Closed aseem1234 closed 7 years ago
jackivanov
commented
7 years ago Windows client affected only.
Windows 10 DNS resolver sends DNS requests in parallel to all available network interfaces and uses the fastest reply to come.
The fix will be added to the PS script soon.
aseem1234
commented
7 years ago Thanks for the info! Just curious, once the script is released, will there be a way to update the current Windows settings rather than re-creating the entire server?
Thanks!
dguido
commented
7 years ago You can probably just run the applicable line of PowerShell when we update it. It's a client problem, not a server one.
aseem1234
commented
7 years ago OK gotcha. Exactly how will I know when the script is updated with this specific fix? Is there a ticket open for it that I can track? Thanks
dguido
commented
7 years ago You filed the issue.
aseem1234
commented
7 years ago hahaha Sorry, I'm new to this. Didn't realize this thread was the ticket. Thanks
jackivanov
commented
7 years ago Can not reproduce. @aseem1234 you are at windows 10 1703 right?
some info:
Interesting fact # 2: Built-in VPN configuration (tested with IPsec IKEv2) somehow sets system up to avoid DNS leaks if your DNS on internet adapter is out of local segment. We have the same situation with two default gateways, one (VPN) with lower metric and another (internet) with higher, but Windows doesn't do DNS queries like it does with OpenVPN connection. If we can force this behavior for OpenVPN, we fix this issue.
dguido
commented
7 years ago We can't reproduce this issue so we're closing it.
deven10100
commented
7 years ago Disable IPV6 on the vpn adapter properties, And do the same to your local ethernet adapter, then its just using IPv4 then change your dns on your local adapter to google 8.8.8.8 / 8.8.4.4 and not let it dhcp to your ISP dns, Then any leaktest should just resolve to google and not you. This was my work around since i had this same issue
OS / Environment
WIndows 10 64-bit
Ansible version
2.2.0.0
Version of components from
requirements.txtSummary of the problem
I created an EC2 instance on Amazon and connected using Windows 10. When I go to dnsleaktest.com and run an extended test, it lists out both my Amazon IP address and my Verizon FIOS IP address. If I'm connected to the VPN, why does it show the Verizon IP also?
Steps to reproduce the behavior
The way of deployment (cloud or local)
Amazon EC2
Expected behavior
Actual behavior
Full log
(env)akishore@ASEEMVOSTRO:/mnt/c/Users/Aseem/Downloads/algo-master/algo-master$ ./algo
What provider would you like to use?
Enter the number of your desired provider : 2
Enter your aws_access_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html) Note: Make sure to use an IAM user with an acceptable policy attached (see https://github.com/trailofbits/algo/blob/master/docs/deploy-from-ansible.md). [pasted values will not be displayed] [AKIA...]:
Enter your aws_secret_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html) [pasted values will not be displayed] [ABCD...]:
Name the vpn server:
What region should the server be located in?
Do you want macOS/iOS clients to enable "VPN On Demand" when connected to cellular networks?
Do you want macOS/iOS clients to enable "VPN On Demand" when connected to Wi-Fi?
List the names of trusted Wi-Fi networks (if any) that macOS/iOS clients exclude from using the VPN (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi) : FIOS-ZOPPY-5G
Do you want to install a DNS resolver on this VPN server, to block ads while surfing?
Do you want each user to have their own account for SSH tunneling?
