cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-master/files/default/check_mem.pl

@@ -0,0 +1,197 @@
+#! /usr/bin/perl -w
+#
+# $Id: check_mem.pl 8 2008-08-23 08:59:52Z rhomann $
+#
+# check_mem v1.7 plugin for nagios
+#
+# uses the output of `free` to find the percentage of memory used
+#
+# Copyright Notice: GPL
+#
+# History:
+# v1.8 Rouven Homann - rouven.homann@cimt.de
+# + added findbin patch from Duane Toler
+# + added backward compatibility patch from Timour Ezeev
+#
+# v1.7 Ingo Lantschner - ingo AT boxbe DOT com
+# + adapted for systems with no swap (avoiding divison through 0)
+#
+# v1.6 Cedric Temple - cedric DOT temple AT cedrictemple DOT info
+# + add swap monitoring
+#       + if warning and critical threshold are 0, exit with OK
+#       + add a directive to exclude/include buffers
+#
+# v1.5 Rouven Homann - rouven.homann@cimt.de
+# + perfomance tweak with free -mt (just one sub process started instead of 7)
+# + more code cleanup
+#
+# v1.4 Garrett Honeycutt - gh@3gupload.com
+# + Fixed PerfData output to adhere to standards and show crit/warn values
+#
+# v1.3 Rouven Homann - rouven.homann@cimt.de
+#   + Memory installed, used and free displayed in verbose mode
+# + Bit Code Cleanup
+#
+# v1.2 Rouven Homann - rouven.homann@cimt.de
+# + Bug fixed where verbose output was required (nrpe2)
+#       + Bug fixed where perfomance data was not displayed at verbose output
+# + FindBin Module used for the nagios plugin path of the utils.pm
+#
+# v1.1 Rouven Homann - rouven.homann@cimt.de
+#     + Status Support (-c, -w)
+# + Syntax Help Informations (-h)
+#       + Version Informations Output (-V)
+# + Verbose Output (-v)
+#       + Better Error Code Output (as described in plugin guideline)
+#
+# v1.0 Garrett Honeycutt - gh@3gupload.com
+#   + Initial Release
+#
+use strict;
+use FindBin;
+FindBin::again();
+use lib $FindBin::Bin;
+use utils qw($TIMEOUT %ERRORS &print_revision &support);
+use vars qw($PROGNAME $PROGVER);
+use Getopt::Long;
+use vars qw($opt_V $opt_h $verbose $opt_w $opt_c);
+
+$PROGNAME = "check_mem";
+$PROGVER = "1.8";
+
+# add a directive to exclude buffers:
+my $DONT_INCLUDE_BUFFERS = 0;
+
+sub print_help ();
+sub print_usage ();
+
+Getopt::Long::Configure('bundling');
+GetOptions ("V"   => \$opt_V, "version"    => \$opt_V,
+  "h"   => \$opt_h, "help"       => \$opt_h,
+        "v" => \$verbose, "verbose"  => \$verbose,
+  "w=s" => \$opt_w, "warning=s"  => \$opt_w,
+  "c=s" => \$opt_c, "critical=s" => \$opt_c);
+
+if ($opt_V) {
+  print_revision($PROGNAME,'$Revision: '.$PROGVER.' $');
+  exit $ERRORS{'UNKNOWN'};
+}
+
+if ($opt_h) {
+  print_help();
+  exit $ERRORS{'UNKNOWN'};
+}
+
+print_usage() unless (($opt_c) && ($opt_w));
+
+my ($mem_critical, $swap_critical);
+my ($mem_warning, $swap_warning);
+($mem_critical, $swap_critical) = ($1,$2) if ($opt_c =~ /([0-9]+)[%]?(?:,([0-9]+)[%]?)?/);
+($mem_warning, $swap_warning)   = ($1,$2) if ($opt_w =~ /([0-9]+)[%]?(?:,([0-9]+)[%]?)?/);
+
+# Check if swap params were supplied
+$swap_critical ||= 100;
+$swap_warning  ||= 100;
+
+# print threshold in output message
+my $mem_threshold_output = " (";
+my $swap_threshold_output = " (";
+
+if ( $mem_warning > 0 && $mem_critical > 0) {
+  $mem_threshold_output .= "W> $mem_warning, C> $mem_critical";
+}
+elsif ( $mem_warning > 0 ) {
+  $mem_threshold_output .= "W> $mem_warning";
+}
+elsif ( $mem_critical > 0 ) {
+  $mem_threshold_output .= "C> $mem_critical";
+}
+
+if ( $swap_warning > 0 && $swap_critical > 0) {
