Implement vpn

base/pretask_debian.yml

@@ -3,6 +3,8 @@
     name: 
       - sendmail
       - openssh-server
+      - git
+      - vim
     state: present
     update_cache: yes
     autoremove: yes

roles/mderasse.firewall/tasks/main.yml

@@ -41,6 +41,10 @@
     mode: 0644
   when: "ansible_service_mgr == 'systemd'"
 
+- name: Firewall - Launch iptables manually first
+  shell: /etc/firewall/firewall.sh &
+  run_once: yes
+
 - name: Firewall - Manage firewall service
   service:
     name: firewall

roles/mderasse.firewall/templates/firewall.sh.j2

@@ -23,15 +23,16 @@ iptables -t mangle -F
 iptables -t mangle -X
 
 # ---------- Basic Policies ---------- 
-# Apply default policies
-iptables -P INPUT {{ firewall_default_input }}
-iptables -P FORWARD {{ firewall_default_forward }}
-iptables -P OUTPUT {{ firewall_default_output }}
 
 # Let's keep current connection
 iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 
+# Apply default policies
+iptables -P INPUT {{ firewall_default_input }}
+iptables -P FORWARD {{ firewall_default_forward }}
+iptables -P OUTPUT {{ firewall_default_output }}
+
 # Accept traffic from loopback interface (localhost).
 iptables -t filter -A INPUT -i lo -j ACCEPT
 iptables -t filter -A OUTPUT -o lo -j ACCEPT

roles/stouts.openvpn/.bumpversion.cfg

@@ -0,0 +1,6 @@
+[bumpversion]
+commit = True
+current_version = 2.4.1
+tag = True
+tag_name = {new_version}
+

roles/stouts.openvpn/.travis.yml

@@ -0,0 +1,18 @@
+---
+
+language: python
+python: "2.7"
+
+env:
+  - MOLECULE_DISTRO=ubuntu1404
+  - MOLECULE_DISTRO=ubuntu1604
+  # - MOLECULE_DISTRO=ubuntu1804
+  - MOLECULE_DISTRO=debian8 MOLECULE_INIT_CMD=/lib/systemd/systemd
+  - MOLECULE_DISTRO=debian9 MOLECULE_INIT_CMD=/lib/systemd/systemd
+  # - MOLECULE_DISTRO=centos6 MOLECULE_INIT_CMD=/lib/systemd/systemd
+  - MOLECULE_DISTRO=centos7 MOLECULE_INIT_CMD=/lib/systemd/systemd
+install:
+  - pip install docker molecule
+
+script:
+  - molecule test

roles/stouts.openvpn/CONTRIBUTORS

@@ -0,0 +1,20 @@
+Contributors:
+
+* Adam Kunicki (https://github.com/kunickiaj)
+* Adham Helal (https://github.com/ahelal)
+* Daniel Miranda (https://github.com/danielkza)
+* Elias (https://github.com/viderizer)
+* Federico Capoano (https://github.com/nemesisdesign)
+* JP Viljoen (https://github.com/froztbyte)
+* Jason Bond Pratt (https://github.com/juniorplenty)
+* Kirill Klenov (http://klen.github.io/)
+* Kurt Sussman (https://github.com/neophiliac)
+* Mahmoud Abdelkader (https://github.com/mahmoudimus)
+* Marcelo Anton (https://github.com/mbanton)
+* Maxim Kravets (https://github.com/zeelax)
+* Michael Frister (https://github.com/meeee)
+* Mohammed Naser (https://github.com/mnaser)
+* Roland von Ohlen (https://github.com/RockingRolli)
+* Sebastien Badia (https://github.com/sbadia)
+* Thomas Krille (https://github.com/tkrille)
+* https://github.com/teadur

roles/stouts.openvpn/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Stouts
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

roles/stouts.openvpn/Makefile

@@ -0,0 +1,20 @@
+.PHONY: release major minor patch
+
+VERSION?=minor
+release:
+	@bumpversion $(VERSION)
+	@git checkout master
+	@git merge develop
+	@git checkout develop
+	@git push --all
+	@git push --tags
+	@git checkout develop
+
+major:
+	make release VERSION=major
+
+minor:
+	make release VERSION=minor
+
+patch:
+	make release VERSION=patch

roles/stouts.openvpn/README.md

@@ -0,0 +1,55 @@
+# Stouts.openvpn
+
+[![Build Status](http://img.shields.io/travis/Stouts/Stouts.openvpn.svg?style=flat-square)](https://travis-ci.org/Stouts/Stouts.openvpn)
+[![Galaxy](http://img.shields.io/badge/galaxy-Stouts.openvpn-blue.svg?style=flat-square)](https://galaxy.ansible.com/Stouts/openvpn/)
+
+Ansible role that installs an openvpn server
+
+* Install and setup OpenVPN server
+* Create/revoke client's configurations and certificates
+* Setup authentication with PAM (System, passwd files)
+
+## Requirements
+
+None. 
+
+## Supported platforms
+
+- Ubuntu 14.04
+- Ubuntu 16.04
+- Debian 8
+- Debian 9
+- Centos 7
+
+## Variables
+
+For a complete variable reference, see the [`defaults/main.yml`](defaults/main.yml) file.
+
+## Example playbook
+
+```yaml
+
+- hosts: all
+  vars:
+    openvpn_use_pam: true
+    openvpn_download_clients: true
+    openvpn_download_dir: /home/me/Projects
+    openvpn_clients: 
+      - client1
+      - client2
+    openvpn_use_pam_users:
+      - name: user1
+        password: password1
+      - name: user2
+        password: password2
+  roles:
+    - Stouts.openvpn
+```
+
+## License
+
+Licensed under the MIT License. See the LICENSE file for details.
+
+## Feedback, bug-reports, requests, ...
+
+...are [welcome](https://github.com/Stouts/Stouts.openvpn/issues)!

