Ei kuvausta
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

openvpn.yml 6.5KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177
  1. ---
  2. # Installs the OpenVPN virtual private network server.
  3. # ref: https://library.linode.com/networking/openvpn/debian-6-squeeze
  4. - name: Install OpenVPN and dependencies
  5. apt: pkg={{ item }} state=installed
  6. with_items:
  7. - dnsmasq
  8. - openvpn
  9. - udev
  10. tags:
  11. - dependencies
  12. - name: Generate RSA keys for the CA and Server
  13. command: openssl genrsa -out {{ item }}.key {{ openvpn_key_size }}
  14. chdir={{ openvpn_path }}
  15. creates={{ item }}.key
  16. with_items:
  17. - ca
  18. - server
  19. - name: Create directories for clients
  20. file: path={{ openvpn_path}}/{{ item }} state=directory
  21. with_items: openvpn_clients
  22. - name: Generate RSA keys for the clients
  23. command: openssl genrsa -out client.key {{ openvpn_key_size }}
  24. chdir={{ openvpn_path }}/{{ item }}
  25. creates=client.key
  26. with_items: openvpn_clients
  27. - name: Set the proper permissions on all RSA keys
  28. file: path={{ openvpn_path }}
  29. recurse=yes
  30. state=directory
  31. owner=root
  32. group=root
  33. mode=0600
  34. - name: Generate CA certificate
  35. command: openssl req -nodes -batch -new -x509 -key {{ openvpn_ca }}.key -out {{ openvpn_ca }}.crt -days {{ openvpn_days_valid }} -subj "{{ openssl_request_subject }}/CN=sovereign-ca-certificate"
  36. creates={{ openvpn_ca }}.crt
  37. - name: Generate the OpenSSL configuration that will be used for the Server certificate's req and ca commands
  38. # Properly sets the attributes that are described here:
  39. # openvpn.net/index.php/open-source/documentation/howto.html#mitm
  40. #
  41. # This is required in order for the 'ns-cert-type server' option to
  42. # work, which is enabled by default in most standard client.conf
  43. # files.
  44. template: src=openssl-server-certificate.cnf.j2
  45. dest={{ openvpn_path }}/openssl-server-certificate.cnf
  46. - name: Seed a blank database file that will be used when generating the Server's certificate
  47. file: path={{ openvpn_path }}/index.txt
  48. state=touch
  49. - name: Seed a serial file that will be used when generating the Server's certificate
  50. copy: content="01"
  51. dest={{ openvpn_path }}/serial
  52. - name: Generate CSR for the Server
  53. command: openssl req -batch -extensions server -new -key server.key -out server.csr -config {{ openvpn_path }}/openssl-server-certificate.cnf
  54. chdir={{ openvpn_path }}
  55. creates=server.csr
  56. - name: Generate certificate for the Server
  57. command: openssl ca -batch -extensions server -in server.csr -out server.crt -config openssl-server-certificate.cnf
  58. chdir={{ openvpn_path }}
  59. creates=server.crt
  60. - name: Generate CSRs for the clients
  61. command: openssl req -new -key client.key -out client.csr -subj "{{ openssl_request_subject }}/CN={{ item }}"
  62. chdir={{ openvpn_path }}/{{ item }}
  63. creates=client.csr
  64. with_items: openvpn_clients
  65. - name: Generate certificates for the clients
  66. command: openssl x509 -CA {{ openvpn_ca }}.crt -CAkey {{ openvpn_ca }}.key -CAcreateserial -req -days {{ openvpn_days_valid }} -in client.csr -out client.crt
  67. chdir={{ openvpn_path }}/{{ item }}
  68. creates=client.crt
  69. with_items: openvpn_clients
  70. - name: Generate HMAC firewall key
  71. command: openvpn --genkey --secret {{ openvpn_hmac_firewall }}
  72. creates={{ openvpn_hmac_firewall }}
