Add Remote Access / Always-On VPN module (74-AlwaysOnVPN) - #39
Merged
Conversation
New module 74-AlwaysOnVPN is the VPN-gateway half of the remote-access
stack whose RADIUS auth back end is the NPS module (73): RRAS forwards
authentication to NPS, NPS applies the network policy.
* Install the RemoteAccess (DirectAccess and VPN) role (reversible,
via the timeout wrapper + undo).
* Configure RRAS as a VPN server (Install-RemoteAccess -VpnType Vpn).
* Point VPN authentication at an NPS/RADIUS server. The shared secret
is collected as a SecureString, converted to plaintext only for the
Add-RemoteAccessRadius call, then zeroed — never written to the
Dry-Run queue, its JSON export, or any file. Undo removes the RADIUS
server and reverts auth back to Windows.
* Generate device-tunnel (machine-cert) / user-tunnel (EAP-TLS)
Always-On VPN ProfileXML from a few prompts. User-supplied values are
XML-escaped before interpolation, and profiles are written to the
Admins+SYSTEM-only hardened state dir.
* Show the current Remote Access / VPN configuration.
Wired into the loader, Header action set, entry-point dispatch
(AlwaysOnVPNSetup), Roles & Features menu (item 11), and menu runner.
Module count 74 -> 75; 4944 tests, 0 failures; PSScriptAnalyzer clean.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New module 74-AlwaysOnVPN adds the Windows Remote Access (RRAS) VPN server and Always-On VPN profile generation — the gateway half of the remote-access stack whose RADIUS auth back end is the NPS module (73). RRAS forwards authentication to NPS; NPS applies the network policy.
Install-WindowsFeatureWithTimeoutwith a registered undo.Install-RemoteAccess -VpnType Vpn(SSTP + IKEv2). Undo tears the configuration back down.SecureString, converted to plaintext only for theAdd-RemoteAccessRadiuscall and zeroed after — never in the Dry-Run queue, its JSON export, or any file. Undo removes the RADIUS server and reverts auth back to Windows (so it can't be left pointing at a removed server).Security
Get-RackStackSecureStateDir(Admins S-1-5-32-544 + SYSTEM S-1-5-18-only DACL), not a world-readable temp path.SecurityElement::Escape, so a stray</&/</...>can't break out of an element or extend the profile. (Caught by the pre-ship security review, along with the undo auth-revert.)Integration
Wired into all 9 points: loader,
-ActionValidateSet, entry-point dispatch (AlwaysOnVPNSetup), Roles & Features menu (item 11), menu runner, version (4 files), test suite (Section 171), and the monolithic build's module count.Validation