Commit graph

137 commits

Author SHA1 Message Date
Jack Ivanov
45b00ee994
BSD StrongSwan fixes (#1207) 2018-11-20 19:20:24 +01:00
Jack Ivanov
66d30e3005
WireGuard update-users fix (#1183) 2018-11-12 18:03:31 +01:00
TC1977
a76642c4d5 Update mobileconfig.j2 (#1197)
Adds "Algo VPN" to the organization in the "Profiles" menu of "General Settings". (The type still shows up as "Unknown" in the "VPN" menu, because that seems to be governed by the "VPNSubType" string, which must be empty according to the [developer reference](https://developer.apple.com/enterprise/documentation/Configuration-Profile-Reference.pdf) Maybe this can help clear the way for #1101.
2018-11-12 10:21:54 +01:00
Jack Ivanov
efc8dc7620
add tags for the wireguard qr code task. variables fix (#1147) 2018-10-14 10:22:45 +03:00
Jack Ivanov
bcba905547 ssh tunneling fixes (#1127) 2018-10-07 17:33:55 -07:00
Jack Ivanov
dbd68aa97d WireGuard BSD (#1083)
* WireGuard BSD

* Remove unneeded config option

* Enable PersistentKeepalive for NAT and Firewall Traversal Persistence

* Install dnscrypt-proxy from repositories
2018-09-27 04:18:12 -04:00
Jack Ivanov
91a9dfd983 invoke dns encryption from main playbook instead of meta-dependencies (#1097) 2018-09-02 14:52:59 -04:00
Jack Ivanov
e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
2018-08-27 10:05:45 -04:00
Jack Ivanov
ca59eeb5c3 Explicitly allow traffic between clients if enabled (#1028) 2018-07-20 10:31:27 -04:00
Jack Ivanov
07a6bbe652
Move max_mss to config.cfg (#1015)
* Move max_mss to config.cfg

* Add docs about max_mss

* Update troubleshooting.md
2018-07-03 09:06:45 +03:00
Jack Ivanov
4ca8c03e3c New default cipher suite (#991)
* New ciphers enabled

* Update CHANGELOG.md

* Switch ecparam to secp384r1

* Change CertificateType to ECDSA384
2018-06-27 11:22:45 -04:00
Jack Ivanov
3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
2018-05-24 08:15:27 -07:00
Evgeny Aleksandrov
d9dc68164f Remove algo_params (#961) 2018-05-24 09:01:26 +03:00
Evgeny Aleksandrov
87836e0358 Fix typo (#960) 2018-05-24 09:00:38 +03:00
Jack Ivanov
35e526a5a3 IPv6 fixes (#930) 2018-05-08 13:55:17 -07:00
Jack Ivanov
c82bd8c5ff DNS-over-HTTPS (#875) 2018-04-25 12:27:58 -07:00
Jack Ivanov
ed6e2d998d Add ipv6 address to subjectAltName if supported (#881)
CHANGELOG

Some changes

Some changes
2018-04-23 16:06:34 -07:00
Micah R Ledbetter
e944ee993a Embed certs into Windows deployment scripts (#840)
- Obviate need to copy separate script and certificate files
- Allow execution from any directory, not just the script's parent
  directory (no assumption of any particular working directory)
- Fix docs that neglected to mention copying cacert.pem
- Fix docs that incorrectly referred to the user cert store

As part of this work, rewrite the windows_client.ps1.j2 deployment
script template

- Add comment-based help
- Require admin privileges
- Use a Param() block
- Use parameter sets with -Add and -Remove switches
- Add the -GetInstalledCerts switch, to list any Algo certificates
  installed the machine's cert store
- Add the -SaveCerts switch, to save the embedded certificates to files
- Put Jinja2 variables inside Powershell variables,
- Use native Powershell cmdlets rather than shell out to certutil.exe
- Add a playbook to regenerate the windows_USER.ps1 scripts
2018-03-28 11:20:43 -07:00
Micah R Ledbetter
4b0aea8f5a Document iptables rules (#854)
* Remove firewall rule related to the old proxy role

* Remove proxy conditionals from mobileconfig template

* Add comments explaining firewall rules
2018-03-28 11:17:56 -07:00
Jack Ivanov
78830d96aa Android: add the CA and set the ciphers explicitly (#837) 2018-03-19 12:05:30 -04:00
Jack Ivanov
4e4440a318 Exclude CA from P12 (#835) 2018-03-17 17:16:22 -04:00
adamluk
b30f6db079 Update rules.v6.j2 (#818)
Updated to use -m conntrack for consistency as per the other IPv6 rules.
2018-03-12 11:51:34 -04:00
Jack Ivanov
02427910de Ansible 2.4, Lightsail, Scaleway, DreamCompute (OpenStack) integration (#804)
* Move to ansible-2.4.3

