# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Hive Infrastructure Installation and Configuration Guide

11 November, 2012

- 1
- 2
…
- 12
- 13
- 14
- 15
- 16
- 17
- 18

SECRET//NOFORN
(S//NF) Blot Proxy Hive Infrastructure Configuration Guide
chkconfig --levels 2345 openvpn on
(S//NF) Then verify that it will be on in runlevels 2, 3, 4, and 5.
chkconfig --list openvpn
4.3.2 (S//NF) Key Generation
(S//NF) Generate the master Certificate Authority (CA) certificate and key on a secure host apart from
the Blot and VPS proxies. This is done using the source code directory tree. After installing the source
code, go to the easy-rsa/2.0 directory and edit the vars file. This file contains a number of variables that
will need to be changed before generating the CA certificates and keys. After editing this file, execute
the following commands:
$ . ./vars
$ ./clean-all
$ ./build-ca
$ ./build-key-server server
$ ./build-key client1
$ ./build-key client2
.
.
$ ./build-dh
(S//NF) The following files are generated:
Filename Needed By Purpose Secret?
ca.crt Blot + all VPS clients Root CA certificate No
ca.key Key signing host only Root CA key Yes
dh{n}.pem Blot only Diffie Hellman parameters No
Server.crt Blot only Server Certificate No
Server.key Blot only Server Key Yes
Client1.crt VPS1 only Client1 Certificate No
Client1.key VPS1 only Client 1 Key Yes
. . . .
Clientn.crt VPSn only Clientn Certificate No
Clientn.key VPSn only Clientn Key Yes
(S//NF) Distribute the keys to the /etc/openvpn directory on the appropriate hosts.
4.3.3 (S//NF) Blot-Side Configuration
(S//NF) Edit the server.conf file in /etc/openvpn. Keep the defaults, but check the following parameters
and make changes if necessary.
port 1194
proto tcp
/dev/tun
8 SECRET//NOFORN//20371105 November 2012

- 1
- 2
…
- 12
- 13
- 14
- 15
- 16
- 17
- 18