cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-splunk/templates/default/inputs.conf.erb

@@ -0,0 +1,13 @@
+[default]
+host = <%= @inputs_conf['host'] %>
+
+[SSL]
+sslVersions = tls1.2
+cipherSuite = TLSv1.2:!eNULL:!aNULL
+
+<% @inputs_conf['ports'].each do |port| -%>
+[tcp://:<%= port['port_num'] %>]
+  <% port['config'].each_pair do |name, value| -%>
+<%= name %> = <%= value %>
+  <% end -%>
+<% end -%>

data/cookbooks/mu-splunk/templates/default/outputs.conf.erb

@@ -0,0 +1,9 @@
+[tcpout]
+defaultGroup = splunk_indexers_<%= node['splunk']['receiver_port'] %>
+disabled=false
+
+[tcpout:splunk_indexers_<%= node['splunk']['receiver_port'] %>]
+server=<%= @splunk_servers.map do |s| "#{s['splunk']['receiver_ip']}:#{s['splunk']['receiver_port']}" end.join(', ') %>
+<% @outputs_conf.each_pair do |name, value| -%>
+<%= name %> = <%= value %>
+<% end -%>

data/cookbooks/mu-splunk/templates/default/splunk-init.erb

@@ -0,0 +1,74 @@
+#!/bin/sh
+#
+# /etc/init.d/splunk
+# init script for Splunk.
+# generated by 'splunk enable boot-start'.
+#
+### BEGIN INIT INFO
+# Provides: splunkd
+# Required-Start: $remote_fs
+# Required-Stop: $remote_fs
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Start splunk
+# Description: Splunk indexer service
+### END INIT INFO
+#
+RETVAL=0
+
+splunk_start() {
+  echo Starting Splunk...
+  <% if @runasroot %>
+  "<%= @splunkdir %>/bin/splunk" start --no-prompt --answer-yes
+  <% else %>
+  /bin/su - splunk -c "\"<%= @splunkdir %>/bin/splunk\" start --no-prompt --answer-yes"
+  <% end %>
+  RETVAL=$?
+}
+splunk_stop() {
+  echo Stopping Splunk...
+  <% if @runasroot %>
+  "<%= @splunkdir %>/bin/splunk" stop 
+  <% else %>
+  /bin/su - splunk -c "\"<%= @splunkdir %>/bin/splunk\" stop "
+  <% end %>
+  RETVAL=$?
+}
+splunk_restart() {
+  echo Restarting Splunk...
+  <% if @runasroot %>
+  "<%= @splunkdir %>/bin/splunk" restart  --no-prompt --answer-yes
+  <% else %>
+  /bin/su - splunk -c "\"<%= @splunkdir %>/bin/splunk\" restart --no-prompt --answer-yes"
+  <% end %>
+  RETVAL=$?
+}
+splunk_status() {
+  echo Splunk status:
+  <% if @runasroot %>
+  "<%= @splunkdir %>/bin/splunk" status  --no-prompt --answer-yes
+  <% else %>
+  /bin/su - splunk -c "\"<%= @splunkdir %>/bin/splunk\" status --no-prompt --answer-yes"
+  <% end %>
+  RETVAL=$?
+}
+case "$1" in
+  start)
+    splunk_start
+    ;;
+  stop)
+    splunk_stop
+    ;;
+  restart)
+    splunk_restart
+    ;;
+  status)
+    splunk_status
+    ;;
+  *)
+    echo "Usage: $0 {start|stop|restart|status}"
+    exit 1
+    ;;
+esac
+
+exit $RETVAL

data/cookbooks/mu-splunk/templates/default/system-web.conf.erb

@@ -0,0 +1,7 @@
+[settings]
+httpport = <%= node['splunk']['web_port'] %>
+enableSplunkWebSSL = <%= @enable_ssl.inspect %>
+privKeyPath = etc/auth/splunkweb/<%= @keyfile%>
+caCertPath = etc/auth/splunkweb/<%= @crtfile %>
+sslVersions = tls1.2
+cipherSuite = TLSv1.2:!eNULL:!aNULL

data/cookbooks/mu-tools/CHANGELOG.md

@@ -0,0 +1,12 @@
+# CHANGELOG for platform
+
+This file is used to list changes made in each version of platform.
+
+## 0.1.0:
+
+* Initial release of platform
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

data/cookbooks/mu-tools/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/mu-tools/README.md

