{"id":55,"date":"2015-09-07T13:59:44","date_gmt":"2015-09-07T13:59:44","guid":{"rendered":"http:\/\/onlinelab.info\/?p=55"},"modified":"2015-09-07T13:59:44","modified_gmt":"2015-09-07T13:59:44","slug":"cau-hinh-certificate-authorization-tren-linux","status":"publish","type":"post","link":"https:\/\/www.asianux.org.vn\/index.php\/2015\/09\/07\/cau-hinh-certificate-authorization-tren-linux\/","title":{"rendered":"C\u1ea5u hinh Certificate Authorization tr\u00ean Linux"},"content":{"rendered":"

I. M\u00f4 h\u00ecnh<\/p>\n

\"\"<\/a><\/div>\n

 <\/p>\n

 <\/p>\n

H\u01b0\u1edbng d\u1eabn chu\u1ea9n b\u1ecb h\u1ec7 th\u1ed1ng nh\u01b0 h\u00ecnh v\u1ebd<\/h4>\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>C\u1ea5u h\u00ecnh card mang \u1edf ch\u1ebf \u0111\u1ed9 host-only<\/div>\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>C\u1ea5u h\u00ecnh \u0111\u1ecba ch\u1ec9 Ip nh\u01b0 h\u00ecnh v\u1ebd v\u00e0 ki\u1ec3m tra k\u1ebft n\u1ed1i<\/div>\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>C\u1ea5u h\u00ecnh DNS v\u1edbi b\u1ea3n sau<\/div>\n\n\n\n\n\n\n
\n
Server<\/b><\/div>\n<\/td>\n
\n
Server Name<\/b><\/div>\n<\/td>\n
\n
IP<\/b><\/div>\n<\/td>\n<\/tr>\n
\n
CA server<\/div>\n<\/td>\n
\n
ca.lablinux.vn<\/div>\n<\/td>\n
\n
192.168.1.3\/24<\/div>\n<\/td>\n<\/tr>\n
\n
Web Server<\/div>\n<\/td>\n
\n
web.lablinux.vn<\/div>\n<\/td>\n
\n
192.168.1.2\/24<\/div>\n<\/td>\n<\/tr>\n
\n
client<\/div>\n<\/td>\n
\n
client.lablinux.vn<\/div>\n<\/td>\n
\n
192.168.1.1\/24<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
4.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ki\u1ec3m tra c\u1ea5u h\u00ecnh<\/div>\n
[root@client\u00a0 <\/span>tmp]# ping ca.lablinux.vn<\/span><\/div>\n
[root@client\u00a0 <\/span>tmp]# ping web.lablinux.vn<\/span><\/div>\n
<\/div>\n

Kh\u1edfi t\u1ea1o Certificate Authorization Server<\/h4>\n
5.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ki\u1ec3m tra b\u1ed9 c\u00e0i<\/div>\n
[root@ca \u00a0<\/span>tmp]# rpm \u2013q\u00a0 <\/span>openssl<\/span><\/div>\n
6.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o th\u01b0 m\u1ee5c th\u1eed nghi\u1ec7m<\/div>\n
[root@ca <\/span>tmp]# mkdir -m 0755\u00a0 <\/span>\/etc\/pki<\/div>\n
7.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o th\u01b0 m\u1ee5c \u0111\u1ec3 l\u01b0u CA<\/div>\n
[root@ca tmp]# mkdir -m 0755 \/etc\/pki\/myCA \u00a0<\/span>\/etc\/pki\/myCA\/private\u00a0\u00a0 <\/span>\/etc\/pki\/myCA\/certs\u00a0 <\/span>\/etc\/pki\/myCA\/newcerts \u00a0\u00a0<\/span>\/etc\/pki\/myCA\/crl<\/span><\/div>\n
[root@test myCA]# touch index.txt<\/pre>\n
[root@test myCA]# echo '01' > serial<\/span><\/pre>\n
8.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o file c\u1ea5u h\u00ecnh:<\/div>\n
[root@ca pki]#cd \/etc\/pki\/myCA<\/span><\/div>\n
[root@ca \u00a0<\/span>myCA]#vi\u00a0 <\/span>testssl.conf<\/span><\/div>\n
\n
[ ca ]<\/span><\/div>\n
default_ca\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= CA_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># The default ca section<\/span><\/div>\n
<\/div>\n
[ CA_default ]<\/span><\/div>\n
\u00a0<\/span>dir\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= .\/\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span># top dir<\/span><\/div>\n
