mirror of
https://github.com/trailofbits/algo
synced 2024-11-18 09:25:38 +00:00
117 lines
4.1 KiB
YAML
117 lines
4.1 KiB
YAML
---
|
|
|
|
- hosts: localhost
|
|
gather_facts: False
|
|
vars_files:
|
|
- config.cfg
|
|
vars_prompt:
|
|
|
|
- name: "server_ip"
|
|
prompt: "Enter IP address of your server: (use localhost for local installation)\n"
|
|
default: localhost
|
|
private: no
|
|
|
|
- name: "server_user"
|
|
prompt: "What user should we use to login on the server? (ignore if you're deploying to localhost):\n"
|
|
default: "root"
|
|
private: no
|
|
|
|
- name: "easyrsa_p12_export_password"
|
|
prompt: "Enter the password for p12 certificates:\n"
|
|
default: "vpn"
|
|
private: yes
|
|
|
|
- name: "IP_subject"
|
|
prompt: "Enter public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)\n"
|
|
private: no
|
|
|
|
tasks:
|
|
- name: Add the server to the vpn-host group
|
|
add_host:
|
|
hostname: "{{ server_ip }}"
|
|
groupname: vpn-host
|
|
ansible_ssh_user: "{{ server_user }}"
|
|
ansible_python_interpreter: "/usr/bin/python2.7"
|
|
easyrsa_p12_export_password: "{{ easyrsa_p12_export_password }}"
|
|
IP_subject: "{{ IP_subject }}"
|
|
|
|
- name: Wait for SSH to become available
|
|
local_action: "wait_for port=22 host={{ server_ip }} timeout=320"
|
|
become: false
|
|
|
|
- name: User management
|
|
hosts: vpn-host
|
|
gather_facts: false
|
|
become: true
|
|
vars_files:
|
|
- config.cfg
|
|
|
|
pre_tasks:
|
|
- set_fact:
|
|
IP_subject_alt_name: "{{ IP_subject }}"
|
|
|
|
tasks:
|
|
- name: Build the client's pair
|
|
shell: >
|
|
./easyrsa build-client-full {{ item }} nopass &&
|
|
touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
|
|
args:
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
|
|
with_items: "{{ users }}"
|
|
|
|
- name: Build the client's p12
|
|
shell: >
|
|
openssl pkcs12 -in {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt -inkey {{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.key -export -name {{ item }} -out /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 -certfile {{ easyrsa_dir }}/easyrsa3//pki/ca.crt -passout pass:{{ easyrsa_p12_export_password }} &&
|
|
touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_p12_initialized'
|
|
args:
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_p12_initialized'
|
|
with_items: "{{ users }}"
|
|
|
|
- name: Get active users
|
|
shell: >
|
|
grep ^V pki/index.txt | grep -v "{{ IP_subject_alt_name }}" | awk '{print $5}' | sed 's/\/CN=//g'
|
|
args:
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
register: valid_certs
|
|
|
|
- name: Revoke non-existing users
|
|
shell: >
|
|
ipsec pki --signcrl --cacert {{ easyrsa_dir }}/easyrsa3//pki/ca.crt --cakey {{ easyrsa_dir }}/easyrsa3/pki/private/ca.key --reason superseded --cert {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt > /etc/ipsec.d/crls/{{ item }}.der &&
|
|
./easyrsa revoke {{ item }} &&
|
|
ipsec rereadcrls
|
|
args:
|
|
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
|
when: item not in users
|
|
with_items: "{{ valid_certs.stdout_lines }}"
|
|
|
|
- name: Register p12 PayloadContent
|
|
shell: >
|
|
cat /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 | base64
|
|
register: PayloadContent
|
|
with_items: "{{ users }}"
|
|
|
|
- name: Register CA PayloadContent
|
|
shell: >
|
|
cat /{{ easyrsa_dir }}/easyrsa3/pki/ca.crt | base64
|
|
register: PayloadContentCA
|
|
|
|
- name: Build the mobileconfigs
|
|
template: src=roles/vpn/templates/mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600
|
|
with_together:
|
|
- "{{ users }}"
|
|
- "{{ PayloadContent.results }}"
|
|
no_log: True
|
|
|
|
- name: Fetch users P12
|
|
fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 dest=configs/{{ IP_subject_alt_name }}_{{ item }}.p12 flat=yes
|
|
with_items: "{{ users }}"
|
|
|
|
- name: Fetch users mobileconfig
|
|
fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.mobileconfig dest=configs/{{ IP_subject_alt_name }}_{{ item }}.mobileconfig flat=yes
|
|
with_items: "{{ users }}"
|
|
|
|
- name: Fetch server CA certificate
|
|
fetch: src=/{{ easyrsa_dir }}/easyrsa3/pki/ca.crt dest=configs/{{ IP_subject_alt_name }}_ca.crt flat=yes
|