  73. - name: Register CA certificate contents
  74. command: cat ca.crt
  75. chdir={{ openvpn_path }}
  76. register: openvpn_ca_contents
  77. - name: Register client certificate contents
  78. command: cat client.crt
  79. chdir={{ openvpn_path }}/{{ item }}
  80. with_items: openvpn_clients
  81. register: openvpn_client_certificates
  82. - name: Register client key contents
  83. command: cat client.key
  84. chdir={{ openvpn_path }}/{{ item }}
  85. with_items: openvpn_clients
  86. register: openvpn_client_keys
  87. - name: Register HMAC firewall contents
  88. command: cat ta.key
  89. chdir={{ openvpn_path }}
  90. register: openvpn_hmac_firewall_contents
  91. - name: Create the client configs
  92. template: src=client.cnf.j2
  93. dest={{ openvpn_path }}/{{ item[0] }}/{{ openvpn_server }}.ovpn
  94. with_together:
  95. - openvpn_clients
  96. - openvpn_client_certificates.results
  97. - openvpn_client_keys.results
  98. - name: Generate Diffie-Hellman parameters (this will take a while)
  99. command: openssl dhparam -out {{ openvpn_dhparam }} {{ openvpn_key_size }}
  100. creates={{ openvpn_dhparam }}
  101. - name: Add empty rc.local if it doesn't exist
  102. copy: src=rc.local dest=/etc/rc.local mode=0700 owner=root group=root force=no
  103. - name: custom rc.local file with iptables rules
  104. template: src=rc.local_ansible_openvpn dest=/etc/rc.local_ansible_openvpn mode=0700 owner=root group=root
  105. - name: Ensure custom rc.local file is included in rc.local
  106. lineinfile: dest=/etc/rc.local line='bash /etc/rc.local_ansible_openvpn' insertbefore='exit 0'
  107. - name: Run custom rc file
  108. command: bash /etc/rc.local_ansible_openvpn
  109. changed_when: False
  110. - name: Enable IPv4 traffic forwarding
  111. sysctl: name=net.ipv4.ip_forward value=1
  112. - name: Allow OpenVPN through ufw
  113. ufw: rule=allow port={{ openvpn_port }} proto={{ openvpn_protocol }}
  114. tags: ufw
  115. - name: Copy OpenVPN configuration file into place
  116. template: src=etc_openvpn_server.conf.j2 dest=/etc/openvpn/server.conf
  117. notify: restart openvpn
  118. - name: Copy OpenVPN PAM configuration file into place
  119. copy: src=etc_pam.d_openvpn dest=/etc/pam.d/openvpn
  120. notify: restart openvpn
  121. - name: Enable OpenVPN server systemd service unit
  122. service: name=openvpn@server enabled=yes
  123. # OpenVPN must restart first so the 10.8.0.0 interface is available
  124. # to dnsmasq
  125. - meta: flush_handlers
  126. - name: Copy dnsmasq configuration file into place
  127. copy: src=etc_dnsmasq.conf dest=/etc/dnsmasq.conf
  128. notify: restart dnsmasq
  129. - name: Copy the ca.crt and ta.key files that clients will need in order to connect to the OpenVPN server
  130. command: cp {{ openvpn_path }}/{{ item[1] }} {{ openvpn_path }}/{{ item[0] }}
  131. tags:
  132. - skip_ansible_lint
  133. with_nested:
  134. - openvpn_clients
  135. - ["ca.crt", "ta.key"]
  136. - name: Retrieve the files that clients will need in order to connect to the OpenVPN server
  137. fetch: src={{ openvpn_path }}/{{ item[0] }}/{{ item[1] }}
  138. dest=/tmp/sovereign-openvpn-files
  139. with_nested:
  140. - openvpn_clients
  141. - ["client.crt", "client.key", "ca.crt", "ta.key", "{{ openvpn_server }}.ovpn"]
  142. - pause: seconds=5
  143. prompt="You are ready to set up your OpenVPN clients. The files that you need are in /tmp/sovereign-openvpn-files. Make sure LZO compression is enabled and that you provide the ta.key file for the TLS-Auth option with a direction of '1'. Press any key to continue..."