Do you want to apply operating system security enhancements on the server? (warning: replaces your sshd_config)
Do you want the VPN to support Windows 10 or Linux Desktop clients? (enables compatible ciphers and key exchange, less secure)
Do you want to retain the CA key? (required to add users in the future, but less secure)
PLAY [Configure the server] ****
TASK [setup] *** ok: [localhost]
TASK [Generate the SSH private key] **** ok: [localhost]
TASK [Generate the SSH public key] ***** ok: [localhost]
TASK [Change mode for the SSH private key] ***** ok: [localhost]
TASK [Ensure the dynamic inventory exists] ***** ok: [localhost]
TASK [cloud-ec2 : set_fact] **** ok: [localhost]
TASK [cloud-ec2 : Locate official AMI for region] ** ok: [localhost]
TASK [cloud-ec2 : set_fact] **** ok: [localhost]
TASK [cloud-ec2 : Make a cloudformation template] ** changed: [localhost]
TASK [cloud-ec2 : Deploy the template] ***** changed: [localhost]
TASK [cloud-ec2 : Add new instance to host group] ** changed: [localhost]
TASK [cloud-ec2 : set_fact] **** ok: [localhost]
TASK [cloud-ec2 : Get EC2 instances] *** ok: [localhost]
TASK [cloud-ec2 : Ensure the group ec2 exists in the dynamic inventory file] *** changed: [localhost]
TASK [cloud-ec2 : Populate the dynamic inventory] ** changed: [localhost] => (item={u'kernel': None, u'instance_profile': None, u'root_device_type': u'ebs', u'private_dns_name': u'ip-172-16-254-204.ec2.internal', u'spot_instance_request_id': None, u'source_destination_check': u'true', u'id': u'i-077c898ddb4841113', u'ebs_optimized': False, u'state': u'running', u'client_token': u'Aseem-EC2In-1K410N1A1O2SL', u'virtualization_type': u'hvm', u'ramdisk': None, u'public_ip_address': u'34.202.48.102', u'block_device_mapping': [{u'status': u'attached', u'volume_id': u'vol-049393f10005c9aab', u'delete_on_termination': True, u'attach_time': u'2017-05-24T02:21:59.000Z', u'device_name': u'/dev/sda1'}], u'key_name': None, u'interfaces': [{u'id': u'eni-5b727655', u'mac_address': u'06:61:4c:e1:67:16'}], u'image_id': u'ami-20631a36', u'groups': [{u'id': u'sg-a2f3aedc', u'name': u'AseemVPN-InstanceSecurityGroup-X5TCSL0EV862'}], u'public_dns_name': u'ec2-34-202-48-102.compute-1.amazonaws.com', u'requester_id': None, u'tags': {u'Environment': u'Algo', u'aws:cloudformation:stack-name': u'AseemVPN', u'aws:cloudformation:logical-id': u'EC2Instance', u'aws:cloudformation:stack-id': u'arn:aws:cloudformation:us-east-1:199272313300:stack/AseemVPN/8a044f90-4027-11e7-b3f4-500c28b12efe', u'Name': u'Algo'}, u'monitoring_state': u'disabled', u'placement': {u'tenancy': u'default', u'zone': u'us-east-1e'}, u'ami_launch_index': u'0', u'hypervisor': u'xen', u'region': u'us-east-1', u'launch_time': u'2017-05-24T02:21:58.000Z', u'persistent': False, u'architecture': u'x86_64', u'private_ip_address': u'172.16.254.204', u'vpc_id': u'vpc-9b00c0e2'})
TASK [Wait until SSH becomes ready...] ***** ok: [localhost]
TASK [A short pause, in order to be sure the instance is ready] **** Pausing for 20 seconds (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort) ok: [localhost]
TASK [Ensure the local ssh directory is exist] ***** ok: [localhost]
TASK [Copy the algo ssh key to the local ssh directory] **** changed: [localhost]
PLAY [Configure the server and install required software] **
TASK [Check the system] **** changed: [34.202.48.102]
TASK [Ubuntu | Install prerequisites] ** changed: [34.202.48.102]
TASK [Ubuntu | Configure defaults] ***** changed: [34.202.48.102]
TASK [FreeBSD / HardenedBSD | Install prerequisites] *** skipping: [34.202.48.102]
TASK [FreeBSD / HardenedBSD | Configure defaults] ** skipping: [34.202.48.102]
TASK [set_fact] **** skipping: [34.202.48.102]
TASK [Gather Facts] **** ok: [34.202.48.102]
TASK [Ensure the algo ssh key exist on the server] ***** ok: [34.202.48.102]