+  $swap_threshold_output .= "W> $swap_warning, C> $swap_critical";
+}
+elsif ( $swap_warning > 0 ) {
+  $swap_threshold_output .= "W> $swap_warning";
+}
+elsif ( $swap_critical > 0 )  {
+  $swap_threshold_output .= "C> $swap_critical";
+}
+
+$mem_threshold_output .= ")";
+$swap_threshold_output .= ")";
+
+my $verbose = $verbose;
+
+my ($mem_percent, $mem_total, $mem_used, $swap_percent, $swap_total, $swap_used) = &sys_stats();
+my $free_mem = $mem_total - $mem_used;
+my $free_swap = $swap_total - $swap_used;
+
+# set output message
+my $output = "Memory Usage".$mem_threshold_output.": ". $mem_percent.'% <br>';
+$output .= "Swap Usage".$swap_threshold_output.": ". $swap_percent.'%';
+
+# set verbose output message
+my $verbose_output = "Memory Usage:".$mem_threshold_output.": ". $mem_percent.'% '."- Total: $mem_total MB, used: $mem_used MB, free: $free_mem MB<br>";
+$verbose_output .= "Swap Usage:".$swap_threshold_output.": ". $swap_percent.'% '."- Total: $swap_total MB, used: $swap_used MB, free: $free_swap MB<br>";
+
+# set perfdata message
+my $perfdata_output = "MemUsed=$mem_percent\%;$mem_warning;$mem_critical";
+$perfdata_output .= " SwapUsed=$swap_percent\%;$swap_warning;$swap_critical";
+
+
+# if threshold are 0, exit with OK
+if ( $mem_warning == 0 ) { $mem_warning = 101 };
+if ( $swap_warning == 0 ) { $swap_warning = 101 };
+if ( $mem_critical == 0 ) { $mem_critical = 101 };
+if ( $swap_critical == 0 ) { $swap_critical = 101 };
+
+
+if ($mem_percent>$mem_critical || $swap_percent>$swap_critical) {
+    if ($verbose) { print "<b>CRITICAL: ".$verbose_output."</b>|".$perfdata_output."\n";}
+    else { print "<b>CRITICAL: ".$output."</b>|".$perfdata_output."\n";}
+    exit $ERRORS{'CRITICAL'};
+} elsif ($mem_percent>$mem_warning || $swap_percent>$swap_warning) {
+    if ($verbose) { print "<b>WARNING: ".$verbose_output."</b>|".$perfdata_output."\n";}
+    else { print "<b>WARNING: ".$output."</b>|".$perfdata_output."\n";}
+    exit $ERRORS{'WARNING'};
+} else {
+    if ($verbose) { print "OK: ".$verbose_output."|".$perfdata_output."\n";}
+    else { print "OK: ".$output."|".$perfdata_output."\n";}
+    exit $ERRORS{'OK'};
+}
+
+sub sys_stats {
+    my @memory = split(" ", `free -mt`);
+    my $mem_total = $memory[7];
+    my $mem_used;
+    if ( $DONT_INCLUDE_BUFFERS) { $mem_used = $memory[15]; }
+    else { $mem_used = $memory[8];}
+    my $swap_total = $memory[18];
+    my $swap_used = $memory[19];
+    my $mem_percent = ($mem_used / $mem_total) * 100;
+    my $swap_percent;
+    if ($swap_total == 0) {
+  $swap_percent = 0;
+    } else {
+  $swap_percent = ($swap_used / $swap_total) * 100;
+    }
+    return (sprintf("%.0f",$mem_percent),$mem_total,$mem_used, sprintf("%.0f",$swap_percent),$swap_total,$swap_used);
+}
+
+sub print_usage () {
+    print "Usage: $PROGNAME -w <warn> -c <crit> [-v] [-h]\n";
+    exit $ERRORS{'UNKNOWN'} unless ($opt_h);
+}
+
+sub print_help () {
+    print_revision($PROGNAME,'$Revision: '.$PROGVER.' $');
+    print "Copyright (c) 2005 Garrett Honeycutt/Rouven Homann/Cedric Temple\n";
+    print "\n";
+    print_usage();
+    print "\n";
+    print "-w <MemoryWarn>,<SwapWarn> = Memory and Swap usage to activate a warning message (eg: -w 90,25 ) .\n";
+    print "-c <MemoryCrit>,<SwapCrit> = Memory and Swap usage to activate a critical message (eg: -c 95,50 ).\n";
+    print "-v = Verbose Output.\n";
+    print "-h = This screen.\n\n";
+    support();
+}

