reachable over the internet leave it out and set hidden=1 below.
# If possible supply a hostname (even dyndns) and not an ip address for easier changing
# from your side without touching the central config.

network=<ipv4 subnet in the vpn>
network6=<ipv6 subnet in the vpn>
# (mandatory, must include)
# this may be more than one, IPv4 or IPv6, network6 with  IPv6 is optional
#
# These subnets must be unique in our vpn,
# simply renumber your home network (or use something like NETMAP) with a network block that is still free.
#
# Please use the list of assigned networks on ChaosVPN:IPRanges, and add yourself there.

owner=
# (mandatory, must include)
# Admin of the VPN gateway, with email address - a way to contact the responsible
# person in case of problems with your network link.

port=4712
# (optional)
# if not specified tinc works on tcp+udp port 655
# it is better if everyone chooses a random port for this.
# either this specified port or port 655 should accept TCP and UDP traffic from internet.

hidden=0
# (optional)
# "I cannot accept inbound tunnel connections, I can only connect out."
# (e.g. behind a NAT)
silent=0
# (optional)
# "I cannot connect out, but you can connect to me."
# Only ONE of hidden=1 or silent=1 is possible. 

Ed25519PublicKey=<something>
# (optional)
# tinc 1.1pre11+ only, contents of your /etc/tinc/chaos/ed25519_key.pub

-----BEGIN RSA PUBLIC KEY-----
....
-----END RSA PUBLIC KEY-----
# (mandatory)
# rsa-public-key - contents of your /etc/tinc/chaos/rsa_key.pub


Awaiting Response, give us some days, your request is processed manually

Retry until $success or $reject - but do not spam us.

Customize configfile

FIXME to be expanded

/etc/tinc/chaosvpn.conf

In the top part are the variables.

change

$my_peerid to the network nick from step 4
$my_vpn_ip to an ip address in your network range, like 172.31.x.1

Enable Starting of ChaosVPN

If you installed ChaosVPN through our Debian packages it is not started by default.

To enable this edit the file /etc/default/chaosvpn and change the RUN= line to RUN="yes"

After all changes (re-)start the chaosvpn client:

# /etc/init.d/chaosvpn start

If you made everything correct there should now be a tinc daemon running, and the output of 'route -n' should show lots of routes pointing to the new 'chaos_vpn' network interface.

script automatic starting at boottime

if you built/installed a debian package and installed it the init.d part is already setup, if you installed it manually with "make install" you have to do it yourself. As a template for your own script you can use from inside your git checkout

# cp debian/init.d /etc/init.d/chaosvpn
# cp debian/default /etc/default/chaosvpn
# update-rc.d chaosvpn defaults


and with luck, it will function beautifully! ;)


todo: tons ;) test in particular, and adjust docs for other linux distros, and perhaps even with *bsd