Краткая инструкция по установке OpenVPN с поддержкой TLS 1.2 на Debian Squeeze.

Версии openssl и openvpn до начала обновления:

root@gateway:~# openssl
OpenSSL> version
OpenSSL 0.9.8o 01 Jun 2010
root@gateway:~# openvpn --version
OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun 6 2013


Обновлять версию дистрибутива возможности нет. Поэтому будем устанавливать openssl и openvpn из исходников.

1. Обновление openssl

aptitude update
aptitude install libz-dev libpam-dev liblzo2-dev
wget http://openssl.org/source/openssl-1.0.1.tar.gz
tar xzfz openssl-1.0.1.tar.gz
cd openssl-1.0.1
./config --prefix=/usr zlib-dynamic --openssldir=/etc/ssl shared
make
make install


2. Обновление openvpn

wget https://swupdate.openvpn.org/community/releases/openvpn-2.3.18.tar.gz --no-check-certificate
tar xzvf openvpn-2.3.18.tar.gz
cd openvpn-2.3.18
./configure --prefix=/usr
make
make install


Проверим версии после обновления

root@gateway:/home/user/openvpn-2.3.18# openvpn --version
OpenVPN 2.3.18 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jun 23 2020
library versions: OpenSSL 1.0.1 14 Mar 2012, LZO 2.03
Originally developed by James Yonan
Copyright (C) 2002-2017 OpenVPN Technologies, Inc.
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no

root@gateway:/home/user/openvpn-2.3.18# openssl
OpenSSL> version
OpenSSL 1.0.1 14 Mar 2012