TASK [Enable IPv6] ***** ok: [34.202.48.102]
TASK [Set facts if the deployment in a cloud] ** ok: [34.202.48.102]
TASK [Generate password for the CA key] **** changed: [34.202.48.102 -> localhost]
TASK [Define password facts] *** ok: [34.202.48.102]
TASK [Define the commonName] *** ok: [34.202.48.102]
TASK [common : Install software updates] *** changed: [34.202.48.102]
TASK [common : Check if reboot is required] **** changed: [34.202.48.102]
TASK [common : Reboot] ***** ok: [34.202.48.102]
TASK [common : Wait until SSH becomes ready...] **** ok: [34.202.48.102 -> localhost]
TASK [common : Disable MOTD on login and SSHD] ***** changed: [34.202.48.102] => (item={u'regexp': u'^session.optional.pam_motd.so.', u'line': u'# MOTD DISABLED', u'file': u'/etc/pam.d/login'}) changed: [34.202.48.102] => (item={u'regexp': u'^session.optional.pam_motd.so.', u'line': u'# MOTD DISABLED', u'file': u'/etc/pam.d/sshd'})
TASK [common : Loopback for services configured] *** changed: [34.202.48.102]
TASK [common : Loopback included into the network config] ** changed: [34.202.48.102]
RUNNING HANDLER [common : restart loopback] **** changed: [34.202.48.102]
TASK [common : Check apparmor support] ***** changed: [34.202.48.102]
TASK [common : set_fact] *** ok: [34.202.48.102]
TASK [common : set_fact] *** ok: [34.202.48.102]
TASK [common : set_fact] *** skipping: [34.202.48.102]
TASK [common : Loopback included into the rc config] *** skipping: [34.202.48.102]
TASK [common : Enable the gateway features] **** skipping: [34.202.48.102] => (item={u'value': u'"YES"', u'param': u'firewall_enable'}) skipping: [34.202.48.102] => (item={u'value': u'"open"', u'param': u'firewall_type'}) skipping: [34.202.48.102] => (item={u'value': u'"YES"', u'param': u'gateway_enable'}) skipping: [34.202.48.102] => (item={u'value': u'"YES"', u'param': u'natd_enable'}) skipping: [34.202.48.102] => (item={u'value': u'""', u'param': u'natd_interface'}) skipping: [34.202.48.102] => (item={u'value': u'"-dynamic -m"', u'param': u'natd_flags'})
TASK [common : FreeBSD | Activate IPFW] **** skipping: [34.202.48.102]
TASK [common : Install tools] ** changed: [34.202.48.102] => (item=[u'git', u'screen', u'apparmor-utils', u'uuid-runtime', u'coreutils', u'sendmail', u'iptables-persistent', u'cgroup-tools', u'openssl'])
TASK [common : Sysctl tuning] ** changed: [34.202.48.102] => (item={u'item': u'net.ipv4.ip_forward', u'value': 1}) changed: [34.202.48.102] => (item={u'item': u'net.ipv4.conf.all.forwarding', u'value': 1}) changed: [34.202.48.102] => (item={u'item': u'net.ipv6.conf.all.forwarding', u'value': 1})
TASK [security : Install tools] **** ok: [34.202.48.102] => (item=[u'unattended-upgrades'])
TASK [security : Configure unattended-upgrades] **** changed: [34.202.48.102]
TASK [security : Periodic upgrades configured] ***** changed: [34.202.48.102]
TASK [security : Find directories for minimizing access] *** ok: [34.202.48.102] => (item=/usr/local/sbin) ok: [34.202.48.102] => (item=/usr/local/bin) ok: [34.202.48.102] => (item=/usr/sbin) ok: [34.202.48.102] => (item=/usr/bin) ok: [34.202.48.102] => (item=/sbin) ok: [34.202.48.102] => (item=/bin)
TASK [security : Minimize access] ** ok: [34.202.48.102] => (item=(censored due to no_log)) ok: [34.202.48.102] => (item=(censored due to no_log)) ok: [34.202.48.102] => (item=(censored due to no_log)) ok: [34.202.48.102] => (item=(censored due to no_log)) ok: [34.202.48.102] => (item=(censored due to no_log)) ok: [34.202.48.102] => (item=(censored due to no_log))
TASK [security : Change shadow ownership to root and mode to 0600] ***** changed: [34.202.48.102]
TASK [security : change su-binary to only be accessible to user and group root] changed: [34.202.48.102]
TASK [security : Collect Use of privileged commands] *** changed: [34.202.48.102]