data/cookbooks/mu-master/files/default/dirsrv_admin.te

@@ -0,0 +1,13 @@
+
+module dirsrv_admin 1.0;
+
+require {
+	type httpd_t;
+	type unreserved_port_t;
+	class tcp_socket name_bind;
+}
+
+#============= httpd_t ==============
+
+#!!!! This avc can be allowed using the boolean 'nis_enabled'
+allow httpd_t unreserved_port_t:tcp_socket name_bind;

data/cookbooks/mu-master/files/default/nagios_selinux.te

@@ -0,0 +1,51 @@
+module nagios_selinux 1.0;
+
+require {
+  type nagios_t;
+  type usr_t;
+  type nagios_log_t;
+  type httpd_t;
+  type httpd_sys_script_t;
+  type httpd_sys_content_t;
+  type httpd_sys_script_exec_t;
+  type nagios_exec_t;
+  type initrc_var_run_t;
+  type port_t;
+  type ssh_exec_t;
+  class capability chown;
+  class dir { search read write remove_name add_name };
+  class file { create open execute_no_trans read append write getattr setattr lock unlink rename execute };
+  class fifo_file { read open getattr write create };
+  class sock_file { create write unlink };
+  class tcp_socket { name_bind };
+  class capability { chown };
+}
+
+allow httpd_t nagios_log_t:dir search;
+allow httpd_t nagios_log_t:file { read open };
+allow httpd_t nagios_log_t:fifo_file { read open getattr write };
+allow httpd_t httpd_sys_script_exec_t:fifo_file { read open getattr write };
+allow nagios_t nagios_exec_t:file execute_no_trans;
+allow httpd_sys_script_t nagios_log_t:dir search;
+allow httpd_sys_script_t nagios_log_t:file { read open };
+allow httpd_sys_script_t nagios_log_t:fifo_file { read open getattr write };
+allow httpd_sys_script_t httpd_sys_script_exec_t:fifo_file { read open getattr write };
+allow nagios_t nagios_exec_t:file execute_no_trans;
+allow nagios_t ssh_exec_t:file { getattr execute read open execute_no_trans };
+allow nagios_t self:capability chown;
+allow nagios_t httpd_sys_content_t:dir { read search write remove_name add_name };
+allow nagios_t httpd_sys_script_exec_t:dir { read search write remove_name add_name };
+allow nagios_t nagios_log_t:dir { read search write remove_name add_name };
+allow nagios_t httpd_sys_content_t:file { open read append getattr setattr create write rename };
+allow nagios_t httpd_sys_script_exec_t:file { open read append getattr setattr create write rename };
+allow nagios_t nagios_log_t:file { open read append getattr setattr create write rename };
+allow nagios_t httpd_sys_content_t:sock_file { unlink create write };
+allow nagios_t httpd_sys_script_exec_t:sock_file { unlink create write };
+allow nagios_t nagios_log_t:sock_file { unlink create write };
+allow nagios_t initrc_var_run_t:file { read write open lock unlink };
+allow nagios_t port_t:tcp_socket { name_bind };
+allow nagios_t nagios_t:capability { chown };
+allow nagios_t httpd_sys_script_exec_t:fifo_file { read open getattr write create };
+allow nagios_t nagios_log_t:fifo_file { read open getattr write create };
+allow nagios_t nagios_log_t:fifo_file { read open getattr write create };
+allow nagios_t usr_t:file { read open getattr execute execute_no_trans append };