@@ -0,0 +1,188 @@
+mu-tools Cookbook
+=================
+The mu-tools cookbook implements the core patterns for Mu platform construction across any platform, including
+image hardening, security reporting and secure credential retrieval and usage.  Use this cookbook for patterns relating specifically to Mu, and the utility cookbook for more generic recipes for specific packages, etc. and community repository imports
+
+Components
+==========
+Libraries
+---------
+The capvolume library deals with all aspects of acquiring, attaching, mounting, unmounting and securing volumes for Mu.  It contains utility methods for secure key handling volume operations, etc. 
+
+Recipes
+-------
+
+#### apply_security 
+apply_security carries out platform level OS security hardening that takes place before recipes install application-
+specific platform enablers and applications.  apply_security may be supplemented with application-specific
+hardening in application recipes
+
+#### cisbenchmark
+cisbenchmark installs and runs the CIS benchmark.  It is currently (12/13) a stub
+
+#### set_application_attributes
+set_application_attributes retrieves application attributes, including credentials from
+a secure store, and configures the attributes on a node under the key "application_attributes"
+
+1.  Initially "application_attributes" is set in the environment and includes bootstrapping pointers to the
+    secure message store and the JSON-formatted configuration file for the application
+2.  set_application_attributes retrives the configuration file and augments the initial
+    "application_attributes" with its contents
+3.  Subsequent recipes depend upon the "application_attributes" structure in the node.
+
+Application configuration is stored in an out-of-band secure encrypted repository in a specific
+    JSON format, with a key for each area, e.g. see the -git- key below, and child keys beneath:
+
+```json
+{
+    "id": "icras_dev_properties",
+    "project": {
+            "id": "ICRAS",
+            "name": "ICRAS Project"
+    },
+    "icras_hhs": {
+        "git" : {
+            "repo": "someRepoPath.git",
+            "repo_name": "someRepoName",
+            "username": "someUsername",
+            "password": "somePassword"
+        },
+        "database" : {
+            "connect_string" : "someConnect",
+            "username"  : "someUser",
+            "password"  :   "somePassword"
+        }
+    },
+    "icras_edu": {
+        "git" : {
+            "repo": "someRepoPath.git",
+            "repo_name": "someRepoName",
+            "username": "someUsername",
+            "password": "somePassword"
+        },
+        "database" : {
+            "connect_string" : "someConnectMySQL",
+            "username"  : "someUserMySQL",
+            "password"  :   "somePasswordMySQL"
+        }
+    }
+}
+ 
+```
+#### create application volume
+This recipe invokes the methods in the capvolume library to
+- create a volume for storing an application, currently implemented for AWS
+- Attach the volume to a device
+- Encrypt the device pulling the key from a secure source and storing it in ram so it never touches the node disk
+- Mount the device on an indicated mount point from the node structure
+- Destroy the ram device as soon as mount is complete
+
+When run without an encryption key location attribute the recipe will create, attach and mount an ordinary volume without encryption and log a warning.
+
+
+Requirements
+------------
+#### operating systems
+Currently the hardening recipes have been completed for CentOS6 only.  Stubs are present for
+Ubuntu operating systems
+
+#### compile phase
+set_application_attributes, must run in the compile phase so that
+a target node's attributes are preconfigured for the subsequent recipes.  
+
+#### recipes
+awscli recipe required by set_application_attributes to provide the aws cli
+command to fetch creds from the secure repository.  No require is listed in the recipe in order to work around the limitations of the curren(12/13) version of egt-get-cookbooks.sh.  Credential and configuration fetch is accomplished by a required AWS IAM role on the node, sufficient to fetch creds from the secure repository.
+
+#### attributes
+set_application_attributes depends on preexisting base application attributes for:
+  ['application_attributes']['secure_location']
+  ['application_attributes']['attributes_file']
+  these attributes are typically set in the environment, for example:
+
+```json
+"application_attributes" : {
+                        "secure_location" : "somePathToCredentials, e.g. s3:://whatever, file:///whatever, etc.",
+                        "attributes_file" : "nameOfAppSpecificPropertiesFile.json",
+                        "ebs" : {
+                            "mount_device" : "/dev/xvdh",
+                            "mount_directory" : "/apps"
+                        },
+                        "otherInitialAttributes" : "Whatever you need to get started"
+}
+```
+
+Other required recipes such as awscli may also need to be run in compile phase, with appropriate controlling attributes typically set in an environment
+
+The overall capvolume library depends on a node structure for volumes, defaulted in the default attributes and modifiable both by recipe and the environment, which typically is used for overrides.
+
+Each volume has a structure like this:
+```json
+   "application_attributes": {
+      "application_volume": {
+        "mount_directory": "/apps",
+        "mount_device": "/dev/xvdh",
+        "filesystem": "ext3",
+        "volume_size_gb": "5",
+        "ebs_keyfile": "the name of the key to use on the secure location"
+      },
+      "secure_location": "where the creds live",
+      "attributes_file": "the attributes of the app on the secure location"
+    }
+
+```
+In addition, once a volume is actually created, you get:
+
+```json
+ "application_volume": {
+        "volume_id": "vol-5392d61e",
+        "mount_device": "/dev/xvdh"
+      }
+
+```
+
+
+#### packages
+* set_application_attributes depends on the rubygems and json gem for parse
+* apply_security depends on yum on centos and will depend on apt in ubuntu
+
+
+Attributes
+----------
+default.rb has a default set of attributes for a typical small application volume
+
+Usage
+-----
+#### set_application_attributes::default
+Ensure that the environment presets the seed attributes for credential fetch as detailed
+in dependencies
+
+Ensure that the required credential fetch cookbook has previously run in compile phase as detailed in dependencies
+
+Run the recipe.  Success can be demonstrated by viewing a fully populated application_attributes hash in nodes
+
+A typical run list looks like:
+
+```json
+        "env_run_lists" : {
+                "production_icras_hhs" : [
+                ],
+                "development_icras_hhs": [
+                        "recipe[utility::epel]",
+                        "recipe[awscli]",
+                        "recipe[mu-tools::set_application_attributes]"
+                ]
+        }
+```
+
+####To Do
+Add temporary ram volume destroy
+Add cloud independent abstraction wrappers
+
+Contributing
+------------
+
+License and Authors
+-------------------
+Authors: Robert Patt-Corner, Jai Bapna, Ami Rahav, John Stang
+c. 2013 eGlobalTech