\u00a0<\/span>certs\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= $dir\/certs<\/pre>\n
 crl_dir\u00a0\u00a0\u00a0\u00a0 <\/span>= $dir\/crl<\/pre>\n
\u00a0<\/span>database\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= $dir\/index.txt\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># index file.<\/span><\/div>\n
\u00a0<\/span>new_certs_dir\u00a0 <\/span>= $dir\/newcerts\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># new certs dir<\/span><\/div>\n
<\/div>\n
\u00a0<\/span>certificate\u00a0\u00a0\u00a0 <\/span>= $dir\/certs\/ca.crt\u00a0\u00a0\u00a0 <\/span><\/b># The CA cert<\/span><\/div>\n
\u00a0<\/span>serial\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= $dir\/serial\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># serial no file<\/span><\/div>\n
\u00a0<\/span>private_key\u00a0\u00a0\u00a0 <\/span>= $dir\/private\/cakey.pem# CA private key<\/span><\/div>\n
\u00a0<\/span>RANDFILE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= $dir\/private\/.rand\u00a0\u00a0\u00a0 <\/span># random number file<\/span><\/div>\n
<\/div>\n
\u00a0<\/span>crl_dir\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= $dir\/crl<\/span><\/div>\n
\u00a0<\/span>default_days\u00a0\u00a0 <\/span>= 365\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># how long to certify for<\/span><\/div>\n
\u00a0<\/span>default_crl_days= 30\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># how long before next CRL<\/span><\/div>\n
\u00a0<\/span>default_md\u00a0\u00a0\u00a0\u00a0 <\/span>= md5\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># md to use<\/span><\/div>\n
\u00a0<\/span>policy\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= policy_any\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># default policy<\/span><\/div>\n
\u00a0<\/span>email_in_dn\u00a0\u00a0\u00a0 <\/span>= no\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># Don’t add the email into cert DN<\/span><\/div>\n
\u00a0<\/span>name_opt \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>= ca_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># Subject name display option<\/span><\/div>\n
\u00a0<\/span>cert_opt\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= ca_default\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># Certificate display option<\/span><\/div>\n
\u00a0<\/span>copy_extensions = none\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span># Don’t copy extensions from request<\/span><\/div>\n
\u00a0<\/span>[ policy_any ]<\/span><\/div>\n
\u00a0<\/span>countryName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= supplied<\/span><\/div>\n
\u00a0<\/span>stateOrProvinceName\u00a0\u00a0\u00a0 <\/span>= optional<\/span><\/div>\n
\u00a0<\/span>organizationName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= optional<\/span><\/div>\n
\u00a0<\/span>organizationalUnitName = optional<\/span><\/div>\n
\u00a0<\/span>commonName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= supplied<\/span><\/div>\n
\u00a0<\/span>emailAddress\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>= optional<\/span><\/div>\n<\/div>\n
9.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o m\u1ed9t certificate cho b\u1ea3n th\u00e2n m\u00ecnh<\/div>\n
[root@ca myCA]# cd \/etc\/pki\/myCA<\/span><\/div>\n
