安装过程
yum install epel-release
yum install ocserv
mkdir anyconnect
cd anyconnect
生成ca证书
$ certtool --generate-privkey --outfile ca-key.pem
$ cat >ca.tmpl < cn = "a.speedphp.com" organization = "SP Corp" serial = 1 expiration_days = 3650 ca signing_key cert_signing_key crl_signing_key EOF $ certtool --generate-self-signed --load-privkey ca-key.pem \ --template ca.tmpl --outfile ca-cert.pem $ cp ca-cert.pem /etc/pki/ocserv/cacerts 生成服务器证书 $ certtool --generate-privkey --outfile server-key.pem $ cat >server.tmpl < cn = "a.speedphp.com" organization = "SP Corp" serial = 2 expiration_days = 3650 encryption_key signing_key tls_www_server EOF $ certtool --generate-certificate --load-privkey server-key.pem \ --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem \ --template server.tmpl --outfile server-cert.pem $ cp server-cert.pem /etc/pki/ocserv/public/server.crt $ cp server-key.pem /etc/pki/ocserv/private/server.key 生成本地服务器证书(如果不用证书登录，此步骤可以不做） 创建 gen-client-cert.sh，并将下面内容复制进去 #!/bin/bash USER=$1 CA_DIR=$2 SERIAL=`date +%s` certtool --generate-privkey --outfile $USER-key.pem cat << _EOF_ >user.tmpl cn = "$USER" unit = "users" serial = "$SERIAL" expiration_days = 9999 signing_key tls_www_client _EOF_ certtool --generate-certificate --load-privkey $USER-key.pem --load-ca-certificate $CA_DIR/ca-cert.pem --load-ca-privkey $CA_DIR/ca-key.pem --template user.tmpl --outfile $USER-cert.pem openssl pkcs12 -export -inkey $USER-key.pem -in $USER-cert.pem -name "$USER VPN Client Cert" -certfile $CA_DIR/ca-cert.pem -out $USER.p12 创建用户文件夹并调用 gen-client-cert.sh 生成证书 $ mkdir user $ cd user # user 指的是用户名，.. 指的是 ca 证书所在的目录 $ ../gen-client-cert.sh user .. # 按提示设置证书使用密码，或直接回车不设密码 最后，通过 http 服务器或其他方式将 user.p12 传输给客户端导入即可 配置 ocserv, 配置文件/etc/ocserv/ocserv.conf auth = "plain[passwd=/etc/ocserv/ocpasswd]” tcp-port = 4433 udp-port = 4433 max-clients = 16 max-same-clients = 16 #以下默认 server-cert = /etc/pki/ocserv/public/server.crt server-key = /etc/pki/ocserv/private/server.key ca-cert = /etc/pki/ocserv/cacerts/ca.crt #以下开启 compression = true no-compress-limit = 256 ipv4-network = 192.168.1.0 ipv4-netmask = 255.255.255.0 dns = 8.8.8.8 配置文件到此 建用户 $ sudo ocpasswd -c /etc/ocserv/ocpasswd 用户名 开启内核转发 $ echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf $ sysctl -p /etc/sysctl.conf 配置防火墙规则，放行端口，如果有的话 自启动 systemctl enable ocserv systemctl start ocserv systemctl restart ocserv 现在已经改为域名登录了。