algo/docs/setup-roles.md

Ansible Roles

Required roles

• Common
  • Installs several required packages and software updates, then reboots if necessary
  • Configures network interfaces, and enables packet forwarding on them
• VPN
  • Installs strongSwan, enables AppArmor, limits CPU and memory access, and drops user privileges
  • Builds a Certificate Authority (CA) with easy-rsa-ipsec and creates one client certificate per user
  • Bundles the appropriate certificates into Apple mobileconfig profiles for each user
  • Configures IPtables to block traffic that might pose a risk to VPN users, such as SMB/CIFS

Optional roles

• Security Enhancements
  • Enables unattended-upgrades to ensure available patches are always applied
  • Modify features like core dumps, kernel parameters, and SUID binaries to limit possible attacks
  • Enhances SSH with modern ciphers and seccomp, and restricts access to old or unwanted features like X11 forwarding and SFTP
• DNS-based Adblocking
  • Install the dnsmasq local resolver with a blacklist for advertising domains
  • Constrains dnsmasq with AppArmor and cgroups CPU and memory limitations
• SSH Tunneling
  • Adds a restricted algo group with no shell access and limited SSH forwarding options
  • Creates one limited, local account per user and an SSH public key for each