0

After installing the Taskwarrior and Taskwarrior server on Ubuntu 16.04 on Windows 10 and successfully synchronizing Taskwarrior with the Taskwarrior server on that laptop, I am trying to synchronize the F-Droid Taskwarrior app on LineageOS 7.1.2 with the laptop:

  • either when they are locally on the same WiFi network, without a configurable router,
  • or through the internet, preferably without dependency on external services.

So the question is, what taskd.server solution/value in the APK/app would allow me to connect to my local PC with a local static IP address: and public shared IP adress: ?^

^Whilst satisfying constraints:

  • Preferably without dependency on external services
  • Otherwise, a non-paid service that allows maintaining your own security/certificates.

Now I do not expect a simple answer, I would really appreciate confirmations of assumptions or explanations why my assumptions or reasonings are invalid/incomplete.

Information that describes the installation steps followed:

  1. For simplification, all options are multiplied by applied twice, to alternate for the following setting:

    ciphers=NORMAL
    ciphers=SECURE256
    

    As suggested here: https://bitbucket.org/kvorobyev/taskwarriorandroid/issues/2/provide-a-taskrcandroid-with-options-and

  2. The certificates are copied from the folder in Ubuntu /home/a/.task folder to the C:/exportcertificates folder on the Windows 10 OS with the following command:

    cp /home/a/.task/first.cert.pem /mnt/c/exportcertificates
    cp /home/a/.task/first.key.pem /mnt/c/exportcertificates 
    cp /home/a/.task/ca.cert.pem /mnt/c/exportcertificates
    

    Next, in Windows, ca.cert.pem is opened in Subliminal. All the text above -----BEGIN CERTIFICATE----- is deleted, to ensure the ca.cert.pem certificate starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE----- as suggested by the repo owner here: https://bitbucket.org/kvorobyev/taskwarriorandroid/issues/19/failed-sync-on-android-601-nexus-6

    Next, these 3 certificates are copied to the internal storage of the Android phone with LineageOS, Android 7.1.2.

  3. The location of the certificates storage is created manually in the internal storage of the phone as <uuid>:

    /storage/self/primary/Android/data/kvj.taskw/files/<uuid>
    

    Where <uuid> is the User Key in the original Ubuntu installation of Taskserver, as specified here: https://gitpitch.com/GothenburgBitFactory/taskserver-setup#/13/2. This adheres to the protocol according to: https://wiki.archlinux.org/index.php/Taskd

    Next, a new account is created and the location accompanying that account is the previously created <uuid>.

  4. There are n keys, and certificates produced, some might be based on the information in: /var/taskd/vars file which contains the CN=localhost line.

    If one of the 3 exported certificates, most likely ca.cert.pem is based on that CN=localhost line, it could produce an error since the "config file" of the Taskwarrior app needs to refer to a different/external host if it wants to connect to the localhost on that PC. As I think is implied here: https://gitpitch.com/GothenburgBitFactory/taskserver-setup#/9/2

  5. The PC has local IP: 172.XX.YY.4 and all PC's on the whole building (200+ PCs) share the following external IP address: 89.AAA.BBB.4. So, the first thing I tried was accessing the building's router at the default gateway to set up a portforward. That was not possible, neither with https://github.com/kaklakariada/portmapper nor the system administrator indicated:

    Routers are not supplied to the building, you on your individual LAN ports you are given through DHCP you are given a public IPv4 address. If you connect your PC to the LAN you don't need to portforward. If you want you can put a router between the wall socket and your PC to portforward.

    That seems to suggest that without the portforward, it should directly connect to the localhost.

    But I do not understand how I could tell it to go from public IP address 89.AAA.BBB.4 to local IP address 89.AAA.BBB.4 at port 53589.

  6. I am currently working at brute forcing all attempts to connect to localhost on a different PC listed below. The list contains the settings for the Taskwarrior F-Droid app:"

    If the following lines are not specified, they are added in the settings as either:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL
    

    Or:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256
    

    List of current attempts:

    taskd.server=localhost:53589
    taskd.server=127.0.0.1:53589
    taskd.server=172.XX.YY.4:53589  
    taskd.server=89.AAA.BBB.4:53589
    

    Then I tried tunneling an external host using ngrok (Source: https://dashboard.ngrok.com/get-started)

    I downloaded and unpacked the ngrok.exe to c:/ngrok/ opened cmd>cd c:/ngrok and entered the following commands:

    ngrok http 80
    

    Which returned:

    http://f59195a3.ngrok.io -> localhost:80
    https://f59195a3.ngrok.io -> localhost:80
    

    So the config file in the APK file was set to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=http://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL
    

    And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=http://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256
    

    And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=https://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL
    

    And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=https://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256
    

    And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL
    

    And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256
    

    Without a port number specified at the end, e.g. taskd.server=https://f59195a3.ngrok.io, it immediately returns the following error:

    Sync disabled: certificate load failure

    With a port specified, e.g. taskd.server=f59195a3.ngrok.io:80 and taskd.server=f59195a3.ngrok.io:53589, the sync is configured successfully and it tries and fails after a few minutes with the error:

    Failed to receive data: Unkown error -1 sync failed. Could not connect to the Taskserver.

