lopeznathan / vpn-deployer

OpenVPN Deploy CLI Tool

VPN Deployer

Simple OpenVPN Deploy CLI Tool

This CLI tool will install OpenVPN utilizing the OpenVPN Installer by Angristan on a DigitalOcean Droplet. Once OpenVPN has been installed, NGINX is installed and a link is provided to download the OpenVPN Client file.

This is only intended for short-term/one-time use, as currently no major security protection is added to the base server.

Installation

This package requires Python 3.7

$ pip3 install git+https://github.com/LopezNathan/vpn-deployer

You will now have access to the vpndeployer command.

Usage

$ vpndeployer --help

usage: vpndeployer [-h] [--ip IP] [--email EMAIL] [--name NAME]
                   [--region REGION]
                   [--image {centos-7-x64,centos-8-x64,ubuntu-16-04-x64,ubuntu-18-04-x64,ubuntu-20-04-x64,debian-9-x64,debian-10-x64}]

VPN Deploy CLI Tool

optional arguments:
  --ip IP               Client IP Address
  --email EMAIL         Email Address for OpenVPN Download Link
  --name NAME           Instance Name
  --region REGION       Instance Region
  --image {centos-7-x64,centos-8-x64,ubuntu-16-04-x64,ubuntu-18-04-x64,ubuntu-20-04-x64,debian-9-x64,debian-10-x64}
                        Instance Distribution Image

Example

vpndeployer

• You will be prompted for your DigitalOcean API Token. This is only passed through getpass to the DigitalOcean API during the creation of the droplet and obtaining the droplet IP.

Once the installer has completed, it will output the OpenVPN download link. This link automatically expires in 5 minutes.

Legacy Deploy Options

DigitalOcean - API

• Copy the API request Code:

  curl -X POST "https://api.digitalocean.com/v2/droplets" \
        -d'{"name":"VPN-Deployer.local","region":"nyc3","size":"512mb","image":"centos-7-x64","user_data":
  "#!/bin/bash
  export EMAIL='EMAIL'
  export IP='IP'
  bash
  curl -o /root/vpn-installer.sh https://raw.githubusercontent.com/LopezNathan/vpn-deployer/archive/OpenVPN-Deploy.sh
  chmod +x /root/vpn-installer.sh && bash /root/vpn-installer.sh"}' \
        -H "Authorization: Bearer API-TOKEN" \
        -H "Content-Type: application/json"

• Edit IP, EMAIL and API-Token

  • IP - Your local IP address
  • Email - Where the download link will be sent
  • API-Token - Your DigitalOcean API token

DigitalOcean - Control Panel

• Create New DigitalOcean Droplet with Options:
  • Choose an image: CentOS
  • Choose a size: 512 MB
  • Choose a datacenter region: Any
  • Select additional options: Check "User Data" & Paste the Script
  • Edit $IP & $EMAIL in the "User Data" Script
    • IP - Your local IP address
    • Email - Where the download link will be sent

vpn-deployer's Issues

get_droplet_ip Reporting Incorrect IP

During recent updates the get_droplet_ip function is grabbing the private IP instead of the public IP. This is due to the for loop updating the variable with the last result.

Temporarily fixed with a break in the loop : 1792720

Dynamic Inventory Environment Variable

The DigitalOcean dynamic inventory script requires an environment variable to authorize, although currently the environment variable is not required as it can be passed in during the deploy. We need to set the environment variable if one is not provided already.

Ansible Playbook Implementation

We are still missing a few things from the old PREP script that was utilized to configure the server (outside the setup of OpenVPN) in the Ansible Playbook configuration. Need to review both and ensure everything that is needed is properly implemented.

PREP Script - https://raw.githubusercontent.com/LopezNathan/vpn-deployer/master/openvpn-install-prep.sh
Ansible Playbook - https://raw.githubusercontent.com/LopezNathan/vpn-deployer/development/openvpn-install.yml

Outdated Distro/Image List

Default image and available distro list is outdated, requiring to specify an image during the deploy.

digitalocean.DataReadError: You specified an invalid image for Droplet creation.

Also, incorrect spelling avaialble_distros in main.py.

IP Argument - Make Optional

Turn the ip argument into an optional argument. We can pull this through the OS itself.

Dynamic Inventory Execution Issues

After downloading the python package via PIP the dynamic inventory script is no longer executable. To correct this, the script has to be re-downloaded and made executable.

Due to this, we most likely need to download the script after the download of the package, prior to the deploy occurring.

