cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-tools/files/centos-6/etc/sysconfig/init

@@ -0,0 +1,30 @@
+# color => new RH6.0 bootup
+# verbose => old-style bootup
+# anything else => new style bootup without ANSI colors or positioning
+BOOTUP=color
+# column to start "[  OK  ]" label in
+RES_COL=60
+# terminal sequence to move to that column. You could change this
+# to something like "tput hpa ${RES_COL}" if your terminal supports it
+MOVE_TO_COL="echo -en \\033[${RES_COL}G"
+# terminal sequence to set color to a 'success' color (currently: green)
+SETCOLOR_SUCCESS="echo -en \\033[0;32m"
+# terminal sequence to set color to a 'failure' color (currently: red)
+SETCOLOR_FAILURE="echo -en \\033[0;31m"
+# terminal sequence to set color to a 'warning' color (currently: yellow)
+SETCOLOR_WARNING="echo -en \\033[0;33m"
+# terminal sequence to reset to the default color.
+SETCOLOR_NORMAL="echo -en \\033[0;39m"
+# Set to anything other than 'no' to allow hotkey interactive startup...
+PROMPT=yes
+# Set to 'yes' to allow probing for devices with swap signatures
+AUTOSWAP=no
+# What ttys should gettys be started on?
+ACTIVE_CONSOLES=/dev/tty1
+# Set to '/sbin/sulogin' to prompt for password on single-user mode
+# Set to '/sbin/sushell' otherwise
+SINGLE=/sbin/sushell
+# 
+# Add CAP Modifications
+#
+umask 027 

data/cookbooks/mu-tools/files/centos-6/etc/sysctl.conf

@@ -0,0 +1,40 @@
+# Kernel sysctl configuration file for Red Hat Linux
+#
+# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
+# sysctl.conf(5) for more details.
+
+# Controls IP packet forwarding
+net.ipv4.ip_forward = 0
+
+# Controls source route verification
+net.ipv4.conf.default.rp_filter = 1
+
+# Do not accept source routing
+net.ipv4.conf.default.accept_source_route = 0
+
+# Controls the System Request debugging functionality of the kernel
+kernel.sysrq = 0
+
+# Controls whether core dumps will append the PID to the core filename.
+# Useful for debugging multi-threaded applications.
+kernel.core_uses_pid = 1
+
+# Controls the use of TCP syncookies
+net.ipv4.tcp_syncookies = 1
+
+# Disable netfilter on bridges.
+net.bridge.bridge-nf-call-ip6tables = 0
+net.bridge.bridge-nf-call-iptables = 0
+net.bridge.bridge-nf-call-arptables = 0
+
+# Controls the default maxmimum size of a mesage queue
+kernel.msgmnb = 65536
+
+# Controls the maximum size of a message, in bytes
+kernel.msgmax = 65536
+
+# Controls the maximum shared segment size, in bytes
+kernel.shmmax = 68719476736
+
+# Controls the maximum number of shared memory segments, in pages
+kernel.shmall = 4294967296