TASK [security : Restrict core dumps (with PAM)] *** changed: [34.202.48.102]
TASK [security : Restrict core dumps (with sysctl)] **** changed: [34.202.48.102]
TASK [security : Disable Source Routed Packet Acceptance] ** changed: [34.202.48.102] => (item=net.ipv4.conf.all.accept_source_route) changed: [34.202.48.102] => (item=net.ipv4.conf.default.accept_source_route)
TASK [security : Disable ICMP Redirect Acceptance] ***** changed: [34.202.48.102] => (item=net.ipv4.conf.all.accept_redirects) changed: [34.202.48.102] => (item=net.ipv4.conf.default.accept_redirects)
TASK [security : Disable Secure ICMP Redirect Acceptance] ** changed: [34.202.48.102] => (item=net.ipv4.conf.all.secure_redirects) changed: [34.202.48.102] => (item=net.ipv4.conf.default.secure_redirects)
TASK [security : Enable Bad Error Message Protection] ** changed: [34.202.48.102]
TASK [security : Enable RFC-recommended Source Route Validation] *** changed: [34.202.48.102] => (item=net.ipv4.conf.all.rp_filter) changed: [34.202.48.102] => (item=net.ipv4.conf.default.rp_filter)
TASK [security : Do not send ICMP redirects (we are not a router)] ***** changed: [34.202.48.102]
TASK [security : SSH config] *** changed: [34.202.48.102]
TASK [dns_adblocking : The DNS tag is defined] ***** ok: [34.202.48.102]
TASK [dns_adblocking : Dnsmasq installed] ** changed: [34.202.48.102]
TASK [dns_adblocking : Ensure that the dnsmasq user exist] ***** changed: [34.202.48.102]
TASK [dns_adblocking : The dnsmasq directory created] ** changed: [34.202.48.102]
TASK [dns_adblocking : Ubuntu | Dnsmasq profile for apparmor configured] *** changed: [34.202.48.102]
TASK [dns_adblocking : Ubuntu | Enforce the dnsmasq AppArmor policy] *** changed: [34.202.48.102]
TASK [dns_adblocking : Ubuntu | Ensure that the dnsmasq service directory exist] *** changed: [34.202.48.102]
TASK [dns_adblocking : Ubuntu | Setup the cgroup limitations for the ipsec daemon] *** changed: [34.202.48.102]
TASK [dns_adblocking : FreeBSD / HardenedBSD | Enable dnsmasq] ***** skipping: [34.202.48.102]
TASK [dns_adblocking : Dnsmasq configured] ***** changed: [34.202.48.102]
TASK [dns_adblocking : Adblock script created] ***** changed: [34.202.48.102]
TASK [dns_adblocking : Adblock script added to cron] *** changed: [34.202.48.102]
TASK [dns_adblocking : Update adblock hosts] *** changed: [34.202.48.102] [WARNING]: Consider using 'become', 'become_method', and 'become_user' rather than running sudo
RUNNING HANDLER [common : flush routing cache] ***** changed: [34.202.48.102]
RUNNING HANDLER [security : restart ssh] *** changed: [34.202.48.102]
RUNNING HANDLER [dns_adblocking : restart dnsmasq] ***** changed: [34.202.48.102]
RUNNING HANDLER [vpn : daemon-reload] ** changed: [34.202.48.102]
TASK [dns_adblocking : Dnsmasq enabled and started] **** ok: [34.202.48.102]
TASK [ssh_tunneling : Ensure that the sshd_config file has desired options] **** changed: [34.202.48.102]
TASK [ssh_tunneling : Ensure that the algo group exist] **** changed: [34.202.48.102]
TASK [ssh_tunneling : Ensure that the jail directory exist] **** changed: [34.202.48.102]
TASK [ssh_tunneling : Ensure that the SSH users exist] ***** changed: [34.202.48.102] => (item=akishore)
TASK [ssh_tunneling : The authorized keys file created] **** changed: [34.202.48.102] => (item=akishore)
TASK [ssh_tunneling : Generate SSH fingerprints] *** changed: [34.202.48.102]
TASK [ssh_tunneling : Fetch users SSH private keys] **** changed: [34.202.48.102] => (item=akishore)
TASK [ssh_tunneling : Change mode for SSH private keys] **** ok: [34.202.48.102 -> localhost] => (item=akishore)
TASK [ssh_tunneling : Fetch the known_hosts file] ** changed: [34.202.48.102 -> localhost]
TASK [ssh_tunneling : Build the client ssh config] ***** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [ssh_tunneling : SSH | Get active system users] *** skipping: [34.202.48.102]