 [WARNING]:  * Failed to parse /Users/username/.local/share/virtualenvs/tes
ting-1ZikHb_g/lib/python3.7/site-
packages/vpndeployer/playbooks/inventory/digital_ocean.py with script plugin:
Inventory script (/Users/username/.local/share/virtualenvs/testing-1ZikHb_g
/lib/python3.7/site-packages/vpndeployer/playbooks/inventory/digital_ocean.py)
had an execution error: env: python\r: No such file or directory

 [WARNING]:  * Failed to parse /Users/username/.local/share/virtualenvs/tes
ting-1ZikHb_g/lib/python3.7/site-
packages/vpndeployer/playbooks/inventory/digital_ocean.py with ini plugin: /Use
rs/username/.local/share/virtualenvs/testing-1ZikHb_g/lib/python3.7/site-
packages/vpndeployer/playbooks/inventory/digital_ocean.py:3: Error parsing host
definition '"""': No closing quotation

 [WARNING]: Unable to parse /Users/username/.local/share/virtualenvs/testin
g-1ZikHb_g/lib/python3.7/site-
packages/vpndeployer/playbooks/inventory/digital_ocean.py as an inventory
source

Mail Failing after Droplet Name Change

The DO Droplet names were recently changed to include a timestamp and these names are extremely sketchy when it comes to mail. Appears Google is blocking the emails completely due to this. Find alternative? Is the email feature even needed?

From: Mail Delivery Subsystem <[email protected]>

... while talking to aspmx.l.google.com.:
>>> DATA
<<< 550-5.7.1 [134.209.219.59      11] Our system has detected that this message is
<<< 550-5.7.1 not RFC 5322 compliant:
<<< 550-5.7.1 'From' header has non compliant domain name.
<<< 550-5.7.1 To reduce the amount of spam sent to Gmail, this message has been
<<< 550-5.7.1 blocked. Please visit
<<< 550-5.7.1  https://support.google.com/mail/?p=RfcMessageNonCompliant
<<< 550 5.7.1 and review RFC 5322 specifications for more information. q28si204383qtj.379 - gsmtp
554 5.0.0 Service unavailable

feature_localansible - SSH Connection Failing

The initial SSH connection to the droplet is failing when attempting to execute the playbook remotely :

fatal: [droplet1]: UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: ssh: connect to host IP port 22: Connection timed out",
    "unreachable": true
}

Although, if you utilize the same connection string used by Ansible and connect manually, it works and after you can successfully re-run the playbook with no issues.

I believe this is related to Ansible unable to add to the list of known hosts?

Improve Deploy Speed & Security

• The deploy process currently takes about 8 minutes from start to finish, mainly due to the slowness of yum -y update && yum -y upgrade.

  • Possibly utilize yum-plugin-security and only install security packages?

• Install Basic firewalld

Duo2Unix Cleanup

Run duo2unix across all files in the repository and remove any DOS ^M references.

Incorrect Key Issue

If you have multiple SSH keys attached to your DigitalOcean account with the "VPN-Deployer" name, it does not select the latest key and this causes the SSH connection to fail.

Implement Terraform for Infrastructure Provisioning

I'd like to switch to Terraform to build the infrastructure, allowing easy support for additional providers.

Improve Client Link Download

• Add a check into vpn-deploy.py to monitor http://DROPLET_IP/client.ovpn and output when it's available for download. This avoids the need for the email (make optional).
  • Time the deploy process and determine how often to cURL http://DROPLET_IP/client.ovpn
• Spinning wheel animation while the deploy is in-progress.

IPTables w/ IPv6 Broken - Ansible Playbook

After switching to Ansible, IPTables with IPv6 is failing.

TASK [iptables] ****************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "cmd": "/usr/sbin/iptables -t filter -A INPUT -p tcp -s 123:123:123:123:123:123:123:123-j ACCEPT --destination-port 80", "msg": "iptables v1.4.21: host/network `123:123:123:123:123:123:123:123' not found\nTry `iptables -h' or 'iptables --help' for more information.", "rc": 2, "stderr": "iptables v1.4.21: host/network `123:123:123:123:123:123:123:123' not found\nTry `iptables -h' or 'iptables --help' for more information.\n", "stderr_lines": ["iptables v1.4.21: host/network `123:123:123:123:123:123:123:123' not found", "Try `iptables -h' or 'iptables --help' for more information."], "stdout": "", "stdout_lines": []}
        to retry, use: --limit @/root/openvpn-install.retry