data/cookbooks/mu-tools/files/default/Mu_CA.pem

@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF2zCCA8OgAwIBAgIJALVaC3iJgQA6MA0GCSqGSIb3DQEBDQUAMF0xFjAUBgNV
+BAMMDTU0LjE3NS44Ni4xOTQxIDAeBgNVBAsMF011IFNlcnZlciA1NC4xNzUuODYu
+MTk0MRQwEgYDVQQKDAtlR2xvYmFsVGVjaDELMAkGA1UEBhMCVVMwHhcNMTgxMjAz
+MTM1OTUxWhcNMjEwOTIyMTM1OTUxWjBdMRYwFAYDVQQDDA01NC4xNzUuODYuMTk0
+MSAwHgYDVQQLDBdNdSBTZXJ2ZXIgNTQuMTc1Ljg2LjE5NDEUMBIGA1UECgwLZUds
+b2JhbFRlY2gxCzAJBgNVBAYTAlVTMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAo7rntOFj/WPNvh00SN55aJBusppsY9arq7QF5gt/9+cBPsjcXn7jJMu0
+vD9RFqkR8fpkvs01MiTToKHDli30FYSO+pybW/3R8VMby3jU7Df+i20tnB8gZqkc
+XQGU4c8cGwdu1J/DpRoX5oCOlO2by+2+5nebJd7ABpzl9eE2/1HBJVaHROCVzmbu
+UCXVIlKAOccgwzPj+r4EHwH4Nyv8cSnh67Fg8jehW21ZltZNXek7upc9421MQLka
+9TtbBod7DWVQNfc8hAxATlupOnKsKa1n8vZD9bj9xvK2wz1E6lVYbkuxzpOzqBqy
+PO/6Svt8zTH3pEJMbxwtiwJ8cCLiqSoxj8hOKvvsSmvboN9DwN73JQjOY/pXHaU1
+/w9syNORnwEKMzs5Eu14dAV1+w7Nk8xff4LHjIYoTWD+zuK6ETVnX8j7f1zwebok
+HLF0qlnfZhU4uiE8+wU1h6oeGZG9fLV63wlGdUXA+HermzovuJ0d2ocy0O93QQDt
+Y92dr6UcPfAmzFyX3Rj9FFMYb2/n1G8l5pEd/Qkx3sH04aoxEmyQU0zugo3zQsL9
+KNyIbp2BTlSh2R/4hWJpWiXFliRvotiJu1s2wdNQ1D3SZgxDbfxf/3j04xgdi5eW
+e4Q3VnxhRfmkS1NqEzIvPabVLg9qvN419cubpE6HAtBJw/f3ocUCAwEAAaOBnTCB
+mjBKBgNVHREEQzBBhwQ2r1bCgglsb2NhbGhvc3SHBH8AAAGCGXN0YW5nZS1tdS1k
+ZXYucGxhdGZvcm0tbXWCDXN0YW5nZS1tdS1kZXYwHQYDVR0OBBYEFK/EmtGebCwd
+5QpM8y/3EKdYNVbcMB8GA1UdIwQYMBaAFK/EmtGebCwd5QpM8y/3EKdYNVbcMAwG
+A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAIFFoIWaS2vsiMjEeFo/FXKd
+Gy5lrvbBMaKgeFBI7Yqrz7wxmPol5de1KuuYANrcHtgpTuqnNRPMKt4VF6NW6CRY
+FTaaG0kwJU0Y3FMAdrmUUFK0bqNhchrwSv3Zqs68ifQ7vxwN0xLZrKJ5kMWjfQCn
+XDOImEe14ZQYwAf0kxZXm9qGoVQZK+ObIfNDPTPAOADQ3ZeawRrogZ2M6694mN+4
+eS/PDibpcZ4Dl8Cw4nuLIG4ct9Dm/8kZ0XRAoxXTEUfMIrJQpKmjnhux8Kzjy/DU
+eovi+530klyeyV0909lN9l8JJmBd3Zw1EArSB2PgSSTfGXrdGN/A6TlE50QahZS6
+wlE4/P2ISDCyyc+Zobu9e+6WII7DFcNwzyFuC3WO6h2I2IXnZvUfVCowjipfdSKx
++qQvevSmbprs+AJVfvkyaejKYK5PPe+fGMHJo80Pqc2LiODoChs6NZh10xAG0Sd6
+zQ05A4ZUmZjlC0lpFkgVPBaAlUAW28y6CdlRNW6H52KgvctJecGrBYZ52cTdju1b
+AXdlwMbPHHoA0HDCT7vGhGb/zUWkWYJVpXQ7EwwQWdCEejegtCRNWqTZC0s4mjUa
+Yw4ISVSAaTkzWWxBkizBGJcIxUfukuhnEEGs1G09hqpaXMWyXLg3wf9GkCsn+tD+
+PY7N1R6ysc8wA8nByPeR
+-----END CERTIFICATE-----