roles/stouts.openvpn/defaults/main.yml

@@ -0,0 +1,104 @@
+---
+
+# Set to 'false' to completely disable the role
+openvpn_enabled: true
+
+openvpn_etcdir: /etc/openvpn
+openvpn_keydir: "{{ openvpn_etcdir }}/keys"
+
+# Set to 'true' to install openvpn from the upstream repo
+openvpn_use_external_repo: false
+
+# Set to 'true' to install EasyRSA from system packages
+openvpn_use_system_easyrsa: false
+
+# Set to true to make the vpn server NAT incoming traffic
+openvpn_route_traffic: false
+
+# The interface that traffic will come in from (WARNING default: any)
+openvpn_interface: ''
+
+# Default settings (See OpenVPN documentation)
+openvpn_host: "{{ inventory_hostname }}"
+
+openvpn_port: 1194
+openvpn_proto: udp
+openvpn_dev: tun
+openvpn_server: 10.8.0.0 255.255.255.0
+openvpn_bridge: {}
+openvpn_max_clients: 100
+openvpn_log: /var/log/openvpn.log
+openvpn_keepalive: "10 120"
+openvpn_ifconfig_pool_persist: ipp.txt
+openvpn_comp_lzo: true
+openvpn_cipher: BF-CBC
+openvpn_status: openvpn-status.log
+openvpn_verb: 3
+openvpn_tls_auth: false
+openvpn_tls_key: "ta.key"
+openvpn_user: nobody
+openvpn_group: nogroup
+openvpn_resolv_retry: infinite
+openvpn_client_to_client: true
+
+
+# Network ranges that the connecting clients should try to reach using the VPN
+# connection. Example:
+# openvpn_route_ranges:
+#   - 192.168.0.0 255.255.255.0
+#   - 192.168.10.0 255.255.255.0
+openvpn_route_ranges: []
+
+# DNS servers to push to the connecting client to avoid leaks via DNS queries
+openvpn_dns_servers: []
+
+openvpn_server_options: []
+# Additional server options
+# openvpn_server_options:
+# - dev-node MyTap
+# - client-to-client
+
+openvpn_client_options: []
+# Additional client options
+# openvpn_client_options:
+# - dev-node MyTap
+# - client-to-client
+
+openvpn_key_country: US
+openvpn_key_province: CA
+openvpn_key_city: SanFrancisco
+openvpn_key_org: Fort-Funston
+openvpn_key_email: me@myhost.mydomain
+openvpn_key_size: 1024
+
+# Make clients certificate
+openvpn_clients:
+  - client
+
+# Revoke clients certificates
+openvpn_clients_revoke: []
+
+# Use PAM authentication
+openvpn_use_pam: true
+openvpn_use_pam_users: []
+# Only for Debian-based, CentOS requires 'pam_pwdfile' from third party repos.
+# If empty use system users
+# otherwise use users from the option
+# openvpn_use_pam_users:
+# - { name: user, password: password }
+
+# LDAP authentication and configuration (optional)
+openvpn_use_ldap: false
+openvpn_ldap_tlsenable: 'false'
+openvpn_ldap_follow_referrals: 'false'
+
+# Use simple authentication (default is disabled)
+openvpn_simple_auth: false
+openvpn_simple_auth_password: ""
+
+# Whether to embed CA, cert, and key info inside client OVPN config file.
+openvpn_unified_client_profiles: false
+
+# Download the created client credentials to the specified directory
+openvpn_download_clients: false
+openvpn_download_dir: "client_credentials/"

roles/stouts.openvpn/handlers/main.yml

@@ -0,0 +1,40 @@
+---
+
+- name: Restart networking (Debian)
+  service:
+    name: networking
+    state: restarted
+  listen: restart networking debian
+
+- name: Restart networking (RedHat)
+  service:
+    name: network
+    state: restarted
+  listen: restart networking redhat
+
+- name: Save iptables rules
+  block:
+    - name: Save iptable rules (RedHat)
+      command: iptables-save
+      when: ansible_os_family == "RedHat"
+      listen: openvpn save iptables
+
+    - name: Save iptable rules (Ubuntu Trusty)
+      command: /etc/init.d/iptables-persistent save
+      when:
+        - ansible_os_family == "Debian"
+        - ansible_lsb.codename == "trusty"
+      listen: openvpn save iptables
+
+    - name: Save the rules (Ubuntu)
+      command: netfilter-persistent save
+      when:
+        - ansible_os_family == "Debian"
+        - ansible_lsb.codename != "trusty"
+      listen: openvpn save iptables
+
+- name: Restart OpenVPN service
+  service:
+    name: "{{ openvpn_service }}"
+    state: restarted
+  listen: openvpn restart

roles/stouts.openvpn/meta/main.yml

@@ -0,0 +1,8 @@
+---
+galaxy_info:
+  author: klen
+  company: stouts
+  description: Manage OpenVPN server
+  min_ansible_version: 2.4
+  license: MIT
+dependencies: []

roles/stouts.openvpn/molecule/default/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python2-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

roles/stouts.openvpn/molecule/default/INSTALL.rst

@@ -0,0 +1,16 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* General molecule dependencies (see https://molecule.readthedocs.io/en/latest/installation.html)
+* Docker Engine
+* docker-py
+* docker
+
+Install
+=======
+
+    $ sudo pip install docker-py