* Add Lightsail support #623

* Fixing the EC2 deployment

* Scaleway integration #623

* OpenStack cloud provider (DreamCompute optimised) #623

* Remove the security role

* Enable unattended-upgrades for clouds

* New requirements to make Azure and GCE work
2018-03-02 07:55:54 -05:00
Jack Ivanov
f18c1a0d67 Certificate revocation fix (#719) 2017-11-12 17:09:57 -05:00
Julie Bernosky
dc4dff040e Add StrongSwan log level config option to ipsec.conf template (#700) 2017-10-19 16:06:43 +02:00
Jack Ivanov
ee7264f26e Ask users to enter the p12 password manually (#697) 2017-10-18 16:15:39 -04:00
Jack Ivanov
6b803e069f LibreSSL fix #625 (#685) 2017-10-01 16:40:08 -04:00
Jack Ivanov
9d8e39f63d Move back to the Xenial repo (#606) 2017-06-21 13:39:29 -04:00
Jack Ivanov
f0283856ad fix revocation (#586) 2017-06-06 12:42:23 +02:00
Jack Ivanov
26c202ded5 Generate p12 each deployment. Generate ps1 scripts if windows supported. Define become for all the section. (#580) 2017-06-04 12:18:55 -04:00
Jack Ivanov
ba7859ba5f Revoke non-existing users fix 2017-06-04 11:30:55 +02:00
Jack Ivanov
0131505195 Enhance PS1 script (#510)
update docs

Update README.md

update readme
2017-05-23 11:31:53 -04:00
Jack Ivanov
ee6db37428 Change the P12 and SSH passwords only for new users (#550) 2017-05-21 22:28:18 -04:00
Jack Ivanov
40e0363b18 Add html helper for Android (#554)
* add html helper #280

move to the new local schema

fix a typo

* Update client-android.md
2017-05-21 22:27:53 -04:00
Ruben Jongejan
e9e6c6e383 cleaner syntax for local actions (#536)
* refactored local actions to cleaner syntax

* openssl commands folded

* removed unnecessary local_action's
2017-05-17 02:30:04 -04:00
tetov
ac6db06a19 grammar edit (#540)
* grammar edit

* Update openssl.yml
2017-05-10 10:06:19 -04:00
Jack Ivanov
58d5a06e87 delete tasks and move to roles (#519) 2017-05-08 16:34:45 -04:00
Ruben Jongejan
07ddb5863b improved readability with native yaml (#530) 2017-05-08 16:34:24 -04:00
Jack Ivanov
9f698fdd68 Get strongswan from the Zesty repo on Xenial (#515) 2017-05-03 16:03:10 -04:00
Jack Ivanov
bd348af9c2 Implementing blocks and additional fail hints #487 (#497)
change the troubleshooting url
2017-04-29 10:48:25 -04:00
Jack Ivanov
2f5c050fd2 dpdaction to clear (#498) 2017-04-27 14:47:45 -04:00
Jack Ivanov
0ed68b6c30 Properly configure ICMP restrictions (#492) 2017-04-27 12:47:05 -04:00
Ryan Kasper
0cb43650cb Windows 10 -PfsGroup None --> -PfsGroup ECP256 (#493)
* Windows 10 -PfsGroup None --> -PfsGroup ECP256

Fixes broken tunnel when rekey (CREATE_CHILD_SA request [ N(REKEY_SA) SA No TSi TSr KE ]) occurs (on my Windows 10 1703 build 15063.138 Creator's Update system this is ~every 57 minutes)

* Update Windows Client PfsGroup Commandline
2017-04-27 12:46:50 -04:00
Jack Ivanov
540c761d3b Disable RSA in the mobileconfigs. Fixes #486 2017-04-25 23:06:51 +02:00
Jack Ivanov
451394100d Some enhances in the compat ciphers (#464)
raise the IntegrityCheckMethod to SHA384

Move Windows to ECDSA

Increase IntegrityCheckMethod
2017-04-23 16:00:37 -04:00
Jack Ivanov
c3fcfe5d0d Let users choose the distro version #449 (#466)
Make dpdaction great again

add 1704 to travis

Make EC2 image name more convenient

modify apparmor profile
2017-04-22 17:06:10 -04:00
Andy Boutte
76cdc69548 CF tested and working for EC2 deployment (#431)
* AWS CloudFormation #132

* IPv6 EC2 draft

* CF tested and working for EC2 deployment

* IPv6 Implementation, EC2, Cloudformation

* Fixed ipv6 networking

* adding ip6tables rule for DHCP on AWS
2017-04-20 18:04:57 -04:00
Jack Ivanov
a7b06058cb remove the proxy role #440 (#457)
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
2017-04-20 18:00:17 -04:00
Dan Guido
0b05ea19bc Windows needs SHA2-256. Closes #453. (#456) 2017-04-20 07:26:46 -04:00
Dan Guido
8173b84ff8 Change uniqueids back to never (#448)
We need this to allow multiple connections with the same id/certificate
2017-04-19 09:53:30 +02:00