[root@ca myCA]# openssl req -new -x509 -keyout private\/ca.key -out certs\/ca.crt -days 1825<\/span><\/div>\n
10.\u00a0 <\/span><\/span><\/span>Ph\u00e2n quy\u1ec1n \u0111\u1ec3 b\u1ea3o m\u1eadt kh\u00f3a private<\/div>\n
[root@ca tmp]# chmod 0400 \/etc\/pki\/myCA\/private\/ca.key<\/span><\/div>\n
<\/h4>\n
T\u1ea1o m\u1ed9t certificate request t\u1eeb Web Server<\/h4>\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ki\u1ec3m tra b\u1ed9 c\u00e0i<\/div>\n
[root@<\/span> web<\/span> tmp]#rpm \u2013q\u00a0 <\/span>openssl<\/span><\/div>\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o th\u01b0 m\u1ee5c th\u1eed nghi\u1ec7m v\u00e0 kh\u00f4ng s\u1eed d\u1ee5ng m\u1ee5c m\u1eb7c \u0111\u1ecbnh \/etc\/pki\/<\/b><\/div>\n
[root@web tmp]# mkdir -m 0755 \/etc\/pki<\/span><\/div>\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o th\u01b0 m\u1ee5c \u0111\u1ec3 l\u01b0u CA<\/span><\/div>\n
[root@ web tmp]#mkdir -m 0755 \/etc\/pki\/myCA \/etc\/pki\/myCA\/private\u00a0 <\/span>\/etc\/pki\/myCA\/certs\u00a0 <\/span>\/etc\/pki\/myCA\/newcerts \u00a0<\/span>\/etc\/pki\/myCA\/crl<\/span><\/div>\n
4.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o m\u1ed9t certificate request:<\/div>\n
[root@web myCA]#cd \/etc\/pki\/myCA <\/span><\/div>\n
[root@ web myCA]#openssl req -new -nodes -keyout private\/server.key -out server.csr -days 365<\/span><\/div>\n
Ch\u00fa \u00fd: Common Name (CN) l\u00e0 t\u00ean d\u1ecbch v\u1ee5 c\u1ee7a b\u1ea1n<\/strong><\/div>\n
5.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Gi\u1edbi h\u1ea1n quy\u1ec1n truy c\u1eadp file private<\/span><\/div>\n
[root@web myCA]#chown root.apache \/etc\/pki \/myCA\/private\/server.key<\/span><\/div>\n
[root@webr myCA]#chmod 0440 \/etc\/pki\/myCA\/private\/server.key<\/span><\/div>\n
6.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>G\u1eedi ch\u1ee9ng ch\u1ec9 t\u1edbi CA server<\/div>\n
[root@web myCA]#scp\u00a0 <\/span>server.csr\u00a0\u00a0\u00a0 <\/span>root@192.168.1.3:\/etc\/pki\/myCA\/<\/span><\/a><\/div>\n
<\/h4>\n
C\u1ea5p ph\u00e1t ch\u1ee9ng ch\u1ec9 cho Web Server<\/h4>\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ch\u1ea5p nh\u1eadn m\u1ed9t ch\u1ee9ng ch\u1ec9<\/div>\n
[root@ca \u00a0\u00a0<\/span>~]# <\/span>cd \/etc\/pki\/myCA\/<\/div>\n
[root@ca myCA]# <\/span>openssl ca \u2013config testssl.conf\u00a0 <\/span>-out certs\/server.crt -infiles server.csr<\/div>\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>X\u00f3a certificate request<\/div>\n
[root@ca myCA]# rm -f \/etc\/pki\/myCA\/server.csr<\/span><\/div>\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ki\u1ec3m tra Certificate<\/div>\n
[root@ca myCA]# openssl x509 -subject -issuer -enddate -noout -in \/etc\/pki \/myCA\/certs\/server.crt<\/span><\/div>\n
Ho\u1eb7c<\/div>\n
[root@ca myCA]# openssl x509 -in certs\/server.crt -noout -text<\/span><\/div>\n
4.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ki\u1ec3m tra ch\u1ee9ng th\u1ef1c v\u1edbi ch\u1ee9ng th\u1ef1c m\u00e1y ch\u1ee7 CA<\/div>\n
[root@ca myCA]# \u00a0<\/span>openssl verify -purpose sslserver -CAfile \/etc\/pki\/myCA\/certs\/ca.crt\u00a0 <\/span>\u00a0<\/span>\/etc\/pki\/myCA\/certs\/server.crt<\/span><\/div>\n
5.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o m\u1edbi m\u1ed9t CRL (Certificate Revokation List):<\/div>\n
