Rocky 10

YubiKey OpenVPN

The following section describes how to configure OpenVPN on Rocky 10.1 Linux with an Idem Key Plus, TrustKey G310, or Yubikey 5 NFC FIPS.

Login to the machine as root. Install the packages that are required to build the PIV Tool. You will have to enable crb and epel-release.

dnf config-manager --set-enabled crb 

dnf install epel-release

dnf install gcc gcc-c++ cmake libtool openssl-devel pkgconf check check-devel pcsc-lite pcsc-lite-devel gengetopt help2man zlib-devel openvpn

Download the latest release of the Yubico PIV Tool from Yubico's website. Choose the option that ends with .tar.tgz. Untar the file and cd into the folder it creates. In this document, the latest version of the Yubico PIV Tool was 2.7.2.
```
cd yubico-piv-tool-2.7.2
```
Run the following commands to build the pkcs-11 provider.
```
mkdir build; cd build
cmake ..
make
sudo make install
```
Create and edit the strongkey.conf file.
```
vi /etc/ld.so.conf.d/strongkey.conf
```
In the strongkey.conf file, put the following string as its content:
```
/usr/local/lib64
```
Run the ldconfig command to create the correct links.
```
ldconfig
```
OpenVPN using a .p12 file loaded onto a Security Key is similar to regular OpenVPN on a Linux terminal. However, the client configuration file will be slightly different. It will look similar to this:
```
client
dev tun
proto tcp
remote 192.168.1.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 4
auth-nocache
cipher AES-256-GCM
tls-auth ta.key 1
ca cacert.pem
pkcs11-providers /usr/local/lib64/libykcs11.so.2.7.2
pkcs11-id 'pkcs11:model=YubiKey%20YK5;token=YubiKey%20PIV%20%2334648820;manufacturer=Yubico%20%28www.yubico.com%29;serial=34648820;id=%02'
```
Notice at the bottom that there is a pkcs11-providers field and a pkcs11-id field. These two fields and their contents will cause the OpenVPN client to request authentication using a specific Security Key.
The pkcs11-providers field should be filled in by the location of the Security Key provider’s PKCS 11 .so file. For YubiKey, the path should be /usr/local/lib64/libykcs11.so.2.7.2, and the file can be obtained by installing Yubico PIV Tool for Linux.
The pkcs11-id field will be filled in by the id of the Security Key. In order to obtain this, insert the Security Key into the computer and run this command in the terminal:
```
sudo openvpn --show-pkcs11-ids /usr/lib64/libykcs11.so.2.7.2
```
If the ID that this command gives you does not work, then you may have to use a different version of OpenVPN to get the correct ID. OpenVPN 2.7_rc6 was used to get the above ID.
After getting the pkcs11-id field and filling it in with the appropriate value, you can now use the configuration file to connect to the VPN.