data/cookbooks/mu-master/files/default/nagios_selinux_7.te

@@ -0,0 +1,17 @@
+module nagios_selinux_7 1.0;
+
+require {
+  type nagios_t;
+  type nagios_etc_t;
+  type nrpe_t;
+  type httpd_sys_script_t;
+  type httpd_sys_content_t;
+  class unix_stream_socket connectto;
+  class file { read open getattr };
+  class dir { search read };
+}
+
+allow httpd_sys_script_t nagios_etc_t:file { read open getattr } ;
+allow nagios_t self:unix_stream_socket connectto;
+allow nrpe_t httpd_sys_content_t:dir { read search };
+allow nrpe_t httpd_sys_content_t:file { read open getattr };

data/cookbooks/mu-master/files/default/pam_sshd

@@ -0,0 +1,18 @@
+#%PAM-1.0
+auth	   required	pam_sepermit.so
+auth       include      password-auth
+auth        sufficient    pam_ldap.so use_first_pass
+account    required     pam_nologin.so
+account    include      password-auth
+account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
+password   include      password-auth
+password    sufficient    pam_ldap.so use_authtok
+# pam_selinux.so close should be the first session rule
+session    required     pam_selinux.so close
+session    required     pam_loginuid.so
+# pam_selinux.so open should only be followed by sessions to be executed in the user context
+session    required     pam_selinux.so open env_params
+session    optional     pam_keyinit.so force revoke
+session    include      password-auth
+session optional pam_umask.so umask=0077
+session     optional      pam_ldap.so

data/cookbooks/mu-master/files/default/ssl_enable.ldif

@@ -0,0 +1,18 @@
+dn: cn=encryption,cn=config
+changetype: modify
+replace: nsSSL3
+nsSSL3: off
+-
+replace: nsSSLClientAuth
+nsSSLClientAuth: allowed
+-
+add: nsSSL3Ciphers
+nsSSL3Ciphers: +all
+
+dn: cn=config
+changetype: modify
+add: nsslapd-security
+nsslapd-security: on
+-
+replace: nsslapd-ssl-check-hostname
+nsslapd-ssl-check-hostname: off

data/cookbooks/mu-master/files/default/syslogd_oddjobd.te

@@ -0,0 +1,10 @@
+
+module syslogd_oddjobd 1.0;
+
+require {
+	type oddjob_t;
+	class capability dac_override;
+}
+
+#============= oddjob_t ==============
+allow oddjob_t self:capability dac_override;

data/cookbooks/mu-master/files/default/vimrc

@@ -0,0 +1,19 @@
+set columns=80
+set ts=2
+syntax on
+set shiftwidth=2
+set tabstop=2
+set shiftwidth=2
+set expandtab
+set softtabstop=2
+set smarttab
+set paste
+set autoindent
+set smartindent
+set cinwords=if,else,while,do,for,switch,def,class,elif,try,except,finally
+" fix the syntax highlighting to avoid dark blue comments on a black bg
+hi Comment term=bold    ctermfg=DarkCyan    guifg=#80a0ff
+" and to get PHP right when working on Drupal
+au BufReadPost *.module set syntax=php
+au BufReadPost *.install set syntax=php
+set viminfo='10,<500,s150,h

data/cookbooks/mu-master/libraries/mu.rb

@@ -0,0 +1,29 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# 
+# This library deals with volume creation and mounting
+
+
+# Sets the $MU_CFG hash
+if ENV.include?('MU_LIBDIR')
+  require "#{ENV['MU_LIBDIR']}/modules/mu-load-config.rb"
+elsif ENV.include?('MU_INSTALLDIR')
+  require "#{ENV['MU_INSTALLDIR']}/lib/modules/mu-load-config.rb"
+elsif File.readable?("/opt/mu/lib/modules/mu-load-config.rb")
+  ENV['MU_INSTALLDIR'] = "/opt/mu"
+  ENV['MU_LIBDIR'] = "/opt/mu/lib"
+  require "/opt/mu/lib/modules/mu-load-config.rb"
+end
+
+require "mu"

