Commit Graph

413 Commits (1083b4bb978f274ef83a3d4170312364eb9f7bc0)

Author SHA1 Message Date
Federico G. Schwindt a4f2c97fd2 Fix ipv4 address missing on reboot (#1245) 6 years ago
David Myers 66681521c1 Increase memory limit for dnsmasq (#1228)
* Increase memory limit for dnsmasq

* Increase memory limit for dnsmasq further
6 years ago
David Myers 8d23f715d7 Run adblock.sh at a random time (#1227) 6 years ago
David Myers 22395f5f84 Add p12 password back to mobileconfigs (#1218) 6 years ago
Jack Ivanov a66d8f0069 on-build python venvs (#1199) 6 years ago
Jack Ivanov 9187d8e637 dnscrypt-proxy apparmor fix (#1210)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Apparmor profile for dnscrypt-proxy didn't work at all

## Motivation and Context
Fixes #1155

## How Has This Been Tested?
Deployed to DigitalOcean, checked that the dnscrypt-proxy binary is in enforce mode

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] All new and existing tests passed.
6 years ago
Jack Ivanov 45b00ee994
BSD StrongSwan fixes (#1207) 6 years ago
Jack Ivanov 66d30e3005
WireGuard update-users fix (#1183) 6 years ago
TC1977 a76642c4d5 Update mobileconfig.j2 (#1197)
Adds "Algo VPN" to the organization in the "Profiles" menu of "General Settings". (The type still shows up as "Unknown" in the "VPN" menu, because that seems to be governed by the "VPNSubType" string, which must be empty according to the [developer reference](https://developer.apple.com/enterprise/documentation/Configuration-Profile-Reference.pdf) Maybe this can help clear the way for #1101.
6 years ago
zuccs 2b2d90a8a9 Fix typo (#1165) 6 years ago
datew0 30446d0363 Set disk size depending on server plan (#1159)
Scaleway`s START1-XS does not start with a disk size of 50GB.
6 years ago
Jack Ivanov 399d47233a
add region (#1182) 6 years ago
Jack Ivanov 3468d27e61 Lightsail back (#1157) 6 years ago
Jack Ivanov fbc7b29456 WireGuard update-users fix (#1154) 6 years ago
Jack Ivanov efc8dc7620
add tags for the wireguard qr code task. variables fix (#1147) 6 years ago
Jack Ivanov bcba905547 ssh tunneling fixes (#1127) 6 years ago
David Myers d90ba3d11a Allow more flexible DNSCrypt configuration (#1120)
* Allow more flexible DNSCrypt configuration

* Correct permissions on files changed in #1120

I'm not sure why using BBEdit over SMB makes every file executable.

* Put the public resolvers cache file in /tmp.
6 years ago
Jack Ivanov 1442586682 WireGuard: Generate QR codes (#1129)
* WireGuard: Generate QR codes

* Update client-android.md
6 years ago
Jack Ivanov dbd68aa97d WireGuard BSD (#1083)
* WireGuard BSD

* Remove unneeded config option

* Enable PersistentKeepalive for NAT and Firewall Traversal Persistence

* Install dnscrypt-proxy from repositories
6 years ago
Jack Ivanov 6c0753e3b8 GCE: Static external ip (optional) (#1125) 6 years ago
Jack Ivanov eb2224cde1
install generic linux headers (#1124) 6 years ago
James 14234344eb Use gateway ip address for wireguard interface (#1115) 6 years ago
Jack Ivanov 4a42fbea35 Move to the ARM deployment schema (#1107) 6 years ago
David Myers d95df710a5 Add an unattended reboot option (#1082) 6 years ago
Jack Ivanov 91a9dfd983 invoke dns encryption from main playbook instead of meta-dependencies (#1097) 6 years ago
Jack Ivanov e860b78d80
Scaleway authentication fix (#1088) 6 years ago
Jack Ivanov e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
6 years ago
Jack Ivanov 53d1113881 Split up unattended upgrades (#1041) 6 years ago
David Myers b86ebe20d7 Prevent DNS rebinding (#1049) 6 years ago
Fabian Foerg 3ddd0ac30f Run dnsmasq as the dnsmasq user (#1029)
* Run dnsmasq as the dnsmasq user

There is a task that checks whether the dnsmasq user exists.
However, dnsmasq is configured to run as user "nobody" instead.
This change lets dnsmasq run as user "dnsmasq".

