forked from usecallmanagernz/usecallmanagernz.github.io
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathvpn-group.html
More file actions
151 lines (145 loc) · 8.86 KB
/
Copy pathvpn-group.html
File metadata and controls
151 lines (145 loc) · 8.86 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
<!DOCTYPE html>
<html>
<head>
<title>VPN Connection</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link rel="shortcut icon" type="image/x-icon" href="favicon.ico">
<link rel="stylesheet" type="text/css" href="includes/theme.css">
<link rel="stylesheet" type="text/css" href="includes/prettify.css">
<script type="text/javascript" src="includes/jquery.js"></script>
<script type="text/javascript" src="includes/prettify.js"></script>
<script type="text/javascript">
jQuery (window).on ("load", function () {
prettyPrint ();
});
</script>
</head>
<body>
<header>
<img src="images/logo.png">
<h2><<span>proxy</span>></h2><h1><span>USECALLMANAGER</span>.nz</h1><h2></<span>proxy</span>></h2>
</header>
<main>
<nav>
<ul>
<li><span class="icon">home</span> <a href="document-overview.html">Document Overview</a></li>
<li><span class="icon">build</span> <a href="patching-asterisk.html">Patching Asterisk</a></li>
</ul>
<ul>
<li><h3>Network Configuration</h3></li>
<li><span class="icon">settings_ethernet</span> <a href="dhcpd-conf.html">DHCP Options</a></li>
<li><span class="icon">file_download</span> <a href="apache-conf.html">HTTP Provisioning</a></li>
<li><span class="icon">file_download</span> <a href="tftpd-conf.html">TFTP Provisioning</a></li>
</ul>
<ul>
<li><h3>Phone Configuration</h3></li>
<li><span class="icon">settings_phone</span> <a href="sepmac-cnf-xml.html">SEPMAC.cnf.xml</a></li>
<li><span class="icon">dialpad</span> <a href="dial-template-xml.html">Dial Templates</a></li>
<li><span class="icon">import_contacts</span> <a href="app-dial-rules-xml.html">Application Dial Rules</a></li>
<li><span class="icon">power_input</span> <a href="soft-keys-xml.html">Soft Keys</a></li>
<li><span class="icon">format_list_bulleted</span> <a href="line-keys-xml.html">Line Keys</a></li>
<li><span class="icon">done</span> <a href="feature-policy-xml.html">Feature Policy</a></li>
<li><span class="icon">language</span> <a href="network-locale.html">Network Locale</a></li>
<li><span class="icon">face</span> <a href="user-locale.html">User Locale</a></li>
<li><span class="icon">file_upload</span> <a href="load-information.html">Firmware Load Information</a></li>
<li><span class="icon">wallpaper</span> <a href="image-list-xml.html">Background Images</a></li>
<li><span class="icon">ring_volume</span> <a href="ring-list-xml.html">Ring Tones</a></li>
<li><span class="icon">security</span> <a href="itl-file-tlv.html">Device Security</a></li>
<li><span class="icon selected">vpn_key</span> <b>VPN Connection</b></li>
</ul>
<ul>
<li><h3>Asterisk Configuration</h3></li>
<li><span class="icon">dialer_sip</span> <a href="sip-conf.html">SIP Peers</a></li>
<li><span class="icon">settings_power</span> <a href="sip-notify-conf.html">SIP Notify Commands</a></li>
<li><span class="icon">format_list_numbered</span> <a href="extensions-conf.html">Dialplan Extensions</a></li>
<li><span class="icon">local_parking</span> <a href="res-parking-conf.html">Call Parking</a></li>
<li><span class="icon">code</span> <a href="sippeer-options.html">SIPPEER Options</a></li>
<li><span class="icon">volume_up</span> <a href="rtp-streaming.html">RTP Streaming</a></li>
<li><span class="icon">keyboard_arrow_right</span> <a href="command-line.html">Command Line</a></li>
</ul>
<ul>
<li><h3>XML Services</h3></li>
<li><span class="icon">settings</span> <a href="phone-services-xml.html">Phone Services</a></li>
<li><span class="icon">phone_forwarded</span> <a href="cgi-execute-xml.html">CGI Execute</a></li>
</ul>
<ul>
<li><h3>Additional Features</h3></li>
<li><span class="icon">extension</span> <a href="as-feature-events.html">AS Feature Events</a></li>
</ul>
</nav>
<article>
<h1>VPN Connection</h1>
