cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-tools/recipes/configure_oracle_tools.rb

@@ -0,0 +1,81 @@
+#
+# Cookbook Name::mu-tools
+# Recipe::configure_oracle_tools
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Installs the oracle instantclient, sqlplus and the dev tools, then sets up environment for access
+#
+# USAGE: Must define location of packages in the node, typically via environment, EXAMPLE ONLY:
+#                 "oracle-instantclient":{
+#                        "public-url":"https://s3.amazonaws.com/flra-cms-dev/packages/",
+#                        "sqlplus-rpm":"oracle-instantclient12.1-sqlplus-12.1.0.1.0-1.x86_64.rpm",
+#                        "devel-rpm":"oracle-instantclient12.1-devel-12.1.0.1.0-1.x86_64.rpm",
+#                       "basic-rpm":"oracle-instantclient12.1-basic-12.1.0.1.0-1.x86_64.rpm"
+#                },
+#                "oracle-jdbc":{
+#                       "public-url":"https://s3.amazonaws.com/flra-cms-dev/packages/",
+#                       "oracle-jdbc-jar" : "ojdbc7.jar",
+#                       "jar-home" : "/usr/local/lib/jvm/"
+#                }
+#
+# TODO: Make the versions attribute-driven
+#               The package relies upon the packages being accessible via https, which requires public access.
+#               Eliminate this by either an s3 copy possibility or creating an rpm repository
+#
+# Maintained by: robert.patt-corner@eglobaltech.com
+#
+case node['platform']
+
+  when "centos"
+    # Install sqlplus and the oracle development sdk, then set the oracle environment up
+    include_recipe "oracle-instantclient::sqlplus"
+    include_recipe "oracle-instantclient::devel"
+
+    # Add a pull and setup for JDBC if driven by node
+    uses_jdbc = node['oracle-jdbc']
+    unless uses_jdbc.nil?
+      directory node['oracle-jdbc']['jar-home'] do
+        owner "root"
+        group "root"
+        mode 0755
+        action :create
+      end
+
+      remote_file File.join(node['oracle-jdbc']['jar-home'], node['oracle-jdbc']['oracle-jdbc-jar']) do
+        source node['oracle-jdbc']['public-url'] + node['oracle-jdbc']['oracle-jdbc-jar']
+        action :create
+      end
+
+
+    end
+
+    # Set up the configuration so oracle is in the path
+    file "/etc/ld.so.conf.d/oracle.conf" do
+      content "/usr/lib/oracle/12.1/client64/lib\n"
+      mode 0644
+      owner "root"
+      group "root"
+      notifies :run, "execute[/sbin/ldconfig]", :immediately
+    end
+
+    execute "/sbin/ldconfig" do
+      action :nothing
+    end
+
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+
+end

data/cookbooks/mu-tools/recipes/disable-requiretty.rb

@@ -0,0 +1,22 @@
+# Copyright:: Copyright (c) 2015 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+case node['platform']
+when platform_family?('rhel')
+  execute "sed -i 's/^Defaults.*requiretty$/Defaults   !requiretty/' /etc/sudoers" do
+    not_if "grep '!requiretty' /etc/sudoers"
+  end
+else
+  Chef::Log.info("Unsupported platform #{node['platform']}")
+end

