config
{
profiles:
{
CONTRACT:
{
servers: [ "dc-11.office.daily","dc-12.office.daily","dc-13.office.daily" ]
baseDN: "ou=Users_External,OU=Dailymotion,DC=office,DC=daily",
bindCn: "CN=VPN Service,OU=Services,OU=Dailymotion,DC=office,DC=daily",
bindPw: "********************",
searchFilter: "(&(sAMAccountName=%s))"
primaryAttribute: "memberOf"
secondaryAttribute: "mail"
validGroups:
[
"CN=SEC_VPN_Users_External,OU=Security,OU=Groups,OU=Dailymotion,DC=office,DC=daily",
]
otp: "okta"
cert: "ignore"
ip_range: "192.168.207.1 - 192.168.207.254",
routes:
[
"10.189.10.9 255.255.255.255",
"10.190.32.2 255.255.255.255",
"10.190.32.20 255.255.255.255",
"10.190.22.1 255.255.255.255",
"10.190.22.2 255.255.255.255",
"188.65.124.35 255.255.255.255",
"195.8.215.129 255.255.255.255",
"195.8.215.140 255.255.255.255",
"10.190.52.100 255.255.255.255",
"10.190.62.150 255.255.255.255",
]
}
CORP:
{
servers: [ "dc-11.office.daily","dc-12.office.daily","dc-13.office.daily" ]
baseDN: "OU=Dailymotion,DC=office,DC=daily",
bindCn: "CN=VPN Service,OU=Services,OU=Dailymotion,DC=office,DC=daily",
bindPw: "********************",
searchFilter: "(&(sAMAccountName=%s))"
primaryAttribute: "memberOf"
secondaryAttribute: "mail"
validGroups:
[
"CN=SEC_VPN,OU=Security,OU=Groups,OU=Dailymotion,DC=office,DC=daily",
]
otp: "okta"
cert: "optionnal"
upgrade-to: "DEV"
ip_range: "192.168.201.1 - 192.168.203.254"
}
DEV:
{
servers: [ "ldap-auth.vip.dailymotion.com" ]
baseDN: "dc=dailymotion,dc=com"
bindCn: "cn=readonly,dc=dailymotion,dc=com"
bindPw: "**********"
searchFilter: "(&(mail=%s))"
primaryAttribute: "description"
secondaryAttribute: "sshPublicKey"
upgrade-from: "CORP"
upgrade-to: "ADMINS"
otp: "okta"
cert: "optionnal"
ip_range: "192.168.204.1 - 192.168.206.254"
}
ADMINS:
{
validGroups:
[
"infra",
"net",
"datacenter",
]
upgrade-from: "DEV"
otp: [ "internal", "slack" ]
cert: "mandatory"
ip_range: "192.168.200.2 - 192.168.200.254"
}
}
cacheDir: "/var/run/openvpn/"
masterSecrets: [ "*******************************J" ]
vpnLogUrl: "https://install.dm.gg/vpn-log.php"
slackToken: "*************************************************************************"
slackChannels: [ "#squad-it-office" ]
configParser: "/etc/openvpn/roadwarrior_([a-zA-Z0-9]*).conf"
mailRelay: "mailrelay.dailymotion.com:25"
mailFrom: "engineering-infra@dailymotion.com"
ccPwnPassword: "security-incident-report@dailymotion.com"
pwnTemplate: "Mime-Version: 1.0;\nContent-Type: text/html; charset=\"ISO-8859-1\";\nContent-Transfer-Encoding: 7bit;\nFrom: {{.MailFrom}}\nSubject: [Dailymotion] Your current okta password is compromised\nTo: {{.Mail}}\nCc: {{.CcPwnPassword}}\n\nHello
\n
\nWe have detected that you recently connected to the dailymotion's corporate VPN with login {{.Login}} and a password which was part a password-related breach - possibly related to your own account on a third party website - and which is now widely known to hackers.
\n
\nPlease contact the security team and go to the Okta homepage to change your password immediately : https://dailymotion.okta.com/
\n
\nIf you were using the same unsafe password anywhere else, you should change it everywhere and make sure you use a unique password for every service (password managers make this feasible).
\n
\nWe remind you that you should always keep your passwords strong and strictly unique, especially when it comes to your dailymotion accounts. A robust password can, for example, be generated using an easily remembered phrase and retaining certain letters: for example, the phrase \"a bird in the hand is worth two in the bush\" would give the password \"1bitH=2itB\" (this example must not be used as a password).
\n
\nRegards,
\n
\n--
\nThe Dailymotion Security Team"
newAsTemplate: "From: {{.MailFrom}}\nSubject: A new connection from you to the Dailymotion VPN\nTo: {{.Mail}}\n\nHello\n\nWe have detected a new connection to the vpn from {{.Login}}.\nIt was detected the {{.Time}} coming from the ip {{.IP}} ({{.AsName}}).\n\nIt's not the usual internet provider you connect to the Dailymotion VPN from.\nOr maybe it's the first time you use the VPN from this location.\n\nIf you think there is something suspicious, please contact {{.CcPwnPassword}}\nIf it's you who connected to the VPN, we are sorry for the spam. You won't receive another mail if you connect from this location.\n\nRegards,\n\n--\nThe Dailymotion Infra and Security Teams"
slackTemplate: "Hello.\nYou tried to connect to the VPN without an OTP code from your phone app.\nIf you have a Mac, use `{{.Login}}@{{.OTP}}` as your login.\nIf you have a PC with windows or linux, the VPN application should ask you for an OTP code after your login and password.\nThe OTP code is `{{.OTP}}`\n\nPS : you can check to learn how to use a proper OTP application and get rid of these messages"
slackTemplate2: "User *{{.Login}}* required the slack OTP token"
}