mirror of https://github.com/trailofbits/algo
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
425 lines
13 KiB
Bash
425 lines
13 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -e
|
|
|
|
SKIP_TAGS="_null encrypted"
|
|
ADDITIONAL_PROMPT="[pasted values will not be displayed]"
|
|
|
|
additional_roles () {
|
|
|
|
read -p "
|
|
Do you want macOS/iOS clients to enable \"VPN On Demand\" when connected to cellular networks?
|
|
[y/N]: " -r OnDemandEnabled_Cellular
|
|
OnDemandEnabled_Cellular=${OnDemandEnabled_Cellular:-n}
|
|
if [[ "$OnDemandEnabled_Cellular" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_Cellular=Y"; fi
|
|
|
|
read -p "
|
|
Do you want macOS/iOS clients to enable \"VPN On Demand\" when connected to Wi-Fi?
|
|
[y/N]: " -r OnDemandEnabled_WIFI
|
|
OnDemandEnabled_WIFI=${OnDemandEnabled_WIFI:-n}
|
|
if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_WIFI=Y"; fi
|
|
|
|
if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then
|
|
read -p "
|
|
List the names of trusted Wi-Fi networks (if any) that macOS/iOS clients exclude from using the VPN (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
|
|
: " -r OnDemandEnabled_WIFI_EXCLUDE
|
|
OnDemandEnabled_WIFI_EXCLUDE=${OnDemandEnabled_WIFI_EXCLUDE:-_null}
|
|
EXTRA_VARS+=" OnDemandEnabled_WIFI_EXCLUDE=\"$OnDemandEnabled_WIFI_EXCLUDE\""
|
|
fi
|
|
|
|
read -p "
|
|
Do you want to install a DNS resolver on this VPN server, to block ads while surfing?
|
|
[y/N]: " -r dns_enabled
|
|
dns_enabled=${dns_enabled:-n}
|
|
if [[ "$dns_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" dns"; EXTRA_VARS+=" local_dns=Y"; fi
|
|
|
|
read -p "
|
|
Do you want each user to have their own account for SSH tunneling?
|
|
[y/N]: " -r ssh_tunneling_enabled
|
|
ssh_tunneling_enabled=${ssh_tunneling_enabled:-n}
|
|
if [[ "$ssh_tunneling_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" ssh_tunneling"; fi
|
|
|
|
read -p "
|
|
Do you want to apply operating system security enhancements on the server? (warning: replaces your sshd_config)
|
|
[y/N]: " -r security_enabled
|
|
security_enabled=${security_enabled:-n}
|
|
if [[ "$security_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" security"; fi
|
|
|
|
read -p "
|
|
Do you want the VPN to support Windows 10 clients? (requires RSA certificates and key exchange, less secure)
|
|
[y/N]: " -r Win10_Enabled
|
|
Win10_Enabled=${Win10_Enabled:-n}
|
|
if [[ "$Win10_Enabled" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" Win10_Enabled=Y"; fi
|
|
|
|
read -p "
|
|
Do you want to retain the CA key? (required to add users in the future, but less secure)
|
|
[y/N]: " -r Store_CAKEY
|
|
Store_CAKEY=${Store_CAKEY:-N}
|
|
if [[ "$Store_CAKEY" =~ ^(n|N)$ ]]; then EXTRA_VARS+=" Store_CAKEY=N"; fi
|
|
|
|
}
|
|
|
|
deploy () {
|
|
|
|
ansible-playbook deploy.yml -t "${ROLES// /,}" -e "${EXTRA_VARS}" --skip-tags "${SKIP_TAGS// /,}"
|
|
|
|
}
|
|
|
|
azure () {
|
|
read -p "
|
|
Enter your azure secret id (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
|
|
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
|
|
$ADDITIONAL_PROMPT
|
|
[...]: " -rs azure_secret
|
|
|
|