data/cookbooks/mu-tools/recipes/ebs_rolling_snapshots.rb

@@ -0,0 +1,75 @@
+#
+# Cookbook Name::mu-tools
+# Recipe::ebs_rolling_snapshots
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#	  http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Install/upgrade Python if missing on both Windows and Linux as well as install/upgrade Boto and Requests
+# Works on both Windows and Linux, runs nightly on both.
+# Unless -d/--device_name is specified will snapshot all volumes except for the following:
+# On Windows /dev/sda1. On Linux /dev/sda1,/dev/sda, /dev/xvdn, /dev/xvdo, /dev/xvdp, /dev/xvdq, xvdn, xvdo, xvdp, xvdq
+
+include_recipe "poise-python"
+snap_string = "--num_snaps_keep #{node['ebs_snapshots']['days_to_keep']}"
+snap_string << " --device_name #{node['ebs_snapshots']['device_name']}" if node['ebs_snapshots']['device_name']
+snap_string << " --exclude_devices '#{node['ebs_snapshots']['exclude_devices'].join(', ')}'" if !node['ebs_snapshots']['exclude_devices'].empty?
+
+case node['platform']
+when "windows"
+  cookbook_file "#{Chef::Config[:file_cache_path]}/ebs_snapshots.py" do
+    source 'ebs_snapshots.py'
+  end
+
+  ['boto', 'requests'].each do |pkg|
+    execute "Installing #{pkg}" do
+      command "#{node['python']['pip_binary']} install #{pkg} --upgrade"
+      not_if "echo %path% | find /I \"#{node['python']['prefix_dir']}\\python#{node['python']['major_version']}\\Scripts\""
+    end
+  end
+
+  ['boto', 'requests'].each do |pkg|
+    python_package pkg do
+      action :upgrade
+      only_if "echo %path% | find /I \"#{node['python']['prefix_dir']}\\python#{node['python']['major_version']}\\Scripts\""
+    end
+  end
+
+  windows_task 'daily-snapshots' do
+    user "SYSTEM"
+    command "python #{Chef::Config[:file_cache_path]}\\ebs_snapshots.py #{snap_string}"
+    run_level :highest
+    frequency :daily
+    start_time "06:00"
+  end
+else
+  cookbook_file "/opt/ebs_snapshots.py" do
+    source 'ebs_snapshots.py'
+  end
+
+  ['boto', 'requests'].each do |pkg|
+    python_package pkg do
+      action :upgrade
+    end
+  end
+
+  snap_string << " --logfile /var/log/ebs_snapshots.log"
+  cron "Nightly rotate snapshot" do
+    action :create
+    minute "10"
+    hour "6"
+    user "root"
+    command "python /opt/ebs_snapshots.py #{snap_string}"
+  end
+end

data/cookbooks/mu-tools/recipes/efs.rb

@@ -0,0 +1,70 @@
+# Cookbook Name:: mu-tools
+# Recipe:: efs
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#		 http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Client-side behavior for interfacing with Amazon Elastic File System
+
+if node['deployment'].has_key?('storage_pools')
+  require 'net/http'
+  require 'json'
+
+  case node['platform']
+  when 'ubuntu'
+    package "nfs-common"
+  when "rhel", "amazon", "centos"
+    package %w{nfs-utils nfs4-acl-tools}
+  end
+
+  instance_identity = JSON.parse(Net::HTTP.get(URI("http://169.254.169.254/latest/dynamic/instance-identity/document")))
+
+  node['deployment']['storage_pools'].each { |name, pool|
+    pool['mount_targets'].each { |name, target|
+      if target['availability_zone'] == instance_identity["availabilityZone"]
+      # Should also make it possible to choose a random endpoint if there isn't one for a specific AZ
+
+        directory target['mount_directory'] do
+          recursive true
+          mode 0755
+        end
+
+        endpoint = target['endpoint']
+        resolver = Resolv::DNS.new
+        begin
+          resolver.getaddress(endpoint)
+        rescue  Resolv::ResolvError
+          endpoint = target['ip_address']
+        end
+
+        if node[:platform_family] == "rhel" and node[:platform_version].to_i < 6 and node['platform'] != "amazon"
+          service "portmap" do
+            action [:enable, :start]
+          end
+        end
+
+        mount target['mount_directory'] do
+          device "#{endpoint}:/"
+          fstype "nfs4"
+          action [:mount, :enable]
+          unless node['platform_family'] == "rhel" and node['platform_version'].to_i < 6
+            options "nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2"
+          end
+        end
+
+        break
+      end
+    }
+  }
+end