* remove dnsmasq user task
6 years ago
bghost 60a99faaf8 Update PPA for dnscrypt-proxy to 'bionic' (#1039) 6 years ago
Jack Ivanov ca59eeb5c3 Explicitly allow traffic between clients if enabled (#1028) 6 years ago
Jack Ivanov 952e759af4
Revert "Update dnscrypt-proxy.toml.j2 (#1022)" (#1030)
This reverts commit e6281bc7df.
6 years ago
adamluk e6281bc7df Update dnscrypt-proxy.toml.j2 (#1022) 6 years ago
Jack Ivanov 07a6bbe652
Move max_mss to config.cfg (#1015)
* Move max_mss to config.cfg

* Add docs about max_mss

* Update troubleshooting.md
6 years ago
Jack Ivanov d1c58f0d28
apt_repository fix (#1017) 6 years ago
Jack Ivanov 4ca8c03e3c New default cipher suite (#991)
* New ciphers enabled

* Update CHANGELOG.md

* Switch ecparam to secp384r1

* Change CertificateType to ECDSA384
6 years ago
Jack Ivanov b061df6631
Move DNSCrypt proxy fallback_resolver to systemd resolved (#1011) 6 years ago
Emir Beganović 2f142f6dcc Remove duplicate dict key (enable_ipv6) (#999)
Warning in yaml file:
` [WARNING]: While constructing a mapping from /root/algo/roles/cloud-scaleway/tasks/main.yml, line 73, column 11, found a duplicate dict key (enable_ipv6). Using last defined value only.`
6 years ago
Jack Ivanov ffb5a1f737 WireGuard: disable SaveConfig, update-users fix (#985)
- Disables SaveConfig. SaveConfig totally breaks the idea of configuration management and it breaks update-users
- WireGuard update-users fix. Mentioned in https://github.com/trailofbits/algo/issues/980#issuecomment-393720561
6 years ago
Jack Ivanov aee043977f explicit installation of linux headers (#975) 6 years ago
Jack Ivanov 2d9a36d13a Scaleway: enable ipv6 and switch to local boot (#974)
- Enables IPv6 on Scaleway
- Adds local boot on scaleway
- Fixes #966
6 years ago
Jack Ivanov d56f50180b Extra line and better DNS configuration for WireGuard (#968)
- Adds an extra line after the if statement. Jinja2 trims such blocks by default in Ansible. Fixes #965
- More appropriate way to configure DNS servers
- Removes `DNS` option from the wireguard server config
- Fixes dnscrypt-proxy restart
6 years ago
Jack Ivanov 3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
6 years ago
Jack Ivanov d27b849f24 Ubuntu1804 (#925)
- Fixes #897 #944 #956

Work in progress. Lightsail is not ready for Ubuntu 18.04 yet

- [x] DigitalOcean
~~- [ ] Amazon Lightsail~~
- [x] Amazon EC2
- [x] Microsoft Azure
- [x] Google Compute Engine
- [x] Scaleway
- [x] OpenStack (DreamCompute optimised)
6 years ago
Evgeny Aleksandrov d9dc68164f Remove algo_params (#961) 6 years ago
Evgeny Aleksandrov 87836e0358 Fix typo (#960) 6 years ago
Jack Ivanov 35e526a5a3 IPv6 fixes (#930) 6 years ago
Brian Hulette e01e82b1c3 Don't download minisig dnscrypt release (#905) 7 years ago
adamluk 3d9fa7f8c8 Update dnscrypt-proxy.toml.j2 (#899)
Updated dnscrypt-proxy.tml with new options: cache_neg_min_ttl and cache_neg_max_ttl
7 years ago
Dan Guido c276f971b7
monkey patch problematic dnscrypt-proxy cgroup limits (#894) 7 years ago
Jack Ivanov c82bd8c5ff DNS-over-HTTPS (#875) 7 years ago
Jack Ivanov ed6e2d998d Add ipv6 address to subjectAltName if supported (#881)
CHANGELOG

