It is possible to access services/resources of the institute from outside the institute by using VPN.

Resources available via VPN:

• internal webserver
• terminal servers
• SSH-Gateway

To use VPN you need a special software installed on your computer. This software is available for

• Windows 2000/XP/7
• Linux 
• Mac OS X.

To use VPN on insitute computers, please ask your department's IT staff to install this software and to issue a digital certificate for you.

Install and configure OpenVPN for Linux clients

1. Install openvpn on your Linux client by using the distribution package.

2. Obtain an OpenVPN certificate from your department's IT administrator.

3. Put all files belonging to the certificate into the /etc/openvpn directory:

• update-resolv-conf.suse  or
• update-resolv-conf.ubuntu
• MPI_EVAN_ca.crt
• MPI_EVAN_client.crt
• MPI_EVAN_client.key
• MPI_EVAN_enigma2_ta.key
• MPI_EVAN_suse.conf   or
• MPI_EVAN_ubuntu.conf

4. cd into /etc/openvpn and execute "sudo chmod 755 /etc/openvpn/udate-resolv-conf*"

5. To start OpenVPN tunnel one must have root privileges on the system to load and setup kernel modules and network interfaces.

6. cd into /etc/openvpn and excute openvpn MPI_EVAN_suse.conf or openvpn MPI_EVAN_ubuntu.conf depending on your linux distribution.

root@client:/etc/openvpn# openvpn MPI_EVAN_ubuntu.conf
Fri Mar  7 13:05:19 2008 OpenVPN 2.0.9 arm-angstrom-linux-gnueabi [SSL] [LZO] [EPOLL] built on Aug  6 2007
Fri Mar  7 13:05:19 2008 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Enter Private Key Password:
Fri Mar  7 13:05:21 2008 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Fri Mar  7 13:05:21 2008 LZO compression initialized
Fri Mar  7 13:05:21 2008 UDPv4 link local (bound): [undef]:1194
Fri Mar  7 13:05:21 2008 UDPv4 link remote: <IP-address of gateway>:1194
Fri Mar  7 13:05:23 2008 [OPENVPN-SERVER] Peer Connection Initiated with <IP-address of gateway>:1194
Fri Mar  7 13:05:24 2008 NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes.
Fri Mar  7 13:05:24 2008 TUN/TAP device tun0 opened
Fri Mar  7 13:05:24 2008 /sbin/ifconfig tun0 <IP-address> pointopoint <IP-address> mtu 1500
Fri Mar  7 13:05:24 2008 ./client.up.linux.sh tun0 1500 1558 <IP-address> <IP-address> init
Fri Mar  7 13:05:25 2008 Initialization Sequence Completed

Changing certificate password

root@client:/etc/openvpn# openssl rsa -aes256 <client.key >client.key.new
Enter pass phrase:
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
root@client:/etc/openvpn# mv client.key.new client.key

Download the most recent version of "Tunnelblick" from here and double click  to open it: Tunnelblick 3.3.beta21b

Install Tunnelblick

Start the installation by double-clicking at the Tunnelblick icon:

Open:

Install:

Launch:

Confirm the permission settings:

At the right top you will now find the Tunnelblick icon:

Copy your certificate and OpenVPN configuration files into ~/Library/Application Support/Tunnelblick/Configurations/

Starting the "tunnel"

Enter the passphrase.

If correctly done the tunnel icon changes its appearance.

Whenever you want to connect to the MPI-EVA just click at the tunnel icon. You may then use the Citrix Server (https://citrix.eva.mpg.de) or ssh-commands.

Changing certificate password

~# cd ~/Library/Application\ Support/Tunnelblick/Configurations/
~# openssl rsa -aes256 <MPI_EVAN_client.key >client.key.new

Enter pass phrase: OLD PASSWORD
Enter PEM pass phrase: NEW PASSWORD
Verifying - Enter PEM pass phrase: NEW PASSWORD

~# mv client.key.newMPI_EVAN_client.key