data/cookbooks/mu-master/metadata.rb

@@ -0,0 +1,30 @@
+name 'mu-master'
+maintainer 'Mu'
+maintainer_email 'mu-developers@googlegroups.com'
+license 'BSD-3-Clause'
+description 'Installs/Configures mu-master'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 12.1' if respond_to?(:chef_version)
+version '0.9.0'
+
+%w( centos ).each do |os|
+	supports os
+end
+
+depends 'nagios'
+depends 'nrpe', '~> 2.0.3'
+depends 'mu-utility'
+depends 'mu-tools'
+depends 'mu-activedirectory'
+depends 's3fs', '~> 3.0.1'
+depends 'postfix', '~> 5.3.1'
+depends 'bind', '~> 2.2.0'
+depends 'bind9-ng', '~> 0.1.0'
+depends 'mu-firewall'
+depends 'vault-cluster', '~> 2.1.0'
+depends 'consul-cluster', '~> 2.0.0'
+depends 'hostsfile', '~> 3.0.1'
+depends 'chef-vault', '~> 3.1.1'
+depends 'apache2', '< 4.0'

data/cookbooks/mu-master/providers/user.rb

@@ -0,0 +1,41 @@
+# Cookbook Name:: mu-master
+# Provider:: mu_user
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'mu'
+
+action :add do
+  allusers = MU::Master.listUsers
+  password = nil
+  if !allusers.has_key?(new_resource.username)
+    password = new_resource.password || MU.generateWindowsPassword
+  end
+  new_resource.admin ||= false
+  ::MU::Master.manageUser(
+    new_resource.username,
+    name: new_resource.realname,
+    password: password,
+    email: new_resource.email,
+    admin: new_resource.admin,
+    orgs: new_resource.orgs,
+    remove_orgs: new_resource.remove_orgs
+  )
+end
+
+action :delete do
+  ::MU::Master.deleteUser(new_resource.username)
+end