TASK [ssh_tunneling : SSH | Delete non-existing users] ***** skipping: [34.202.48.102] => (item=null)
TASK [vpn : Ensure that the strongswan group exist] **** changed: [34.202.48.102]
TASK [vpn : Ensure that the strongswan user exist] ***** changed: [34.202.48.102]
TASK [vpn : set_fact] ** ok: [34.202.48.102]
TASK [vpn : Configure apt to use the Xenial release by default] **** changed: [34.202.48.102]
TASK [vpn : Configure packages preferences] **** changed: [34.202.48.102]
TASK [vpn : Configure the Ubuntu Zesty repository] ***** changed: [34.202.48.102]
TASK [vpn : Ubuntu | Install strongSwan] *** changed: [34.202.48.102]
TASK [vpn : Ubuntu | Enforcing ipsec with apparmor] **** changed: [34.202.48.102] => (item=/usr/lib/ipsec/charon) changed: [34.202.48.102] => (item=/usr/lib/ipsec/lookip) changed: [34.202.48.102] => (item=/usr/lib/ipsec/stroke)
TASK [vpn : Ubuntu | Enable services] ** ok: [34.202.48.102] => (item=apparmor) ok: [34.202.48.102] => (item=strongswan) ok: [34.202.48.102] => (item=netfilter-persistent)
TASK [vpn : Ubuntu | Ensure that the strongswan service directory exist] *** changed: [34.202.48.102]
TASK [vpn : Ubuntu | Setup the cgroup limitations for the ipsec daemon] **** changed: [34.202.48.102]
TASK [vpn : Iptables configured] *** changed: [34.202.48.102] => (item={u'dest': u'/etc/iptables/rules.v4', u'src': u'rules.v4.j2'})
TASK [vpn : Iptables configured] *** changed: [34.202.48.102] => (item={u'dest': u'/etc/iptables/rules.v6', u'src': u'rules.v6.j2'})
TASK [vpn : FreeBSD / HardenedBSD | Get the existing kernel parameters] **** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Set the rebuild_needed fact] *** skipping: [34.202.48.102] => (item=IPSEC) skipping: [34.202.48.102] => (item=IPSEC_NAT_T) skipping: [34.202.48.102] => (item=crypto)
TASK [vpn : FreeBSD / HardenedBSD | Make the kernel config] **** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Ensure the all options are enabled] **** skipping: [34.202.48.102] => (item=options IPSEC) skipping: [34.202.48.102] => (item=options IPSEC_NAT_T) skipping: [34.202.48.102] => (item=device crypto)
TASK [vpn : HardenedBSD | Determine the sources] *** skipping: [34.202.48.102]
TASK [vpn : FreeBSD | Determine the sources] *** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Increase the git postBuffer size] ** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Fetching the sources...] *** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Fetching the sources...] *** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | The kernel is being built...] ** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | The kernel is being built...] ** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Reboot] **** skipping: [34.202.48.102]
TASK [vpn : FreeBSD / HardenedBSD | Enable strongswan] ***** skipping: [34.202.48.102]
TASK [vpn : Install strongSwan] **** ok: [34.202.48.102]
TASK [vpn : Get StrongSwan versions] *** changed: [34.202.48.102]
TASK [vpn : Setup the config files from our templates] ***** changed: [34.202.48.102] => (item={u'dest': u'/etc/strongswan.conf', u'src': u'strongswan.conf.j2', u'group': u'root', u'mode': u'0644', u'owner': u'root'}) changed: [34.202.48.102] => (item={u'dest': u'/etc/ipsec.conf', u'src': u'ipsec.conf.j2', u'group': u'root', u'mode': u'0644', u'owner': u'root'}) changed: [34.202.48.102] => (item={u'dest': u'/etc/ipsec.secrets', u'src': u'ipsec.secrets.j2', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'})
TASK [vpn : Get loaded plugins] **** changed: [34.202.48.102]