data/cookbooks/mu-tools/recipes/eks.rb

@@ -0,0 +1,160 @@
+# Cookbook Name:: mu-tools
+# Recipe:: eks
+#
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#		 http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Client-side behavior for interfacing with Amazon Elastic File System
+
+if node['deployment'].has_key?('container_clusters')
+  cluster_short_name = node['service_name'].sub(/-workers$/, "")
+  region = node['deployment']['container_clusters'][cluster_short_name]['region']
+  cluster = node['deployment']['container_clusters'][cluster_short_name]['name']
+  max_pods = node['deployment']['container_clusters'][cluster_short_name]['max_pods']
+  ca = node['deployment']['container_clusters'][cluster_short_name]['certificate_authority']['data']
+  endpoint = node['deployment']['container_clusters'][cluster_short_name]['endpoint']
+#  admin_role = node['deployment']['container_clusters'][cluster_short_name]['k8s_admin_role']
+
+  if platform_family?("rhel") and node[:platform_version].to_i >= 7
+    execute "rpm --import https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg"
+    file "/etc/yum.repos.d/kubernetes.repo" do
+      content "[kubernetes]
+name=Kubernetes
+baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
+        https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
+"
+    end
+    execute "yum -q makecache -y --disablerepo='*' --enablerepo=kubernetes"
+    package "docker"
+    package "awscli"
+    package "kubeadm"
+    package "kubelet"
+    package "kubectl"
+  elsif platform_family?("debian")
+    package "apt-transport-https"
+    package "ca-certificates"
+    package "software-properties-common"
+    package "curl"
+    bash "install docker" do
+      code <<EOH
+        curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
+        add-apt-repository "deb https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") $(lsb_release -cs) stable"
+        apt-get update && apt-get install -y docker-ce=$(apt-cache madison docker-ce | grep 17.03 | head -1 | awk '{print $3}')
+EOH
+    end
+
+    execute "curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -"
+    file "/etc/apt/sources.list.d/kubernetes.list" do
+      content "deb http://apt.kubernetes.io/ kubernetes-xenial main\n"
+    end
+    package "kubeadm"
+    package "kubelet"
+    package "kubectl"
+  else
+    Chef::Log.info("I don't know how to turn this #{node['platform']} AMI (#{node[:platform_version].to_s}) into a Kubernetes worker, hopefully it's the official, pre-configured AMI")
+  end
+
+  service "docker" do
+    action [:start, :enable]
+  end
+  service "kubelet" do
+    action [:start, :enable]
+  end
+
+  directory "/etc/kubernetes/pki/" do
+    recursive true
+    action :create
+  end
+  file "/etc/kubernetes/pki/ca.crt" do
+    content Base64.decode64(ca)
+  end
+
+  directory "/root/.aws/eks" do
+    recursive true
+    action :create
+  end
+
+  remote_file "/root/.aws/eks/eks-2017-11-01.normal.json" do
+    source "https://s3-us-west-2.amazonaws.com/amazon-eks/1.10.3/2018-06-05/eks-2017-11-01.normal.json"
+  end
+
+  execute "aws configure add-model --service-model file://root/.aws/eks/eks-2017-11-01.normal.json --service-name eks"
+
+  execute "systemctl daemon-reload" do
+    action :nothing
+  end
+
+  template "/etc/systemd/system/kubelet.service" do
+    source "kubelet.service.erb"
+    mode 0644
+#    :pod_infra_container? :region?
+#    --pod-infra-container-image=602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/pause-amd64:3.1
+    variables(
+      :dns => get_first_nameserver(),
+      :node_ip => get_aws_metadata("meta-data/local-ipv4")
+    )
+    notifies :run, "execute[systemctl daemon-reload]", :immediately
+    notifies :restart, "service[kubelet]", :delayed
+  end
+
+  directory "/root/.kube"
+
+  remote_file "/usr/bin/aws-iam-authenticator" do
+    source "https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/aws-iam-authenticator"
+    mode 0755
+    not_if "test -f /usr/bin/aws-iam-authenticator"
+  end
+
+  ["/var/lib/kubelet/kubeconfig", "/root/.kube/config"].each { |kubecfg|
+    template kubecfg do
+      source "kubeconfig.erb"
+      variables(
+        :endpoint => endpoint,
+        :cluster => cluster,
+        :cacert => ca,
+        :rolearn => node['ec2']['iam_instance_profile']['arn'].sub(/:instance-profile\//, ":role/")
+      )
+    end
+  }
+
+  master_ips = get_mu_master_ips
+  opento = master_ips.map { |x| "#{x}/32"}
+
+  opento.uniq.each { |src|
+    [:tcp, :udp, :icmp].each { |proto|
+      execute "iptables -I INPUT -p #{proto.to_s} -s #{src}" do
+        not_if "iptables -L -n | tr -s ' ' | grep -- '#{proto.to_s} -- #{src.sub(/\/32$/, "")}' > /dev/null"
+      end
+    }
+  }
+
+  execute "/usr/sbin/sysctl -w net.ipv4.ip_forward=1"
+
+  execute "echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf" do
+    not_if "grep ^net.ipv4.ip_forward /etc/sysctl.conf"
+  end
+
+  bash "Allow DockerD to forward traffic outside" do
+    code <<EOH
+    /sbin/iptables -A FORWARD -i docker0 -j ACCEPT
+    /sbin/iptables -A INPUT -i docker0 -j ACCEPT
+    /sbin/iptables -t nat -A POSTROUTING -o eth0 -s 172.17.0.0/16 -j MASQUERADE
+EOH
+  end
+
+end

