1 # Manually Creating & Removing OpenVPN access for users
5 In order to manually create/remove OpenVPN access for users, there are pre-requisites
6 steps which should be fulfilled.
8 * Access to below Nordix OpenVPN/Jump and CA servers with sudo access to infra user
9 from your local machine,
10 +----------------+---------------+--------------------------------------+
11 | Nordix OpenVPN | IP ADDRESS | SSH ACCESS |
12 +================+===============+======================================+
13 | ONAP-CityCloud | 77.81.6.42 | ssh <USER_ID>@77.81.6.42 -p 52413 |
14 +----------------+---------------+--------------------------------------+
15 | ONAP-Xerces | 129.192.70.24 | ssh <USER_ID>@129.192.70.24 -p 52413 |
16 +----------------+---------------+--------------------------------------+
17 | Acumos | 91.106.193.58 | ssh <USER_ID>@91.106.193.58 -p 52413 |
18 +----------------+---------------+--------------------------------------+
19 | CCD | 188.212.109.53| ssh <USER_ID>@188.212.109.53 -p 52413|
20 +----------------+---------------+--------------------------------------+
21 | CA Server | 77.81.6.250 | ssh <USER_ID>@77.81.6.250 -p 52413 |
22 +----------------+---------------+--------------------------------------+
24 * Install virtualenv, python3-minimal, python3-dev, and python3-pip
27 sudo apt install -y virtualenv python3-minimal python3-dev python3-pip
29 * Create and set virtualenv
31 virtualenv -p python3 .venv
32 source ~/.venv/bin/activate
34 * Install Ansible 2.9.6
36 pip install ansible==2.9.6
39 ## Generate User ovpn file
41 * Clone infra/tools repository from Nordix Gerrit
44 git clone "https://gerrit.nordix.org/infra/tools"
46 You are now ready to create ovpn files for users in project specific OpenVPN server,
48 * Change directory in your computer where the repo cloned,
50 cd tools/infra/openvpn_automation
53 * Export the `user_name` and `vpn_server_public_ip` as environment variable
55 export user_name=<Client_name>
56 export vpn_server_public_ip=<PUBLIC_IP_OF_REQUIRED_OPENVPNSERVER>
59 * OpenVPN server public IP's can be taken from the table in the top of this file
60 * Client user ID should be user's username (first character of user firstname + lastname)
61 * {{ client_name }} should be given as per specific OpenvVPN servers listed below,
62 +----------------+---------------+---------------------------+
63 | Nordix OpenVPN | CIDR | Client_name |
64 +================+===============+===========================+
65 | ONAP-CityCloud | 10.1.0.0/24 | client_userid.onap |
67 +----------------+---------------+---------------------------+
68 | ONAP-Xerces | 10.10.10.0/24 | client_userid.xerces.onap |
70 +----------------+---------------+---------------------------+
71 | Acumos | 10.1.0.0/24 | client_userid.acumos |
72 +----------------+---------------+---------------------------+
73 | CCD | 10.4.0.0/24 | client_userid.ccd |
74 +----------------+---------------+---------------------------+
76 * Update the invetory file to proceed,
78 cat >> inventory/inventory.ini <<EOF
80 # Nordix OpenVPN server
81 jumphost ansible_connection=ssh ansible_host=$vpn_server_public_ip ansible_user=infra ansible_port=52413 ansible_python_interpreter=/usr/bin/python3
85 * Created user OpenVPN file by running the script,
87 ./generate_openvpn_client.sh
90 * Once user specific ovpn file is generated, this file should be shared with user's email with below instructions,
92 * Please install the openvpn on your laptop. Assuming you using Ubuntu:
93 $ sudo apt install openvpn
94 * Then you need to open the VPN connection using the .ovpn file which contain all the required certificates:
95 $ sudo openvpn --config {{ client_name }}.ovpn
96 * Now, you should have access to all the VMs directly from your laptop
97 $ nmap -n -sP <CIDR>/24
98 * In case you use Windows 10 OS, please use the community version of OpenVPN client:
99 https://swupdate.openvpn.org/community/releases/openvpn-install-2.4.8-I602-Win10.exe
102 ## Revoke User ovpn file
104 * Clone infra/tools repository from Nordix Gerrit
107 git clone "ssh://<USERNAME>@gerrit.nordix.org:29418/infra/tools && scp -p -P 29418 <USERNAME>@gerrit.nordix.org:hooks/commit-msg "tools/.git/hooks/"
109 You are now ready to revoke Openvpn access for users in project specific OpenVPN server,
111 * Change directory in your computer where the repo cloned,
113 cd tools/infra/openvpn_automation
116 * Export the `user_name` and `vpn_server_public_ip` as environment variable
118 export user_name=<Client_name>
119 export vpn_server_public_ip=<PUBLIC_IP_OF_REQUIRED_OPENVPNSERVER>
122 * OpenVPN server public IP's can be taken from the table in the top of this file
123 * Client user ID should be user's username (first character of user firstname + lastname)
124 * {{ client_name }} should be given as per specific OpenvVPN servers listed below,
125 +----------------+---------------+---------------------------+
126 | Nordix OpenVPN | CIDR | Client_name |
127 +================+===============+===========================+
128 | ONAP-CityCloud | 10.1.0.0/24 | client_userid.onap |
130 +----------------+---------------+---------------------------+
131 | ONAP-Xerces | 10.10.10.0/24 | client_userid.xerces.onap |
132 | | 172.16.0.0/16 | |
133 +----------------+---------------+---------------------------+
134 | Acumos | 10.1.0.0/24 | client_userid.acumos |
135 +----------------+---------------+---------------------------+
136 | CCD | 10.4.0.0/24 | client_userid.ccd |
137 +----------------+---------------+---------------------------+
139 * Update the invetory file to proceed,
141 cat >> inventory/inventory.ini <<EOF
143 # Nordix OpenVPN server
144 jumphost ansible_connection=ssh ansible_host=$vpn_server_public_ip ansible_user=infra ansible_port=52413 ansible_python_interpreter=/usr/bin/python3
148 * Delete user entries from OpenVPN server & Nordix CA servers by running the script,
150 ./delete_openvpn_client.sh