Some changes

Some changes
7 years ago
Micah R Ledbetter e944ee993a Embed certs into Windows deployment scripts (#840)
- Obviate need to copy separate script and certificate files
- Allow execution from any directory, not just the script's parent
  directory (no assumption of any particular working directory)
- Fix docs that neglected to mention copying cacert.pem
- Fix docs that incorrectly referred to the user cert store

As part of this work, rewrite the windows_client.ps1.j2 deployment
script template

- Add comment-based help
- Require admin privileges
- Use a Param() block
- Use parameter sets with -Add and -Remove switches
- Add the -GetInstalledCerts switch, to list any Algo certificates
  installed the machine's cert store
- Add the -SaveCerts switch, to save the embedded certificates to files
- Put Jinja2 variables inside Powershell variables,
- Use native Powershell cmdlets rather than shell out to certutil.exe
- Add a playbook to regenerate the windows_USER.ps1 scripts
7 years ago
Micah R Ledbetter 4b0aea8f5a Document iptables rules (#854)
* Remove firewall rule related to the old proxy role

* Remove proxy conditionals from mobileconfig template

* Add comments explaining firewall rules
7 years ago
Jack Ivanov 78830d96aa Android: add the CA and set the ciphers explicitly (#837) 7 years ago
Jack Ivanov 4e4440a318 Exclude CA from P12 (#835) 7 years ago
Jack Ivanov 3b19f13082 Enable no-resolv (#816) 7 years ago
adamluk b30f6db079 Update rules.v6.j2 (#818)
Updated to use -m conntrack for consistency as per the other IPv6 rules.
7 years ago
Jack Ivanov 7e07c35474 proper cloudformation template (#815) 7 years ago
Jack Ivanov 02427910de Ansible 2.4, Lightsail, Scaleway, DreamCompute (OpenStack) integration (#804)
* Move to ansible-2.4.3

* Add Lightsail support #623

* Fixing the EC2 deployment

* Scaleway integration #623

* OpenStack cloud provider (DreamCompute optimised) #623

* Remove the security role

* Enable unattended-upgrades for clouds

* New requirements to make Azure and GCE work
7 years ago
Jack Ivanov 4da752b603 Ubuntu 17.10 support (#811) 7 years ago
Micah R Ledbetter 5eed1bbba4 Use dns_servers in dnsmasq.conf (#794) 7 years ago
Douglas Gastonguay-Goddard 7eb4fc5f22 DigitalOcean - Add cleanup step for SSH key (#784)
* Add cleanup step for SSH key.

* Two space tabs are hard to see.
7 years ago
Jack Ivanov a844870b7a Sendmail should not be installed (#738) 7 years ago
Marcelo Elizeche Landó 07a1c70bf4 Update adblock.sh for systemd to fix issue #735 (#736)
* Update script to restart the dnsmasq service using systemctl(systemd) command instead of service(Upstart)

* Use  instead of legacy  REF: https://github.com/koalaman/shellcheck/wiki/SC2006