    This procedure is repeated with the different secure tunnel by ngrok using forward to port 53589 (which is set open in the Windows firewall. TODO: Present evidence that it is reachable from an external (not local WiFi) system).

    ngrok http 53589
    ngrok tcp 53589
    

    Without a successful sync.

    Next, a similar approach is used using https://localtunnel.github.io/www/. After installation, the following commands are used to set up a secure tunnel to the server on Windows 10.

    lt --port 53589
    

    returning: https://ancient-octopus-100.localtunnel.me

    Analogous to ng, the servers without the port specified immediately failed on the certificate error described above.

    And the ones with port specifications tried, but they failed after a few minutes on the same error as specified above.

    Next, there was the awesome site https://www.freecinc.com/ which provides a hosting service. However, it only allows one to use the keys that are generated by that service. As far as I understand, using that, you lose your security, which I do appreciate.

    The other awesome equivalent is https://inthe.am/ which requires a Google account. Which I am trying to avoid.

    The next option is to modify the cn=.. in the configuration file on the hosting server (my laptop) itself so that that matches the value of what eventually needs to be filled in in the Android Taskwarrior app. However, since I have not determined this value yet, and I assume the ca.cert.pert is dependent on the "cn=.." value in the config file, they need to be transferred every iteration, making it a rather convoluted process.

    Against recommendations, I am trying to use a laptop as a hosting server, and I would be ecstatic if the Android phone and laptop could sync if they are on the same home WiFi network.

    Here, it is suggested on https://gitpitch.com/GothenburgBitFactory/taskserver-setup#/10/1 to use "your full machine name for proper network addressability". hostname -f returns DESKTOP-2XXXXXT.localdomain, I do not think that is the "full machine name".

1 Answer 1

1

The short answer is classified by the Taskwarrior setup guide as "a bad idea". Source: https://taskwarrior.org/docs/taskserver/taskwarrior.html

Set the taskd.trust to ignore hostname with the following line:

sudo task config taskd.trust -- ignore hostname

This approach was combined with the solution suggested in this question that I found afterward: https://superuser.com/questions/1314916/when-listening-to-a-port-taskserver-should-the-local-address-be-localhost-or

It suggests one set the CN=localhost:portnr to CN=0.0.0.0:53589 in the /pki folder before generating the certificates. CN=0.0.0.0:53589 would mean only Taskwarrior instances that are on the same machine, e.g. VirtualBox Ubuntu with Taskwarrior or emulated Android with Taskwarrior F-Droid app would be able to access the server.

However, just setting CN=0.0.0.0:53589 did not allow the Taskwarrior server on Ubuntu on Windows 10 (through Windows Store) to sync with itself. That is why the ignore hostname a bad idea, was added to make it work.

That also meant the Taskwarrior F-Droid app was able to synchronize with it from a different WiFi network in the same building.

There are two moments where one needs to enter the host IP address and port name.

  1. In the vars file in the pki folder in the line CN=...
  2. After telling Taskserver where the freshly generated certificates are located, with the line: sudo taskd config --force server 0.0.0.0:53589 --data $TASKDDATA

I intend on testing the following setups to yield a definite answer.

  1. Setting the static IP address of my laptop and seeing if I can sync the Taskserver on Ubuntu on Windows 10 and the Taskwarrior app with the server on the PC if I enter the static. With and without ignoring the hostname in taskd.trust

  2. Setting CN=127.0.0.1:53589 and seeing if I can sync the Taskserver on Ubuntu on Windows 10 and the Taskwarrior app with the server on the PC if I enter the static. With and without ignoring the hostname in taskd.trust

  3. Performing more thorough troubleshooting with CN=0.0.0.0:53589 to try and sync without ignoring hostname in taskd.trust.

  4. Changing a character in every certificate (one at a time) in the F-Droid Taskwarrior app and checking if the successful synchronisation becomes unsuccessful due to an invalid certificate. From that, one could conclude that the answer I suggest, ignoring the hostname breaches the security of the hostname location, and not the complete certificate security check.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .