update-users with local_openssl_tasks

roles/vpn/tasks/main.yml

@@ -241,15 +241,6 @@
     chdir: "configs/{{ IP_subject_alt_name }}/pki/"
   with_items: "{{ users }}"
 
-- name: Register p12 PayloadContent
-  local_action: >
-    shell cat private/{{ item }}.p12 | base64
-  register:  PayloadContent
-  become: no
-  args:
-    chdir: "configs/{{ IP_subject_alt_name }}/pki/"
-  with_items: "{{ users }}"
-
 - name: Set facts for mobileconfigs
   set_fact:
     proxy_enabled: false

users.yml

@@ -39,6 +39,7 @@
         ssh_tunneling_enabled: "{{ ssh_tunneling_enabled }}"
         easyrsa_CA_password: "{{ easyrsa_CA_password }}"
         IP_subject: "{{ IP_subject }}"
+        ansible_ssh_private_key_file: "{{ SSH_keys.private }}"
 
     - name: Wait until SSH becomes ready...
       local_action:
@@ -53,7 +54,7 @@
 
 - name: User management
   hosts: vpn-host
-  gather_facts: false
+  gather_facts: true
   become: true
   vars_files:
     - config.cfg
@@ -73,70 +74,136 @@
     - set_fact:
         easyrsa_p12_export_password: "{{ (ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0] }}"
 
-    - name: Build the client's pair
+    - name: Cheking the signature algorithm
-      shell: >
+      local_action: >
-        ./easyrsa gen-req {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" &&
+          shell openssl x509 -text -in certs/82.196.1.93.crt  | grep 'Signature Algorithm' | head -n1
-        ./easyrsa --subject-alt-name='DNS:{{ item }}' sign-req client {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" &&
+      become: no
-        touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
+      register: sig_algo
       args:
-        chdir: '{{ easyrsa_dir }}/easyrsa3/'
+        chdir: "configs/{{ IP_subject_alt_name }}/pki/"
-        creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
+
+    - name: Change the algorithm to RSA
+      set_fact:
+        algo_params: "rsa:2048"
+      when: '"ecdsa" not in sig_algo.stdout'
+
+    - name: Build the client's pair
+      local_action: >
+        shell openssl req -utf8 -new -newkey {{ algo_params | default('ec:ecparams/prime256v1.pem') }} -config openssl.cnf -keyout private/{{ item }}.key -out reqs/{{ item }}.req -nodes -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" -batch &&
+          openssl ca -utf8 -in reqs/{{ item }}.req -out certs/{{ item }}.crt -config openssl.cnf -days 3650 -batch -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" &&
+          touch certs/{{ item }}_crt_generated
+      become: no
+      args:
+        chdir: "configs/{{ IP_subject_alt_name }}/pki/"
+        creates: certs/{{ item }}_crt_generated
+      environment:
+        subjectAltName: "DNS:{{ item }}"
       with_items: "{{ users }}"
 
     - name: Build the client's p12
-      shell: >
+      local_action: >
-        openssl pkcs12 -in {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt -inkey {{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.key -export -name {{ item }} -out /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 -certfile {{ easyrsa_dir }}/easyrsa3//pki/ca.crt -passout pass:{{ easyrsa_p12_export_password }}
+        shell openssl pkcs12 -in certs/{{ item }}.crt -inkey private/{{ item }}.key -export -name {{ item }} -out private/{{ item }}.p12 -certfile cacert.pem -passout pass:"{{ easyrsa_p12_export_password }}"
+      become: no
       args:
-        chdir: '{{ easyrsa_dir }}/easyrsa3/'
+        chdir: "configs/{{ IP_subject_alt_name }}/pki/"
       with_items: "{{ users }}"
 
+    - name: Copy the p12 certificates
+      local_action:
+        module: copy
+        src: "configs/{{ IP_subject_alt_name }}/pki/private/{{ item }}.p12"
+        dest: "configs/{{ IP_subject_alt_name }}/{{ item }}.p12"
+        mode: 0600
+      become: no
+      with_items:
+        - "{{ users }}"
+
     - name: Get active users
-      shell: >
+      local_action: >
-        grep ^V pki/index.txt | grep -v "{{ IP_subject_alt_name }}" | awk '{print $5}' | sed 's/\/CN=//g'
+        shell grep ^V index.txt | grep -v "{{ IP_subject_alt_name }}" | awk '{print $5}' | sed 's/\/CN=//g'
+      become: no
       args:
-        chdir: '{{ easyrsa_dir }}/easyrsa3/'
+        chdir: "configs/{{ IP_subject_alt_name }}/pki/"
       register: valid_certs
 