* Replace non-standard egrep(deprecated) for grep -E. REF: https://github.com/koalaman/shellcheck/wiki/SC2196
7 years ago
Jack Ivanov f18c1a0d67 Certificate revocation fix (#719) 7 years ago
Jack Ivanov b64f682bae remove the dead code. Fixes #671 7 years ago
Jurgen Verhasselt 185c0f51d7 correct configs_prefix vars in client tasks (#712) 7 years ago
Julie Bernosky dc4dff040e Add StrongSwan log level config option to ipsec.conf template (#700) 7 years ago
Jack Ivanov 3c55cd15a4 GCE. replace underscores (#698) 7 years ago
Jack Ivanov ee7264f26e Ask users to enter the p12 password manually (#697) 7 years ago
Jack Ivanov 6b803e069f LibreSSL fix #625 (#685) 7 years ago
Jack Ivanov 8da53f859b Some browsers (eg. Safari) stop loading pages if the element with ads can't be loaded (#633) 7 years ago
Samuel Horwitz 0607e968d7 Update main.yml (#621) 7 years ago
Jack Ivanov 0bb9279094 bug in the gce_net module #616 (#620) 7 years ago
Jack Ivanov 78bd5b017c client fixes (#605) 7 years ago
Jack Ivanov 9d8e39f63d Move back to the Xenial repo (#606) 7 years ago
Jack Ivanov f0283856ad fix revocation (#586) 7 years ago
Jack Ivanov a8ebb16437 Enable timeouts. Fixes #581 7 years ago
Jack Ivanov 26c202ded5 Generate p12 each deployment. Generate ps1 scripts if windows supported. Define `become` for all the section. (#580) 7 years ago
Jack Ivanov ba7859ba5f Revoke non-existing users fix 7 years ago
Jack Ivanov 0131505195 Enhance PS1 script (#510)
update docs

Update README.md

update readme
7 years ago
Jack Ivanov e6c8f19d3c Create a VPC network for each instane (#561) 7 years ago
Jack Ivanov ee6db37428 Change the P12 and SSH passwords only for new users (#550) 7 years ago
Jack Ivanov 40e0363b18 Add html helper for Android (#554)
* add html helper #280

move to the new local schema

fix a typo

* Update client-android.md
7 years ago
Ruben Jongejan e9e6c6e383 cleaner syntax for local actions (#536)
* refactored local actions to cleaner syntax

* openssl commands folded

* removed unnecessary local_action's
7 years ago
Rod Vagg 75d64ac018 Make DNS blocklist URLs configurable (#548) 7 years ago
tetov ac6db06a19 grammar edit (#540)
* grammar edit

* Update openssl.yml
7 years ago
Jack Ivanov 58d5a06e87 delete tasks and move to roles (#519) 7 years ago
Ruben Jongejan 07ddb5863b improved readability with native yaml (#530) 7 years ago
Jack Ivanov 97369c303a define local_dns if dns tag used (#533) 7 years ago
Jack Ivanov 0031d2809e Disable the Signature Algorithm check and add default vars. Fixes #525 7 years ago
Christopher J. Pilkington a225bde2b8 Specify EIP domain (#521) 8 years ago
Jack Ivanov 6f170982aa move to Elastic IP (#512) 8 years ago
Jack Ivanov 9f698fdd68 Get strongswan from the Zesty repo on Xenial (#515) 8 years ago
Jack Ivanov bd348af9c2 Implementing blocks and additional fail hints #487 (#497)
change the troubleshooting url
8 years ago
Jack Ivanov 2f5c050fd2 dpdaction to clear (#498) 8 years ago
Jack Ivanov 0ed68b6c30 Properly configure ICMP restrictions (#492) 8 years ago
Ryan Kasper 0cb43650cb Windows 10 -PfsGroup None --> -PfsGroup ECP256 (#493)
* Windows 10 -PfsGroup None --> -PfsGroup ECP256

Fixes broken tunnel when rekey (CREATE_CHILD_SA request [ N(REKEY_SA) SA No TSi TSr KE ]) occurs (on my Windows 10 1703 build 15063.138 Creator's Update system this is ~every 57 minutes)