read -p "
|
|
|
|
Enter your azure tenant id (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
|
|
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
|
|
$ADDITIONAL_PROMPT
|
|
[...]: " -rs azure_tenant
|
|
|
|
read -p "
|
|
|
|
Enter your azure client id (application id) (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
|
|
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
|
|
$ADDITIONAL_PROMPT
|
|
[...]: " -rs azure_client_id
|
|
|
|
read -p "
|
|
|
|
Enter your azure subscription id (https://github.com/trailofbits/algo/blob/master/docs/cloud-azure.md)
|
|
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
|
|
$ADDITIONAL_PROMPT
|
|
[...]: " -rs azure_subscription_id
|
|
|
|
read -p "
|
|
|
|
Name the vpn server:
|
|
[algo]: " -r azure_server_name
|
|
azure_server_name=${azure_server_name:-algo}
|
|
|
|
read -p "
|
|
|
|
What region should the server be located in? (https://azure.microsoft.com/en-us/regions/)
|
|
1. South Central US
|
|
2. Central US
|
|
3. North Europe
|
|
4. West Europe
|
|
5. Southeast Asia
|
|
6. Japan West
|
|
7. Japan East
|
|
8. Australia Southeast
|
|
9. Australia East
|
|
10. Canada Central
|
|
11. West US 2
|
|
12. West Central US
|
|
13. UK South
|
|
14. UK West
|
|
15. West US
|
|
16. Brazil South
|
|
17. Canada Central
|
|
18. Central India
|
|
19. East Asia
|
|
20. Germany Central
|
|
21. Germany Northeast
|
|
22. Korea Central
|
|
23. Korea South
|
|
24. North Central US
|
|
25. South India
|
|
26. West India
|
|
|
|
Enter the number of your desired region:
|
|
[1]: " -r azure_region
|
|
azure_region=${azure_region:-1}
|
|
|
|
case "$azure_region" in
|
|
1) region="southcentralus" ;;
|
|
2) region="centralus" ;;
|
|
3) region="northeurope" ;;
|
|
4) region="westeurope" ;;
|
|
5) region="southeastasia" ;;
|
|
6) region="japanwest" ;;
|
|
7) region="japaneast" ;;
|
|
8) region="australiasoutheast" ;;
|
|
9) region="australiaeast" ;;
|
|
10) region="canadacentral" ;;
|
|
11) region="westus2" ;;
|
|
12) region="westcentralus" ;;
|
|
13) region="uksouth" ;;
|
|
14) region="ukwest" ;;
|
|
15) region="westus" ;;
|
|
16) region="brazilsouth" ;;
|
|
17) region="canadacentral" ;;
|
|
18) region="centralindia" ;;
|
|
19) region="eastasia" ;;
|
|
20) region="germanycentral" ;;
|
|
21) region="germanynortheast" ;;
|
|
22) region="koreacentral" ;;
|
|
23) region="koreasouth" ;;
|
|
24) region="northcentralus" ;;
|
|
25) region="southindia" ;;
|
|
26) region="westindia" ;;
|
|
esac
|
|
|
|
ROLES="azure vpn cloud"
|
|
EXTRA_VARS="azure_secret=$azure_secret azure_tenant=$azure_tenant azure_client_id=$azure_client_id azure_subscription_id=$azure_subscription_id azure_server_name=$azure_server_name ssh_public_key=$ssh_public_key region=$region"
|
|
}
|
|
|
|
digitalocean () {
|
|
read -p "
|
|
Enter your API token. The token must have read and write permissions (https://cloud.digitalocean.com/settings/api/tokens):
|
|
$ADDITIONAL_PROMPT
|
|
: " -rs do_access_token
|
|
|
|
read -p "
|
|
|
|
Name the vpn server:
|
|
[algo.local]: " -r do_server_name
|
|
do_server_name=${do_server_name:-algo.local}
|
|
|
|
read -p "
|
|
|
|
What region should the server be located in?
