diff --git a/.gitignore b/.gitignore index a8b42eb..2ffe569 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,4 @@ *.retry +users/*.mobileconfig +users/*.p12 +users/*.crt diff --git a/common.yml b/common.yml index 396af7b..63a4707 100644 --- a/common.yml +++ b/common.yml @@ -23,6 +23,8 @@ - git - screen - apparmor-utils + - uuid-runtime + - coreutils - name: Enable packet forwarding for IPv4 sysctl: name=net.ipv4.ip_forward value=1 diff --git a/config.cfg b/config.cfg index 1ff0dcd..2348265 100644 --- a/config.cfg +++ b/config.cfg @@ -8,6 +8,7 @@ easyrsa_dir: /opt/easy-rsa-ipsec easyrsa_curve: secp384r1 easyrsa_ca_expire: 3650 easyrsa_cert_expire: 3650 +easyrsa_p12_export_password: vpn # if True re-init all existing certificates. Boolean easyrsa_reinit_existent: True diff --git a/templates/mobileconfig.j2 b/templates/mobileconfig.j2 new file mode 100644 index 0000000..fe8ba42 --- /dev/null +++ b/templates/mobileconfig.j2 @@ -0,0 +1,140 @@ + + + + + PayloadContent + + + IKEv2 + + AuthenticationMethod + Certificate + ChildSecurityAssociationParameters + + DiffieHellmanGroup + 19 + EncryptionAlgorithm + AES-128-GCM + IntegrityAlgorithm + SHA2-256 + LifeTimeInMinutes + 1440 + + DeadPeerDetectionRate + Medium + DisableMOBIKE + 0 + DisableRedirect + 0 + EnableCertificateRevocationCheck + 0 + EnablePFS + + IKESecurityAssociationParameters + + DiffieHellmanGroup + 19 + EncryptionAlgorithm + AES-128-GCM + IntegrityAlgorithm + SHA2-256 + LifeTimeInMinutes + 1440 + + LocalIdentifier + {{ item.0 }} + PayloadCertificateUUID + 1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 + RemoteAddress + {{ server_name }} + RemoteIdentifier + {{ server_name }} + UseConfigurationAttributeInternalIPSubnet + 0 + + IPv4 + + OverridePrimary + 1 + + PayloadDescription + Configures VPN settings + PayloadDisplayName + VPN + PayloadIdentifier + com.apple.vpn.managed.D247A30B-6023-4C8E-B3E3-FF1910A65E53 + PayloadType + com.apple.vpn.managed + PayloadUUID + D247A30B-6023-4C8E-B3E3-FF1910A65E53 + PayloadVersion + 1 + Proxies + + HTTPEnable + 0 + HTTPSEnable + 0 + + UserDefinedName + {{ server_name }} IKEv2 + VPNType + IKEv2 + + + Password + {{ easyrsa_p12_export_password }} + PayloadCertificateFileName + {{ item.0 }}.p12 + PayloadContent + + {{ item.1.stdout }} + + PayloadDescription + Adds a PKCS#12-formatted certificate + PayloadDisplayName + {{ item.0 }}.p12 + PayloadIdentifier + com.apple.security.pkcs12.1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 + PayloadType + com.apple.security.pkcs12 + PayloadUUID + 1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 + PayloadVersion + 1 + + + PayloadCertificateFileName + ca.crt + PayloadContent + + {{ PayloadContentCA.stdout }} + + PayloadDescription + Adds a CA root certificate + PayloadDisplayName + {{ server_name }} + PayloadIdentifier + com.apple.security.root.32EA3AAA-D19E-43EF-B357-608218745A38 + PayloadType + com.apple.security.root + PayloadUUID + 32EA3AAA-D19E-43EF-B357-608218745A38 + PayloadVersion + 1 + + + PayloadDisplayName + {{ server_name }} IKEv2 + PayloadIdentifier + donut.local.37CA79B1-FC6A-421F-960A-90F91FC983BE + PayloadRemovalDisallowed + + PayloadType + Configuration + PayloadUUID + 743B04A8-5725-45A2-B1BB-836F8C16DB0A + PayloadVersion + 1 + + diff --git a/users/.gitinit b/users/.gitinit new file mode 100644 index 0000000..e69de29 diff --git a/users/mr.smith b/users/mr.smith new file mode 100644 index 0000000..e9e4819 --- /dev/null +++ b/users/mr.smith @@ -0,0 +1 @@ +qwe11 diff --git a/users/mrs.smith b/users/mrs.smith new file mode 100644 index 0000000..e62415c --- /dev/null +++ b/users/mrs.smith @@ -0,0 +1 @@ +qwe diff --git a/users/qwe b/users/qwe new file mode 100644 index 0000000..1241a80 Binary files /dev/null and b/users/qwe differ diff --git a/vpn.yml b/vpn.yml index 358cea9..0e9f01e 100644 --- a/vpn.yml +++ b/vpn.yml @@ -67,7 +67,7 @@ notify: - restart strongswan - - name: Build the server pair + - name: Build the server pair # TODO: IP and DNS for sertificate shell: | ./easyrsa build-server-full {{ server_name }} nopass touch '{{ easyrsa_dir }}/easyrsa3/pki/server_initialized' @@ -88,13 +88,13 @@ - name: Build the client's p12 shell: | - openssl pkcs12 -in {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt -inkey {{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.key -export -name {{ item }} -out /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 -certfile {{ easyrsa_dir }}/easyrsa3//pki/ca.crt -passout pass:vpn + openssl pkcs12 -in {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt -inkey {{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.key -export -name {{ item }} -out /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 -certfile {{ easyrsa_dir }}/easyrsa3//pki/ca.crt -passout pass:{{ easyrsa_p12_export_password }} touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_p12_initialized' args: chdir: '{{ easyrsa_dir }}/easyrsa3/' creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_p12_initialized' with_items: "{{ users }}" - + - name: Copy the CA cert to the strongswan directory copy: remote_src=True src='{{ easyrsa_dir }}/easyrsa3/pki/ca.crt' dest=/etc/ipsec.d/cacerts/ca.crt owner=root group=root mode=0600 notify: @@ -109,20 +109,38 @@ copy: remote_src=True src='{{ easyrsa_dir }}/easyrsa3/pki/private/{{ server_name }}.key' dest=/etc/ipsec.d/private/{{ server_name }}.key owner=root group=root mode=0600 notify: - restart strongswan + + - name: Register p12 PayloadContent + shell: > + cat /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 | base64 + register: PayloadContent + with_items: "{{ users }}" + + - name: Register CA PayloadContent + shell: > + cat /{{ easyrsa_dir }}/easyrsa3/pki/ca.crt | base64 + register: PayloadContentCA + + - name: Build the mobileconfigs + template: src=mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600 + with_together: + - "{{ users }}" + - "{{ PayloadContent.results }}" + + - name: Fetch users P12 + fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 dest=users/{{ server_name }}_{{ item }}.p12 flat=yes + with_items: "{{ users }}" + + - name: Fetch users mobileconfig + fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.mobileconfig dest=users/{{ server_name }}_{{ item }}.mobileconfig flat=yes + with_items: "{{ users }}" + + - name: Fetch server CA certificate + fetch: src=/{{ easyrsa_dir }}/easyrsa3/pki/ca.crt dest=users/{{ server_name }}_ca.crt flat=yes handlers: - name: restart strongswan service: name=strongswan state=restarted - name: restart apparmor - service: name=apparmor state=restarted - - - - - - - - - - + service: name=apparmor state=restarted