* Update Windows Client PfsGroup Commandline
8 years ago
Jack Ivanov 540c761d3b Disable RSA in the mobileconfigs. Fixes #486 8 years ago
Jack Ivanov 451394100d Some enhances in the compat ciphers (#464)
raise the IntegrityCheckMethod to SHA384

Move Windows to ECDSA

Increase IntegrityCheckMethod
8 years ago
Dan Guido aac052da46 this option is deprecated (#477) 8 years ago
Jack Ivanov c3fcfe5d0d Let users choose the distro version #449 (#466)
Make dpdaction great again

add 1704 to travis

Make EC2 image name more convenient

modify apparmor profile
8 years ago
Andy Boutte 76cdc69548 CF tested and working for EC2 deployment (#431)
* AWS CloudFormation #132

* IPv6 EC2 draft

* CF tested and working for EC2 deployment

* IPv6 Implementation, EC2, Cloudformation

* Fixed ipv6 networking

* adding ip6tables rule for DHCP on AWS
8 years ago
Jack Ivanov a7b06058cb remove the proxy role #440 (#457)
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
8 years ago
Dan Guido 0b05ea19bc Windows needs SHA2-256. Closes #453. (#456) 8 years ago
Dan Guido 8173b84ff8 Change uniqueids back to never (#448)
We need this to allow multiple connections with the same id/certificate
8 years ago
Dan Guido b29772f146 prefer ed25519 8 years ago
Dan Guido f9f7be7b0d Fix a typo from #439 8 years ago
Dan Guido 1778cb1f45 disable dpd #430 (#437)
Closes #430
8 years ago
Dan Guido 8e5e6d5088 remove extraneous integrity algos from AEAD ciphers (#439)
In reference to
https://github.com/trailofbits/algo/issues/9#issuecomment-294370560
8 years ago
Jauder Ho 5b2e13d18f Only enable ChaCha cipher (#412)
* Only enable ChaCha cipher

* Add back a few ciphers for compatability
8 years ago
Jack Ivanov fa5a956193 Add URLStringProbe (#428)
* Add URLStringProbe

* switch to Apple's hotspot-detect.html
8 years ago
Jack Ivanov ea5976f49b write logs to file if BSD only 8 years ago
Jack Ivanov 9c12272c8c Python False-y values should be accepted. #417 (#426) 8 years ago
Jack Ivanov 16329fe088 Instance size (#404)
* Escaping Special Characters #388

* Make instance sizes more flexible to edit #355
8 years ago
Jack Ivanov bf75a1bb03 move generating of the known_hosts file to local_action (#425) 8 years ago
MiWCryptAnalytics 04b61ca3d2 Increase CA key entropy to 128bit (#415)
Changes the default CA key size from 48 bit to 128bit with OpenSSL usermode CSPRNG with hex encoding
8 years ago
Jack Ivanov 02f363d825 change the order of ciphers 8 years ago
mathew19 ae43ed6f81 Update client_ipsec.secrets.j2 (#414)
Fix filename in client ipsec_user.secrets
8 years ago
mathew19 5e56996f5c Fix name (#411) 8 years ago
Jack Ivanov c61a07fb60 Escaping Special Characters #388 (#403) 8 years ago
Jack Ivanov 56a72e5af2 New ciphers implementing #247 (#352)
Switches to SHA2_512_256 HMAC integrity algorithm and adds cipher compatibility for other platforms.
8 years ago
Jack Ivanov 70738ed8be Enable IP forwarding GCE #369 8 years ago
Jack Ivanov 95e0134f21 1. Disable SSH key deploying if installation on existing server
2. Move to the ed25519 algorithm
3. Delete unneeded option RSAAuthentication
Fixes #272
8 years ago
Dan Guido e55ce03906 URLStringProbe with this URL does not work as intended 8 years ago
Dan Guido 5e22b79033 Add configuration for URL probes to Apple profile
Chrome and Android both request a known URL that generates HTTP 204 No Content responses to determine if they have internet connectivity. In Apple profiles, we can use the same URL to determine whether the VPN needs to connect. Using this feature will help save battery life for lots of users.
8 years ago
Jack Ivanov 47515154bb add mtu in the sswan profile 8 years ago
Casey Lang 8b977afd99 Modify creation of GCE Instance (#363)
Update deprecated GCE metadata options
8 years ago
Jack Ivanov 3b8d04d06c remove the logging role 8 years ago
Jack Ivanov 6e61a51aca rewrite the sysctl task 8 years ago
Jack Ivanov c0f4b5fa41 Enable default values if the role is skipped #313 8 years ago
Josh Soref 84bbcb88d0 Spelling fixes (#342)
* spelling: algorithm