|
|
1. Amsterdam (Datacenter 2)
|
|
2. Amsterdam (Datacenter 3)
|
|
3. Frankfurt
|
|
4. London
|
|
5. New York (Datacenter 1)
|
|
6. New York (Datacenter 2)
|
|
7. New York (Datacenter 3)
|
|
8. San Francisco (Datacenter 1)
|
|
9. San Francisco (Datacenter 2)
|
|
10. Singapore
|
|
11. Toronto
|
|
12. Bangalore
|
|
Enter the number of your desired region:
|
|
[7]: " -r region
|
|
region=${region:-7}
|
|
|
|
case "$region" in
|
|
1) do_region="ams2" ;;
|
|
2) do_region="ams3" ;;
|
|
3) do_region="fra1" ;;
|
|
4) do_region="lon1" ;;
|
|
5) do_region="nyc1" ;;
|
|
6) do_region="nyc2" ;;
|
|
7) do_region="nyc3" ;;
|
|
8) do_region="sfo1" ;;
|
|
9) do_region="sfo2" ;;
|
|
10) do_region="sgp1" ;;
|
|
11) do_region="tor1" ;;
|
|
12) do_region="blr1" ;;
|
|
esac
|
|
|
|
ROLES="digitalocean vpn cloud"
|
|
EXTRA_VARS="do_access_token=$do_access_token do_server_name=$do_server_name do_region=$do_region"
|
|
}
|
|
|
|
ec2 () {
|
|
read -p "
|
|
Enter your aws_access_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
|
|
Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached
|
|
$ADDITIONAL_PROMPT
|
|
[AKIA...]: " -rs aws_access_key
|
|
|
|
read -p "
|
|
|
|
Enter your aws_secret_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
|
|
Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached
|
|
$ADDITIONAL_PROMPT
|
|
[ABCD...]: " -rs aws_secret_key
|
|
|
|
read -p "
|
|
|
|
Name the vpn server:
|
|
[algo]: " -r aws_server_name
|
|
aws_server_name=${aws_server_name:-algo}
|
|
|
|
read -p "
|
|
|
|
What region should the server be located in?
|
|
1. us-east-1 US East (N. Virginia)
|
|
2. us-east-2 US East (Ohio)
|
|
3. us-west-1 US West (N. California)
|
|
4. us-west-2 US West (Oregon)
|
|
5. ap-south-1 Asia Pacific (Mumbai)
|
|
6. ap-northeast-2 Asia Pacific (Seoul)
|
|
7. ap-southeast-1 Asia Pacific (Singapore)
|
|
8. ap-southeast-2 Asia Pacific (Sydney)
|
|
9. ap-northeast-1 Asia Pacific (Tokyo)
|
|
10. eu-central-1 EU (Frankfurt)
|
|
11. eu-west-1 EU (Ireland)
|
|
12. eu-west-2 EU (London)
|
|
13. ca-central-1 Canada (Central)
|
|
Enter the number of your desired region:
|
|
[1]: " -r aws_region
|
|
aws_region=${aws_region:-1}
|
|
# sa-east-1 region does not support the size instance we use.
|
|
|
|
case "$aws_region" in
|
|
1) region="us-east-1" ;;
|
|
2) region="us-east-2" ;;
|
|
3) region="us-west-1" ;;
|
|
4) region="us-west-2" ;;
|
|
5) region="ap-south-1" ;;
|
|
6) region="ap-northeast-2" ;;
|
|
7) region="ap-southeast-1" ;;
|
|
8) region="ap-southeast-2" ;;
|
|
9) region="ap-northeast-1" ;;
|
|
10) region="eu-central-1" ;;
|
|
11) region="eu-west-1" ;;
|
|
12) region="eu-west-2";;
|
|
13) region="ca-central-1" ;;
|
|
esac
|
|
|
|
ROLES="ec2 vpn cloud"
|
|
EXTRA_VARS="aws_access_key=$aws_access_key aws_secret_key=$aws_secret_key aws_server_name=$aws_server_name ssh_public_key=$ssh_public_key region=$region"
|
|
}
|
|
|
|
gce () {
|
|
read -p "
|
|
Enter the local path to your credentials JSON file (https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts):
|
|
: " -r credentials_file
|
|
|
|
read -p "
|
|
|
|
Name the vpn server:
|
|
[algo]: " -r server_name
|
|
server_name=${server_name:-algo}
|
|
|
|
read -p "
|
|
|
|
What zone should the server be located in?
|
|
1. Western US (Oregon A)
|
|
2. Western US (Oregon B)
|
|
3. Central US (Iowa A)
|
|
4. Central US (Iowa B)
|
|
5. Central US (Iowa C)
|
|
6. Central US (Iowa F)
|
|
7. Eastern US (South Carolina B)
|
|
8. Eastern US (South Carolina C)
|
|
9. Eastern US (South Carolina D)
|
|
10. Western Europe (Belgium B)
|
|
11. Western Europe (Belgium C)
|
|
12. Western Europe (Belgium D)
|
|
13. East Asia (Taiwan A)
|
|
14. East Asia (Taiwan B)
|
|
15. East Asia (Taiwan C)
|
|
Please choose the number of your zone. Press enter for default (#8) zone.
