Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create
Terraform will perform the following actions:
# alicloud_instance.instance will be created + resource "alicloud_instance" "instance" { + availability_zone = "cn-hongkong-b" + credit_specification = (known after apply) + deletion_protection = false + deployment_set_group_no = (known after apply) + dry_run = false + host_name = (known after apply) + id = (known after apply) + image_id = "centos_7_6_x64_20G_alibase_20211130.vhd" + instance_charge_type = "PostPaid" + instance_name = "tf-npvonepo" + instance_type = "ecs.t6-c1m1.large" + internet_charge_type = "PayByTraffic" + internet_max_bandwidth_in = (known after apply) + internet_max_bandwidth_out = 10 + key_name = (known after apply) + password = (sensitive value) + private_ip = (known after apply) + public_ip = (known after apply) + role_name = (known after apply) + secondary_private_ip_address_count = (known after apply) + secondary_private_ips = (known after apply) + security_groups = (known after apply) + spot_strategy = "NoSpot" + status = (known after apply) + subnet_id = (known after apply) + system_disk_category = "cloud_essd" + system_disk_performance_level = (known after apply) + system_disk_size = 40 + volume_tags = (known after apply) + vswitch_id = (known after apply) }
# alicloud_security_group.group will be created + resource "alicloud_security_group" "group" { + description = "npvonepo" + id = (known after apply) + inner_access = (known after apply) + inner_access_policy = (known after apply) + name = "tf_npvonepo" + security_group_type = "normal" + vpc_id = (known after apply) }
# alicloud_security_group_rule.allow_nvp_tcp will be created + resource "alicloud_security_group_rule" "allow_npv_tcp" { + cidr_ip = "0.0.0.0/0" + id = (known after apply) + ip_protocol = "tcp" + nic_type = "intranet" + policy = "accept" + port_range = "22/22" + prefix_list_id = (known after apply) + priority = 1 + security_group_id = (known after apply) + type = "ingress" }
# alicloud_security_group_rule.allow_npv_udp will be created + resource "alicloud_security_group_rule" "allow_npv_udp" { + cidr_ip = "0.0.0.0/0" + id = (known after apply) + ip_protocol = "udp" + nic_type = "intranet" + policy = "accept" + port_range = "8192/8192" + prefix_list_id = (known after apply) + priority = 1 + security_group_id = (known after apply) + type = "ingress" }
# alicloud_vpc.vpc will be created + resource "alicloud_vpc" "vpc" { + cidr_block = "172.16.0.0/16" + id = (known after apply) + ipv6_cidr_block = (known after apply) + name = (known after apply) + resource_group_id = (known after apply) + route_table_id = (known after apply) + router_id = (known after apply) + router_table_id = (known after apply) + status = (known after apply) + vpc_name = "tf-npvonepo" }
# alicloud_vswitch.vswitch will be created + resource "alicloud_vswitch" "vswitch" { + availability_zone = (known after apply) + cidr_block = "172.16.0.0/24" + id = (known after apply) + name = (known after apply) + status = (known after apply) + vpc_id = (known after apply) + vswitch_name = "tf-onpvonepo" + zone_id = "cn-hongkong-b" }
Plan: 6 to add, 0 to change, 0 to destroy.
Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve.
Enter a value: yes
alicloud_vpc.vpc: Creating... alicloud_vpc.vpc: Creation complete after 6s [id=vpc-j6cc7lkzgg05tupe1h1bd] alicloud_security_group.group: Creating... alicloud_vswitch.vswitch: Creating... alicloud_security_group.group: Creation complete after 2s [id=sg-j6c1qkz2y3t3pwphv8hj] alicloud_security_group_rule.allow_npv_udp: Creating... alicloud_security_group_rule.allow_npv_tcp: Creating... alicloud_security_group_rule.allow_npv_tcp: Creation complete after 0s [id=sg-j6c1qkz2y3t3pwphv8hj:ingress:tcp:22/22:intranet:0.0.0.0/0:accept:1] alicloud_security_group_rule.allow_npv_udp: Creation complete after 0s [id=sg-j6c1qkz2y3t3pwphv8hj:ingress:udp:8192/8192:intranet:0.0.0.0/0:accept:1] alicloud_vswitch.vswitch: Creation complete after 6s [id=vsw-j6cc8h304tnv2beg9bmep] alicloud_instance.instance: Creating... alicloud_instance.instance: Still creating... [10s elapsed] alicloud_instance.instance: Creation complete after 13s [id=i-j6c9jstyznznykk4o42j]
[root@iZj6cgggpr8nezr166qvdsZ ~]# cd /etc/npvonepo/easy-rsa/easyrsa3/ [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ll total 168 -rwxr-xr-x 1 root root 145939 Oct 31 21:53 easyrsa -rw-r--r-- 1 root root 5043 Oct 31 21:53 openssl-easyrsa.cnf -rw-r--r-- 1 root root 8688 Oct 31 21:53 vars.example drwxr-xr-x 2 root root 4096 Oct 31 21:53 x509-types
# 复制样例变量文件 [root@iZj6cgggpr8nezr166qvdsZ easyrsa3]# cp vars.example vars [root@iZj6cgggpr8nezr166qvdsZ easyrsa3]# egrep -v '^$^#' vars if [ -z "$EASYRSA_CALLER" ]; then echo "You appear to be sourcing an Easy-RSA *vars* file." >&2 echo "This is no longer necessary and is disallowed. See the section called" >&2 echo "*How to use this file* near the top comments for more details." >&2 return 1 fi set_var EASYRSA_REQ_COUNTRY "CN" set_var EASYRSA_REQ_PROVINCE "GuangDong" set_var EASYRSA_REQ_CITY "Guangzhou" set_var EASYRSA_REQ_ORG "My_Org" set_var EASYRSA_REQ_EMAIL "xadocker@xadocker.cn" set_var EASYRSA_REQ_OU "Xadocker_NPVnepO"
Notice ------ 'init-pki' complete; you may now create a CA or requests.
