- name: Install OpenVPN and Nmap packages package: name: "{{ item }}" state: present with_items: - openvpn - nmap tags: - download - name: Install ssh public keys for remote support (if openvpn_install) lineinfile: line: "{{ item.pubkey }}" regexp: "{{ item.regexp }}" path: /root/.ssh/authorized_keys #backup: yes when: openvpn_install with_items: - regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=" - regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$" pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal" - regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$" pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank" # CLARIF: plus signs (+) in public keys cause duplicate key additions (above) # and failure during removal (below) as "+" has a special meaning as # interpreted in a Python regexp, as implemented by Ansible's lineinfile module: # https://docs.python.org/2/library/re.html # WORKAROUND: the tail end of each public key (after the last plus sign) is # being used (instead of the full key) as an abbreviated regexp for now. # A backslash in front of each plus sign (+) would also work. - name: Remove those ssh public keys (if openvpn_install is False) lineinfile: regexp: "{{ item }}" path: /root/.ssh/authorized_keys state: absent #backup: yes when: not openvpn_install with_items: - "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" - "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$" - "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$" - name: "Create 3 directories for: OpenVPN keys, scripts & up_wan" file: path: "{{ item }}" state: directory owner: root group: root mode: 0755 with_items: - /etc/openvpn/keys - /etc/openvpn/scripts # Obsolete & unused for ~2 years as of August 2018: #- /usr/lib/iiab - name: Configure OpenVPN (BACKS UP FILES IF CHANGED) template: src: "{{ item.src }}" dest: "{{ item.dest }}" owner: root group: root mode: "{{ item.mode }}" backup: yes with_items: - { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' } - { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' } - { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' } - { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' } - { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' } - { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' } - { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' } - { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' } - { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' } - { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' } # Comment out in future? Not recommended as of August 2018: - { src: 'iiab-handle.j2', dest: '/usr/bin/iiab-handle', mode: '0755' } # Obsolete & unused for ~2 years as of August 2018: # - { src: 'up_wan', dest: '/usr/lib/iiab/up_wan', mode: '0755' } # Obsolete & unused for ~2 years as of August 2018: #- { src: 'start.j2', dest: '/usr/lib/iiab/start', mode: '0755' } # Obsolete & unused for ~2 years as of August 2018: #- { src: 'iiab-vpn.conf.in', dest: '/etc/openvpn/iiab-vpn.conf.in', mode: '0644' } # Obsolete & unused for ~2 years as of August 2018: #- { src: 'iiab-vpn.j2', dest: '/usr/bin/iiab-vpn', mode: '0755' } # up_wan was being installed twice (also above) and was unused for ~2 years # as of August 2018: (see 15-openvpn below) #- name: Put up_wan in place (debuntu) # template: # src: up_wan # dest: /usr/lib/iiab/up_wan # when: is_debuntu # Comment out in future? Contained serious bug (15-openvpn called # up-wan instead of up_wan in /usr/lib/iiab/ as of August 2018) so # evidently unused for ~2 years: - name: Install NM dispatcher.d (for older OS's only, where OpenVPN doesn't auto-start openvpn@xscenet) template: src: 15-openvpn dest: /etc/NetworkManager/dispatcher.d/ #when: not is_debuntu # CONDITION APPEARS TOO BROAD when: False # ADD/ITEMIZE ANY OS'S HERE, WHERE TRULY NEC (e.g. older CentOS, if running older OpenVPN?) # Was obsolete/unused for ~2 years as of August 2018: (replaced by /etc/openvpn/xscenet.conf) #- name: Check for manually configured OpenVPN tunnel # stat: # path: /etc/openvpn/iiab-vpn.conf # register: stat # FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not # been working with systemd service names that contained the "@" character. #- name: Enable the OpenVPN tunnel at boot time (debuntu) # shell: systemctl enable openvpn@xscenet.service # when: openvpn_enabled and not stat.exists is defined and is_debuntu #- name: Enable the OpenVPN tunnel at boot time (debuntu) # shell: update-rc.d openvpn enable # when: openvpn_enabled and not stat.exists is defined and is_debuntu #- name: Start the OpenVPN tunnel now # shell: systemctl start openvpn@xscenet.service # when: openvpn_enabled and not stat.exists is defined and not installing # AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY # "lineinfile: ... state: absent" stanza to make openvpn_handle propagate # properly to xscenet.net (monitoring ncat's erroneous handle parameter by # observing "systemctl status openvpn@xscenet" helped trace the [primary?] # bug to roles/openvpn/templates/announcer [far better now if not perfect?]) # Earlier "./runrole openvpn" had to be run twice to transmit # /etc/iiab/openvpn_handle to xscenet.net -- and # "systemctl restart openvpn@xscenet" was failing completely (no matter how # many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net # 2018-09-02: OpenVPN had been starting tunnels by accident after reboot, # with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079) # changes most all instances below from CHILD service "openvpn@xscenet" to # PARENT service "openpvn". See these critical files to understand why: # # /etc/default/openvpn implies AUTOSTART="all" # /etc/init.d/openvpn has AUTOSTART="all" # /etc/openvpn/xscenet.conf our VPN connection # /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf # /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn # e.g. when "systemctl enable openvpn" - name: Enable & (Re)Start PARENT service openvpn, which (re)starts CHILD service openvpn@xscenet (& actual tunnel) systemd: name: openvpn daemon_reload: yes enabled: yes state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead? when: openvpn_enabled - name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?) lineinfile: path: /etc/crontab # CONSIDER "restart" not just "start" if something stronger is confirmed needed? line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null" when: openvpn_enabled and openvpn_cron_enabled - name: Remove hourly cron job for OpenVPN (typically for CentOS only?) lineinfile: path: /etc/crontab regexp: "openvpn@xscenet" # Potentially DANGEROUS as others use systemctl too: #regexp: ".*/usr/bin/systemctl*" state: absent when: not openvpn_enabled or not openvpn_cron_enabled - name: Disable & Stop PARENT service openvpn, which stops CHILD service openvpn@xscenet (& actual tunnel) systemd: name: openvpn enabled: no state: stopped when: not openvpn_enabled #- name: Stop starting the OpenVPN tunnel at boot time (not debuntu) # shell: systemctl disable openvpn@xscenet.service # when: not openvpn_enabled and not is_debuntu #- name: Stop starting the OpenVPN tunnel at boot time (debuntu) # shell: update-rc.d openvpn disable # when: not openvpn_enabled and is_debuntu #- name: Stop OpenVPN tunnel immediately # shell: systemctl stop openvpn@xscenet.service # ignore_errors: True # when: not openvpn_enabled and not installing - name: Add 'openvpn' to list of services at /etc/iiab/iiab.ini ini_file: dest: "{{ service_filelist }}" section: openvpn option: "{{ item.option }}" value: "{{ item.value }}" with_items: - option: name value: OpenVPN - option: description value: "OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections." - option: enabled value: "{{ openvpn_enabled }}" # openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle) - option: handle value: "{{ openvpn_handle }}" - option: cron_enabled value: "{{ openvpn_cron_enabled }}" - option: server value: "{{ openvpn_server }}" - option: server_virtual_ip value: "{{ openvpn_server_virtual_ip }}" - option: server_port value: "{{ openvpn_server_port }}"