wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-04-25 10:43:48 +02:00
Code Issues Projects Releases Wiki Activity

fix

Browse source
This commit is contained in:
Jack Ivanov 2016-08-25 22:20:53 +03:00
commit cf08c5ff61
14 changed files with 178 additions and 183 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
digitalocean.yml
View file

@ -1,3 +1,4 @@
# vim:ft=ansible:
- name: Configure the server and install required software
hosts: localhost
@ -50,29 +51,29 @@
private: no
- name: "dns_enabled"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (Y or N):\n"
default: "Y"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (y/n):\n"
default: "y"
private: no
- name: "proxy_enabled"
prompt: "Do you want to install a proxy to block ads and decrease traffic usage while surfing? (Y or N):\n"
default: "Y"
private: no
prompt: "Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing? (y/n):\n"
default: "y"
private: no
- name: "auditd_enabled"
prompt: "Do you want to use auditd ? (Y or N):\n"
default: "Y"
prompt: "Do you want to use auditd for security monitoring (see config.cfg)? (y/n):\n"
default: "y"
private: no
- name: "ssh_tunneling_enabled"
prompt: "Do you want to use SSH tunneling ? (Y or N):\n"
default: "Y"
private: no
prompt: "Do you want each user to have their own account for SSH tunneling? (y/n):\n"
default: "y"
private: no
- name: "easyrsa_p12_export_password"
prompt: "Enter the password for p12 certificates:\n"
prompt: "Enter a password for p12 certificates:\n"
default: "vpn"
private: yes
private: yes
roles:
- cloud-digitalocean
@ -131,10 +132,10 @@
- common
- security
- vpn
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "Y" }
- { role: dns_adblocking, when: dns_enabled is defined and dns_enabled == "Y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == 'Y' }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "Y" }
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "y" }
- { role: dns_adblocking, when: dns_enabled is defined and dns_enabled == "y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == "y" }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }
handlers:
- name: reload eth0

113
ec2.yml
View file

@ -21,66 +21,65 @@
"11": "sa-east-1"
vars_prompt:
- name: "aws_access_key"
prompt: "Enter your aws_access_key (http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html):\n"
private: yes
- name: "aws_access_key"
prompt: "Enter your aws_access_key (http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html):\n"
private: yes
- name: "aws_secret_key"
prompt: "Enter your aws_secret_key (http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html):\n"
private: yes
- name: "aws_secret_key"
prompt: "Enter your aws_secret_key (http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html):\n"
private: yes
- name: "region"
prompt: >
What region should the server be located in?
1. us-east-1 US East (N. Virginia)
2. us-west-1 US West (N. California)
3. us-west-2 US West (Oregon)
4. ap-south-1 Asia Pacific (Mumbai)
5. ap-northeast-2 Asia Pacific (Seoul)
6. ap-southeast-1 Asia Pacific (Singapore)
7. ap-southeast-2 Asia Pacific (Sydney)
8. ap-northeast-1 Asia Pacific (Tokyo)
9. eu-central-1 EU (Frankfurt)
10. eu-west-1 EU (Ireland)
11. sa-east-1 South America (São Paulo)
default: "1"
private: no
- name: "region"
prompt: >
What region should the server be located in?
1. us-east-1 US East (N. Virginia)
2. us-west-1 US West (N. California)
3. us-west-2 US West (Oregon)
4. ap-south-1 Asia Pacific (Mumbai)
5. ap-northeast-2 Asia Pacific (Seoul)
6. ap-southeast-1 Asia Pacific (Singapore)
7. ap-southeast-2 Asia Pacific (Sydney)
8. ap-northeast-1 Asia Pacific (Tokyo)
9. eu-central-1 EU (Frankfurt)
10. eu-west-1 EU (Ireland)
11. sa-east-1 South America (São Paulo)
default: "1"
private: no
- name: "aws_server_name"
prompt: "Name the vpn server:\n"
default: "algo.local"
private: no
- name: "aws_server_name"
prompt: "Name the vpn server:\n"
default: "algo.local"
private: no
- name: "ssh_public_key"
prompt: "Enter the local path to your SSH public key:\n"
default: "~/.ssh/id_rsa.pub"
private: no
- name: "ssh_public_key"
prompt: "Enter the local path to your SSH public key:\n"
default: "~/.ssh/id_rsa.pub"
private: no
- name: "dns_enabled"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (y/n):\n"
default: "y"
private: no
- name: "dns_enabled"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (Y or N):\n"
default: "Y"
private: no
- name: "proxy_enabled"
prompt: "Do you want to install a proxy to block ads and decrease traffic usage while surfing? (Y or N):\n"
default: "Y"
private: no
- name: "proxy_enabled"
prompt: "Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing? (y/n):\n"
default: "y"
private: no
- name: "auditd_enabled"
prompt: "Do you want to use auditd ? (Y or N):\n"
default: "Y"
private: no
- name: "ssh_tunneling_enabled"
prompt: "Do you want to use SSH tunneling ? (Y or N):\n"
default: "Y"
private: no
- name: "easyrsa_p12_export_password"
prompt: "Enter the password for p12 certificates:\n"
default: "vpn"
private: yes
- name: "auditd_enabled"
prompt: "Do you want to use auditd for security monitoring (see config.cfg)? (y/n):\n"
default: "y"
private: no
- name: "ssh_tunneling_enabled"
prompt: "Do you want each user to have their own account for SSH tunneling? (y/n):\n"
default: "y"
private: no
- name: "easyrsa_p12_export_password"
prompt: "Enter a password for p12 certificates:\n"
default: "vpn"
private: yes
roles:
- cloud-ec2
@ -102,7 +101,7 @@
- common
- security
- vpn
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "Y" }
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "Y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == 'Y' }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "Y" }
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "y" }
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == "y" }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }

33
gce.yml
View file

@ -1,3 +1,4 @@
# vim:ft=ansible:
- name: Configure the server and install required software
hosts: localhost
gather_facts: false
@ -54,27 +55,27 @@
private: no
- name: "dns_enabled"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (Y or N):\n"
default: "Y"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (y/n):\n"
default: "y"
private: no
- name: "proxy_enabled"
prompt: "Do you want to install a proxy to block ads and decrease traffic usage while surfing? (Y or N):\n"
default: "Y"
prompt: "Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing? (y/n):\n"
default: "y"
private: no
- name: "auditd_enabled"
prompt: "Do you want to use auditd ? (Y or N):\n"
default: "Y"
prompt: "Do you want to use auditd for security monitoring (see config.cfg)? (y/n):\n"
default: "y"
private: no
- name: "ssh_tunneling_enabled"
prompt: "Do you want to use SSH tunneling ? (Y or N):\n"
default: "Y"
prompt: "Do you want each user to have their own account for SSH tunneling? (y/n):\n"
default: "y"
private: no
- name: "easyrsa_p12_export_password"
prompt: "Enter the password for p12 certificates:\n"
prompt: "Enter a password for p12 certificates:\n"
default: "vpn"
private: yes
@ -98,7 +99,7 @@
- common
- security
- vpn
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "Y" }
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "Y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == 'Y' }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "Y" }
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "y" }
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == "y" }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }

77
non-cloud.yml
View file

@ -1,47 +1,48 @@
# vim:ft=ansible:
- hosts: localhost
gather_facts: False
vars_files:
- config.cfg
vars_prompt:
- name: "server_ip"
prompt: "Enter IP address of your server: (use localhost for local installation)\n"
default: localhost
private: no
- name: "server_ip"
prompt: "Enter IP address of your server: (use localhost for local installation)\n"
default: localhost
private: no
- name: "server_user"
prompt: "What user should we use to login on the server? (ignore if you're deploying to localhost):\n"
default: "root"
private: no
- name: "server_user"
prompt: "What user should we use to login on the server? (ignore if you're deploying to localhost):\n"
default: "root"
private: no
- name: "dns_enabled"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (y/n):\n"
default: "y"
private: no
- name: "dns_enabled"
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (Y or N):\n"
default: "Y"
private: no
- name: "proxy_enabled"
prompt: "Do you want to install a proxy to block ads and decrease traffic usage while surfing? (Y or N):\n"
default: "Y"
private: no
- name: "proxy_enabled"
prompt: "Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing? (y/n):\n"
default: "y"
private: no
- name: "auditd_enabled"
prompt: "Do you want to use auditd ? (Y or N):\n"
default: "Y"
private: no
- name: "auditd_enabled"
prompt: "Do you want to use auditd for security monitoring (see config.cfg)? (y/n):\n"
default: "y"
private: no
- name: "ssh_tunneling_enabled"
prompt: "Do you want each user to have their own account for SSH tunneling? (y/n):\n"
default: "y"
private: no
- name: "easyrsa_p12_export_password"
prompt: "Enter a password for p12 certificates:\n"
default: "vpn"
private: yes
- name: "ssh_tunneling_enabled"
prompt: "Do you want to use SSH tunneling ? (Y or N):\n"
default: "Y"
private: no
- name: "easyrsa_p12_export_password"
prompt: "Enter the password for p12 certificates:\n"
default: "vpn"
private: yes
- name: "IP_subject"
prompt: "Enter public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)\n"
private: no
- name: "IP_subject"
prompt: "Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)\n"
private: no
tasks:
- name: Add the server to the vpn-host group
@ -76,7 +77,7 @@
- common
- security
- vpn
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "Y" }
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "Y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == 'Y' }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "Y" }
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "y" }
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "y" }
- { role: logging, when: auditd_enabled is defined and auditd_enabled == "y" }
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }

4
roles/common/tasks/main.yml
View file

@ -33,7 +33,7 @@
- name: SSH config
template: src=sshd_config.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0644
notify:
- restart ssh
- restart ssh
- name: Disable MOTD on login and SSHD
replace: dest="{{ item.file }}" regexp="{{ item.regexp }}" replace="{{ item.line }}"
@ -70,7 +70,7 @@
lineinfile: dest=/etc/network/interfaces line='source /etc/network/interfaces.d/10-loopback-services.cfg' state=present
notify:
- restart loopback
- meta: flush_handlers
- name: Enable packet forwarding for IPv4

13
roles/common/templates/sshd_config.j2
View file

@ -24,7 +24,6 @@ PubkeyAuthentication yes
AcceptEnv LANG LC_*
# Turn off a lot of features
AllowAgentForwarding no
IgnoreRhosts yes
RhostsRSAAuthentication no
RSAAuthentication no
@ -33,7 +32,6 @@ PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
UseDNS no
X11Forwarding no
# Do not enable sftp
# If you DO enable it, use this line to log which files sftp users read/write
@ -51,21 +49,16 @@ HostKey /etc/ssh/ssh_host_ed25519_key
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
###
# TODO: I haven't seen anyone review these yet
# HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
# TODO: I haven't seen anyone review these yet
# PubkeyAcceptedKeyTypes ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519
# TODO: I think we want to enable tunnels but disable stream local fowarding?
# PermitTunnel yes
# AllowStreamLocalForwarding no
{% if ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "Y" %}
Match Group algo
AllowTcpForwarding remote
AllowAgentForwarding no
AllowStreamLocalForwarding no
PermitTunnel no
X11Forwarding no
{% endif %}

16
roles/dns_adblocking/tasks/main.yml
View file

@ -8,24 +8,24 @@
template: src=usr.sbin.dnsmasq.j2 dest=/etc/apparmor.d/usr.sbin.dnsmasq owner=root group=root mode=0600
notify:
- restart dnsmasq
- name: The dnsmasq directory created
file: dest=/var/lib/dnsmasq state=directory mode=755 owner=dnsmasq group=nogroup
file: dest=/var/lib/dnsmasq state=directory mode=0755 owner=dnsmasq group=nogroup
- name: Enforce the dnsmasq AppArmor policy
shell: aa-enforce usr.sbin.dnsmasq
- name: Ensure that the dnsmasq service directory exist
file: path=/etc/systemd/system/dnsmasq.service.d/ state=directory mode=0755 owner=root group=root
- name: Setup the cgroup limitations for the ipsec daemon
template: src=100-CustomLimitations.conf.j2 dest=/etc/systemd/system/dnsmasq.service.d/100-CustomLimitations.conf
notify:
- daemon-reload
- daemon-reload
- restart dnsmasq
- meta: flush_handlers
- meta: flush_handlers
- name: Dnsmasq configured
template: src=dnsmasq.conf.j2 dest=/etc/dnsmasq.conf
notify:
@ -35,7 +35,7 @@
template: src=adblock.sh dest=/opt/adblock.sh owner=root group=root mode=0755
- name: Adblock script added to cron
cron:
cron:
name: Adblock hosts update
minute: 10
hour: 2

4
roles/proxy/handlers/main.yml
View file

@ -1,8 +1,8 @@
- name: restart privoxy
service: name=privoxy state=restarted
- name: daemon-reload
shell: systemctl daemon-reload
shell: systemctl daemon-reload
- name: restart apparmor
service: name=apparmor state=restarted