|
|
[8]: " -r region
|
|
region=${region:-8}
|
|
|
|
case "$region" in
|
|
1) zone="us-west1-a" ;;
|
|
2) zone="us-west1-b" ;;
|
|
3) zone="us-central1-a" ;;
|
|
4) zone="us-central1-b" ;;
|
|
5) zone="us-central1-c" ;;
|
|
6) zone="us-central1-f" ;;
|
|
7) zone="us-east1-b" ;;
|
|
8) zone="us-east1-c" ;;
|
|
9) zone="us-east1-d" ;;
|
|
10) zone="europe-west1-b" ;;
|
|
11) zone="europe-west1-c" ;;
|
|
12) zone="europe-west1-d" ;;
|
|
13) zone="asia-east1-a" ;;
|
|
14) zone="asia-east1-b" ;;
|
|
15) zone="asia-east1-c" ;;
|
|
esac
|
|
|
|
ROLES="gce vpn cloud"
|
|
EXTRA_VARS="credentials_file=$credentials_file server_name=$server_name ssh_public_key=$ssh_public_key zone=$zone max_mss=1316"
|
|
}
|
|
|
|
non_cloud () {
|
|
read -p "
|
|
Enter the IP address of your server: (or use localhost for local installation)
|
|
: " -r server_ip
|
|
|
|
read -p "
|
|
|
|
What user should we use to login on the server? (note: passwordless login required, or ignore if you're deploying to localhost)
|
|
[root]: " -r server_user
|
|
server_user=${server_user:-root}
|
|
|
|
read -p "
|
|
|
|
Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)
|
|
[$server_ip]: " -r IP_subject
|
|
IP_subject=${IP_subject:-$server_ip}
|
|
|
|
ROLES="local vpn"
|
|
EXTRA_VARS="server_ip=$server_ip server_user=$server_user IP_subject_alt_name=$IP_subject"
|
|
SKIP_TAGS+=" cloud update-alternatives"
|
|
|
|
read -p "
|
|
|
|
Was this server deployed by Algo previously?
|
|
[y/N]: " -r Deployed_By_Algo
|
|
Deployed_By_Algo=${Deployed_By_Algo:-n}
|
|
if [[ "$Deployed_By_Algo" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" Deployed_By_Algo=Y"; fi
|
|
|
|
}
|
|
|
|
algo_provisioning () {
|
|
echo -n "
|
|
What provider would you like to use?
|
|
1. DigitalOcean
|
|
2. Amazon EC2
|
|
3. Microsoft Azure
|
|
4. Google Compute Engine (only for testing, see issue #369)
|
|
5. Install to existing Ubuntu 16.04 server
|
|
|
|
Enter the number of your desired provider
|
|
: "
|
|
|
|
read -r N
|
|
|
|
case "$N" in
|
|
1) digitalocean; ;;
|
|
2) ec2; ;;
|
|
3) azure; ;;
|
|
4) gce; ;;
|
|
5) non_cloud; ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
|
|
additional_roles
|
|
deploy
|
|
}
|
|
|
|
user_management () {
|
|
|
|
read -p "
|
|
Enter the IP address of your server: (or use localhost for local installation)
|
|
: " -r server_ip
|
|
|
|
read -p "
|
|
What user should we use to login on the server? (note: passwordless login required, or ignore if you're deploying to localhost)
|
|
[root]: " -r server_user
|
|
server_user=${server_user:-root}
|
|
|
|
read -p "
|
|
Do you want each user to have their own account for SSH tunneling?
|
|
[y/N]: " -r ssh_tunneling_enabled
|
|
ssh_tunneling_enabled=${ssh_tunneling_enabled:-n}
|
|
|
|
read -p "
|
|
Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)
|
|
[$server_ip]: " -r IP_subject
|
|
IP_subject=${IP_subject:-$server_ip}
|
|
|
|
read -p "
|
|
Enter the password for the private CA key:
|
|
$ADDITIONAL_PROMPT
|
|
: " -rs easyrsa_CA_password
|
|
|
|
ansible-playbook users.yml -e "server_ip=$server_ip server_user=$server_user ssh_tunneling_enabled=$ssh_tunneling_enabled IP_subject=$IP_subject easyrsa_CA_password=$easyrsa_CA_password"
|
|
}
|
|
|
|
case "$1" in
|
|
update-users) user_management ;;
|
|
*) algo_provisioning ;;
|
|
esac
|