Commit graph

131 commits

Author SHA1 Message Date
Jack Ivanov
91a9dfd983 invoke dns encryption from main playbook instead of meta-dependencies (#1097) 2018-09-02 14:52:59 -04:00
Jack Ivanov
e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
2018-08-27 10:05:45 -04:00
Jack Ivanov
ca59eeb5c3 Explicitly allow traffic between clients if enabled (#1028) 2018-07-20 10:31:27 -04:00
Jack Ivanov
07a6bbe652
Move max_mss to config.cfg (#1015)
* Move max_mss to config.cfg

* Add docs about max_mss

* Update troubleshooting.md
2018-07-03 09:06:45 +03:00
Jack Ivanov
4ca8c03e3c New default cipher suite (#991)
* New ciphers enabled

* Update CHANGELOG.md

* Switch ecparam to secp384r1

* Change CertificateType to ECDSA384
2018-06-27 11:22:45 -04:00
Jack Ivanov
3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
2018-05-24 08:15:27 -07:00
Evgeny Aleksandrov
d9dc68164f Remove algo_params (#961) 2018-05-24 09:01:26 +03:00
Evgeny Aleksandrov
87836e0358 Fix typo (#960) 2018-05-24 09:00:38 +03:00
Jack Ivanov
35e526a5a3 IPv6 fixes (#930) 2018-05-08 13:55:17 -07:00
Jack Ivanov
c82bd8c5ff DNS-over-HTTPS (#875) 2018-04-25 12:27:58 -07:00
Jack Ivanov
ed6e2d998d Add ipv6 address to subjectAltName if supported (#881)
CHANGELOG

Some changes

Some changes
2018-04-23 16:06:34 -07:00
Micah R Ledbetter
e944ee993a Embed certs into Windows deployment scripts (#840)
- Obviate need to copy separate script and certificate files
- Allow execution from any directory, not just the script's parent
  directory (no assumption of any particular working directory)
- Fix docs that neglected to mention copying cacert.pem
- Fix docs that incorrectly referred to the user cert store

As part of this work, rewrite the windows_client.ps1.j2 deployment
script template

- Add comment-based help
- Require admin privileges
- Use a Param() block
- Use parameter sets with -Add and -Remove switches
- Add the -GetInstalledCerts switch, to list any Algo certificates
  installed the machine's cert store
- Add the -SaveCerts switch, to save the embedded certificates to files
- Put Jinja2 variables inside Powershell variables,
- Use native Powershell cmdlets rather than shell out to certutil.exe
- Add a playbook to regenerate the windows_USER.ps1 scripts
2018-03-28 11:20:43 -07:00
Micah R Ledbetter
4b0aea8f5a Document iptables rules (#854)
* Remove firewall rule related to the old proxy role

* Remove proxy conditionals from mobileconfig template

* Add comments explaining firewall rules
2018-03-28 11:17:56 -07:00
Jack Ivanov
78830d96aa Android: add the CA and set the ciphers explicitly (#837) 2018-03-19 12:05:30 -04:00
Jack Ivanov
4e4440a318 Exclude CA from P12 (#835) 2018-03-17 17:16:22 -04:00
adamluk
b30f6db079 Update rules.v6.j2 (#818)
Updated to use -m conntrack for consistency as per the other IPv6 rules.
2018-03-12 11:51:34 -04:00
Jack Ivanov
02427910de Ansible 2.4, Lightsail, Scaleway, DreamCompute (OpenStack) integration (#804)
* Move to ansible-2.4.3

* Add Lightsail support #623

* Fixing the EC2 deployment

* Scaleway integration #623

* OpenStack cloud provider (DreamCompute optimised) #623

* Remove the security role

* Enable unattended-upgrades for clouds

* New requirements to make Azure and GCE work
2018-03-02 07:55:54 -05:00
Jack Ivanov
f18c1a0d67 Certificate revocation fix (#719) 2017-11-12 17:09:57 -05:00
Julie Bernosky
dc4dff040e Add StrongSwan log level config option to ipsec.conf template (#700) 2017-10-19 16:06:43 +02:00
Jack Ivanov
ee7264f26e Ask users to enter the p12 password manually (#697) 2017-10-18 16:15:39 -04:00
Jack Ivanov
6b803e069f LibreSSL fix #625 (#685) 2017-10-01 16:40:08 -04:00
Jack Ivanov
9d8e39f63d Move back to the Xenial repo (#606) 2017-06-21 13:39:29 -04:00
Jack Ivanov
f0283856ad fix revocation (#586) 2017-06-06 12:42:23 +02:00
Jack Ivanov
26c202ded5 Generate p12 each deployment. Generate ps1 scripts if windows supported. Define become for all the section. (#580) 2017-06-04 12:18:55 -04:00
Jack Ivanov
ba7859ba5f Revoke non-existing users fix 2017-06-04 11:30:55 +02:00
Jack Ivanov
0131505195 Enhance PS1 script (#510)
update docs

