Add an iOS/OS X .mobileconfig file for L2TP #822

nopdotcom · 2017-07-20T15:26:19Z

Disclaimer: I am not an ansible person; would love someone to clean up.

The .mobileconfig generated is very similar to what OS X Server emits. Note that we can't configure "AlwaysOn" VPNs because that apparently requires a "managed" device, and nobody really wants that.

See https://developer.apple.com/library/content/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html for more information on these config files.

This PR addresses half of #136 (we still need to generate some mobileconfig containing our server certs) and I am ignoring the similar #512 until I understand what that “connect on demand” checkbox really does. (Probably not what you’d think.)

Disclaimer: I am not an ansible person; would love someone to clean up. The .mobileconfig included is very similar to what OS X Server emits. Note that we can't configure "AlwaysOn" VPNs because that apparently requires a "managed" device, and nobody really wants that. See https://developer.apple.com/library/content/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html for more information.

cpu · 2017-07-20T22:16:57Z

Hi @nopdotcom

I'm super excited to see this PR! Thank you! I know there are a number of people that will be happy to see this support.

I'm likely not going to be able to review this until the weekend but I wanted to leave a note to make sure you know that the PR is noticed & in someone's queue.

Thanks again

nopdotcom · 2017-07-20T22:51:25Z

Cool, and thank you for the kind words. Perhaps I could convince @ccaviness to eyeball this PR for sanity’s sake. (Clay, I’m on Keybase.) I predict he’s going to tell me that I shouldn’t be writing XML in a text-based template language, and he’d be right.

Just FYI: I am planning on building a mobileconfig package for the HTTPS cert too, which is a more pressing problem for overall security on iOS.

It also looks like much of the drudgework in setting up L2TP on Windows can be done via a downloadable file; see AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk and yeah, just like you would have predicted from Windows RAS:

DEVICE=vpn
PhoneNumber=192.168.1.1
AreaCode=
...

ccaviness · 2017-07-21T14:27:44Z

It's pretty common practice to template .mobileconfig files (or other large XML blobs) like this; we do this with ERB in puppet code frequently.

I'm not familiar with ansible or the specifics of configuring L2TP via profile, but looking through it everything seems sane.

nopdotcom · 2017-07-21T17:44:21Z

@ccaviness, thanks for your help. I owe you one.

cpu

At surface level this looks good to me. I've tested provisioning with the PR on a couple providers.

I do not have any iOS/OSX devices to test the actual profile with. @alimakki @jlund Are either of you able to give this a second pass and perhaps try some actual clients?

Thanks!

cpu · 2017-07-23T15:06:03Z

playbooks/roles/l2tp-ipsec/tasks/main.yml

+  apt:
+    name: uuid
+
+- name: Generate a UUID for this Apple .mobileconfig package


nit: "this Apple .mobileconfig" -> "the Apple .mobileconfig"

cpu · 2017-07-23T15:06:24Z

playbooks/roles/l2tp-ipsec/tasks/main.yml

+  shell: uuid -v4
+  register: l2tp_mobileconfig_package_uuid
+
+- name: Generate a UUID for this VPN for the Apple .mobileconfig package


Same nit comment as above.

cpu · 2017-07-23T15:29:35Z

playbooks/roles/l2tp-ipsec/templates/streisand.mobileconfig.j2

+	<key>PayloadVersion</key>
+	<integer>1</integer>
+	<key>PayloadDisplayName</key>
+	<string>Streisand L2TP config for({{ streisand_server_name }})</string>


I think you're missing a space between "for" and ({{ here.

cpu · 2017-07-23T15:32:21Z

Just FYI: I am planning on building a mobileconfig package for the HTTPS cert too, which is a more pressing problem for overall security on iOS.

Sounds good! The TLS/HTTPS config needs some love overall. I have a bit of in-progress work here that I hope to return to. I can always catch up the mobileconfig afterwards.

jlund

I can confirm that the mobileconfig file works perfectly on iOS 10.3.3 connecting to a brand-new Streisand test server running this branch. Nice work! This is a great feature for L2TP users.

In addition to the feedback @cpu posted, I think we also need to add a couple of short sentences that explain how to use these (even though the steps are dead-simple).

Thanks for putting this together! This is a pretty fantastic first-time contribution.

jlund · 2017-07-23T19:21:12Z

playbooks/roles/l2tp-ipsec/templates/instructions.md.j2

+
+There are two ways to configure the OS X L2TP VPN to connect to this Streisand server. The easiest is to install an OS X *profile* containing the VPN definition. You can also set it up manually.
+
+The profile is [available here](streisand.mobileconfig).


We should include additional instructions here. Maybe something like...

"Double-click on the downloaded file to begin the connection setup process."

jlund · 2017-07-23T19:24:44Z

playbooks/roles/l2tp-ipsec/templates/instructions.md.j2

+
+There are two ways to configure the iOS L2TP VPN to connect to this Streisand server. The easiest is to install an iOS *profile* containing the VPN definition. You can also set it up manually.
+
+The profile is [available here](streisand.mobileconfig).


