ansible-openvpn-hardened
ansible-openvpn-hardened copied to clipboard
include amazon aws example and startup sshd after openvpn
An issue with this playbook is that the sshd service often get's stopped on reboot.
This can make this playbook impossible to use on Amazon AWS since there is no console -- you just get locked out of ssh whether or not you have connect via openvpn.
I modified the playbook to fix this, by specifying that the sshd service should startup only after the openvpn tunnel device is setup. This is accomplished by modifying the systemd file for the ssh service (/lib/systemd/system/ssh.service).
This is inspired from: https://btux1984.wordpress.com/2015/10/15/start-a-service-after-openvpn-connection-has-been-established-using-systemd/
This method circumvents the usual method of defining an "up.sh" script which starts ssh after openvpn startup that is usually recommended (see: https://unix.stackexchange.com/questions/144992/starting-ssh-server-after-vpn-starts), but which DOES NOT work here because openvpn does not have root privileges in this hardened setup and so cannot execute the restart command.
I also added a typical AWS example (assuming ubuntu 16.04) to inventory.example, which sudo user name ubuntu (as is typical on AWS).
Tested on Ubuntu 16.04 x64. Not sure it will work on the other supported distros, maybe the location of the ssh.service file is different or it's contents are.