data/cookbooks/mu-tools/files/default/ebs_snapshots.py

@@ -0,0 +1,123 @@
+import argparse
+import datetime
+import logging
+import sys
+import boto
+import boto.ec2
+import boto.utils
+import requests
+
+parser = argparse.ArgumentParser(
+    description='Script to automaticly snapshot EBS volumes',
+    prog='ebs_snpashots.py', 
+    formatter_class=lambda prog: argparse.HelpFormatter(prog,max_help_position=40)
+)
+
+parser.add_argument('-n', '--num_snaps_keep', metavar='', help='Number of Snapshots to Keep', type=int, default=15)
+parser.add_argument('-l', '--logfile', metavar='', help='Location of logfile', type=str, default='ebs_snapshots.log')
+parser.add_argument('-d', '--device_name', metavar='', help='Device name of EBS volume. If not specified, a snapshot will be created to all attached volumes', type=str, default=None)
+parser.add_argument('-x', '--exclude_devices', metavar='', help='Mounted volumes endpoints to exclude from automated snapshtos', type=str, default='/dev/sda1, /dev/sda, /dev/xvdn, /dev/xvdo, /dev/xvdp, /dev/xvdq, xvdn, xvdo, xvdp, xvdq')
+parser.add_argument('-dt', '--desc_tag', metavar='', help='Description tag for new snapshot', type=str, default='Created by Automated Snapshot Script')
+parser.add_argument('-nt', '--name_tag', metavar='', help='Name tag for the new snapshots', type=str, default=None)
+parsed_args = parser.parse_args()
+
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s %(name)-15s %(levelname)-8s %(lineno)d %(message)s',
+    datefmt='%m-%d-%Y %H:%M:%S',
+    filename=parsed_args.logfile,
+    filemode='a'
+)
+
+console_log = logging.StreamHandler()
+console_log.setLevel(logging.INFO)
+formatter = logging.Formatter('%(name)-10s: %(levelname)-8s %(message)s')
+console_log.setFormatter(formatter)
+logging.getLogger('').addHandler(console_log)
+logger = logging.getLogger('logger')
+
+class ebs_snapshot:
+    def __init__(self, args=parsed_args):
+        self.region = boto.utils.get_instance_identity()['document']['region']
+        self.ec2 = boto.ec2.connect_to_region(self.region)
+        self.instance_id = boto.utils.get_instance_metadata()['instance-id']
+        self.name_tag = args.name_tag
+        self.description_tag = args.desc_tag
+        self.device_name = args.device_name
+        self.num_snapshots_keep = args.num_snaps_keep
+        self.exclude_devices = map(str.strip, args.exclude_devices.split(','))
+
+    def get_volumes(self):
+        volumes = []
+        volume_filters = {'attachment.instance-id': self.instance_id}
+        try:
+            volumes = self.ec2.get_all_volumes(filters=volume_filters)
+        except boto.exception.EC2ResponseError as err:
+            logger.exception('Failed to authenticate to AWS {err}'.format(err=err.message))
+            raise err
+
+        return volumes
+
+    def create_snapshot(self, volume):
+        date = datetime.datetime.utcnow().strftime('%m%d%Y-%H%M')
+        try:
+            new_snapshot = volume.create_snapshot('{snapshot_description} on {date}'.format(snapshot_description=self.description_tag, date=date))
+        except boto.exception.EC2ResponseError as err:
+            logger.exception('Failed to create snapshot {err}'.format(err=err.message))
+            raise err
+
+        if self.name_tag:
+            snap_tag = self.name_tag
+        elif 'Name' in volume.tags:
+            snap_tag = volume.tags['Name']
+        else:
+            snap_tag = "{volume_id}-{device_name}-{instance_id}".format(volume_id=volume.id, instance_id=self.instance_id, device_name=volume.attach_data.device.upper())
+
+        new_snapshot.add_tag('Name', snap_tag)
+        new_snapshot.add_tag('SnapshotType', 'Automated-Snapshots')
+        new_snapshot.add_tag('Attachment-Device', volume.attach_data.device.upper())
+
+        for tag_key in volume.tags:
+            if tag_key != "Name":
+                new_snapshot.add_tag(tag_key, volume.tags[tag_key])
+
+        logger.info('Snapshot {snap_id}/{snap_name} Created'.format(snap_id=new_snapshot.id, snap_name=new_snapshot.tags['Name']))
+
+    def delete_snapshots(self, volume):
+        snapshots_filters = {
+            'volume-id': volume.id,
+            'tag-key': 'SnapshotType',
+            'tag-value':'Automated-Snapshots'
+        }
+
+        all_snapshots = self.ec2.get_all_snapshots(filters=snapshots_filters)
+        sorted_snapshots = sorted(all_snapshots, key=lambda snapshot: snapshot.start_time)
+        snpashots_to_delete = len(sorted_snapshots) - self.num_snapshots_keep
+
+        for i in range(snpashots_to_delete):
+            try:
+                sorted_snapshots[i].delete()
+            except boto.exception.EC2ResponseError as err:
+                logger.exception('Failed to delete snapshot {snap_id}/{snap_name}: {err}'.format(snap_id=sorted_snapshots[i].id, snap_name=sorted_snapshots[i].tags['Name'], err=err.message))
+                continue
+
+            logger.info('Deleted snapshot {snap_id}/{snap_name}'.format(snap_id=sorted_snapshots[i].id, snap_name=sorted_snapshots[i].tags['Name']))
+
+    def process_volume(self, volume):
+        if self.num_snapshots_keep > 0:
+            self.create_snapshot(volume)
+        self.delete_snapshots(volume)
+
+    def run(self):
+        volumes = self.get_volumes()
+
+        if volumes:
+            for volume in volumes:
+                if self.device_name is None:
+                    if volume.attach_data.device not in self.exclude_devices: 
+                        self.process_volume(volume)
+                else:
+                    if volume.attach_data.device == self.device_name:
+                        self.process_volume(volume)
+
+ebs_snapshot().run()