TASK [vpn : Disable unneeded plugins] ** skipping: [34.202.48.102] => (item=revocation) skipping: [34.202.48.102] => (item=hmac) skipping: [34.202.48.102] => (item=gcm) changed: [34.202.48.102] => (item=resolve) changed: [34.202.48.102] => (item=sshkey) changed: [34.202.48.102] => (item=md5) changed: [34.202.48.102] => (item=attr) skipping: [34.202.48.102] => (item=socket-default) changed: [34.202.48.102] => (item=test-vectors) changed: [34.202.48.102] => (item=xcbc) changed: [34.202.48.102] => (item=eap-mschapv2) changed: [34.202.48.102] => (item=constraints) changed: [34.202.48.102] => (item=connmark) changed: [34.202.48.102] => (item=ccm) changed: [34.202.48.102] => (item=xauth-generic) skipping: [34.202.48.102] => (item=aes) skipping: [34.202.48.102] => (item=nonce) changed: [34.202.48.102] => (item=pkcs1) changed: [34.202.48.102] => (item=sha1) changed: [34.202.48.102] => (item=md4) skipping: [34.202.48.102] => (item=kernel-netlink) skipping: [34.202.48.102] => (item=sha2) skipping: [34.202.48.102] => (item=stroke) changed: [34.202.48.102] => (item=agent) skipping: [34.202.48.102] => (item=pgp) skipping: [34.202.48.102] => (item=pkcs12) skipping: [34.202.48.102] => (item=pubkey) skipping: [34.202.48.102] => (item=x509) changed: [34.202.48.102] => (item=dnskey) skipping: [34.202.48.102] => (item=pkcs7) skipping: [34.202.48.102] => (item=pem) changed: [34.202.48.102] => (item=gmp) changed: [34.202.48.102] => (item=rc2) skipping: [34.202.48.102] => (item=random) skipping: [34.202.48.102] => (item=pkcs8) skipping: [34.202.48.102] => (item=openssl) changed: [34.202.48.102] => (item=fips-prf) changed: [34.202.48.102] => (item=aesni) changed: [34.202.48.102] => (item=updown)
TASK [vpn : Ensure that required plugins are enabled] ** changed: [34.202.48.102] => (item=revocation) changed: [34.202.48.102] => (item=hmac) changed: [34.202.48.102] => (item=gcm) skipping: [34.202.48.102] => (item=resolve) skipping: [34.202.48.102] => (item=sshkey) skipping: [34.202.48.102] => (item=md5) skipping: [34.202.48.102] => (item=attr) changed: [34.202.48.102] => (item=socket-default) skipping: [34.202.48.102] => (item=test-vectors) skipping: [34.202.48.102] => (item=xcbc) skipping: [34.202.48.102] => (item=eap-mschapv2) skipping: [34.202.48.102] => (item=constraints) skipping: [34.202.48.102] => (item=connmark) skipping: [34.202.48.102] => (item=ccm) skipping: [34.202.48.102] => (item=xauth-generic) changed: [34.202.48.102] => (item=aes) changed: [34.202.48.102] => (item=nonce) skipping: [34.202.48.102] => (item=pkcs1) skipping: [34.202.48.102] => (item=sha1) skipping: [34.202.48.102] => (item=md4) changed: [34.202.48.102] => (item=kernel-netlink) changed: [34.202.48.102] => (item=sha2) changed: [34.202.48.102] => (item=stroke) skipping: [34.202.48.102] => (item=agent) changed: [34.202.48.102] => (item=pgp) changed: [34.202.48.102] => (item=pkcs12) changed: [34.202.48.102] => (item=pubkey) changed: [34.202.48.102] => (item=x509) skipping: [34.202.48.102] => (item=dnskey) changed: [34.202.48.102] => (item=pkcs7) changed: [34.202.48.102] => (item=pem) skipping: [34.202.48.102] => (item=gmp) skipping: [34.202.48.102] => (item=rc2) changed: [34.202.48.102] => (item=random) changed: [34.202.48.102] => (item=pkcs8) changed: [34.202.48.102] => (item=openssl) skipping: [34.202.48.102] => (item=fips-prf) skipping: [34.202.48.102] => (item=aesni) skipping: [34.202.48.102] => (item=updown)
TASK [vpn : Ensure the pki directory does not exist] *** skipping: [34.202.48.102]
TASK [vpn : Ensure the pki directories exist] ** changed: [34.202.48.102 -> localhost] => (item=ecparams) changed: [34.202.48.102 -> localhost] => (item=certs) changed: [34.202.48.102 -> localhost] => (item=crl) changed: [34.202.48.102 -> localhost] => (item=newcerts) changed: [34.202.48.102 -> localhost] => (item=private) changed: [34.202.48.102 -> localhost] => (item=reqs)
TASK [vpn : Ensure the files exist] **** changed: [34.202.48.102 -> localhost] => (item=.rnd) changed: [34.202.48.102 -> localhost] => (item=private/.rnd) changed: [34.202.48.102 -> localhost] => (item=index.txt) changed: [34.202.48.102 -> localhost] => (item=index.txt.attr) changed: [34.202.48.102 -> localhost] => (item=serial)