* spelling: bertrand

* spelling: between

* spelling: checking

* spelling: conjunction

* spelling: contributor

* spelling: delimited

* spelling: fashion

* spelling: droplet

* spelling: javascript

* spelling: nameserver

* spelling: obligatory

* spelling: official

* spelling: overridden

* spelling: overwrite

* spelling: parameter

* spelling: suppressing
8 years ago
James Hale 41ed682213 Reduce VPC CIDR size to /16 (#341) 8 years ago
Josh Meisels d37c6b72c5 Add new Azure regions and allow user to select VM size (#332)
* Update Azure Region List

Included several additional regions in the Azure list.

In a future version we may want to ask users to choose a continent, then present region options since this list is getting long.

* Add VM size selection

Added prompt for user to choose VM size. Useful because the default size is not available in all regions, and there are cheaper sizes.

* Handle vm_size choice in "Create an Instance" step

Use the variable passed in that the user chose for vm_size.

* Differentiate Basic A0 and Standard A0

* Remove vm_size D1 since it's being deprecated

* Fix syntax issue - missing semicolons

* Remove note to self comment

* Remove changes to let user select VM size

Removing my previous additions that let the user select their Azure VM size.

* Hard code VM size to cheapest size

Remove my usage of a variable for VM size. Update to use the Basic_A0, which is the cheapest size of VM.
8 years ago
Matt Mankins b8d2dc68bb Change EC2 VPC CIDR blocks to uncommon non-routable addresses (#335) 8 years ago
Josh Watson 84a3b5f675 Change EC2 VPC CIDR blocks to non-routable addresses. (#330)
The previous address ranges were actually routable addresses, which caused some concern for some people because it looked suspicious in tracert. The new CIDR blocks are non-routable addresses, which resolves this concern.
8 years ago
brad2014 09e5d87c7b Minor name and documentation edits (#327) 8 years ago
James Hale 3b3fb601ef Fix name tag key (#282) 8 years ago
Dan Guido 655a917dd2 iptables filter table fix (#285) 8 years ago
Jack Ivanov 6facb6cb4f FreeBSD / HardenedBSD (#262)
* FreeBSD draft

ifconfig fix

Pre-tasks fixes

fix hardcoded IP

some refactoring

disable system-based tags

disable freebsd tags

FreeBSD vpn role

add defaults

ssh role freebsd

default fix

dns_adblocking freebsd

ubuntu dict fix

* HardenedBSD

update-users BSD

* Rebuild the kernel

docs changing
8 years ago
Jack Ivanov 49ba1f76b4 Some improvements in the mobileconfig. Fixes #270 8 years ago
Jack Ivanov 045ff4bb9f Azure security group. Fixes #264 8 years ago
Jack Ivanov 906d962d4d GCE. env variables #195 8 years ago
Jack Ivanov 573c2f2322 DO. env variables #195 8 years ago
Jack Ivanov fc30f8bb10 GCE. Tags fixed #267 8 years ago
Jack Ivanov 0aff3ebb6f EC2 instance_initiated_shutdown_behavior to terminate. Close #124 8 years ago
Jack Ivanov c52024d4cc Azure. Add to the inventory #30 8 years ago
Jack Ivanov 0d1731e058 update tags for azure resources 8 years ago