cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-activedirectory/providers/domain_node.rb

@@ -0,0 +1,275 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Provider:: domain_node
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+require 'chef/mixin/shell_out'
+include Chef::Mixin::ShellOut
+include Chef::Mixin::PowershellOut
+
+def whyrun_supported?
+  true
+end
+
+action :add do
+  case node['platform']
+    when "windows"
+      set_client_dns
+      elevate_remote_access
+      join_domain_windows
+#      set_computer_name(join_domain_creds)
+    when platform_family?('rhel')
+      install_ad_client_packages
+      join_domain_linux
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end
+
+action :remove do
+  case node['platform']
+    when "windows"
+      unjoin_domain_windows
+    when platform_family?('rhel')
+      unjoin_domain_linux
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end
+
+# def load_current_resource
+# @current_resource = @new_resource.dup
+# end
+
+def join_domain_creds
+  "(New-Object System.Management.Automation.PSCredential('#{new_resource.netbios_name}\\#{new_resource.join_user}', (ConvertTo-SecureString '#{new_resource.join_password}' -AsPlainText -Force)))"
+end
+
+def join_domain_windows
+  unless in_domain?
+    # This will allow us to add a new computer account to the correct OU so the right group policy is applied
+    new_name = nil
+    new_name = "-NewName #{new_resource.computer_name}" if node['hostname'].downcase != new_resource.computer_name.downcase
+
+    if new_resource.computer_ou
+      code = "Add-Computer -DomainName #{new_resource.dns_name} -Credential#{join_domain_creds} #{new_name} -OUPath '#{new_resource.computer_ou}' -PassThru -Verbose -Force"
+    else
+      code = "Add-Computer -DomainName #{new_resource.dns_name} -Credential#{join_domain_creds} #{new_name} -PassThru -Verbose -Force"
+    end
+
+    Chef::Log.info("Joining #{new_resource.computer_name} node to #{new_resource.dns_name} domain")
+    cmd = powershell_out(code)
+
+    if cmd.stdout.include?("HasSucceeded") && cmd.stdout.include?("True")
+      Chef::Log.info("Domain Join was successful")
+      execute "kill ssh for reboot" do
+        command "Taskkill /im sshd.exe /f /t"
+        returns [0, 128]
+        action :nothing
+      end
+      reboot "Successfully joined #{new_resource.computer_name} to #{new_resource.dns_name} domain" do
+        action :reboot_now
+        reason "Successfully joined #{new_resource.computer_name} to #{new_resource.dns_name} domain"
+        notifies :run, "execute[kill ssh for reboot]", :immediately
+      end
+      kill_ssh
+    elsif cmd.stdout.include?("HasSucceeded") && cmd.stdout.include?("False")
+      Chef::Log.fatal("Domain Join was NOT successful")
+      Chef::Log.fatal("Domain join stderr #{cmd.stderr}")
+      Chef::Application.fatal!("Failed to join #{new_resource.computer_name} to #{new_resource.dns_name} domain")
+    else
+      Chef::Log.fatal("Something went wrong during domain join. Command to join domain was: #{code}")
+      Chef::Log.fatal("Domain join stderr #{cmd.stderr}")
+      Chef::Application.fatal!("Failed to join #{new_resource.computer_name} to #{new_resource.dns_name} domain")
+    end
+  end
+end
+
+def set_client_dns
+  cmd = powershell_out("Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses #{new_resource.dc_ips.join(", ")}")
+  Chef::Log.info("Set DNS addresses to #{new_resource.dc_ips.join(", ")}")
+end
+
+def unjoin_domain_windows
+  if in_domain?
+    Chef::Log.info("Removing #{new_resource.computer_name} node from #{new_resource.dns_name} domain")
+    cmd = powershell_out("Remove-Computer -UnjoinDomaincredential #{join_domain_creds} -Passthru -Verbose -Restart -Force")
+    Chef::Application.fatal!("Failed to remove #{new_resource.computer_name} from #{new_resource.dns_name} domain") unless cmd.exitstatus == 0
+    reboot "Removed #{new_resource.computer_name} from #{new_resource.dns_name} domain" do
+      action :reboot_now
+      reason "Removed #{new_resource.computer_name} from #{new_resource.dns_name} domain"
+    end
+    kill_ssh
+  end
+end
+
+def join_domain_linux
+
+  set_selinux_policies
+  config_ssh_ntp_dns
+  create_pam_winbind_directories
+  pam_winbind_lib
+  configure_winbind_kerberos_authentication
+
+  directory "#{node['ad']['samba_conf_dir']}/includes" do
+    mode 0755
+  end
+
+  template "#{node['ad']['samba_conf_dir']}/smb.conf" do
+    source "smb.conf.erb"
+    owner "root"
+    group "root"
+    mode 0644
+    notifies :restart, "service[smb]", :delayed
+    notifies :restart, "service[winbind]", :delayed
+    variables(
+        :domain_name => new_resource.dns_name,
+        :dcs => new_resource.dc_names,
+        :computer_name => new_resource.computer_name,
+        :netbios_name => new_resource.netbios_name,
+        :include_file => "#{node['ad']['samba_conf_dir']}/includes/#{node['ad']['samba_include_file']}"
+    )
+  end
+
+  # We no longer user Winbind to integrate with AD, but Samba relies on it, so
+  # we run it on top of adcli's Kerberos creds so that you can still use SMB.
+  execute "Join Winbind to domain #{new_resource.dns_name}" do
+    command "( echo '#{new_resource.join_password}' | kinit #{new_resource.join_user} ) ; net ads join #{new_resource.dns_name.downcase} -k -d 4"
+    sensitive true
+    not_if "net ads testjoin -k | grep OK"
+    notifies :restart, "service[winbind]", :delayed
+  end
+end
+
+def install_ad_client_packages
+
+  %w{samba4-winbind authconfig krb5-workstation pam_krb5 samba4-common oddjob-mkhomedir samba4-winbind-clients samba4-winbind-krb5-locator krb5-devel}.each { |pkg|
+    package pkg
+  }
+
+  if %w{centos redhat}.include?(node['platform']) && node['platform_version'].to_i == 7
+    # execute "systemctl enable smb.service "
+    package "samba"
+    service "smb" do 
+      action :enable
+    end
+  end
+end
+
+def set_selinux_policies
+  # Disable SELinux. Need to test if existing policies below work without having to disabling SELinux.
+  execute "setenforce 0"
+  # Add Policies to SELinux to allow winbind and ssh to work correctly. TO DO - TEST THIS
+  %w{winbindpol sshd_pol}.each { |policy_file|
+    %w{te pp}.each { |ext|
+      cookbook_file "#{Chef::Config[:file_cache_path]}/#{policy_file}.#{ext}" do
+        source "#{policy_file}.#{ext}"
+      end
+    }
+
+    execute "semodule -i #{policy_file}.pp" do
+      cwd Chef::Config[:file_cache_path]
+      not_if "semodule -l | grep #{policy_file}"
+      notifies :restart, "service[winbind]", :immediately
+      notifies :restart, "service[sshd]", :immediately
+    end
+  }
+
+  execute "setsebool -P ssh_chroot_rw_homedirs 1" do
+    not_if "grep ssh_chroot_rw_homedirs=1 /etc/selinux/targeted/modules/active/booleans.local"
+  end
+end
+
+def config_ssh_ntp_dns
+  template "mu-activedirectory /etc/ntp.conf" do
+    path "/etc/ntp.conf"
+    source "ntp.conf.erb"
+    owner "root"
+    group "root"
+    mode 0644
+    variables(
+      :dcs => new_resource.dc_names
+    )
+  end
+
+
+  template "mu-activedirectory /etc/ssh/sshd_config" do
+    path "/etc/ssh/sshd_config"
+    source "sshd_config.erb"
+    owner "root"
+    group "root"
+    cookbook "mu-tools"
+    mode 0600
+    notifies :restart, "service[sshd]", :immediately
+    # variables(
+    # :allow_password_auth => new_resource.allow_password_auth,
+    # :allow_groups => new_resource.allow_groups,
+    # :sftp_only_group => new_resource.sftp_only_group,
+    # :sftp_chroot => new_resource.sftp_chroot
+    # )
+  end
+
+end
+
+def create_pam_winbind_directories
+  directory "/home/#{new_resource.dns_name}" do
+    owner "root"
+    group "root"
+    mode 0755
+    not_if { ::File.exists?("/home/#{new_resource.dns_name}") or ::File.symlink?("/home/#{new_resource.dns_name}")}
+  end
+
+  %w[/run /run/samba /run/samba/winbindd].each { |path|
+    directory path do
+      owner "root"
+      group "root"
+      mode 0755
+    end
+  }
+
+  directory "/etc/skel" do
+    owner "root"
+    group "root"
+    mode 0700
+  end
+
+  %w{.bashrc .bash_profile .bash_logout}.each { |file|
+    file "/etc/skel/#{file}" do
+      owner "root"
+      group "root"
+      mode 0600
+    end
+  }
+end
+
+def pam_winbind_lib
+  link "/lib64/security/pam_winbind.so" do
+    to "/usr/lib64/security/pam_winbind.so"
+  end
+
+  execute "echo 'session optional pam_umask.so umask=0077' >> /etc/pam.d/sshd" do
+    not_if "grep pam_umask.so /etc/pam.d/sshd"
+  end
+end
+
+def configure_winbind_kerberos_authentication
+  # Because authconfig doesn't always update those
+#  %w{password-auth system-auth}.each { |file|
+#    cookbook_file "/etc/pam.d/#{file}" do
+#      source file
+#      manage_symlink_source true
+#    end
+#  }
+end
+
+def unjoin_domain_linux
+  execute "Unjoin domain #{new_resource.dns_name}" do
+    command "net ads leave -U #{new_resource.join_user}%#{new_resource.join_password}"
+    sensitive true
+    only_if "net ads testjoin | grep OK"
+  end
+end

data/cookbooks/mu-activedirectory/recipes/default.rb

@@ -0,0 +1,8 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Recipe:: default
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#

data/cookbooks/mu-activedirectory/recipes/domain-controller.rb

@@ -0,0 +1,44 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Recipe:: domain-controller
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'chef-vault'
+domain_admin = chef_vault_item(node['ad']['admin_auth']['vault'], node['ad']['admin_auth']['item'])
+
+can_add_controller = false
+
+case node['platform']
+  when "windows"
+    ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+
+    require 'chef/win32/version'
+    version = Chef::ReservedNames::Win32::Version.new
+
+    if version.windows_server_2012? || version.windows_server_2012_r2?
+      can_add_controller = true
+    else
+      Chef::Log.info "Requires Windows Server 2012 or 2012R2, current version is #{version})"
+    end
+  when platform_family?('rhel')
+    # To do: Active Directory on Linux
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end
+
+if can_add_controller
+  mu_activedirectory_domain_controller node['ad']['domain_name'] do
+    netbios_name node['ad']['netbios_name']
+    domain_admin_user domain_admin[node['ad']['admin_auth']['username_field']]
+    domain_admin_password domain_admin[node['ad']['admin_auth']['password_field']]
+    restore_mode_password domain_admin[node['ad']['admin_auth']['password_field']]
+    site_name node['ad']['site_name']
+    computer_name node['ad']['computer_name']
+    sites node['ad']['sites']
+    existing_dc_ips node['ad']['dc_ips']
+  end
+end

data/cookbooks/mu-activedirectory/recipes/domain-node.rb

@@ -0,0 +1,50 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Recipe:: domain-node
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'chef-vault'
+domain_creds = nil
+if node.has_key?('ad') and node['ad'].has_key?('join_auth') and node['ad']['join_auth'].has_key?('vault') and node['ad']['join_auth'].has_key?('item') and !node['ad']['join_auth']['vault'].nil? and !node['ad']['join_auth']['item'].nil?
+  domain_creds = chef_vault_item(node['ad']['join_auth']['vault'], node['ad']['join_auth']['item'])
+end
+can_join_domain = false
+
+case node['platform']
+  when "windows"
+    ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+
+    require 'chef/win32/version'
+    version = Chef::ReservedNames::Win32::Version.new
+
+    if version.windows_server_2012? || version.windows_server_2012_r2? || version.windows_server_2016?
+      can_join_domain = true
+    else
+      Chef::Log.info "Requires Windows Server 2012, 2012R2 or windows_server_2016"
+    end
+  when platform_family?('rhel')
+    if node['platform_version'].to_i >= 6
+      can_join_domain = true # just winbind, really
+      include_recipe "mu-activedirectory::sssd"
+    else
+      Chef::Log.info "Requires CentOS/RedHat 6/7. Current version is #{node['platform']} #{node['platform_version'].to_i}"
+    end
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end
+
+if can_join_domain and !domain_creds.nil?
+  mu_activedirectory_domain_node node['ad']['domain_name'] do
+    netbios_name node['ad']['netbios_name']
+    computer_name node['ad']['computer_name']
+    join_user domain_creds[node['ad']['join_auth']['username_field']]
+    join_password domain_creds[node['ad']['join_auth']['password_field']]
+    computer_ou node['ad']['computer_ou'] if node['ad']['computer_ou']
+    dc_ips node['ad']['dc_ips']
+    dc_names node['ad']['dcs']
+  end
+end

data/cookbooks/mu-activedirectory/recipes/domain.rb

@@ -0,0 +1,43 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Recipe:: domain
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'chef-vault'
+domain_admin = chef_vault_item(node['ad']['admin_auth']['vault'], node['ad']['admin_auth']['item'])
+can_create_domain = false
+
+case node['platform']
+  when "windows"
+    ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+
+    require 'chef/win32/version'
+    version = Chef::ReservedNames::Win32::Version.new
+
+    if version.windows_server_2012? || version.windows_server_2012_r2?
+      can_create_domain = true
+    else
+      Chef::Log.info "Requires Windows Server 2012 or 2012R2, current version is #{version})"
+    end
+  when platform_family?('rhel')
+    # To do: Active Directory on Linux
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end
+
+if can_create_domain
+  mu_activedirectory_domain node['ad']['domain_name'] do
+    netbios_name node['ad']['netbios_name']
+    domain_admin_user domain_admin[node['ad']['admin_auth']['username_field']]
+    domain_admin_password domain_admin[node['ad']['admin_auth']['password_field']]
+    restore_mode_password domain_admin[node['ad']['admin_auth']['password_field']]
+    site_name node['ad']['site_name']
+    computer_name node['ad']['computer_name']
+    sites node['ad']['sites']
+    existing_dc_ips node['ad']['dc_ips']
+  end
+end

data/cookbooks/mu-activedirectory/recipes/sssd.rb

@@ -0,0 +1,185 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Recipe:: sssd
+#
+# Copyright:: Copyright (c) 2016 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+case node['platform_family']
+  when "rhel"
+
+    %w{sshd winbind smb messagebus}.each { |svc|
+      begin
+        resources('service['+svc+']')
+      rescue Chef::Exceptions::ResourceNotFound
+        service svc do
+          action [:enable, :start]
+          only_if { ::File.exists?("/etc/init.d/#{svc}") }
+        end
+      end
+    }
+
+    begin
+      resources('service[network]')
+    rescue Chef::Exceptions::ResourceNotFound
+      service "network" do
+        only_if { ::File.exists?("/etc/init.d/network") }
+      end
+    end
+
+    packages = %w(epel-release dbus sssd sssd-ldap sssd-ad authconfig nscd oddjob-mkhomedir krb5-devel)
+
+    package packages
+
+    packages_uninstall = %w(nss-pam-ldapd pam_ldap)
+    
+    package packages_uninstall do
+      action :remove
+    end
+
+
+    case elversion
+    when 7
+      package "adcli"
+      # trying to make sure Chef doesn’t try to start the service if it's already started
+      execute "sed -i 's/--nopidfile//' /usr/lib/systemd/system/messagebus.service && systemctl daemon-reload" do
+        only_if "grep '\--nopidfile' /usr/lib/systemd/system/messagebus.service"
+      end
+    end
+
+    service "nscd" do
+      action [:disable, :stop]
+    end
+
+    execute "restorecon -r /usr/sbin"
+
+    # SELinux Policy for oddjobd and its interaction with syslogd
+    cookbook_file "syslogd_oddjobd.pp" do
+      path "#{Chef::Config[:file_cache_path]}/syslogd_oddjobd.pp"
+    end
+
+    execute "Add oddjobd and syslogd interaction to SELinux allow list" do
+      command "/usr/sbin/semodule -i syslogd_oddjobd.pp"
+      cwd Chef::Config[:file_cache_path]
+      not_if "/usr/sbin/semodule -l | grep syslogd_oddjobd"
+      notifies :restart, "service[oddjobd]", :delayed
+    end
+
+    case elversion
+    when 6
+      service "oddjobd" do
+        start_command "sh -x /etc/init.d/oddjobd start" # seems to actually work
+        action [:enable, :start]
+      end
+      package %w(git automake libtool openldap-devel libxslt-devel)
+
+      git 'Clone ADCLI' do
+        repository 'git clone git://anongit.freedesktop.org/realmd/adcli'
+        revision 'master'
+        destination '/root'
+        action :sync
+      end
+      
+      # execute "git clone git://anongit.freedesktop.org/realmd/adcli" do
+      #   cwd "/root"
+      #   not_if { ::Dir.exists?("/root/adcli") }
+      # end
+
+      # execute "git fetch && git pull" do
+      #   cwd "/root/adcli"
+      # end
+
+      build_essential 'name' do
+        compile_time  True
+      end
+
+      # This is our workaround until the RPM makes it way back into a repo
+      # somewhere. It was removed from EPEL after it became part of mainstream
+      # RHEL 6.8, but CentOS doesn't have it yet.
+      execute "compile adcli" do
+        cwd "/root/adcli"
+        command "./autogen.sh --disable-doc --prefix=/usr && make && make install"
+        not_if { ::File.exists?("/usr/sbin/adcli") }
+      end
+    when 7
+      # Seems to work on CentOS7
+      service "oddjobd" do
+        action [:enable, :start]
+      end
+    end
+
+    execute "/usr/sbin/authconfig --disablenis --disablecache --disablewinbind --disablewinbindauth --enablemkhomedir --disablekrb5 --enablesssd --enablesssdauth --enablelocauthorize --disableforcelegacy --disableldap --disableldapauth --updateall" do
+      notifies :restart, "service[oddjobd]", :immediately
+      notifies :reload, "service[sshd]", :delayed
+      not_if "grep pam_sss.so /etc/pam.d/password-auth"
+    end
+
+    include_recipe 'chef-vault'
+    domain_creds = chef_vault_item(node['ad']['join_auth']['vault'], node['ad']['join_auth']['item'])
+
+    service "sssd" do
+      action :nothing
+      notifies :restart, "service[sshd]", :immediately
+      only_if { ::File.exists?("/etc/krb5.keytab") }
+    end
+    directory "/etc/sssd"
+    template "/etc/sssd/sssd.conf" do
+      source "sssd.conf.erb"
+      mode 0600
+      cookbook "mu-activedirectory"
+      notifies :restart, "service[sssd]", :immediately
+      variables(
+        :domain => node['ad']['domain_name'],
+        'homedir' => node['ad']['homedir'],
+        :krb5keytabuser => node['ad']['computer_name'],
+        :short_domain => node['ad']['netbios_name'],
+        :base_dn => node['ad']['domain_name'].split(/\./).map { |x| "dc=#{x}" }.join(","),
+        :dcs => node['ad']['dc_ips']
+      )
+    end
+
+    template "/etc/dhcp/dhclient-eth0.conf" do
+      source "dhclient-eth0.conf.erb"
+      mode 0644
+      variables(
+        :domain => node['ad']['domain_name'],
+        'dc_ips' => node['ad']['dc_ips']
+      )
+      notifies :restart, "service[network]", :immediately unless %w{redhat centos}.include?(node['platform']) && node['platform_version'].to_i == 7
+    end
+
+    # If adcli fails mysteriously, look for bogus /etc/hosts entries pointing
+    # to your DCs. It seems to dumbly trust any reverse mapping it sees,
+    # whether or not the name matches the actual Kerberos tickets you et.
+    execute "Run ADCLI" do
+      not_if { ::File.exists?("/etc/krb5.keytab") }
+      command "echo -n '#{domain_creds[node['ad']['join_auth']['password_field']]}' | /usr/sbin/adcli join #{node['ad']['domain_name']} --domain-realm=#{node['ad']['domain_name'].upcase} -U #{domain_creds[node['ad']['join_auth']['username_field']]} --stdin-password"
+      notifies :restart, "service[sssd]", :immediately
+#      sensitive true
+    end
+
+    template "/etc/krb5.conf" do
+      source "krb5.conf.erb"
+      mode 0444
+      cookbook "mu-activedirectory"
+      notifies :restart, "service[sssd]", :immediately
+      variables(
+        'domain_name' => node['ad']['domain_name'],
+        :dcs => node['ad']['dc_ips']
+      )
+    end
+
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end

data/cookbooks/mu-activedirectory/resources/domain.rb

@@ -0,0 +1,25 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Resource:: domain
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+actions :create, :delete
+default_action :create
+
+attribute :dns_name, :kind_of => String, :name_attribute => true, :required => true
+attribute :sites, :kind_of => Array, :required => false
+attribute :existing_dc_ips, :kind_of => Array, :required => false
+attribute :netbios_name, :kind_of => String, :required => true
+attribute :domain_admin_user, :kind_of => String, :required => true
+attribute :domain_admin_password, :kind_of => String, :required => true
+attribute :restore_mode_password, :kind_of => String, :required => true
+attribute :site_name, :kind_of => String, :default => node['ad']['site_name'], :required => false
+attribute :computer_name, :kind_of => String, :default => node['ad']['computer_name']
+attribute :ntds_static_port, :kind_of => Fixnum, :default => node['ad']['ntds_static_port']
+attribute :ntfrs_static_port, :kind_of => Fixnum, :default => node['ad']['ntfrs_static_port']
+attribute :dfsr_static_port, :kind_of => Fixnum, :default => node['ad']['dfsr_static_port']
+attribute :netlogon_static_port, :kind_of => Fixnum, :default => node['ad']['netlogon_static_port']

data/cookbooks/mu-activedirectory/resources/domain_controller.rb

@@ -0,0 +1,25 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Resource:: domain_controller
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+actions :add, :remove
+default_action :add
+
+attribute :dns_name, :kind_of => String, :name_attribute => true, :required => true
+attribute :sites, :kind_of => Array, :required => false
+attribute :existing_dc_ips, :kind_of => Array, :required => false
+attribute :netbios_name, :kind_of => String, :required => true
+attribute :domain_admin_user, :kind_of => String, :required => true
+attribute :domain_admin_password, :kind_of => String, :required => true
+attribute :restore_mode_password, :kind_of => String, :required => true
+attribute :site_name, :kind_of => String, :default => node['ad']['site_name'], :required => false
+attribute :computer_name, :kind_of => String, :default => node['ad']['computer_name']
+attribute :ntds_static_port, :kind_of => Fixnum, :default => node['ad']['ntds_static_port']
+attribute :ntfrs_static_port, :kind_of => Fixnum, :default => node['ad']['ntfrs_static_port']
+attribute :dfsr_static_port, :kind_of => Fixnum, :default => node['ad']['dfsr_static_port']
+attribute :netlogon_static_port, :kind_of => Fixnum, :default => node['ad']['netlogon_static_port']

data/cookbooks/mu-activedirectory/resources/domain_node.rb

@@ -0,0 +1,20 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Resource:: domain_node
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+actions :add, :remove
+default_action :add
+
+attribute :dns_name, :kind_of => String, :name_attribute => true, :required => true
+attribute :dc_ips, :kind_of => Array, :required => true
+attribute :dc_names, :kind_of => Array, :required => true
+attribute :computer_name, :kind_of => String, :required => true
+attribute :netbios_name, :kind_of => String, :required => true
+attribute :join_user, :kind_of => String, :required => true
+attribute :join_password, :kind_of => String, :required => true
+attribute :computer_ou, :kind_of => String, :required => false

data/cookbooks/mu-activedirectory/templates/default/dhclient-eth0.conf.erb

@@ -0,0 +1,4 @@
+interface "eth0" {
+  prepend domain-search "<%= @domain %>";
+  prepend domain-name-servers <%= @dc_ips.join(", ") %>;
+}