20
roles/proxy/tasks/main.yml
View file

@ -16,17 +16,17 @@
- name: Enforce the privoxy AppArmor policy
shell: aa-enforce usr.sbin.privoxy
- name: Ensure that the privoxy service directory exist
file: path=/etc/systemd/system/privoxy.service.d/ state=directory mode=0755 owner=root group=root
- name: Setup the cgroup limitations for the privoxy daemon
template: src=privoxy_100-CustomLimitations.conf.j2 dest=/etc/systemd/system/privoxy.service.d/100-CustomLimitations.conf
notify:
- daemon-reload
- daemon-reload
- restart privoxy
- meta: flush_handlers
- meta: flush_handlers
- name: Privoxy enabled and started
service: name=privoxy state=started enabled=yes
@ -70,14 +70,14 @@
template: src=ports.conf.j2 dest=/etc/apache2/ports.conf
notify:
- restart apache2
- name: Ensure that the apache2 service directory exist
file: path=/etc/systemd/system/apache2.service.d/ state=directory mode=0755 owner=root group=root
- name: Setup the cgroup limitations for the apache2 daemon
template: src=apache2_100-CustomLimitations.conf.j2 dest=/etc/systemd/system/apache2.service.d/100-CustomLimitations.conf
notify:
- daemon-reload
- daemon-reload
- restart apache2
- meta: flush_handlers
- meta: flush_handlers

4
roles/security/handlers/main.yml
View file

@ -1,8 +1,8 @@
- name: restart rsyslog
service: name=rsyslog state=restarted
- name: restart iptables
service: name=netfilter-persistent state=restarted
- name: flush routing cache
shell: echo 1 > /proc/sys/net/ipv4/route/flush

2
roles/security/tasks/main.yml
View file

@ -97,6 +97,6 @@
template: src="{{ item.src }}" dest="{{ item.dest }}" owner=root group=root mode=0640
with_items:
- { src: rules.v4.j2, dest: /etc/iptables/rules.v4 }
- { src: rules.v6.j2, dest: /etc/iptables/rules.v6 }
- { src: rules.v6.j2, dest: /etc/iptables/rules.v6 }
notify:
- restart iptables

10
roles/ssh_tunneling/tasks/main.yml
View file

@ -2,12 +2,12 @@
- name: Ensure that the algo group exist
group: name=algo state=present
- name: Ensure that the jail directory exist
file: path=/var/jail/ state=directory mode=0755 owner=root group=root
file: path=/var/jail/ state=directory mode=0755 owner=root group=root
- name: Ensure that the SSH users exist
user:
user:
name: "{{ item }}"
group: algo
home: '/var/jail/{{ item }}'
@ -17,5 +17,5 @@
ssh_key_type: ecdsa
ssh_key_bits: 521
ssh_key_comment: '{{ item }}@{{ IP_subject_alt_name }}'
state: present
state: present
with_items: "{{ users }}"

2
roles/vpn/handlers/main.yml
View file

@ -1,6 +1,6 @@
- name: restart strongswan
service: name=strongswan state=restarted
- name: daemon-reload
shell: systemctl daemon-reload

24
roles/vpn/tasks/main.yml
View file

@ -1,6 +1,6 @@
- name: Gather Facts
setup:
- name: Install StrongSwan
apt: name=strongswan state=latest update_cache=yes
@ -19,28 +19,28 @@
- apparmor
- strongswan
- netfilter-persistent
- name: Ensure that the strongswan group exist
group: name=strongswan state=present
- name: Ensure that the strongswan user exist
user: name=strongswan group=strongswan state=present
- name: Ensure that the strongswan service directory exist
file: path=/etc/systemd/system/strongswan.service.d/ state=directory mode=0755 owner=root group=root
- name: Setup the cgroup limitations for the ipsec daemon
template: src=100-CustomLimitations.conf.j2 dest=/etc/systemd/system/strongswan.service.d/100-CustomLimitations.conf
notify:
- daemon-reload
- daemon-reload
- restart strongswan
- meta: flush_handlers
- meta: flush_handlers
- name: Setup the strongswan.conf file from our template
template: src=strongswan.conf.j2 dest=/etc/strongswan.conf owner=root group=root mode=0644
notify:
- restart strongswan
- restart strongswan
- name: Setup the ipsec.conf file from our template
template: src=ipsec.conf.j2 dest=/etc/ipsec.conf owner=root group=root mode=0644
@ -148,11 +148,11 @@
- name: Fetch users mobileconfig
fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.mobileconfig dest=configs/{{ IP_subject_alt_name }}_{{ item }}.mobileconfig flat=yes
with_items: "{{ users }}"
- name: Restrict permissions
file: path="{{ item }}" state=directory mode=0700 owner=strongswan group=root
with_items:
- /etc/ipsec.d/private
- /etc/ipsec.d/private
- name: Fetch server CA certificate
fetch: src=/{{ easyrsa_dir }}/easyrsa3/pki/ca.crt dest=configs/{{ IP_subject_alt_name }}_ca.crt flat=yes