We should include additional instructions here. Maybe something like...

"Tap this link from your iOS device to begin the setup process."

nopdotcom · 2017-07-25T16:21:14Z

Thanks for the feedback. I'll update the PR tonight or tomorrow.

The profile instructions reflect the user interface for iOS 10.3.2 and OS X 10.11. Added details on how to manage profiles, including removing them. Warned that profiles may be dangerous.

nopdotcom · 2017-07-26T19:44:17Z

OK, this is back in good enough shape to merge.

I got this feedback from reviewers on the whole document: add screenshots, and give the rest of the systems some love that way. But adding inline imgs would bloat the page out. Along with detailed instructions, screenshots also have a maintenance tail (new operating systems etc) and finding people to do both at once might be problematic.

Eventually, I want to include the VPN icon on OS X because it is not obviously “VPN” at all. ~500 byte PNG, so it fits in a data url.

I’ve attached what you can get for 65kB/20kB images as an example. (Both are lossily-compressed PNGs.) But the pressure for screenshots should be off the OS X/iOS L2TP side.

cpu · 2017-07-29T12:31:27Z

@jlund Can you give this another 🔍? I think it's ready to merge pending your review being accepted/dismissed.

jlund · 2017-07-30T20:41:24Z

This looks good to me. Merged!

I created a related discussion with my thoughts on including screenshots in our documentation: StreisandEffect/discussions#33

Thanks again for making this happen!

nopdotcom added 3 commits July 5, 2017 20:15

initial

fe4ed8f

Merge branch 'apple-mobileconfig'

3f78945

cpu added the area/l2tp label Jul 20, 2017

cpu suggested changes Jul 23, 2017

View reviewed changes

jlund suggested changes Jul 23, 2017

View reviewed changes

nopdotcom added 3 commits July 26, 2017 11:09

Add better installation instructions for iOS/OS X profiles.

843707e

The profile instructions reflect the user interface for iOS 10.3.2 and OS X 10.11. Added details on how to manage profiles, including removing them. Warned that profiles may be dangerous.

Clean up typos/nits noticed by @cpu and @jlund.

fa0852c

Rewrite OS X/iOS docs to be easier to understand.

fc1ee85

cpu approved these changes Jul 26, 2017

View reviewed changes

jlund approved these changes Jul 30, 2017

View reviewed changes

jlund merged commit b824ef5 into StreisandEffect:master Jul 30, 2017

jlund mentioned this pull request Jul 30, 2017

Screenshots in generated documentation StreisandEffect/discussions#33

Open

jlund mentioned this pull request Jul 30, 2017

Update French translation for the mobileconfig support that was added in #822 #849

Closed

nopdotcom deleted the bare-mobileconfig branch August 15, 2017 18:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add an iOS/OS X .mobileconfig file for L2TP #822

Add an iOS/OS X .mobileconfig file for L2TP #822

nopdotcom commented Jul 20, 2017

cpu commented Jul 20, 2017

nopdotcom commented Jul 20, 2017 •

edited

Loading

ccaviness commented Jul 21, 2017

nopdotcom commented Jul 21, 2017

cpu left a comment

cpu Jul 23, 2017

cpu Jul 23, 2017

cpu Jul 23, 2017

cpu commented Jul 23, 2017

jlund left a comment

jlund Jul 23, 2017

jlund Jul 23, 2017

nopdotcom commented Jul 25, 2017 via email

nopdotcom commented Jul 26, 2017

cpu commented Jul 29, 2017

jlund commented Jul 30, 2017


		There are two ways to configure the OS X L2TP VPN to connect to this Streisand server. The easiest is to install an OS X profile containing the VPN definition. You can also set it up manually.

		The profile is [available here](streisand.mobileconfig).


		There are two ways to configure the iOS L2TP VPN to connect to this Streisand server. The easiest is to install an iOS profile containing the VPN definition. You can also set it up manually.

		The profile is [available here](streisand.mobileconfig).

Add an iOS/OS X .mobileconfig file for L2TP #822

Add an iOS/OS X .mobileconfig file for L2TP #822

Conversation

nopdotcom commented Jul 20, 2017

cpu commented Jul 20, 2017

nopdotcom commented Jul 20, 2017 • edited Loading

ccaviness commented Jul 21, 2017

nopdotcom commented Jul 21, 2017

cpu left a comment

Choose a reason for hiding this comment

cpu Jul 23, 2017

Choose a reason for hiding this comment

cpu Jul 23, 2017

Choose a reason for hiding this comment

cpu Jul 23, 2017

Choose a reason for hiding this comment

cpu commented Jul 23, 2017

jlund left a comment

Choose a reason for hiding this comment

jlund Jul 23, 2017

Choose a reason for hiding this comment

jlund Jul 23, 2017

Choose a reason for hiding this comment

nopdotcom commented Jul 25, 2017 via email

nopdotcom commented Jul 26, 2017

cpu commented Jul 29, 2017

jlund commented Jul 30, 2017

nopdotcom commented Jul 20, 2017 •

edited

Loading