TASK [vpn : Generate the openssl server configs] *** changed: [34.202.48.102 -> localhost]
TASK [vpn : Build the CA pair] ***** changed: [34.202.48.102 -> localhost]
TASK [vpn : Copy the CA certificate] *** changed: [34.202.48.102 -> localhost]
TASK [vpn : Generate the serial number] **** changed: [34.202.48.102 -> localhost]
TASK [vpn : Build the server pair] ***** changed: [34.202.48.102 -> localhost]
TASK [vpn : Build the client's pair] *** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Build the client's p12] **** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Copy the p12 certificates] ***** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Get active users] ** changed: [34.202.48.102 -> localhost]
TASK [vpn : Revoke non-existing users] ***** skipping: [34.202.48.102] => (item=akishore)
TASK [vpn : Copy the revoked certificates to the vpn server] *** skipping: [34.202.48.102] => (item=akishore)
TASK [vpn : Copy the keys to the strongswan directory] ***** changed: [34.202.48.102] => (item={u'dest': u'/etc/ipsec.d/cacerts/ca.crt', u'src': u'configs/34.202.48.102/pki/cacert.pem', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'}) changed: [34.202.48.102] => (item={u'dest': u'/etc/ipsec.d/certs/34.202.48.102.crt', u'src': u'configs/34.202.48.102/pki/certs/34.202.48.102.crt', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'}) changed: [34.202.48.102] => (item={u'dest': u'/etc/ipsec.d/private/34.202.48.102.key', u'src': u'configs/34.202.48.102/pki/private/34.202.48.102.key', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'})
TASK [vpn : Register p12 PayloadContent] *** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Set facts for mobileconfigs] *** ok: [34.202.48.102 -> localhost]
TASK [vpn : Build the mobileconfigs] *** changed: [34.202.48.102 -> localhost] => (item=(censored due to no_log))
TASK [vpn : Build the strongswan app android config] *** changed: [34.202.48.102 -> localhost] => (item=(censored due to no_log))
TASK [vpn : Build the android helper html] ***** changed: [34.202.48.102 -> localhost] => (item=(censored due to no_log))
TASK [vpn : Build the client ipsec config file] **** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Build the client ipsec secret file] **** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Build the windows client powershell script] **** changed: [34.202.48.102 -> localhost] => (item=akishore)
TASK [vpn : Restrict permissions for the local private directories] **** ok: [34.202.48.102 -> localhost] => (item=configs/34.202.48.102)
RUNNING HANDLER [security : restart ssh] *** changed: [34.202.48.102]
RUNNING HANDLER [dns_adblocking : restart apparmor] **** changed: [34.202.48.102]
RUNNING HANDLER [vpn : restart strongswan] ***** changed: [34.202.48.102]
RUNNING HANDLER [vpn : daemon-reload] ** changed: [34.202.48.102]
RUNNING HANDLER [vpn : restart iptables] *** changed: [34.202.48.102]
TASK [vpn : strongSwan started] **** ok: [34.202.48.102]
TASK [debug] *** ok: [34.202.48.102] => { "msg": [ [ "\"# Congratulations! #\"", "\"# Your Algo server is running. #\"", "\"# Config files and certificates are in the ./configs/ directory. #\"", "\"# Go to https://whoer.net/ after connecting #\"", "\"# and ensure that all your traffic passes through the VPN. #\"", "\"# Local DNS resolver 172.16.0.1 #\"", "" ], " \"# The p12 and SSH keys password is a366fb0e #\"\n", " ", " \"# Shell access: ssh -i configs/algo.pem ubuntu@34.202.48.102 #\"\n" ] }
TASK [Delete the CA key] *** changed: [34.202.48.102 -> localhost]
PLAY RECAP ***** 34.202.48.102 : ok=115 changed=92 unreachable=0 failed=0 localhost : ok=19 changed=6 unreachable=0 failed=0