data/cookbooks/mu-tools/files/default/etc/BANNER-FEDERAL

@@ -0,0 +1,19 @@
+ +---------------------------------------------------------------------------- +
+ |                                                                             |
+ |     WARNING!    You are accessing a U.S. Government system.     WARNING!    |
+ |                                                                             |
+ |             =  THERE IS NO RIGHT OF PRIVACY ON THIS SYSTEM   =              |
+ |                                                                             |
+ |   CONNECTION TO and/or USE OF THIS SYSTEM BY ANY USER, AGENT, or ENTITY     |
+ |  AUTHORIZED or UNAUTHORIZED CONSTITUTES COMPLETE CONSENT TO THE MONITORING, |
+ |     RECORDING, READING, INTERCEPTION, COPYING, CAPTURING, and DISCLOSURE    |
+ |                IN ANY MANNER OF ANY and/or ALL ACTIVITY.                    |
+ |                                                                             |
+ |   Federal computer systems are provided ONLY for the processing of          |
+ |   official U.S. Government information. All data contained within Federal   |
+ |   computer systems is owned and controlled by the Federal Government.       |
+ |                                                                             |
+ | Unauthorized access and non-official use of government computers is prohib- |
+ | ited by Federal Law (Public Law 99-474), punishable by fines and/or prison. |
+ |                                                                             |
+ +----- WARNING! -------- WARNING! --------- WARNING! ---------- WARNING! -----+

data/cookbooks/mu-tools/files/default/mypol.te

@@ -0,0 +1,37 @@
+
+module mypol 1.0;
+
+require {
+	type postfix_pickup_t;
+	type sshd_t;
+	type default_t;
+	type winbind_t;
+	type postfix_cleanup_t;
+	type postfix_master_t;
+	class sock_file { getattr unlink create };
+	class dir { write remove_name add_name };
+	class file { write read lock create unlink open };
+}
+
+#============= postfix_cleanup_t ==============
+allow postfix_cleanup_t default_t:sock_file getattr;
+
+#============= postfix_master_t ==============
+allow postfix_master_t default_t:sock_file getattr;
+
+#============= postfix_pickup_t ==============
+allow postfix_pickup_t default_t:sock_file getattr;
+
+#============= sshd_t ==============
+allow sshd_t default_t:sock_file getattr;
+
+#============= winbind_t ==============
+#!!!! The source type 'winbind_t' can write to a 'dir' of the following types:
+# user_home_t, var_run_t, var_log_t, samba_etc_t, samba_log_t, samba_var_t, ctdbd_var_lib_t, pcscd_var_run_t, smbd_var_run_t, user_home_dir_t, winbind_var_run_t, tmp_t, var_t, user_tmp_t, auth_cache_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t
+
+allow winbind_t default_t:dir { write remove_name add_name };
+#!!!! The source type 'winbind_t' can write to a 'file' of the following types:
+# winbind_log_t, user_home_t, samba_secrets_t, samba_log_t, samba_var_t, ctdbd_var_lib_t, pcscd_var_run_t, smbd_var_run_t, winbind_var_run_t, user_tmp_t, auth_cache_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t
+
+allow winbind_t default_t:file { write read lock create unlink open };
+allow winbind_t default_t:sock_file { create unlink };

