Control OpenVPN and ocserv access via /etc/allowed_vpn_certs (#1470)

Just because you have a certificate (you can authenticate) doesn't mean that you are *authorized* to use a service. Create `/etc/allowed_vpn_certs`, with the name of one client cert per line. To disable ocserv and OpenVPN access, comment out the cert's line.

* ocserv properly uses PAM, and `/etc/pam.d/ocserv` configures it to check the list.

* OpenVPN theoretically can use PAM, but in practice does not seem to call it correctly. However, it ships with a script that can authorize certs.

playbooks/roles/certificates/tasks/client.yml

@@ -46,3 +46,11 @@
   loop_control:
     loop_var: "client_name"
     label: "{{ client_name.item }}"
+
+- name: Authorize certificates via /etc/allowed_vpn_certs
+  template:
+    src: allowed_vpn_certs.j2
+    dest: /etc/allowed_vpn_certs
+    owner: root
+    group: root
+    mode: 0644

playbooks/roles/certificates/templates/allowed_vpn_certs.j2

@@ -0,0 +1,6 @@
+# This file lists all the enabled VPN certificate names. Note that
+# it does not affect WireGuard.
+
+{% for client in vpn_client_names.results -%}
+{{ client.stdout }}
+{% endfor %}

playbooks/roles/openconnect/files/ocserv-pam

@@ -0,0 +1,10 @@
+account required pam_listfile.so \
+	sense=allow item=user file=/etc/allowed_vpn_certs
+
+auth required pam_listfile.so \
+	sense=allow item=user file=/etc/allowed_vpn_certs
+
+password required pam_deny.so
+session required pam_deny.so
+
+other required pam_deny.so

playbooks/roles/openconnect/tasks/main.yml

@@ -2,6 +2,14 @@
 # Download, compile and install ocserv and its dependencies
 - import_tasks: install.yml
 
+- name: Create ocserv's PAM control
+  copy:
+    src: ocserv-pam
+    dest: /etc/pam.d/ocserv
+    owner: root
+    group: root
+    mode: 0644
+
 - name: Create the ocserv configuration directory
   file:
     path: "{{ ocserv_path }}"

playbooks/roles/openconnect/templates/config.j2

@@ -62,3 +62,5 @@ tunnel-all-dns = true
 {% for item in upstream_dns_servers %}
 dns = {{ item }}
 {% endfor %}
+
+acct = pam

playbooks/roles/openvpn/templates/etc_openvpn_server_common.j2

@@ -34,3 +34,6 @@ group nogroup
 persist-key
 persist-tun
 verb 0
+
+script-security 2
+tls-verify "/usr/share/openvpn/verify-cn /etc/allowed_vpn_certs"