0

After installing the Taskwarrior and Taskwarrior server on Ubuntu 16.04 on Windows 10 and successfully synchronizing Taskwarrior with the Taskwarrior server on that laptop, I am trying to synchronize the fdroid taskwarrior app on LineageOS 7.1.2 with the laptop.

  • Either when they are locally on the same wifi network, without a configurable router,
  • Or through the internet, preferably without dependency on external services.

So the question is, what taskd.server solution/value in the apk app would allow me to connect to my local pc with local static ip adress: and public shared ip adress: ?^

^Whilst satisfying constraints:

  • Preferably without dependency on external services
  • Otherwise a non-paid service which allows to maintain your own security/certificates.

Now I do not expect a simple answer, I would really appreciate confirmations of assumptions or explanations why my assumptions or reasonings are invalid/incomplete.

Information that describes the installation steps followed:

  1. For simplification all options are multiplied by applied twice, to alternate for the following setting:

ciphers=NORMAL ciphers=SECURE256

As suggested here: https://bitbucket.org/kvorobyev/taskwarriorandroid/issues/2/provide-a-taskrcandroid-with-options-and

  1. The certificates are copied from the folder in Ubuntu /home/a/.task folder to the C:/exportcertificates folder on the windows 10 OS with the following command:

    cp /home/a/.task/first.cert.pem /mnt/c/exportcertificates
    cp /home/a/.task/first.key.pem /mnt/c/exportcertificates 
    cp /home/a/.task/ca.cert.pem /mnt/c/exportcertificates
    

next in windows, ca.cert.pem is opened in subliminal. All the text above -----BEGIN CERTIFICATE----- is deleted, to ensure the ca.cert.pem certificate starts with -----BEGIN CERTIFICATE----- end ends with -----END CERTIFICATE----- as suggested by the repo owner here: https://bitbucket.org/kvorobyev/taskwarriorandroid/issues/19/failed-sync-on-android-601-nexus-6

Next, these 3 certificates are copied to the internal storage of the android phone with LineageOS, Android 7.1.2.

  1. The location of the certificates storage is created manually in the internal storage of the phone as :

/storage/self/primary/Android/data/kvj.taskw/files/<uuid>

Where is the User Key in the original Ubuntu installation of taskserver, as specified here: https://gitpitch.com/GothenburgBitFactory/taskserver-setup#/13/2. This adheres the protocol according to: https://wiki.archlinux.org/index.php/Taskd

Next a new account is created and the location accompanying that account is the previously created <uuid>.

  1. There are n keys, and certificates produced, some might be based on the information in: /var/taskd/vars file which contains the "CN=localhost" line.

If one of the 3 exported certificates, most likely ca.cert.pem is based on that CN=localhost line, it could produce an error since the "config file" of the taskwarrior app needs to refer to a different/external host if it wants to connect to the localhost on that pc. As I think is implied here: https://gitpitch.com/GothenburgBitFactory/taskserver-setup#/9/2

  1. The pc has local IP: 172.XX.YY.4 and all pc's on the whole building (200+ pcs) share the following external ip adress: 89.AAA.BBB.4. So the first thing I tried was accessing the building's router at the default gateway to set up a portforward. That was not possible, neither with https://github.com/kaklakariada/portmapper and the system admistrator indicated:

Routers are not supplied to the building, you on your individual lan ports you are given through DHCP you are given a public IPv4 adress. If you connect your pc to the lan you don't need to portforward. If you want you can put a router between the wall socket and your pc to portforward.

That seems to suggest that without the portforward it should directly connect to the localhost.

But I do not understand how I could tell it to go from public IP adress 89.AAA.BBB.4 to local IP adress 89.AAA.BBB.4 at port 53589.

  1. I am currently working at brute forcing all attempts to connect to localhost on a different pc listed below. The list contains the settings for the taskwarrior F-droid app:"

if the following lines are not specified they are added in the settings as either:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL

Or:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256

List of current attempts:

    taskd.server=localhost:53589

    taskd.server=127.0.0.1:53589

    taskd.server=172.XX.YY.4:53589  

    taskd.server=89.AAA.BBB.4:53589

Then I tried tunneling an external host using ngrok (Source: https://dashboard.ngrok.com/get-started)

I Downloaded and unpacked the ngrok.exe to c:/ngrok/ opened cmd>cd c:/ngrok and entered the following commands:

    ngrok http 80

Which returned:

    http://f59195a3.ngrok.io -> localhost:80
    https://f59195a3.ngrok.io -> localhost:80

So the config file in the APK file was set to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=http://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL

And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=http://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256

And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=https://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL

And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=https://f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256

And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=NORMAL

And to:

    taskd.certificate=first.cert.pem
    taskd.key=first.key.pem
    taskd.ca=ca.cert.pem
    taskd.server=f59195a3.ngrok.io
    taskd.credentials=<organisation>\/<username of taskwarrior>\/<User key>
    ciphers=SECURE256

Without a port number specified at the end, e.g. taskd.server=https://f59195a3.ngrok.io, it immediately returns the following error:

Sync disabled: certificate load failure

With a port specified e.g. taskd.server=f59195a3.ngrok.io:80 and taskd.server=f59195a3.ngrok.io:53589 the sync is configured successfully and it tries and fails after a few minutes with the error:

Failed to receive data: Unkown error -1 sync failed. Could not connect to the Taskserver.

This procedure is repeated with the different secure tunnel by ngrok using forward to port 53589 (which is set open in the windows firewall. TODO: Present evidence that it is reachable from an external(not local wifi) system).

    ngrok http 53589
    ngrok tcp 53589

Without a successfull syc.

Next a similar approach is used using https://localtunnel.github.io/www/. after installation the following commands are used to set up a a secure tunnel to the server on windows 10.

    lt --port 53589

returning: https://ancient-octopus-100.localtunnel.me

Analogous to ng, the servers without the port specified immediately failed on the certificate error described above.

And the ones with port specification tried but they failed after a few minutes on the same error as specified above.

Next there was the awesome site of https://www.freecinc.com/ which provides a hosting service. However it only allows one to use the keys that are generated by that service. As far as I understand, using that, you lose your security, which I do appreciate.

The other awesome equivalent is https://inthe.am/ which requires a google account. Which I am trying to avoid.

The next option is to modify the cn=.. in the configuration file on the hosting server (my laptop) itself so that that matches the value that of what eventually needs to be filled in in the android taskwarrior app. However since I have not determined this value yet, and I assume the ca.cert.pert is dependent on the "cn=.." value in the config file they need to be transferred every iteration, making it a rather convoluted process.

Against recommendations I am trying to use a laptop as hosting server, and I would be ecstatic if the android phone and laptop could sync if they are at the same home wifi network.

Here it is suggested https://gitpitch.com/GothenburgBitFactory/taskserver-setup#/10/1 to use "your full machine name for proper network addressability". hostname -f returns DESKTOP-2XXXXXT.localdomain, I do not think that is the "full machine name".

0

The short answer is classified by the taskwarrior setup guide as "a bad idea". Source: https://taskwarrior.org/docs/taskserver/taskwarrior.html

Set the taskd.trust to ignore hostname with the following line:

sudo task config taskd.trust -- ignore hostname

This approach was combined with the solution suggested in this question that I found afterwards: https://superuser.com/questions/1314916/when-listening-to-a-port-taskserver-should-the-local-address-be-localhost-or

It suggests one set the CN=localhost:portnr to CN=0.0.0.0:53589 in the /pki folder before generating the certificates. CN=0.0.0.0:53589 would mean only taskwarrior instances that are on the same machine, eg. virtualbox ubuntu with Taskwarrior or Emulated android with Taskwarrior F-droid app, would be able to access the server.

However just setting CN=0.0.0.0:53589 did not allow the Taskwarrior server on Ubuntu on Windows 10 (through Windows Store) to sync with itself. That is why the ignore hostname a bad idea, was added to make it work.

That also meant the Taskwarrior F-droid app was able to synchronize with it from a different wifi network in the same building.

There are two moments where one needs to enter the host ip adress and portname.

  1. In the vars file in the pki folder in the line CN=...
  2. After telling taskserver where the freshly generated certificates are located, with the line: sudo taskd config --force server 0.0.0.0:53589 --data $TASKDDATA

I intend on testing the following set-ups to yield a definite answer.

  1. Setting the static Ip adress of my laptop and seeing if I can sync the taskserver on Ubuntu on Windows 10 and the taskwarrior app with the server on the pc if I enter the static. With and without ingoring the hostname in taskd.trust

  2. Setting CN=127.0.0.1:53589 and seeing if I can sync the taskserver on Ubuntu on Windows 10 and the taskwarrior app with the server on the pc if I enter the static. With and without ingoring the hostname in taskd.trust

  3. Performing a more thorough trouble shoot with CN=0.0.0.0:53589 to try and sync without ignoring hostname in taskd.trust.

  4. Changing a character in every certificate (one at a time) in the F-droid Taskwarrior app and checking if the successfull synchronisation becomes unsuccessfull due to an invalid certificate. From that one could conclude that the answer I suggest, ignore hostname breaches the security of the hostname location, and not the complete certificate security check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.