Jack Ivanov
0131505195
Enhance PS1 script ( #510 )
...
update docs
Update README.md
update readme
2017-05-23 11:31:53 -04:00
Jack Ivanov
ee6db37428
Change the P12 and SSH passwords only for new users ( #550 )
2017-05-21 22:28:18 -04:00
Jack Ivanov
40e0363b18
Add html helper for Android ( #554 )
...
* add html helper #280
move to the new local schema
fix a typo
* Update client-android.md
2017-05-21 22:27:53 -04:00
Ruben Jongejan
e9e6c6e383
cleaner syntax for local actions ( #536 )
...
* refactored local actions to cleaner syntax
* openssl commands folded
* removed unnecessary local_action's
2017-05-17 02:30:04 -04:00
tetov
ac6db06a19
grammar edit ( #540 )
...
* grammar edit
* Update openssl.yml
2017-05-10 10:06:19 -04:00
Jack Ivanov
58d5a06e87
delete tasks and move to roles ( #519 )
2017-05-08 16:34:45 -04:00
Ruben Jongejan
07ddb5863b
improved readability with native yaml ( #530 )
2017-05-08 16:34:24 -04:00
Jack Ivanov
9f698fdd68
Get strongswan from the Zesty repo on Xenial ( #515 )
2017-05-03 16:03:10 -04:00
Jack Ivanov
bd348af9c2
Implementing blocks and additional fail hints #487 ( #497 )
...
change the troubleshooting url
2017-04-29 10:48:25 -04:00
Jack Ivanov
2f5c050fd2
dpdaction to clear ( #498 )
2017-04-27 14:47:45 -04:00
Jack Ivanov
0ed68b6c30
Properly configure ICMP restrictions ( #492 )
2017-04-27 12:47:05 -04:00
Ryan Kasper
0cb43650cb
Windows 10 -PfsGroup None --> -PfsGroup ECP256 ( #493 )
...
* Windows 10 -PfsGroup None --> -PfsGroup ECP256
Fixes broken tunnel when rekey (CREATE_CHILD_SA request [ N(REKEY_SA) SA No TSi TSr KE ]) occurs (on my Windows 10 1703 build 15063.138 Creator's Update system this is ~every 57 minutes)
* Update Windows Client PfsGroup Commandline
2017-04-27 12:46:50 -04:00
Jack Ivanov
540c761d3b
Disable RSA in the mobileconfigs. Fixes #486
2017-04-25 23:06:51 +02:00
Jack Ivanov
451394100d
Some enhances in the compat ciphers ( #464 )
...
raise the IntegrityCheckMethod to SHA384
Move Windows to ECDSA
Increase IntegrityCheckMethod
2017-04-23 16:00:37 -04:00
Jack Ivanov
c3fcfe5d0d
Let users choose the distro version #449 ( #466 )
...
Make dpdaction great again
add 1704 to travis
Make EC2 image name more convenient
modify apparmor profile
2017-04-22 17:06:10 -04:00
Andy Boutte
76cdc69548
CF tested and working for EC2 deployment ( #431 )
...
* AWS CloudFormation #132
* IPv6 EC2 draft
* CF tested and working for EC2 deployment
* IPv6 Implementation, EC2, Cloudformation
* Fixed ipv6 networking
* adding ip6tables rule for DHCP on AWS
2017-04-20 18:04:57 -04:00
Jack Ivanov
a7b06058cb
remove the proxy role #440 ( #457 )
...
* remove the proxy role #440
* Separate facts. Make roles more independent from each other
move openssl to local tasks
move unneeded tasks
2017-04-20 18:00:17 -04:00
Dan Guido
0b05ea19bc
Windows needs SHA2-256. Closes #453 . ( #456 )
2017-04-20 07:26:46 -04:00
Dan Guido
8173b84ff8
Change uniqueids back to never ( #448 )
...
We need this to allow multiple connections with the same id/certificate
2017-04-19 09:53:30 +02:00
Dan Guido
f9f7be7b0d
Fix a typo from #439
2017-04-18 01:15:07 -04:00
Dan Guido
1778cb1f45
disable dpd #430 ( #437 )
...
Closes #430
2017-04-18 01:12:21 -04:00
Dan Guido
8e5e6d5088
remove extraneous integrity algos from AEAD ciphers ( #439 )
...
In reference to
https://github.com/trailofbits/algo/issues/9#issuecomment-294370560
2017-04-18 01:11:56 -04:00
Jack Ivanov
fa5a956193
Add URLStringProbe ( #428 )
...
* Add URLStringProbe
* switch to Apple's hotspot-detect.html
2017-04-17 23:16:05 -04:00
Jack Ivanov
ea5976f49b
write logs to file if BSD only
2017-04-17 18:12:38 +02:00
MiWCryptAnalytics
04b61ca3d2
Increase CA key entropy to 128bit ( #415 )
...
Changes the default CA key size from 48 bit to 128bit with OpenSSL usermode CSPRNG with hex encoding
2017-04-15 16:23:15 -04:00
Jack Ivanov
02f363d825
change the order of ciphers
2017-04-15 16:36:39 +02:00
mathew19
ae43ed6f81
Update client_ipsec.secrets.j2 ( #414 )
...
Fix filename in client ipsec_user.secrets
2017-04-15 14:57:22 +02:00
mathew19
5e56996f5c
Fix name ( #411 )
2017-04-15 14:57:07 +02:00
Jack Ivanov
c61a07fb60
Escaping Special Characters #388 ( #403 )
2017-04-14 14:57:27 -04:00
Jack Ivanov
56a72e5af2
New ciphers implementing #247 ( #352 )
...
Switches to SHA2_512_256 HMAC integrity algorithm and adds cipher compatibility for other platforms.
2017-04-11 16:08:03 -04:00
Dan Guido
e55ce03906
URLStringProbe with this URL does not work as intended
2017-04-09 10:44:32 -04:00
Dan Guido
5e22b79033
Add configuration for URL probes to Apple profile
...
Chrome and Android both request a known URL that generates HTTP 204 No Content responses to determine if they have internet connectivity. In Apple profiles, we can use the same URL to determine whether the VPN needs to connect. Using this feature will help save battery life for lots of users.
2017-04-09 09:52:23 -04:00
Jack Ivanov
47515154bb
add mtu in the sswan profile
2017-04-08 10:39:04 +02:00
brad2014
09e5d87c7b
Minor name and documentation edits ( #327 )
2017-04-01 00:19:10 -04:00
Dan Guido
655a917dd2
iptables filter table fix ( #285 )
2017-03-27 00:04:46 -04:00
Jack Ivanov
6facb6cb4f
FreeBSD / HardenedBSD ( #262 )
...
* FreeBSD draft
ifconfig fix
Pre-tasks fixes
fix hardcoded IP
some refactoring
disable system-based tags
disable freebsd tags
FreeBSD vpn role
add defaults
ssh role freebsd
default fix
dns_adblocking freebsd
ubuntu dict fix
* HardenedBSD
update-users BSD
* Rebuild the kernel
docs changing
2017-03-18 12:22:07 +03:00
Jack Ivanov
49ba1f76b4
Some improvements in the mobileconfig. Fixes #270
2017-03-18 11:07:56 +03:00
Jack Ivanov
5cbf125202
Some refactoring. Disable unneeded variables.
2017-03-05 21:33:01 +03:00
Jack Ivanov
237fcc7a7f
additional variables
2017-03-05 10:58:42 +03:00
Jack Ivanov
8eb208c5b7
enable ipv6 if the default gateway is defined. Fixes #244
2017-02-26 20:17:12 +03:00
Craig
43c2f5c31a
Installs the recommended packages with strongswan, because we need the OpenSSL ( #260 )
...
plugin from libstrongswan-standard-plugins for ECDH to work.
2017-02-25 21:07:32 +03:00
Jack Ivanov
e31f10da6d
Fixes #255
2017-02-23 18:25:46 +03:00
Jack Ivanov
aca036142f
AndroidVPNClientProfiles #240
2017-02-17 00:30:21 +03:00
Jack Ivanov
20ebd7a595
rename connection
2017-02-12 23:01:29 +03:00
akirilov
05ab1f5feb
Modified certificate generation to address issues #234 and #228 ( #235 )
...
* Modified certificate generation to address issues #234 and #228
I have made the following modifications to comply with the IKEv2 client certificate requirements:
- Changed client certificate CN to {{ IP_subject_alt_name }}_{{ item }} from {{ item }}
- Changed client certificate SAN to {{IP_subject_alt_name }} from {{ item }}
- Added clientAuth to client certificate EKU
I have made the following changes to address a mismatch in the windows deployment script and file names:
- Changed the client certificate (.p12) filename in config/{{ IP_subject_alt_name }} to {{ IP_subject_alt_name}}_{{ item }}.p12 from {{ item }}.p12 to match the ps1 script
Testing:
I have tested the changes on Windows 10 client, Ubuntu 16.04.1 server (DigitalOcean) - the config described in Issue #234
I apologize for not being able to test on other configurations. I hope that someone else can verify my changes
* fixed iOS issues
* fixed accidentall user change
* simplified changes
* Final iteration. I think that's all I can do to minimize the changes
2017-02-12 22:45:36 +03:00
Jack Ivanov
35faf4bca7
Local openssl tasks ( #169 )
...
* Draft
works with ECDSA
RSA support for Windows
* update-users with local_openssl_tasks
* move prompts to the algo script
* additional directory for SSH keys
* move easyrsa_p12_export_password to pre_tasks
* update-users testing
* Fix hardcoded vars
* Delete the CA key
* Hardcoded IP. Fixes #219
* Some fixes
2017-02-03 14:24:02 -05:00
Jack Ivanov
2798f84d3f
ensure that apparmor is supported by the kernel #215
2017-01-16 00:19:57 +03:00
Jack Ivanov
3e852caf04
disable compression #146
2017-01-14 19:56:23 +03:00
Jack Ivanov
a50a396b94
addtiional fixes
2017-01-11 20:55:44 +03:00
Jack Ivanov
f246165298
Fix a typo
2017-01-04 17:45:42 +03:00
