Clients' CSR and private keys are kept about ansible-role-openvpn HOT 2 CLOSED

Problem is statefulness - I left the keys on disk so they don't get continually generated on every run, and updating the config file wouldn't force a full key regeneration cycle.

If you're running in a "one shot", adding and removing the client from the run list, yeah, this makes sense.

Gate this behind something that acknowledges the one shot of config generation, and this is fine, but for the general Ansible use of "enforce state", this kind of breaks the assumptions.

from ansible-role-openvpn.

Closing this as stale.

I don't understand the exact use case that clearing keys would solve. I see the concern - unencrypted keys left on disk when the server process doesn't need them isn't good security.

As I understand it, the primary case clearing the tokens protects against is a malicious sysadmin who could plausibly grab a copy of the client config and connect with those tokens.

But said malicious sysadmin would have access at generation time anyway.

In the event of a server compromise, the server certs would have to be regenerated and the config redistributed to clients anyway - and this role allows for the simultaneous recreation of server and client certs, so there's negligible additional overhead from regenerating client certs.

Deleting the keys after generation breaks the role's expectations of idempotent config regeneration, and I don't see why that needs to change.

You could use a post_tasks stanza in your playbook to clean up the files that you don't want if you don't want to maintain a fork.

from ansible-role-openvpn.