# openssl ca -config testssl.conf -gencrl -out crl\/myca.crl<\/span><\/div>\n
6.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>G\u1eedi l\u1ea1i ch\u1ee9ng ch\u1ec9 cho m\u00e1y ch\u1ee7 Web<\/div>\n
[root@ca myCA]# \u00a0<\/span>scp\u00a0 <\/span>\/etc\/pki\/myCA\/certs\/server.crt\u00a0\u00a0\u00a0\u00a0 <\/span>root@webserver:\/etc\/pki\/myCA<\/span><\/div>\n
<\/div>\n
C\u1ea5u h\u00ecnh Web server s\u1eed d\u1ee5ng Certificate<\/h4>\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Copy\u00a0 <\/span>certificate \u00a0<\/span>v\u00e0 key t\u1edbi v\u1ecb tr\u00ed \u0111\u1ec3 Apache c\u00f3 th\u1ec3 nh\u1eadn bi\u1ebft<\/div>\n
[root@server myCA]#mv \/etc\/httpd\/conf\/ssl.crt\/server.crt \/etc\/httpd\/conf\/ssl.crt\/server1.crt<\/span><\/div>\n
[root@server myCA]#cp \/etc\/pki\/myCA\/server.crt\u00a0 <\/span>\/etc\/httpd\/conf\/ssl.crt\/<\/span><\/div>\n
[root@server myCA]#mv \/etc\/httpd\/conf\/ssl.key\/server.key \/etc\/httpd\/conf\/ssl.key\/server1.key<\/span><\/div>\n
[root@server myCA]#cp \/etc\/pki\/myCA\/private\/server.key \/etc\/httpd\/conf\/ssl.key\/server.key<\/span><\/div>\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>T\u1ea1o trang web th\u1eed nghi\u1ec7m<\/div>\n
[root@server myCA]# cd \/var\/www\/html\/<\/span><\/div>\n
[root@server html]# vi index.html<\/span><\/div>\n
\n
<html><\/div>\n
<header><\/div>\n
<\/header><\/div>\n
<body><\/div>\n
\u00a0 <\/span>This is a test<\/div>\n
<\/body><\/div>\n
<\/html><\/div>\n<\/div>\n
3.\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ch\u1ea1y m\u00e1y ch\u1ee7 web<\/div>\n
[root@server html]# chkconfig httpd on<\/span><\/div>\n
[root@server html]#service httpd start<\/span><\/div>\n
C\u1ea5u h\u00ecnh client s\u1eed d\u1ee5ng Certificate<\/h4>\n
Trong m\u00e1y client ch\u1ea1y Internet Explorer t\u1edbi \u0111\u1ecba ch\u1ec9:\u00a0 <\/span>http:\/\/web.lablinux.vn<\/span><\/p>\n
\"\"<\/a><\/div>\n
 <\/p>\n
 <\/p>\n
\u00a0\u00a0 <\/span><\/span><\/span>Trong m\u00e1y client ch\u1ea1y Internet Explorer t\u1edbi \u0111\u1ecba ch\u1ec9:\u00a0 <\/span>https:\/\/web.lablinux.vn<\/div>\n
\"\"<\/a><\/div>\n
 <\/p>\n
 <\/p>\n
\u00a0\u00a0 <\/span><\/span><\/span>Import Certificate c\u1ee7a CA<\/div>\n
a.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><\/span><\/span>Ch\u1ecdn Option<\/div>\n
<\/div>\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
I. M\u00f4 h\u00ecnh     H\u01b0\u1edbng d\u1eabn chu\u1ea9n b\u1ecb h\u1ec7 th\u1ed1ng nh\u01b0 h\u00ecnh v\u1ebd 1.\u00a0\u00a0\u00a0\u00a0\u00a0 C\u1ea5u h\u00ecnh card mang \u1edf ch\u1ebf \u0111\u1ed9 host-only 2.\u00a0\u00a0\u00a0\u00a0\u00a0 C\u1ea5u h\u00ecnh \u0111\u1ecba ch\u1ec9 Ip nh\u01b0 h\u00ecnh v\u1ebd v\u00e0 ki\u1ec3m tra…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-55","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/posts\/55","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/comments?post=55"}],"version-history":[{"count":0,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/posts\/55\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/media?parent=55"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/categories?post=55"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/tags?post=55"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}