data/cookbooks/mu-master/recipes/389ds.rb

@@ -0,0 +1,164 @@
+#
+# Cookbook Name:: mu-master
+# Recipe:: 389ds
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_recipe 'mu-master::firewall-holes'
+
+package ["389-ds", "389-ds-console"]
+
+include_recipe 'chef-vault'
+
+# How to completely undo all of this: service dirsrv stop ; pkill ns-slapd ; yum erase -y 389-ds 389-ds-console 389-ds-base 389-admin 389-adminutil 389-console 389-ds-base-libs; rm -rf /etc/dirsrv /var/lib/dirsrv /var/log/dirsrv /var/lock/dirsrv /var/run/dirsrv /etc/sysconfig/dirsrv* /usr/lib64/dirsrv /usr/share/dirsrv; knife data bag delete -y mu_ldap
+
+# Retrieve credentials we need to do LDAP things. Generate from scratch if they
+# haven't been provided.
+$CREDS = {
+  "bind_creds" => {
+    "user" => "CN=mu_bind_creds,#{$MU_CFG["ldap"]['user_ou']}"
+  },
+  "join_creds" => {
+    "user" => "CN=mu_join_creds,#{$MU_CFG["ldap"]['user_ou']}"
+  },
+  "cfg_directory_adm" => {
+    "user" => "admin"
+  },
+  "root_dn_user" => {
+    "user" => "CN=root_dn_user"
+  }
+}
+
+service_name = "dirsrv"
+if node['platform_version'].to_i >= 7
+  service_name = service_name + "@" + $MU_CFG["hostname"]
+end
+
+directory "/root/389ds.tmp" do
+  recursive true
+  mode 0700
+end
+$CREDS.each_pair { |creds, cfg|
+  user = pw = data = nil
+  if $MU_CFG["ldap"].has_key?(creds)
+    data = chef_vault_item($MU_CFG['ldap'][creds]['vault'], $MU_CFG['ldap'][creds]['item'])
+    user = data[$MU_CFG["ldap"][creds]["username_field"]]
+    pw = data[$MU_CFG["ldap"][creds]["password_field"]]
+  else
+    data = chef_vault_item("mu_ldap", creds)
+    user = data["username"]
+    pw = data["password"]
+  end
+  $CREDS[creds]['user'] = user if !$CREDS[creds]['user']
+  $CREDS[creds]['pw'] = pw if !$CREDS[creds]['pw']
+}
+directory "/var/log/dirsrv/admin-serv" do
+  user "nobody"
+  group "nobody"
+  mode 0770
+  recursive true
+end
+
+#  %x{/usr/sbin/setenforce 0}
+execute "initialize 389 Directory Services" do
+  command "/usr/sbin/setup-ds-admin.pl -s -f /root/389ds.tmp/389-directory-setup.inf --continue --debug #{Dir.exists?("/etc/dirsrv/slapd-#{$MU_CFG["hostname"]}") ? "--update" : ""}"
+  action :nothing
+end
+
+template "/root/389ds.tmp/389-directory-setup.inf"do
+  source "389-directory-setup.inf.erb"
+  variables :hostname => $MU_CFG["hostname"],
+            :address => $MU_CFG["public_address"].match(/^\d+\.\d+\.\d+\.\d+$/) ? "localhost" : $MU_CFG["public_address"],
+            :domain => $MU_CFG["ldap"]["domain_name"],
+            :domain_dn => $MU_CFG["ldap"]["domain_name"].split(/\./).map{ |x| "DC=#{x}" }.join(","),
+            :creds => $CREDS
+  not_if { ::Dir.exists?("/etc/dirsrv/slapd-#{$MU_CFG["hostname"]}") }
+  notifies :run, "execute[initialize 389 Directory Services]", :immediately
+end
+
+service service_name do
+  action [:enable, :start]
+end
+
+if platform_family?("rhel") and node['platform_version'].to_i >= 7
+  cookbook_file "dirsrv_admin.pp" do
+    path "#{Chef::Config[:file_cache_path]}/dirsrv_admin.pp"
+  end
+
+  execute "Add dirsrv-admin to SELinux allow list" do
+    command "/usr/sbin/semodule -i dirsrv_admin.pp"
+    cwd Chef::Config[:file_cache_path]
+    not_if "/usr/sbin/semodule -l | grep dirsrv_admin"
+  end
+end
+
+#service "dirsrv-admin" do
+#  action [:enable, :start]
+#end
+
+chef_gem "expect" do
+  compile_time true
+end
+file "/root/389ds.tmp/blank" do
+  content ""
+  action :nothing
+end
+execute "389ds cert util" do
+  if $MU_CFG['ssl'] and $MU_CFG['ssl']['chain']
+    command "/usr/bin/certutil -d /etc/dirsrv/slapd-#{$MU_CFG["hostname"]} -A -n \"Mu Master CA\" -t CT,, -a -i #{$MU_CFG['ssl']['chain']}"
+  else
+    command "/usr/bin/certutil -d /etc/dirsrv/slapd-#{$MU_CFG["hostname"]} -A -n \"Mu Master CA\" -t CT,, -a -i /opt/mu/var/ssl/Mu_CA.pem"
+  end
+  action :nothing
+  notifies :restart, "service[#{service_name}]", :delayed
+end
+
+# Why is this utility interactive-only? So much hate.
+ruby_block "import SSL certificates for 389ds" do
+  block do
+    certimportcmd = "/usr/bin/pk12util -i /opt/mu/var/ssl/ldap.p12 -d /etc/dirsrv/slapd-#{$MU_CFG["hostname"]} -w /root/389ds.tmp/blank -W \"\""
+    require 'pty'
+    require 'expect'
+    PTY.spawn(certimportcmd) { |r, w, pid|
+      begin
+        r.expect("Enter new password:") do
+          w.puts
+        end
+        r.expect("Re-enter password:") do
+          w.puts
+        end
+      rescue Errno::EIO
+        break
+      end
+    }
+
+  end
+  notifies :create, "file[/root/389ds.tmp/blank]", :before
+  notifies :run, "execute[389ds cert util]", :immediately
+end
+
+
+{"ssl_enable.ldif" => "nsslapd-security: on", "addRSA.ldif" => "nsSSLActivation: on"}.each_pair { |ldif, guardstr|
+  cookbook_file "/root/389ds.tmp/#{ldif}" do
+    source ldif
+  end
+
+  execute "/usr/bin/ldapmodify -x -D #{$CREDS["root_dn_user"]['user']} -w #{$CREDS["root_dn_user"]['pw']} -f /root/389ds.tmp/#{ldif}" do
+    notifies :restart, "service[#{service_name}]", :delayed
+    not_if "grep '#{guardstr}' /etc/dirsrv/slapd-#{$MU_CFG['hostname']}/dse.ldif"
+  end
+}
+
+#  %x{/usr/sbin/setenforce 1}