data/cookbooks/mu-tools/files/default/nrpe_c7.te

@@ -0,0 +1,31 @@
+
+module nrpe_c7 1.0;
+
+require {
+	type unconfined_t;
+	type nrpe_t;
+	type nrpe_etc_t;
+	type nagios_etc_t;
+	class dir { read relabelto };
+	class file { read relabelto getattr };
+}
+
+#============= nrpe_t ==============
+
+#!!!! This avc is allowed in the current policy
+allow nrpe_t nagios_etc_t:dir read;
+allow nrpe_t nagios_etc_t:file read;
+
+#!!!! This avc is allowed in the current policy
+allow nrpe_t nagios_etc_t:file getattr;
+
+#!!!! This avc is allowed in the current policy
+allow nrpe_t nrpe_etc_t:dir read;
+
+#============= unconfined_t ==============
+
+#!!!! This avc is allowed in the current policy
+allow unconfined_t nrpe_t:dir relabelto;
+
+#!!!! This avc is allowed in the current policy
+allow unconfined_t nrpe_t:file relabelto;

data/cookbooks/mu-tools/files/default/nrpe_check_disk.te

@@ -0,0 +1,11 @@
+
+module nrpe_check_disk 1.0;
+
+require {
+	type nagios_checkdisk_plugin_t;
+	type configfs_t;
+	class dir getattr;
+}
+
+#============= nagios_checkdisk_plugin_t ==============
+allow nagios_checkdisk_plugin_t configfs_t:dir getattr;

data/cookbooks/mu-tools/files/default/nrpe_disk.te

@@ -0,0 +1,10 @@
+
+module nrpe_disk 1.0;
+
+require {
+	type configfs_t;
+	type nagios_checkdisk_plugin_t;
+	class dir { search getattr };
+}
+
+allow nagios_checkdisk_plugin_t configfs_t:dir { search getattr };

data/cookbooks/mu-tools/files/default/nrpe_file.te

@@ -0,0 +1,31 @@
+
+module nrpe_file 1.0;
+
+require {
+	type unconfined_t;
+	type nrpe_t;
+	type nrpe_etc_t;
+	type nagios_etc_t;
+	class dir { read relabelto };
+	class file { read relabelto getattr open };
+}
+
+#============= nrpe_t ==============
+
+#!!!! This avc is allowed in the current policy
+allow nrpe_t nagios_etc_t:dir read;
+allow nrpe_t nagios_etc_t:file open;
+
+#!!!! This avc is allowed in the current policy
+allow nrpe_t nagios_etc_t:file { read getattr };
+
+#!!!! This avc is allowed in the current policy
+allow nrpe_t nrpe_etc_t:dir read;
+
+#============= unconfined_t ==============
+
+#!!!! This avc is allowed in the current policy
+allow unconfined_t nrpe_t:dir relabelto;
+
+#!!!! This avc is allowed in the current policy
+allow unconfined_t nrpe_t:file relabelto;

data/cookbooks/mu-tools/files/default/serverclass.conf

@@ -0,0 +1,18 @@
+[serverClass:Splunk_for_Unix]
+machineTypesFilter = linux-x86_64,
+whitelist.0 = *
+
+[serverClass:Splunk_for_Unix:app:base_logs_unix]
+restartSplunkWeb = 0
+restartSplunkd = 1
+stateOnClient = enabled
+
+[serverClass:Splunk_for_Windows]
+machineTypesFilter = windows-x64,
+whitelist.0 = *
+
+[serverClass:Splunk_for_Windows:app:base_logs_windows]
+restartSplunkWeb = 0
+restartSplunkd = 1
+stateOnClient = enabled
+

data/cookbooks/mu-tools/files/default/splunk-apps/base_logs_unix/local/app.conf

@@ -0,0 +1 @@
+# Autogenerated file

data/cookbooks/mu-tools/files/default/splunk-apps/base_logs_unix/local/inputs.conf

@@ -0,0 +1,13 @@
+[monitor:///var/log/messages]
+disabled = false
+followTail = 0
+
+[monitor:///var/log/httpd/access_log]
+disabled = false
+followTail = 0
+sourcetype = access_combined
+
+[monitor:///var/log/httpd/error_log]
+disabled = false
+followTail = 0
+sourcetype = apache_error

data/cookbooks/mu-tools/files/default/splunk-apps/base_logs_windows/local/app.conf

@@ -0,0 +1 @@
+#Autogenerated File

data/cookbooks/mu-tools/files/default/splunk-apps/base_logs_windows/local/inputs.conf