Update README.md

update readme
2017-05-23 11:31:53 -04:00
Jack Ivanov
ee6db37428 Change the P12 and SSH passwords only for new users (#550) 2017-05-21 22:28:18 -04:00
Jack Ivanov
40e0363b18 Add html helper for Android (#554)
* add html helper #280

move to the new local schema

fix a typo

* Update client-android.md
2017-05-21 22:27:53 -04:00
Ruben Jongejan
e9e6c6e383 cleaner syntax for local actions (#536)
* refactored local actions to cleaner syntax

* openssl commands folded

* removed unnecessary local_action's
2017-05-17 02:30:04 -04:00
tetov
ac6db06a19 grammar edit (#540)
* grammar edit

* Update openssl.yml
2017-05-10 10:06:19 -04:00
Jack Ivanov
58d5a06e87 delete tasks and move to roles (#519) 2017-05-08 16:34:45 -04:00
Ruben Jongejan
07ddb5863b improved readability with native yaml (#530) 2017-05-08 16:34:24 -04:00
Jack Ivanov
9f698fdd68 Get strongswan from the Zesty repo on Xenial (#515) 2017-05-03 16:03:10 -04:00
Jack Ivanov
bd348af9c2 Implementing blocks and additional fail hints #487 (#497)
change the troubleshooting url
2017-04-29 10:48:25 -04:00
Jack Ivanov
2f5c050fd2 dpdaction to clear (#498) 2017-04-27 14:47:45 -04:00
Jack Ivanov
0ed68b6c30 Properly configure ICMP restrictions (#492) 2017-04-27 12:47:05 -04:00
Ryan Kasper
0cb43650cb Windows 10 -PfsGroup None --> -PfsGroup ECP256 (#493)
* Windows 10 -PfsGroup None --> -PfsGroup ECP256

Fixes broken tunnel when rekey (CREATE_CHILD_SA request [ N(REKEY_SA) SA No TSi TSr KE ]) occurs (on my Windows 10 1703 build 15063.138 Creator's Update system this is ~every 57 minutes)

* Update Windows Client PfsGroup Commandline
2017-04-27 12:46:50 -04:00
Jack Ivanov
540c761d3b Disable RSA in the mobileconfigs. Fixes #486 2017-04-25 23:06:51 +02:00
Jack Ivanov
451394100d Some enhances in the compat ciphers (#464)
raise the IntegrityCheckMethod to SHA384

Move Windows to ECDSA

Increase IntegrityCheckMethod
2017-04-23 16:00:37 -04:00
Jack Ivanov
c3fcfe5d0d Let users choose the distro version #449 (#466)
Make dpdaction great again

add 1704 to travis

Make EC2 image name more convenient

modify apparmor profile
2017-04-22 17:06:10 -04:00
Andy Boutte
76cdc69548 CF tested and working for EC2 deployment (#431)
* AWS CloudFormation #132

* IPv6 EC2 draft

* CF tested and working for EC2 deployment

* IPv6 Implementation, EC2, Cloudformation

* Fixed ipv6 networking

* adding ip6tables rule for DHCP on AWS
2017-04-20 18:04:57 -04:00
Jack Ivanov
a7b06058cb remove the proxy role #440 (#457)
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
2017-04-20 18:00:17 -04:00
Dan Guido
0b05ea19bc Windows needs SHA2-256. Closes #453. (#456) 2017-04-20 07:26:46 -04:00
Dan Guido
8173b84ff8 Change uniqueids back to never (#448)
We need this to allow multiple connections with the same id/certificate
2017-04-19 09:53:30 +02:00
Dan Guido
f9f7be7b0d Fix a typo from #439 2017-04-18 01:15:07 -04:00
Dan Guido
1778cb1f45 disable dpd #430 (#437)
Closes #430
2017-04-18 01:12:21 -04:00
Dan Guido
8e5e6d5088 remove extraneous integrity algos from AEAD ciphers (#439)
In reference to
https://github.com/trailofbits/algo/issues/9#issuecomment-294370560
2017-04-18 01:11:56 -04:00
Jack Ivanov
fa5a956193 Add URLStringProbe (#428)
* Add URLStringProbe

* switch to Apple's hotspot-detect.html
2017-04-17 23:16:05 -04:00
Jack Ivanov
ea5976f49b write logs to file if BSD only 2017-04-17 18:12:38 +02:00
MiWCryptAnalytics
04b61ca3d2 Increase CA key entropy to 128bit (#415)
Changes the default CA key size from 48 bit to 128bit with OpenSSL usermode CSPRNG with hex encoding
2017-04-15 16:23:15 -04:00