This project contents everything related to Jenkins infrastructure VPN. It includes the following elements:
- Build an Openvpn docker image integrated with openldap.
- Manage client configuration and certificate
To connect to this VPN, your VPN client must be configured with your Jenkins account username/password and certificate authentication. Certificate authentication requires the following files:
- The ca.crt
- username.key cfr HowTo Get client access !! Your private key must remain secret,
- username.crt is located in cert/pki/issued, once an administrator signs your request and publish it.
client
remote vpn.jenkins.io 443
ca "~/.cert/jenkins/ca.crt"
cert "~/.cert/jenkins/username.crt"
key "~/.cert/jenkins/username.key"
auth-user-pass
dev tun
proto tcp
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nobody
group nobody
With network manager client, you must enable the option :
Use this connection only for resources on its network
If you want to use multiple VPN connections at the same time with OpenVPN, you have to install a new TAP adapter. This can be very easily by running as Admin the C:\Program Files\TAP-Windows\bin\addtap.bat
. The TAP-Windows tool is installed in parallel with OpenVPN.
This project holds VPN keys for connecting on Jenkins infrastructure VPN.
If you think that you should have access to this network, feel free to read HowTo Get client access.
To access the Jenkins infrastructure private network, you need a certificate containing your Jenkins username as CN. Then this certificate must be signed by an administrator who also assigns you a static IP configuration.
Feel free to follow the next action points:
- Fork this repository on your own Github account: fork a repo
- Build EASYVPN binary by running one of the following commands depending on your
make init_osx
make init_linux
make init_windows
then copy utils/easyvpn/easyvpn.exe at the root of this repository
- Generate your private key and certificate request:
./easyvpn request <your username>
Your private key will be generated incert/pki/private
, this key must remain secret. - Create a new Pull Request on jenkinsinfra/openvpn, staging branch: How to Create a pull request
- Open an INFRA ticket on JIRA referencing your PR
- Grab a cup of coffee and wait patiently for an administrator to sign your certificate request.
- Once an admin notify you that everything is right, you can then retrieve your certificate from
./cert/pki/issued/<your_username>.crt
- Enter in the VPN network directory:
cd cert
- Run
make show-req name=<username>
- Enter in the VPN network directory:
cd cert
- Run
make show-certs name=<username>
You can test if your private key matches your certificate and certificate request by running following commands:
openssl pkey -in <your_private_key> -pubout -outform pem | sha256sum
==
openssl x509 -in <your_certificate> -pubkey -noout -outform pem | sha256sum
==
openssl req -in <your_certificate_request> -pubkey -noout -outform pem | sha256sum
To add/revoke certificates, you must be allowed to decrypt cert/pki/private/ca.key.enc
.
This file is encrypted with sops and you are public gpg key must be added to .sops.yaml by an existing administrator to be allowed to run make decrypt
.
This repository relies on easy-rsa.
To validate and sign a client certificate, you are going to execute the following actions
- Build EASYVPN binary by running one of the following commands depending on your
make init_osx
make init_linux
make init_windows
then copy utils/easyvpn/easyvpn.exe at the root of this repository- Git checkout on the right branch "staging"
- Sign certificate request:
./easyvpn sign <CN_to_sign>
- Update Docker image tag in the puppet configuration.
- Build EASYVPN binary by running one of the following commands depending on your
make init_osx
make init_linux
make init_windows
and copy utils/easyvpn/easyvpn.exe at the root of this repository- Revoke certificate:
./easyvpn revoke <CN_to_sign>
- Update Docker image tag in the puppet configuration.
This image can be configured at runtime with different environment variables.
AUTH_LDAP_BINDDN
Define user dn used to query the ldap databaseAUTH_LDAP_URL
Define ldap endpoint urlAUTH_LDAP_PASSWORD
Define user dn passwordAUTH_LDAP_GROUPS_MEMBER
Define required group member to authenticate
Some examples can be found inside docker-compose.yaml
To test this image, you need a "mock" ldap and SSL certificates.
Then go in directory docker
and run one of the following commands
! Certificates must be readable by UID 101
make start
- Start the ldap and vpn service
This project is designed to work with the following requirements:
Feel free to contribute to this image by:
- Fork this project into your account
- Make your changes in your local fork
- Submit a pull request with a description and a link to a Jira ticket
- Ask for a review
Please report any issue on the Jenkins infrastructure project