@@ -0,0 +1,8 @@
+# Windows platform specific input processor.
+[WinEventLog://Application]
+disabled = 0
+[WinEventLog://Security]
+disabled = 0
+[WinEventLog://System]
+disabled = 0
+

data/cookbooks/mu-tools/files/default/sshd_pol.te

@@ -0,0 +1,32 @@
+
+module sshd_pol 1.0;
+
+require {
+	type sshd_t;
+	type file_t;
+	type default_t;
+	type chroot_user_t;
+	type fusefs_t;
+	class sock_file write;
+	class lnk_file read;
+	class dir { search getattr };
+}
+
+#============= chroot_user_t ==============
+
+#!!!! This avc is allowed in the current policy
+allow chroot_user_t file_t:dir { getattr search };
+
+#!!!! This avc is allowed in the current policy
+allow chroot_user_t file_t:lnk_file read;
+
+#!!!! This avc is allowed in the current policy
+allow chroot_user_t fusefs_t:dir { search getattr };
+
+#============= sshd_t ==============
+allow sshd_t default_t:sock_file write;
+allow sshd_t file_t:dir search;
+allow sshd_t file_t:lnk_file read;
+
+#!!!! This avc can be allowed using the boolean 'use_fusefs_home_dirs'
+allow sshd_t fusefs_t:dir search;

data/cookbooks/mu-tools/files/redhat/etc/bashrc

@@ -0,0 +1,93 @@
+# /etc/bashrc
+
+# System wide functions and aliases
+# Environment stuff goes in /etc/profile
+
+# It's NOT a good idea to change this file unless you know what you
+# are doing. It's much better to create a custom.sh shell script in
+# /etc/profile.d/ to make custom changes to your environment, as this
+# will prevent the need for merging in future updates.
+
+# are we an interactive shell?
+if [ "$PS1" ]; then
+  if [ -z "$PROMPT_COMMAND" ]; then
+    case $TERM in
+    xterm*|vte*)
+      if [ -e /etc/sysconfig/bash-prompt-xterm ]; then
+          PROMPT_COMMAND=/etc/sysconfig/bash-prompt-xterm
+      elif [ "${VTE_VERSION:-0}" -ge 3405 ]; then
+          PROMPT_COMMAND="__vte_prompt_command"
+      else
+          PROMPT_COMMAND='printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/~}"'
+      fi
+      ;;
+    screen*)
+      if [ -e /etc/sysconfig/bash-prompt-screen ]; then
+          PROMPT_COMMAND=/etc/sysconfig/bash-prompt-screen
+      else
+          PROMPT_COMMAND='printf "\033k%s@%s:%s\033\\" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/~}"'
+      fi
+      ;;
+    *)
+      [ -e /etc/sysconfig/bash-prompt-default ] && PROMPT_COMMAND=/etc/sysconfig/bash-prompt-default
+      ;;
+    esac
+  fi
+  # Turn on parallel history
+  shopt -s histappend
+  history -a
+  # Turn on checkwinsize
+  shopt -s checkwinsize
+  [ "$PS1" = "\\s-\\v\\\$ " ] && PS1="[\u@\h \W]\\$ "
+  # You might want to have e.g. tty in prompt (e.g. more virtual machines)
+  # and console windows
+  # If you want to do so, just add e.g.
+  # if [ "$PS1" ]; then
+  #   PS1="[\u@\h:\l \W]\\$ "
+  # fi
+  # to your custom modification shell script in /etc/profile.d/ directory
+fi
+
+if ! shopt -q login_shell ; then # We're not a login shell
+    # Need to redefine pathmunge, it get's undefined at the end of /etc/profile
+    pathmunge () {
+        case ":${PATH}:" in
+            *:"$1":*)
+                ;;
+            *)
+                if [ "$2" = "after" ] ; then
+                    PATH=$PATH:$1
+                else
+                    PATH=$1:$PATH
+                fi
+        esac
+    }
+
+    # By default, we want umask to get set. This sets it for non-login shell.
+    # Current threshold for system reserved uid/gids is 200
+    # You could check uidgid reservation validity in
+    # /usr/share/doc/setup-*/uidgid file
+#    if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
+#       umask 002
+#    else
+#       umask 022
+#    fi
+		umask 077
+
+    SHELL=/bin/bash
+    # Only display echos from profile.d scripts if we are no login shell
+    # and interactive - otherwise just process them to set envvars
+    for i in /etc/profile.d/*.sh; do
+        if [ -r "$i" ]; then
+            if [ "$PS1" ]; then
+                . "$i"
+            else
+                . "$i" >/dev/null
+            fi
+        fi
+    done
+
+    unset i
+    unset -f pathmunge
+fi
+# vim:ts=4:sw=4