mirror of
https://github.com/trailofbits/algo.git
synced 2025-09-06 03:53:39 +02:00
update-users with local_openssl_tasks
This commit is contained in:
Jack Ivanov
parent
40b6c59139
commit
55d40a6b27
2 changed files with 107 additions and 45 deletions
|
|
@ -241,15 +241,6 @@
|
|||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
with_items: "{{ users }}"
|
||||
|
||||
- name: Register p12 PayloadContent
|
||||
local_action: >
|
||||
shell cat private/{{ item }}.p12 | base64
|
||||
register: PayloadContent
|
||||
become: no
|
||||
args:
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
with_items: "{{ users }}"
|
||||
|
||||
- name: Set facts for mobileconfigs
|
||||
set_fact:
|
||||
proxy_enabled: false
|
||||
|
|
|
|||
143
users.yml
143
users.yml
|
|
@ -39,6 +39,7 @@
|
|||
ssh_tunneling_enabled: "{{ ssh_tunneling_enabled }}"
|
||||
easyrsa_CA_password: "{{ easyrsa_CA_password }}"
|
||||
IP_subject: "{{ IP_subject }}"
|
||||
ansible_ssh_private_key_file: "{{ SSH_keys.private }}"
|
||||
|
||||
- name: Wait until SSH becomes ready...
|
||||
local_action:
|
||||
|
|
@ -53,7 +54,7 @@
|
|||
|
||||
- name: User management
|
||||
hosts: vpn-host
|
||||
gather_facts: false
|
||||
gather_facts: true
|
||||
become: true
|
||||
vars_files:
|
||||
- config.cfg
|
||||
|
|
@ -73,70 +74,136 @@
|
|||
- set_fact:
|
||||
easyrsa_p12_export_password: "{{ (ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0] }}"
|
||||
|
||||
- name: Build the client's pair
|
||||
shell: >
|
||||
./easyrsa gen-req {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" &&
|
||||
./easyrsa --subject-alt-name='DNS:{{ item }}' sign-req client {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" &&
|
||||
touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
|
||||
- name: Cheking the signature algorithm
|
||||
local_action: >
|
||||
shell openssl x509 -text -in certs/82.196.1.93.crt | grep 'Signature Algorithm' | head -n1
|
||||
become: no
|
||||
register: sig_algo
|
||||
args:
|
||||
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
||||
creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
|
||||
- name: Change the algorithm to RSA
|
||||
set_fact:
|
||||
algo_params: "rsa:2048"
|
||||
when: '"ecdsa" not in sig_algo.stdout'
|
||||
|
||||
- name: Build the client's pair
|
||||
local_action: >
|
||||
shell openssl req -utf8 -new -newkey {{ algo_params | default('ec:ecparams/prime256v1.pem') }} -config openssl.cnf -keyout private/{{ item }}.key -out reqs/{{ item }}.req -nodes -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" -batch &&
|
||||
openssl ca -utf8 -in reqs/{{ item }}.req -out certs/{{ item }}.crt -config openssl.cnf -days 3650 -batch -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" &&
|
||||
touch certs/{{ item }}_crt_generated
|
||||
become: no
|
||||
args:
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
creates: certs/{{ item }}_crt_generated
|
||||
environment:
|
||||
subjectAltName: "DNS:{{ item }}"
|
||||
with_items: "{{ users }}"
|
||||
|
||||
- name: Build the client's p12
|
||||
shell: >
|
||||
openssl pkcs12 -in {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt -inkey {{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.key -export -name {{ item }} -out /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 -certfile {{ easyrsa_dir }}/easyrsa3//pki/ca.crt -passout pass:{{ easyrsa_p12_export_password }}
|
||||
local_action: >
|
||||
shell openssl pkcs12 -in certs/{{ item }}.crt -inkey private/{{ item }}.key -export -name {{ item }} -out private/{{ item }}.p12 -certfile cacert.pem -passout pass:"{{ easyrsa_p12_export_password }}"
|
||||
become: no
|
||||
args:
|
||||
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
with_items: "{{ users }}"
|
||||
|
||||
- name: Copy the p12 certificates
|
||||
local_action:
|
||||
module: copy
|
||||
src: "configs/{{ IP_subject_alt_name }}/pki/private/{{ item }}.p12"
|
||||
dest: "configs/{{ IP_subject_alt_name }}/{{ item }}.p12"
|
||||
mode: 0600
|
||||
become: no
|
||||
with_items:
|
||||
- "{{ users }}"
|
||||
|
||||
- name: Get active users
|
||||
shell: >
|
||||
grep ^V pki/index.txt | grep -v "{{ IP_subject_alt_name }}" | awk '{print $5}' | sed 's/\/CN=//g'
|
||||
local_action: >
|
||||
shell grep ^V index.txt | grep -v "{{ IP_subject_alt_name }}" | awk '{print $5}' | sed 's/\/CN=//g'
|
||||
become: no
|
||||
args:
|
||||
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
register: valid_certs
|
||||
|
||||
- name: Revoke non-existing users
|
||||