The <b>8800</b>, <b>8900</b> and <b>9900</b> series phones can setup a VPN using the AnyConnect protocol which connects via HTTPS and optionally, DTLS. To enable the VPN connection set <<code class="tag">url1</code>> and <<code class="tag">certHash1</code>> in <a href="sepmac-cnf-xml.html#url1">SEPMAC.cnf.xml</a> and then enter your username and password via the settings or applications menu on the phone.<br>
<br>
Steps for patching, compiling and installed the modified version of OpenConnect Server are below. You should be familiar with building from source before attempting this.<br>
<br>
<b>1.</b> Download a copy of the patch below.<br>
<br>
<span class="icon">file_download</span> <a href="https://raw.githubusercontent.com/usecallmanagernz/patches/master/ocserv/cisco-webvpnlogin-0.12.6.patch">cisco-webvpnlogin-0.12.6.patch</a> (15K) <span class="icon">event</span> 24/03/2020 <span class="icon">security</span> SHA256:0e1bda447cac1a2ab8189144bb9f7ee9e903fccf163436f7dd6f7cd3bbbfff6d.<br>
<br>
<b>2.</b> Download the version of OpenConnect Server that matches the version number in the name of the patch.<br>
<br>
<span class="icon">open_in_browser</span> <a href="ftp://ftp.infradead.org/pub/ocserv/">OpenConnect Server Downloads</a>.<br>
<br>
<b>3.</b> Extract the archive and apply the patch.<br>
<br>
<code class="command-line">~$ tar -Jxvf ocserv-0.12.6.tar.xz
~$ cd ocserv-0.12.6
~/ocserv-0.12.6$ patch -p1 < ../cisco-webvpnlogin-0.12.6.patch</code>
<br>
<b>4.</b> Configure and build OpenConnect Server.<br>
<br>
<code class="command-line">~/ocserv-0.12.6$ ./configure --prefix=/usr --sysconfdir=/etc/ocserv --disable-maintainer-mode
~/ocserv-0.12.6$ make</code>
<br>
<b>5.</b> Install the patched version of OpenConnect Server.<br>
<br>
<code class="command-line">~/ocserv-0.12.6$ sudo make install</code>
<br>
<b>6.</b> Install the sample configuration file.<br>
<br>
<code class="command-line">~/ocserv-0.12.6$ sudo cp doc/sample.config /etc/ocserv/ocserv.conf</code>
<br>
<h2 id="ocserv.conf">ocserv.conf</h2>
The VPN server requires an RSA key and X509 certificate, if you already have a certificate that can be used instead. Otherwise a new certificate can be generated using <code class="literal">gencert</code>.<br>
<br>
<code class="command-line">~/certutils$ ./gencert -c ca.pem -C "OpenConnect" -b 2048 -y 1 -o vpn.pem</code>
<br>
An archive containing the scripts need to generate and hash X509 certificates files can be downloaded from the URL below.<br>
<br>
<span class="icon">file_download</span> <a href="https://github.com/usecallmanagernz/certutils/archive/v2.5.tar.gz">certutils-2.5.tar.gz</a> (16K) <span class="icon">event</span> 29/01/2021 <span class="icon">security</span> SHA256:da620e52e4e982dba8ff000f682fecf4fd6af10d80e0528939fda5b817342ece.<br>
<br>
<code class="prettify">...
# Only username and password authentication is supported for Cisco phones.
# The ocpasswd(1) tool can be used to manage the password file.
auth = "plain[passwd=/etc/ocserv/passwd]"
# The key and the certificates of the server. The certificate must match the
# hash set in one of <certHash1> ... <certHash10>.
server-cert = "/etc/ocserv/vpn.pem"
server-key = "/etc/ocserv/vpn.pem"
# Any unused TCP port can be used.
tcp-port = 443
# Disable DTLS. To use GCM ciphers DTLS support must be disabled because
# the phone negotiates a SSLv3 connection which only allows for CBC mode
# ciphers.
udp-port = 0
# Prefer 256-bit ciphers, ECDHE-RSA-AES-256-GCM or RSA-AES-256-CBC.
tls-priorities = "SECURE256:%COMPAT"
# Alternatively[1], prefer 128-bit ciphers, ECDHE-RSA-AES-128-GCM or RSA-AES-128-CBC.
# tls-priorities = "SECURE128:%COMPAT"
# Alternatively[2], force CBC ciphers so that DTLS can be enabled.
# udp-port = 443
# tls-priorities = "NONE:+VERS-TLS-ALL:+RSA:+SHA:+AES-256-CBC:+AES-128-CBC:+SIGN-ALL:+COMP-ALL:+CTYPE-ALL:%COMPAT"
# dtls-legacy = true
...</code>
<br>
<h2 id="certhash">certhash</h2>
<code class="literal">certhash</code> is used to generate a base64 encoded version of the SHA1 hash of the VPN server certificate. The hash is then set in one of <<code class="tag">certHash1</code>> ... <<code class="tag">certHash10</code>> in <a href="sepmac-cnf-xml.html#certHash1">SEPMAC.cnf.xml</a>.<br>
<br>
<code class="command-line">~/certutils$ ./certhash -d sha1 vpn.pem
s4U4A2DqXtupmzGuEGm2NCjxW/Y=</code>
</article>
</main>
<footer></footer>
</body>
</html>