     - name: Revoke non-existing users
-      shell: >
+      local_action: >
-        openssl ec -in pki/private/ca.key -out pki/private/ca.key -passin pass:"{{ easyrsa_CA_password }}" -passout pass:"" &&
+        shell openssl ca -config openssl.cnf -passin pass:"{{ easyrsa_CA_password }}" -revoke certs/{{ item }}.crt &&
-        ipsec pki --signcrl --cacert {{ easyrsa_dir }}/easyrsa3//pki/ca.crt --cakey {{ easyrsa_dir }}/easyrsa3/pki/private/ca.key --reason superseded --cert {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt > /etc/ipsec.d/crls/{{ item }}.der &&
+          openssl ca -gencrl -config openssl.cnf -passin pass:"{{ easyrsa_CA_password }}" -revoke certs/{{ item }}.crt -out crl/{{ item }}.crt
-        ./easyrsa revoke {{ item }} &&
+          touch crl/{{ item }}_revoked
-        openssl ec -aes256 -in pki/private/ca.key -out pki/private/ca.key -passin pass:"" -passout pass:"{{ easyrsa_CA_password }}" &&
+      become: no
-        ipsec rereadcrls
       args:
-        chdir: '{{ easyrsa_dir }}/easyrsa3/'
+        chdir: "configs/{{ IP_subject_alt_name }}/pki/"
+        creates: crl/{{ item }}_revoked
+      environment:
+        subjectAltName: "DNS:{{ item }}"
       when: item not in users
       with_items: "{{ valid_certs.stdout_lines }}"
 
+    - name: Copy the revoked certificates to the vpn server
+      copy:
+        src: configs/{{ IP_subject_alt_name }}/pki/crl/{{ item }}.crt
+        dest: /etc/ipsec.d/crls/{{ item }}.crt
+      when: item not in users
+      with_items: "{{ valid_certs.stdout_lines }}"
+      notify:
+        - rereadcrls
+
     - name: Register p12 PayloadContent
-      shell: >
+      local_action: >
-        cat /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 | base64
+        shell cat private/{{ item }}.p12 | base64
       register:  PayloadContent
+      become: no
+      args:
+        chdir: "configs/{{ IP_subject_alt_name }}/pki/"
       with_items: "{{ users }}"
 
-    - name: Register CA PayloadContent
+    - name: Set facts for mobileconfigs
-      shell: >
+      set_fact:
-        cat /{{ easyrsa_dir }}/easyrsa3/pki/ca.crt | base64
+        proxy_enabled: false
-      register:  PayloadContentCA
+        PayloadContentCA: "{{ lookup('file' , 'configs/{{ IP_subject_alt_name }}/pki/cacert.pem')|b64encode }}"
 
     - name: Build the mobileconfigs
-      template: src=roles/vpn/templates/mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600
+      local_action:
+        module: template
+        src: roles/vpn/templates/mobileconfig.j2
+        dest: configs/{{ IP_subject_alt_name }}/{{ item.0 }}.mobileconfig
+        mode: 0600
+      become: no
       with_together:
         - "{{ users }}"
         - "{{ PayloadContent.results }}"
       no_log: True
 
-    - name: Fetch users P12
+    - name: Build the client ipsec config file
-      fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 dest=configs/{{ IP_subject_alt_name }}_{{ item }}.p12 flat=yes
+      local_action:
-      with_items: "{{ users }}"
+        module: template
+        src: roles/vpn/templates/client_ipsec.conf.j2
+        dest: configs/{{ IP_subject_alt_name }}/ipsec_{{ item }}.conf
+        mode: 0600
+      become: no
+      with_items:
+        - "{{ users }}"
 
-    - name: Fetch users mobileconfig
+    - name: Build the client ipsec secret file
-      fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.mobileconfig dest=configs/{{ IP_subject_alt_name }}_{{ item }}.mobileconfig flat=yes
+      local_action:
-      with_items: "{{ users }}"
+        module: template
+        src: roles/vpn/templates/client_ipsec.secrets.j2
+        dest: configs/{{ IP_subject_alt_name }}/ipsec_{{ item }}.secrets
+        mode: 0600
+      become: no
+      with_items:
+        - "{{ users }}"
 
-    - name: Fetch server CA certificate
+    - name: Build the windows client powershell script
-      fetch: src=/{{ easyrsa_dir }}/easyrsa3/pki/ca.crt dest=configs/{{ IP_subject_alt_name }}_ca.crt flat=yes
+      local_action:
+        module: template
+        src: roles/vpn/templates/client_windows.ps1.j2
+        dest: configs/{{ IP_subject_alt_name }}/windows_{{ item }}.ps1
+        mode: 0600
+      become: no
+      when: Win10_Enabled is defined and Win10_Enabled == "Y"
+      with_items: "{{ users }}"
 
     # SSH
 
@@ -163,3 +230,7 @@
   post_tasks:
     - debug: msg="{{ congrats.split('\n') }}"
       tags: always
+
+  handlers:
+    - name: rereadcrls
+      shell: ipsec rereadcrls