Your newly created PKI dir is: * /etc/npvonepo/easy-rsa/easyrsa3/pki
* Using Easy-RSA configuration: /etc/npvonepo/easy-rsa/easyrsa3/vars
* The preferred location for 'vars' is within the PKI folder. To silence this message move your 'vars' file to your PKI or declare your 'vars' file with option: --vars=<FILE>
* Using x509-types directory: /etc/npvonepo/easy-rsa/easyrsa3/x509-types
# 开始创建ca证书 [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa build-ca * Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
* Using Easy-RSA configuration: /etc/npvonepo/easy-rsa/easyrsa3/vars
* The preferred location for 'vars' is within the PKI folder. To silence this message move your 'vars' file to your PKI or declare your 'vars' file with option: --vars=<FILE>
Enter New CA Key Passphrase: # 自行输入CA密码（xadocker） Re-Enter New CA Key Passphrase: # 自行输入CA密码（xadocker） .................................................................+++ ........................................+++ You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:xadocker
Notice ------ CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/npvonepo/easy-rsa/easyrsa3/pki/ca.crt
# 创建服务端证书 [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa gen-req server nopass * Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
* Using Easy-RSA configuration: /etc/npvonepo/easy-rsa/easyrsa3/vars
* The preferred location for 'vars' is within the PKI folder. To silence this message move your 'vars' file to your PKI or declare your 'vars' file with option: --vars=<FILE>
Generating a 2048 bit RSA private key ............................................................................................................................+++ ......+++ writing new private key to '/etc/npvonepo/easy-rsa/easyrsa3/pki/a32dfe73/temp.c2d3a3fb' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [server]:xadockernpv
Notice ------ Keypair and certificate request completed. Your files are: req: /etc/npvonepo/easy-rsa/easyrsa3/pki/reqs/server.req key: /etc/npvonepo/easy-rsa/easyrsa3/pki/private/server.key
# 用CA证书签证服务端证书 [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa sign server server * Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
* Using Easy-RSA configuration: /etc/npvonepo/easy-rsa/easyrsa3/vars
* The preferred location for 'vars' is within the PKI folder. To silence this message move your 'vars' file to your PKI or declare your 'vars' file with option: --vars=<FILE>
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 825 days:
subject= commonName = xadockernpv
Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes
Using configuration from /etc/npvonepo/easy-rsa/easyrsa3/pki/safessl-easyrsa.cnf.init-tmp Enter pass phrase for /etc/npvonepo/easy-rsa/easyrsa3/pki/private/ca.key: # 输入上面配置CA密码（xadocker） Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'xadockernpv' Certificate is to be certified until Feb 2 14:00:46 2025 GMT (825 days)
Write out database with 1 new entries Data Base Updated
Notice ------ Certificate created at: /etc/npvonepo/easy-rsa/easyrsa3/pki/issued/server.crt
# 服务端证书加密 [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa gen-dh ....................................+............................................................. DH parameters appear to be ok.
Notice ------
DH parameters of size 2048 created at: /etc/npvonepo/easy-rsa/easyrsa3/pki/dh.pem
Notice ------ 'init-pki' complete; you may now create a CA or requests.
Your newly created PKI dir is: * /root/client/easy-rsa/easyrsa3/pki
* Using Easy-RSA configuration:
* IMPORTANT: Easy-RSA 'vars' template file has been created in your new PKI. Edit this 'vars' file to customise the settings for your PKI.
* Using x509-types directory: /root/client/easy-rsa/easyrsa3/x509-types
# 创建客户端证书 [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa gen-req user_xad * Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
* Using Easy-RSA configuration: /root/client/easy-rsa/easyrsa3/pki/vars
Generating a 2048 bit RSA private key ..+++ ...............+++ writing new private key to '/root/client/easy-rsa/easyrsa3/pki/a709fe24/temp.98dc8708' Enter PEM pass phrase: # 设置客户端密码 Verifying - Enter PEM pass phrase: # 设置客户端密码 ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [user_xad]:user_xad
Notice ------ Keypair and certificate request completed. Your files are: req: /root/client/easy-rsa/easyrsa3/pki/reqs/user_xad.req key: /root/client/easy-rsa/easyrsa3/pki/private/user_xad.key
# 用CA证书签证客户端证书 [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# cd /etc/npvonepo/easy-rsa/easyrsa3/ [root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa import-req /root/client/easy-rsa/easyrsa3/pki/reqs/user_xad.req user_xad * Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
* Using Easy-RSA configuration: /etc/npvonepo/easy-rsa/easyrsa3/vars
* The preferred location for 'vars' is within the PKI folder. To silence this message move your 'vars' file to your PKI or declare your 'vars' file with option: --vars=<FILE>
Notice ------ The request has been successfully imported with a short name of: user_xad You may now use this name to perform signing operations on this request.
[root@iZj6c9jstyznznykk4o42jZ easyrsa3]# ./easyrsa sign client user_xad * Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
* Using Easy-RSA configuration: /etc/npvonepo/easy-rsa/easyrsa3/vars
* The preferred location for 'vars' is within the PKI folder. To silence this message move your 'vars' file to your PKI or declare your 'vars' file with option: --vars=<FILE>
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 825 days:
subject= commonName = user_xad
Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes
Using configuration from /etc/npvonepo/easy-rsa/easyrsa3/pki/safessl-easyrsa.cnf.init-tmp Enter pass phrase for /etc/npvonepo/easy-rsa/easyrsa3/pki/private/ca.key: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'user_xad' Certificate is to be certified until Feb 2 14:09:20 2025 GMT (825 days)
Write out database with 1 new entries Data Base Updated
Notice ------ Certificate created at: /etc/npvonepo/easy-rsa/easyrsa3/pki/issued/user_xad.crt
[root@iZj6c9jstyznznykk4o42jZ ~]# sysetmctl daemon [root@iZj6c9jstyznznykk4o42jZ ~]# systemctl daemon-reload [root@iZj6c9jstyznznykk4o42jZ ~]# systemctl restart npvonepo@server [root@iZj6c9jstyznznykk4o42jZ ~]# systemctl status npvonepo@server ● npvonepo@server.service - NPVnepO Robust And Highly Flexible Tunneling Application On server Loaded: loaded (/usr/lib/systemd/system/npvonepo@server.service; disabled; vendor preset: disabled) Active: active (running) since Mon 2022-10-31 23:18:53 CST; 7s ago Process: 27507 ExecStart=/usr/local/sbin/npvonepo--cd /etc/npvonepo/ --config %i.conf --daemon (code=exited, status=0/SUCCESS) Main PID: 27508 (npvonepo) CGroup: /system.slice/system-npvonepo.slice/npvonepo@server.service └─27508 /usr/local/sbin/npvonepo --cd /etc/npvonepo/ --config server.conf --daemon
Oct 31 23:18:53 iZj6c9jstyznznykk4o42jZ systemd[1]: Starting NPVnepO Robust And Highly Flexible Tunneling Application On server... Oct 31 23:18:53 iZj6c9jstyznznykk4o42jZ npvonepo [27507]: 2022-10-31 23:18:53 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent ...is also set. Oct 31 23:18:53 iZj6c9jstyznznykk4o42jZ systemd[1]: Started NPVnepO Robust And Highly Flexible Tunneling Application On server. Hint: Some lines were ellipsized, use -l to show in full.
# 也可以通过tunip或内网ip连接服务器 31/10/2022 22:28.45 /home/mobaxterm ssh root@10.8.0.1 Warning: Permanently added '10.8.0.1' (RSA) to the list of known hosts. root@10.8.0.1's password:
31/10/2022 22:31.27 /home/mobaxterm ssh root@172.16.0.157 Warning: Permanently added '172.16.0.157' (RSA) to the list of known hosts. root@172.16.0.157's password:
# 连接其他内网服务器 31/10/2022 22:37.11 /home/mobaxterm ssh root@172.16.0.158 Warning: Permanently added '172.16.0.158' (RSA) to the list of known hosts. root@172.16.0.158's password:
