opened
PaulSec
username_0
Hi!

I updated the Ansible role to reflect: 
- changes on the `config.json` file
- make sure that ufw is installed on the remote machine before any operations
- generate a SSL certificate on the fly to serve the app
- use the Ansible capabilities module instead of some shell-fu
- created a gophish service which runs out of the box

Have a great day!
Updated the Ansible role
issue
created
PaulSec
username_0
Btw, just so you know, I also added a nginx to serve as a reverse proxy and made the CN (for the certificate + nginx) a variable that you can change in `vars/main.yml`
comment
created
PaulSec
username_0
Moreover, I updated the role so that it spins up a nginx as a reverse proxy for the gophish server. 
The admin panel will only available on localhost.
comment
created
jordan-wright
username_1
Sounds great! I’ll give this a shot ASAP and will merge if everything checks out.

Thanks for all the help on this!
comment
created
jordan-wright
username_1
This is the error I'm getting on a fresh Debian install:

```
root@gophish:/home/jordan# service gophish status
● gophish.service - gophish
   Loaded: loaded (/etc/systemd/system/gophish.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2020-03-17 22:18:12 CDT; 3min 5s ago
  Process: 461 ExecStart=/home/jordan/gophish_deploy/gophish (code=exited, status=1/FAILURE)
 Main PID: 461 (code=exited, status=1/FAILURE)

Mar 17 22:18:11 gophish systemd[1]: Started gophish.
Mar 17 22:18:12 gophish gophish[461]: time="2020-03-17T22:18:12-05:00" level=warning msg="No contact address has been configured."
Mar 17 22:18:12 gophish gophish[461]: time="2020-03-17T22:18:12-05:00" level=warning msg="Please consider adding a contact_address entry in your config.json"
Mar 17 22:18:12 gophish gophish[461]: goose: no migrations to run. current version: 20200116000000
Mar 17 22:18:12 gophish gophish[461]: time="2020-03-17T22:18:12-05:00" level=info msg="Starting admin server at https://127.0.0.1:3333"
Mar 17 22:18:12 gophish gophish[461]: time="2020-03-17T22:18:12-05:00" level=fatal msg="open /etc/ssl/private/gophish.pem: permission denied"
Mar 17 22:18:12 gophish systemd[1]: gophish.service: Main process exited, code=exited, status=1/FAILURE
Mar 17 22:18:12 gophish systemd[1]: gophish.service: Unit entered failed state.
Mar 17 22:18:12 gophish systemd[1]: gophish.service: Failed with result 'exit-code'.
```

The error appears to be stemming from the fact that I'm using an unprivileged user, which is trying to access `/etc/ssl/private` which is locked down:

```
jordan@gophish:~$ ls -alh /etc/ssl/
total 52K
drwxr-xr-x  6 root root     4.0K Mar 17 22:15 .
drwxr-xr-x 81 root root     4.0K Mar 17 22:19 ..
drwxr-xr-x  2 root root      20K Mar 17 22:16 certs
drwxr-xr-x  2 root root     4.0K Mar 17 22:16 crt
drwxr-xr-x  2 root root     4.0K Mar 17 22:16 csr
-rw-r--r--  1 root root      11K Nov 28  2018 openssl.cnf
drwx--x---  2 root ssl-cert 4.0K Mar 17 22:16 private
```

Perhaps it makes sense for us to ensure that the `{{ gophish_user }}` is in the `ssl-cert` group?
comment
created
jordan-wright
username_1
Oops! Accidentally closed this out and reopened. My bad!
comment
created
PaulSec
username_0
You are totally right Jordan. I changed that to make sure that the user is in the `ssl-cert` group using: 

```yaml
- name: adding existing user '{{ gophish_user }}' to group ssl-cert
  user:
    name: '{{ gophish_user }}'
    groups: ssl-cert
    append: yes
```

Thanks again for the review! I tested it on a vanilla Debian 10.
comment
created
jordan-wright
username_1
Looks like this works great. Thanks @username_0!
comment