shell: >
|
||||
openssl ec -in pki/private/ca.key -out pki/private/ca.key -passin pass:"{{ easyrsa_CA_password }}" -passout pass:"" &&
|
||||
ipsec pki --signcrl --cacert {{ easyrsa_dir }}/easyrsa3//pki/ca.crt --cakey {{ easyrsa_dir }}/easyrsa3/pki/private/ca.key --reason superseded --cert {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt > /etc/ipsec.d/crls/{{ item }}.der &&
|
||||
./easyrsa revoke {{ item }} &&
|
||||
openssl ec -aes256 -in pki/private/ca.key -out pki/private/ca.key -passin pass:"" -passout pass:"{{ easyrsa_CA_password }}" &&
|
||||
ipsec rereadcrls
|
||||
local_action: >
|
||||
shell openssl ca -config openssl.cnf -passin pass:"{{ easyrsa_CA_password }}" -revoke certs/{{ item }}.crt &&
|
||||
openssl ca -gencrl -config openssl.cnf -passin pass:"{{ easyrsa_CA_password }}" -revoke certs/{{ item }}.crt -out crl/{{ item }}.crt
|
||||
touch crl/{{ item }}_revoked
|
||||
become: no
|
||||
args:
|
||||
chdir: '{{ easyrsa_dir }}/easyrsa3/'
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
creates: crl/{{ item }}_revoked
|
||||
environment:
|
||||
subjectAltName: "DNS:{{ item }}"
|
||||
when: item not in users
|
||||
with_items: "{{ valid_certs.stdout_lines }}"
|
||||
|
||||
- name: Copy the revoked certificates to the vpn server
|
||||
copy:
|
||||
src: configs/{{ IP_subject_alt_name }}/pki/crl/{{ item }}.crt
|
||||
dest: /etc/ipsec.d/crls/{{ item }}.crt
|
||||
when: item not in users
|
||||
with_items: "{{ valid_certs.stdout_lines }}"
|
||||
notify:
|
||||
- rereadcrls
|
||||
|
||||
- name: Register p12 PayloadContent
|
||||
shell: >
|
||||
cat /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 | base64
|
||||
local_action: >
|
||||
shell cat private/{{ item }}.p12 | base64
|
||||
register: PayloadContent
|
||||
become: no
|
||||
args:
|
||||
chdir: "configs/{{ IP_subject_alt_name }}/pki/"
|
||||
with_items: "{{ users }}"
|
||||
|
||||
- name: Register CA PayloadContent
|
||||
shell: >
|
||||
cat /{{ easyrsa_dir }}/easyrsa3/pki/ca.crt | base64
|
||||
register: PayloadContentCA
|
||||
- name: Set facts for mobileconfigs
|
||||
set_fact:
|
||||
proxy_enabled: false
|
||||
PayloadContentCA: "{{ lookup('file' , 'configs/{{ IP_subject_alt_name }}/pki/cacert.pem')|b64encode }}"
|
||||
|
||||
- name: Build the mobileconfigs
|
||||
template: src=roles/vpn/templates/mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600
|
||||
local_action:
|
||||
module: template
|
||||
src: roles/vpn/templates/mobileconfig.j2
|
||||
dest: configs/{{ IP_subject_alt_name }}/{{ item.0 }}.mobileconfig
|
||||
mode: 0600
|
||||
become: no
|
||||
with_together:
|
||||
- "{{ users }}"
|
||||
- "{{ PayloadContent.results }}"
|
||||
no_log: True
|
||||
|
||||
- name: Fetch users P12
|
||||
fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 dest=configs/{{ IP_subject_alt_name }}_{{ item }}.p12 flat=yes
|
||||
with_items: "{{ users }}"
|
||||
- name: Build the client ipsec config file
|
||||
local_action:
|
||||
module: template
|
||||
src: roles/vpn/templates/client_ipsec.conf.j2
|
||||
dest: configs/{{ IP_subject_alt_name }}/ipsec_{{ item }}.conf
|
||||
mode: 0600
|
||||
become: no
|
||||
with_items:
|
||||
- "{{ users }}"
|
||||
|
||||
- name: Fetch users mobileconfig
|
||||
fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.mobileconfig dest=configs/{{ IP_subject_alt_name }}_{{ item }}.mobileconfig flat=yes
|
||||
with_items: "{{ users }}"
|
||||
- name: Build the client ipsec secret file
|
||||
local_action:
|
||||
module: template
|
||||
src: roles/vpn/templates/client_ipsec.secrets.j2
|
||||
dest: configs/{{ IP_subject_alt_name }}/ipsec_{{ item }}.secrets
|
||||
mode: 0600
|
||||
become: no
|
||||
with_items:
|
||||
- "{{ users }}"
|
||||
|
||||
- name: Fetch server CA certificate
|
||||
fetch: src=/{{ easyrsa_dir }}/easyrsa3/pki/ca.crt dest=configs/{{ IP_subject_alt_name }}_ca.crt flat=yes
|
||||
- name: Build the windows client powershell script
|
||||
local_action:
|
||||
module: template
|
||||
src: roles/vpn/templates/client_windows.ps1.j2
|
||||
dest: configs/{{ IP_subject_alt_name }}/windows_{{ item }}.ps1
|
||||
mode: 0600
|
||||
become: no
|
||||
when: Win10_Enabled is defined and Win10_Enabled == "Y"
|
||||
with_items: "{{ users }}"
|
||||
|
||||
# SSH
|
||||
|
||||
|
|
@ -163,3 +230,7 @@
|
|||
post_tasks:
|
||||
- debug: msg="{{ congrats.split('\n') }}"
|
||||
tags: always
|
||||
|
||||
handlers:
|
||||
- name: rereadcrls
|
||||
shell: ipsec rereadcrls
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue