cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-activedirectory/templates/default/krb5.conf.erb

@@ -0,0 +1,23 @@
+[logging]
+ default = FILE:/var/log/krb5libs.log
+ kdc = FILE:/var/log/krb5kdc.log
+
+[libdefaults]
+ default_realm = <%= @domain_name.upcase %>
+ dns_lookup_realm = true
+ dns_lookup_kdc = true
+ ticket_lifetime = 48h
+ renew_lifetime = 7d
+ forwardable = true
+ rdns = false
+
+[realms]
+ <%= @domain_name.upcase %> = {
+<% @dcs.each do |dc| %>
+  kdc = <%= dc %>
+<% end %>
+ }
+
+[domain_realm]
+ <%= @domain_name.downcase %> = <%= @domain_name.upcase %>
+ .<%= @domain_name.downcase %> = <%= @domain_name.upcase %>

data/cookbooks/mu-activedirectory/templates/default/ntp.conf.erb

@@ -0,0 +1,56 @@
+# For more information about this file, see the man pages
+# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).
+
+driftfile /var/lib/ntp/drift
+
+# Permit time synchronization with our time source, but do not
+# permit the source to query or modify the service on this system.
+restrict default kod nomodify notrap nopeer noquery
+restrict -6 default kod nomodify notrap nopeer noquery
+
+# Permit all access over the loopback interface.  This could
+# be tightened as well, but to do so would effect some of
+# the administrative functions.
+restrict 127.0.0.1
+restrict -6 ::1
+
+# Hosts on local network are less restricted.
+#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
+
+# Use public servers from the pool.ntp.org project.
+# Please consider joining the pool (http://www.pool.ntp.org/join.html).
+<% @dcs.each { |name| %>
+server <%= name %>
+<% } %>
+server 0.centos.pool.ntp.org iburst
+server 1.centos.pool.ntp.org iburst
+server 2.centos.pool.ntp.org iburst
+server 3.centos.pool.ntp.org iburst
+
+#broadcast 192.168.1.255 autokey        # broadcast server
+#broadcastclient                        # broadcast client
+#broadcast 224.0.1.1 autokey            # multicast server
+#multicastclient 224.0.1.1              # multicast client
+#manycastserver 239.255.254.254         # manycast server
+#manycastclient 239.255.254.254 autokey # manycast client
+
+# Enable public key cryptography.
+#crypto
+
+includefile /etc/ntp/crypto/pw
+
+# Key file containing the keys and key identifiers used when operating
+# with symmetric key cryptography.
+keys /etc/ntp/keys
+
+# Specify the key identifiers which are trusted.
+#trustedkey 4 8 42
+
+# Specify the key identifier to use with the ntpdc utility.
+#requestkey 8
+
+# Specify the key identifier to use with the ntpq utility.
+#controlkey 8
+
+# Enable writing of statistics records.
+#statistics clockstats cryptostats loopstats peerstats

data/cookbooks/mu-activedirectory/templates/default/smb.conf.erb

@@ -0,0 +1,33 @@
+#======================= Global Settings =====================================
+[global]
+
+   workgroup = <%= @netbios_name.upcase %>
+   netbios name = <%= @computer_name.upcase %>
+   #password server = <%= @dcs.join(" ") %>
+   #wins server = <%= @dcs.join(" ") %>
+   realm = <%= @domain_name.upcase %>
+   kerberos method = secrets and keytab
+   security = ads
+   idmap config * : range = 10000-5000000
+   idmap config * : backend = rid
+   idmap config SENT : range = 10000-5000000
+   idmap config SENT : default = yes
+   idmap config SENT : backend = rid
+   idmap uid = 10000-5000000
+   idmap gid = 10000-5000000
+   template homedir = /home/<%= @domain_name.downcase %>/%U
+   template shell = /bin/bash
+   #winbind enum users = Yes
+   #winbind enum groups = Yes
+   #winbind nested groups = yes
+   #winbind use default domain = true
+   #winbind offline logon = false
+   client use spnego = yes
+   client ntlmv2 auth = false
+   encrypt passwords = yes
+   log file = /var/log/samba/log.%m
+   debug level = 3
+   max log size = 5000
+
+# --------------------------- External Configuration File -----------------------------
+  include = <%= @include_file %>

data/cookbooks/mu-activedirectory/templates/default/sssd.conf.erb

@@ -0,0 +1,60 @@
+[domain/<%= @domain %>]
+enumerate = True
+#ldap_search_base = <%= @base_dn %>
+#ldap_user_search_base = <%= @base_dn %>
+#ldap_group_search_base = <%= @base_dn %>
+krb5_server = <%= @domain.upcase %>
+krb5_realm = <%= @domain.upcase %>
+#ldap_tls_reqcert = allow
+#ldap_id_use_start_tls = True
+#ldap_tls_cacertdir = /etc/openldap/cacerts
+ldap_id_mapping = True
+ldap_schema = ad
+ldap_use_tokengroups = False
+<% if node['ad']['domain_sid'] %>
+ldap_idmap_default_domain_sid = <%= node['ad']['domain_sid'] %>
+<% end rescue NoMethodError %>
+ldap_idmap_range_min = 10000
+ldap_idmap_range_max = 40000
+ldap_idmap_range_size = 29999
+id_provider = ad
+auth_provider = ad
+access_provider = ad
+# ldap_user_object_class = user
+# ldap_user_object_class = user
+# ldap_user_name = sAMAccountName
+# ldap_user_uid_number = msSFU30UidNumber
+# ldap_user_gid_number = msSFU30GidNumber
+# ldap_user_gecos = displayName
+# ldap_user_home_directory = msSFU30HomeDirectory
+# ldap_user_shell = msSFU30LoginShell
+# ldap_user_principal = userPrincipalName
+# ldap_group_object_class = group
+# ldap_group_name = cn
+# ldap_group_gid_number = msSFU30GidNumber
+#ldap_sasl_authid = <%= @krb5keytabuser %>
+#krb5_fast_principal = <%= @krb5keytabuser %>
+#krb5_use_fast = try
+#krb5_canonicalize = false
+
+[sssd]
+services = nss, pam, ssh, pac 
+config_file_version = 2
+domains = <%= @domain %>
+
+[nss]
+nss_filter_groups = root
+nss_filter_users = root, apache, postfix, bin, daemon, sshd, ftp, clam, centos, mysql, clam, saslauth, dbus, nagios, rpc, nscd
+override_homedir = <%= @homedir %>
+default_shell = /bin/bash
+
+[pam]
+pam_verbosity = 2
+
+[sudo]
+
+[ssh]
+
+[pac]
+
+[ifp]

data/cookbooks/mu-activedirectory/templates/windows/Backup.xml.erb

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Copyright (c) Microsoft Corporation.  All rights reserved. --><GroupPolicyBackupScheme bkp:version="2.0" bkp:type="GroupPolicyBackupTemplate" xmlns:bkp="http://www.microsoft.com/GroupPolicy/GPOOperations" xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations">
+    <GroupPolicyObject><SecurityGroups><Group><Sid><![CDATA[<%= @ec2config_user_sid %>]]></Sid><SamAccountName><![CDATA[ec2config]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[<%= @netbios_name %>]]></NetBIOSDomainName><DnsDomainName><![CDATA[<%= @domain_name %>]]></DnsDomainName><UPN><![CDATA[ec2config@<%= @domain_name %>]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-1406275717-2083712575-401716046-519]]></Sid><SamAccountName><![CDATA[Enterprise Admins]]></SamAccountName><Type><![CDATA[UniversalGroup]]></Type><NetBIOSDomainName><![CDATA[<%= @netbios_name %>]]></NetBIOSDomainName><DnsDomainName><![CDATA[<%= @domain_name %>]]></DnsDomainName><UPN><![CDATA[Enterprise Admins@<%= @domain_name %>]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-1406275717-2083712575-401716046-512]]></Sid><SamAccountName><![CDATA[Domain Admins]]></SamAccountName><Type><![CDATA[GlobalGroup]]></Type><NetBIOSDomainName><![CDATA[<%= @netbios_name %>]]></NetBIOSDomainName><DnsDomainName><![CDATA[<%= @domain_name %>]]></DnsDomainName><UPN><![CDATA[Domain Admins@<%= @domain_name %>]]></UPN></Group><Group><Sid><![CDATA[<%= @ssh_user_sid %>]]></Sid><SamAccountName><![CDATA[sshd_service]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[<%= @netbios_name %>]]></NetBIOSDomainName><DnsDomainName><![CDATA[<%= @domain_name %>]]></DnsDomainName><UPN><![CDATA[sshd_service@<%= @domain_name %>]]></UPN></Group></SecurityGroups><FilePaths/><GroupPolicyCoreSettings><ID><![CDATA[{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}]]></ID><Domain><![CDATA[<%= @domain_name %>]]></Domain><SecurityDescriptor>01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 85 10 d2 53 3f ee 32 7c 4e b3 f1 17 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 85 10 d2 53 3f ee 32 7c 4e b3 f1 17 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 85 10 d2 53 3f ee 32 7c 4e b3 f1 17 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00</SecurityDescriptor><DisplayName><![CDATA[test]]></DisplayName><Options><![CDATA[0]]></Options><UserVersionNumber><![CDATA[0]]></UserVersionNumber><MachineVersionNumber><![CDATA[851981]]></MachineVersionNumber><MachineExtensionGuids><![CDATA[[{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}]]]></MachineExtensionGuids><UserExtensionGuids/><WMIFilter/></GroupPolicyCoreSettings> 
+        <GroupPolicyExtension bkp:ID="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" bkp:DescName="Registry">
+            
+            
+            <FSObjectFile bkp:Path="%GPO_FSPATH%\Adm\*.*" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Adm\*.*"/>
+        </GroupPolicyExtension>
+        
+        
+        
+        
+        <GroupPolicyExtension bkp:ID="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" bkp:DescName="Security">
+            <FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\microsoft\windows nt\SecEdit\GptTmpl.inf" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf" bkp:ReEvaluateFunction="SecurityValidateSettings" bkp:Location="DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf"/>
+        </GroupPolicyExtension>
+        
+        
+        
+        
+    <GroupPolicyExtension bkp:ID="{F15C46CD-82A0-4C2D-A210-5D0D3182A418}" bkp:DescName="Unknown Extension"><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Microsoft" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\Microsoft" bkp:Location="DomainSysvol\GPO\Machine\Microsoft"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Microsoft\Windows NT" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\Microsoft\Windows NT" bkp:Location="DomainSysvol\GPO\Machine\Microsoft\Windows NT"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Microsoft\Windows NT\SecEdit" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\Microsoft\Windows NT\SecEdit" bkp:Location="DomainSysvol\GPO\Machine\Microsoft\Windows NT\SecEdit"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Scripts" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\Scripts" bkp:Location="DomainSysvol\GPO\Machine\Scripts"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Scripts\Shutdown" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\Scripts\Shutdown" bkp:Location="DomainSysvol\GPO\Machine\Scripts\Shutdown"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Scripts\Startup" bkp:SourceExpandedPath="\\<%= @computer_name %>.<%= @domain_name %>\sysvol\<%= @domain_name %>\Policies\{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}\Machine\Scripts\Startup" bkp:Location="DomainSysvol\GPO\Machine\Scripts\Startup"/></GroupPolicyExtension></GroupPolicyObject>
+</GroupPolicyBackupScheme>

data/cookbooks/mu-activedirectory/templates/windows/bkupInfo.xml.erb

@@ -0,0 +1 @@
+<BackupInst xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest"><GPOGuid><![CDATA[{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}]]></GPOGuid><GPODomain><![CDATA[<%= @domain_name %>]]></GPODomain><GPODomainGuid><![CDATA[{6b56f9d4-4adf-44eb-90ff-ca653d392a25}]]></GPODomainGuid><GPODomainController><![CDATA[<%= @computer_name %>.<%= @domain_name %>]]></GPODomainController><BackupTime><![CDATA[2015-06-07T05:00:23]]></BackupTime><ID><![CDATA[{24E13F41-7118-4FB6-AE8B-45D48AFD6AFE}]]></ID><Comment><![CDATA[]]></Comment><GPODisplayName><![CDATA[test]]></GPODisplayName></BackupInst>

data/cookbooks/mu-activedirectory/templates/windows/gpreprt.xml.erb

@@ -0,0 +1,198 @@
+<?xml version="1.0" encoding="utf-16"?>
+<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
+  <Identifier>
+    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}</Identifier>
+    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @domain_name %></Domain>
+  </Identifier>
+  <Name>test</Name>
+  <IncludeComments>true</IncludeComments>
+  <CreatedTime>2015-06-07T04:31:38</CreatedTime>
+  <ModifiedTime>2015-06-07T04:59:52</ModifiedTime>
+  <ReadTime>2015-06-07T05:00:23.4314191Z</ReadTime>
+  <SecurityDescriptor>
+    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1406275717-2083712575-401716046-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)</SDDL>
+    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
+      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1406275717-2083712575-401716046-512</SID>
+      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\Domain Admins</Name>
+    </Owner>
+    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
+      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1406275717-2083712575-401716046-512</SID>
+      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\Domain Admins</Name>
+    </Group>
+    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
+    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
+      <InheritsFromParent>false</InheritsFromParent>
+      <TrusteePermissions>
+        <Trustee>
+          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
+          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
+        </Trustee>
+        <Type xsi:type="PermissionType">
+          <PermissionType>Allow</PermissionType>
+        </Type>
+        <Inherited>false</Inherited>
+        <Applicability>
+          <ToSelf>true</ToSelf>
+          <ToDescendantObjects>false</ToDescendantObjects>
+          <ToDescendantContainers>true</ToDescendantContainers>
+          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
+        </Applicability>
+        <Standard>
+          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
+        </Standard>
+        <AccessMask>0</AccessMask>
+      </TrusteePermissions>
+      <TrusteePermissions>
+        <Trustee>
+          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
+          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
+        </Trustee>
+        <Type xsi:type="PermissionType">
+          <PermissionType>Allow</PermissionType>
+        </Type>
+        <Inherited>false</Inherited>
+        <Applicability>
+          <ToSelf>true</ToSelf>
+          <ToDescendantObjects>false</ToDescendantObjects>
+          <ToDescendantContainers>true</ToDescendantContainers>
+          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
+        </Applicability>
+        <Standard>
+          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
+        </Standard>
+        <AccessMask>0</AccessMask>
+      </TrusteePermissions>
+      <TrusteePermissions>
+        <Trustee>
+          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
+          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
+        </Trustee>
+        <Type xsi:type="PermissionType">
+          <PermissionType>Allow</PermissionType>
+        </Type>
+        <Inherited>false</Inherited>
+        <Applicability>
+          <ToSelf>true</ToSelf>
+          <ToDescendantObjects>false</ToDescendantObjects>
+          <ToDescendantContainers>true</ToDescendantContainers>
+          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
+        </Applicability>
+        <Standard>
+          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
+        </Standard>
+        <AccessMask>0</AccessMask>
+      </TrusteePermissions>
+      <TrusteePermissions>
+        <Trustee>
+          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1406275717-2083712575-401716046-519</SID>
+          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\Enterprise Admins</Name>
+        </Trustee>
+        <Type xsi:type="PermissionType">
+          <PermissionType>Allow</PermissionType>
+        </Type>
+        <Inherited>false</Inherited>
+        <Applicability>
+          <ToSelf>true</ToSelf>
+          <ToDescendantObjects>false</ToDescendantObjects>
+          <ToDescendantContainers>true</ToDescendantContainers>
+          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
+        </Applicability>
+        <Standard>
+          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
+        </Standard>
+        <AccessMask>0</AccessMask>
+      </TrusteePermissions>
+      <TrusteePermissions>
+        <Trustee>
+          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1406275717-2083712575-401716046-512</SID>
+          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\Domain Admins</Name>
+        </Trustee>
+        <Type xsi:type="PermissionType">
+          <PermissionType>Allow</PermissionType>
+        </Type>
+        <Inherited>false</Inherited>
+        <Applicability>
+          <ToSelf>true</ToSelf>
+          <ToDescendantObjects>false</ToDescendantObjects>
+          <ToDescendantContainers>true</ToDescendantContainers>
+          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
+        </Applicability>
+        <Standard>
+          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
+        </Standard>
+        <AccessMask>0</AccessMask>
+      </TrusteePermissions>
+    </Permissions>
+    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
+  </SecurityDescriptor>
+  <FilterDataAvailable>true</FilterDataAvailable>
+  <Computer>
+    <VersionDirectory>13</VersionDirectory>
+    <VersionSysvol>13</VersionSysvol>
+    <Enabled>true</Enabled>
+    <ExtensionData>
+      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
+        <q1:UserRightsAssignment>
+          <q1:Name>SeAssignPrimaryTokenPrivilege</q1:Name>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ssh_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\sshd_service</Name>
+          </q1:Member>
+        </q1:UserRightsAssignment>
+        <q1:UserRightsAssignment>
+          <q1:Name>SeCreateTokenPrivilege</q1:Name>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ssh_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\sshd_service</Name>
+          </q1:Member>
+        </q1:UserRightsAssignment>
+        <q1:UserRightsAssignment>
+          <q1:Name>SeDenyInteractiveLogonRight</q1:Name>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ssh_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\sshd_service</Name>
+          </q1:Member>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ec2config_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\ec2config</Name>
+          </q1:Member>
+        </q1:UserRightsAssignment>
+        <q1:UserRightsAssignment>
+          <q1:Name>SeDenyRemoteInteractiveLogonRight</q1:Name>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ssh_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\sshd_service</Name>
+          </q1:Member>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ec2config_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\ec2config</Name>
+          </q1:Member>
+        </q1:UserRightsAssignment>
+        <q1:UserRightsAssignment>
+          <q1:Name>SeServiceLogonRight</q1:Name>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ssh_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\sshd_service</Name>
+          </q1:Member>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ec2config_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\ec2config</Name>
+          </q1:Member>
+        </q1:UserRightsAssignment>
+        <q1:UserRightsAssignment>
+          <q1:Name>SeTcbPrivilege</q1:Name>
+          <q1:Member>
+            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @ssh_sid %></SID>
+            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types"><%= @netbios_name %>\sshd_service</Name>
+          </q1:Member>
+        </q1:UserRightsAssignment>
+      </Extension>
+      <Name>Security</Name>
+    </ExtensionData>
+  </Computer>
+  <User>
+    <VersionDirectory>0</VersionDirectory>
+    <VersionSysvol>0</VersionSysvol>
+    <Enabled>true</Enabled>
+  </User>
+</GPO>

data/cookbooks/mu-activedirectory/templates/windows/gptmpl.inf.erb

@@ -0,0 +1,12 @@
+[Unicode]
+Unicode=yes
+[Version]
+signature="$CHICAGO$"
+Revision=1
+[Privilege Rights]
+SeServiceLogonRight = *<%= @ssh_sid %>,*<%= @ec2config_sid %>
+SeCreateTokenPrivilege = *<%= @ssh_sid %>
+SeTcbPrivilege = *<%= @ssh_sid %>
+SeDenyInteractiveLogonRight = *<%= @ssh_sid %>,*<%= @ec2config_sid %>
+SeDenyRemoteInteractiveLogonRight = *<%= @ssh_sid %>,*<%= @ec2config_sid %>
+SeAssignPrimaryTokenPrivilege = *<%= @ssh_sid %>

data/cookbooks/mu-activedirectory/templates/windows/manifest.xml.erb

@@ -0,0 +1 @@
+<Backups xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest" xmlns:mfst="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest" mfst:version="1.0"><BackupInst><GPOGuid><![CDATA[{FD1588BE-0843-43E6-8F35-C4E9F8413EF7}]]></GPOGuid><GPODomain><![CDATA[<%= @domain_name %>]]></GPODomain><GPODomainGuid><![CDATA[{6b56f9d4-4adf-44eb-90ff-ca653d392a25}]]></GPODomainGuid><GPODomainController><![CDATA[<%= @computer_name %>.<%= @domain_name %>]]></GPODomainController><BackupTime><![CDATA[2015-06-07T05:00:23]]></BackupTime><ID><![CDATA[{24E13F41-7118-4FB6-AE8B-45D48AFD6AFE}]]></ID><Comment><![CDATA[]]></Comment><GPODisplayName><![CDATA[test]]></GPODisplayName></BackupInst></Backups>

data/cookbooks/mu-firewall/CHANGELOG.md

@@ -0,0 +1,11 @@
+# mu-firewall CHANGELOG
+
+This file is used to list changes made in each version of the mu-firewall cookbook.
+
+## 0.1.0
+- [your_name] - Initial release of mu-firewall
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

data/cookbooks/mu-firewall/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/mu-firewall/README.md

@@ -0,0 +1,5 @@
+# mu-firewall Cookbook
+
+This cookbook is a wraper of the firewall cookbook for supporting mu
+
+TODO: Improve Readme.md

data/cookbooks/mu-firewall/attributes/default.rb

@@ -0,0 +1,3 @@
+default['firewall']['allow_ssh'] = true
+default['firewall']['firewalld']['permanent'] = true
+default['firewall']['ipv6_enabled'] = false

data/cookbooks/mu-firewall/metadata.rb

@@ -0,0 +1,16 @@
+name             'mu-firewall'
+maintainer       'Mu'
+maintainer_email 'mu-developers@googlegroups.com'
+license          'BSD-3-Clause'
+description      'Installs/Configures mu-firewall'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 12.1' if respond_to?(:chef_version)
+version          '0.1.0'
+
+%w( amazon centos redhat windows ).each do |os|
+	supports os
+end
+
+depends	'firewall', '~> 2.6.5'

data/cookbooks/mu-firewall/recipes/default.rb

@@ -0,0 +1,10 @@
+#
+# Cookbook Name:: mu-firewall
+# Recipe:: default
+#
+# Copyright 2016, YOUR_COMPANY_NAME
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'firewall'

data/cookbooks/mu-glusterfs/CHANGELOG.md

@@ -0,0 +1,13 @@
+mu-glusterfs CHANGELOG
+============================
+
+This file is used to list changes made in each version of the mu-glusterfs cookbook.
+
+0.1.0
+-----
+- [your_name] - Initial release of mu-glusterfs
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

data/cookbooks/mu-glusterfs/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/mu-glusterfs/README.md

@@ -0,0 +1,5 @@
+mu-glusterfs Cookbook
+===========================
+This is a glusterfs cookbook for mu
+
+TODO: Improve Readme.md

data/cookbooks/mu-glusterfs/attributes/default.rb

@@ -0,0 +1,34 @@
+default['gluster_node_class'] = "glusterfs"
+
+default['glusterfs']['client']['mount_path'] = '/gluster'
+
+default['glusterfs']['server']['network_timeout'] = 10
+default['glusterfs']['server']['read_cache_size'] = "128MB"
+default['glusterfs']['server']['brick_base_mount_path'] = '/gluster'
+default['glusterfs']['server']['volume_type'] = "replica"
+default['glusterfs']['server']['num_replicas'] = 2
+default['glusterfs']['server']['raid'] = true
+default['glusterfs']['server']['raid_level'] = 1
+default['glusterfs']['server']['raid_dev'] = "/dev/md0"
+default['glusterfs']['server']['raid_spare_vol'] = false
+default['glusterfs']['server']['volume'] = "gv0"
+default['glusterfs']['server']['portmapper'] = 111
+default['glusterfs']['server']['devices'] = ["/dev/xvdf", "/dev/xvdg"]
+default['glusterfs']['server']['packages'] = %w{xfsprogs mdadm centos-release-gluster glusterfs-server}
+
+default['glusterfs']['fw'] = [
+    {'usage' => 'management', 'port_range' => 24007..24008},
+    {'usage' => 'data', 'port_range' => 49152..49160},
+    {'usage' => 'smb', 'port_range' => 137..139},
+    {'usage' => 'management', 'port_range' => 445},
+]
+
+default['glusterfs']['server']['raid_levels_map'] = [
+    {'level' => 0, 'spare' => false, 'min_devcies' => 2},
+    {'level' => 1, 'spare' => false, 'min_devcies' => 2},
+    {'level' => 5, 'spare' => false, 'min_devcies' => 3},
+    {'level' => 6, 'spare' => false, 'min_devcies' => 4},
+    {'level' => 1, 'spare' => true, 'min_devcies' => 3},
+    {'level' => 5, 'spare' => true, 'min_devcies' => 4},
+    {'level' => 6, 'spare' => true, 'min_devcies' => 5}
+]

data/cookbooks/mu-glusterfs/metadata.rb

@@ -0,0 +1,17 @@
+name 'mu-glusterfs'
+maintainer 'Ami Rahav'
+maintainer_email 'amiram.rahav@eglobaltech.com'
+license 'BSD-3-Clause'
+description 'Installs/Configures mu-glusterfs'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 12.1' if respond_to?(:chef_version)
+version '0.1.0'
+
+%w( centos ).each do |os|
+	supports os
+end
+
+depends 'yum', '~> 5.1.0'
+depends 'mu-firewall'