data/cookbooks/mu-tools/attributes/default.rb

@@ -0,0 +1,142 @@
+#
+# Cookbook Name:: mu-tools
+# Attributes:: default
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+disk_name_str = Chef::Config[:node_name]
+if disk_name_str == "CAP-MASTER" or disk_name_str == "MU-MASTER" and !node['hostname'].nil?
+  disk_name_str = node['hostname']
+end rescue NoMethodError
+
+default['os_updates_using_chef'] = false
+
+default['application_attributes']['application_volume']['mount_directory'] = '/apps'
+default['application_attributes']['application_volume']['mount_device'] = '/dev/xvdf'
+default['application_attributes']['application_volume']['label'] = "#{disk_name_str} /apps"
+default['application_attributes']['application_volume']['volume_size_gb'] = 1
+
+default['application_attributes']['ebs_snapshots']['boto_path'] = '/usr/lib/python2.6/site-packages/boto'
+default['application_attributes']['ebs_snapshots']['minute'] = '10'
+default['application_attributes']['ebs_snapshots']['hour'] = '6'
+default['application_attributes']['ebs_snapshots']['days_to_keep'] = '7'
+default['application_attributes']['skip_recipes'] = []
+
+default['nagios']['server_role'] = "mu-master"
+default['nagios']['multi_environment_monitoring'] = true
+# no idea why this attribute isn't set on MU-MASTER, but it isn't.
+default['chef_node_name'] = Chef::Config[:node_name]
+if node.has_key?("deployment")
+  if node['deployment'].has_key?("admins")
+    default['admins'] = []
+    node['deployment']['admins'].each_value { |data|
+      default['admins'] << data['email']
+    }
+  end
+  if node['deployment'].has_key?("mu_public_ip")
+    default['nagios']['allowed_hosts'] = [node['deployment']['mu_public_ip']]
+  end
+end
+
+if (!node.has_key?("admins") or node['admins'].size == 0) and node['tags'].is_a?(Hash)
+  if node['tags'].has_key?("MU-OWNER")
+    default['admins'] = []
+    default['admins'] << node['tags']['MU-OWNER']+"@localhost"
+  elsif node['tags'].has_key?("MU-ADMINS")
+    default['admins'] = node['tags']['MU-ADMINS'].split(/\s+/)
+  end
+end
+
+begin
+  default['splunk']['receiver_ip'] = node['ec2']['public_ip_address']
+rescue NoMethodError
+  default['splunk']['receiver_ip'] = node['ipaddress']
+end
+
+# Set this to a path to store Splunk's big databases somewhere besides
+# /opt/splunk/var/lib/splunk
+default['splunk']['splunkdb']['dev'] = nil
+default['splunk']['splunkdb']['path'] = "/opt/splunk/var/lib/splunk"
+default['splunk']['minfreespace'] = 733
+default['splunk']['inputs_conf']['host'] = Chef::Config[:node_name]
+default['splunk']['accept_license'] = true
+default['splunk']['auth'] = {
+    'data_bag' => 'splunk',
+    'data_bag_item' => 'admin_user'
+}
+default['splunk']['ssl_options'] = {
+    'enable_ssl' => true,
+    'data_bag' => Chef::Config[:node_name],
+    'data_bag_item' => 'ssl_cert',
+    'keyfile' => 'node.key',
+    'crtfile' => 'node.crt'
+}
+
+default['maldet']['install'] = true
+
+default['sec']['root_login_disabled'] = false
+default['sec']['accnt_lckout'] = 5
+default['sec']['accnt_lckout_duration'] = 900
+default['sec']['pwd'] = {
+    'min_length' => 14,
+    'numeric' => -1,
+    'uppercase' => -1,
+    'lowercase' => -1,
+    'special' => -1,
+    'retry' => 3,
+    'remember' => 5
+}
+
+# dumb hack, or dumbest hack?
+["s", "t", "u", "v", "w", "x", "y", "z"].reverse_each { |drive|
+  if File.exist?("/dev/xvd#{drive}")
+    default['tmp_dev'] = "/dev/xvd#{drive}"
+    break
+  end
+}
+
+default['application_attributes']['home']["volume_size_gb"] = 2
+default['application_attributes']['home']['mount_device'] = "/dev/xvdn"
+default['application_attributes']['home']['label'] = "#{disk_name_str} /home"
+default['application_attributes']['home']['mount_directory'] = "/home"
+
+default['application_attributes']['var']["volume_size_gb"] = 7
+default['application_attributes']['var']['mount_device'] = "/dev/xvdo"
+default['application_attributes']['var']['label'] = "#{disk_name_str} /var"
+default['application_attributes']['var']['mount_directory'] = "/var"
+
+default['application_attributes']['var_log']["volume_size_gb"] = 7
+default['application_attributes']['var_log']['mount_device'] = "/dev/xvdp"
+default['application_attributes']['var_log']['label'] = "#{disk_name_str} /var/log"
+default['application_attributes']['var_log']['mount_directory'] = "/var/log"
+
+default['application_attributes']['var_log_audit']["volume_size_gb"] = 2
+default['application_attributes']['var_log_audit']['mount_device'] = "/dev/xvdq"
+default['application_attributes']['var_log_audit']['label'] = "#{disk_name_str} /var/log/audit"
+default['application_attributes']['var_log_audit']['mount_directory'] = "/var/log/audit"
+
+default['banner']['path'] = "etc/BANNER-FEDERAL"
+# firewalld support in the firewall cookbook is too stupid to breathe
+default['firewall']['redhat7_iptables'] = true
+#if node['platform'] == 'amazon'
+#  override['firewall']['redhat7_iptables'] = true
+#end
+
+# We probably don't want to set java defaults here. This may cause issues with attribute precedence when other cookbooks try to install a different version of Java (JDK 7 is not supported/patched)
+# if platform_family?("windows")
+# override['java']['install_flavor'] = 'windows'
+# override["java"]["jdk_version"] = 7
+# override["java"]["oracle"]["accept_oracle_download_terms"] = true
+# end

data/cookbooks/mu-tools/attributes/ebs_rolling_snapshots.rb

@@ -0,0 +1,3 @@
+default['ebs_snapshots']['device_name'] = nil
+default['ebs_snapshots']['days_to_keep'] = 15
+default['ebs_snapshots']['exclude_devices'] = %w{/dev/xvdn /dev/xvdo /dev/xvdp /dev/xvdq xvdn xvdo xvdp xvdq}