data/cookbooks/mu-tools/recipes/gcloud.rb

@@ -0,0 +1,98 @@
+#
+# Cookbook Name::mu-tools
+# Recipe::gcloud
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if platform_family?("rhel")
+  if node['platform_version'].to_i >= 7
+    yum_repository "google-cloud-sdk" do
+      description 'Google Cloud SDK'
+      url "https://packages.cloud.google.com/yum/repos/cloud-sdk-el#{node['platform_version'].to_i}-x86_64#{node['platform_version'].to_i == 6 ? "-unstable": ""}"
+      enabled true
+      gpgcheck true
+      repo_gpgcheck true
+      gpgkey ["https://packages.cloud.google.com/yum/doc/yum-key.gpg", "https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg"]
+    end
+    package "google-cloud-sdk"
+  elsif node['platform_version'].to_i == 6
+    rpm_package "IUS" do
+      source "https://#{node['platform']}#{node['platform_version'].to_i}.iuscommunity.org/ius-release.rpm"
+    end
+    package ["python27", "python27-libs"]
+    remote_file "#{Chef::Config[:file_cache_path]}/gcloud-cli.sh" do
+      source "https://sdk.cloud.google.com"
+      action :nothing
+    end
+    remote_file "#{Chef::Config[:file_cache_path]}/gcloud-cli.tar.gz" do
+      source "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-167.0.0-linux-x86_64.tar.gz"
+      action :nothing
+    end
+    bash "install gcloud-cli" do
+      cwd "/opt"
+      code <<-EOH
+        # This broken-arsed package set install themselves in the wrong prefix
+        # for some reason, but if you do it manually they land in the right
+        # place. Whatever, just symlink it.
+        filelist=`rpm -qa | grep ^python27- | xargs rpm -ql`
+        for d in $filelist;do
+          if [ -d "$d" ];then
+            rightpath=`echo $d | sed 's/^\\/opt\\/rh\\/python27\\/root//'`
+            if [ "$rightpath" != "$d" -a ! -e "$rightpath" ];then
+              echo $rightpath | grep -v /
+              mkdir -p "$rightpath"
+            fi
+          fi
+        done
+        for f in $filelist;do
+          if [ -f "$f" ];then
+            rightpath=`echo $f | sed 's/^\\/opt\\/rh\\/python27\\/root//'`
+            if [ "$rightpath" != "$f" -a ! -e "$rightpath" ];then
+              ln -s "$f" "$rightpath"
+            fi
+          fi
+        done
+        tar -xzf #{Chef::Config[:file_cache_path]}/gcloud-cli.tar.gz
+        CLOUDSDK_PYTHON=/usr/bin/python2.7 ./google-cloud-sdk/install.sh -q
+#        CLOUDSDK_PYTHON=/usr/bin/python2.7 sh #{Chef::Config[:file_cache_path]}/gcloud-cli.sh --install-dir=/opt --disable-prompts
+      EOH
+      notifies :create, "remote_file[#{Chef::Config[:file_cache_path]}/gcloud-cli.sh]", :before
+      notifies :create, "remote_file[#{Chef::Config[:file_cache_path]}/gcloud-cli.tar.gz]", :before
+      not_if { ::File.exists?("/opt/google-cloud-sdk/bin/gcloud") }
+    end
+    link "/etc/bash_completion.d/gcloud" do
+      to "/opt/google-cloud-sdk/completion.bash.inc"
+    end
+    link "/etc/profile.d/gcloud.sh" do
+      to "/opt/google-cloud-sdk/path.bash.inc"
+    end
+    file "/etc/profile.d/gcloud_python.sh" do
+      content "export CLOUDSDK_PYTHON=/usr/bin/python2.7\n"
+      mode 0644
+    end
+  end
+elsif platform_family?("debian")
+  bash "add google-cloud-sdk repo" do
+    code <<-EOH
+      export CLOUD_SDK_REPO="cloud-sdk-$(lsb_release -c -s)"
+      echo "deb http://packages.cloud.google.com/apt $CLOUD_SDK_REPO main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
+      curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
+      sudo apt-get update
+    EOH
+    not_if { ::File.exists?("/etc/apt/sources.list.d/google-cloud-sdk.list") }
+  end
+  package "google-cloud-sdk"
+else
+end

data/cookbooks/mu-tools/recipes/google_api.rb

@@ -0,0 +1,25 @@
+#
+# Cookbook Name::mu-tools
+# Recipe::google_api
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+["google-api-client", "google-cloud", "googleauth"].each { |gem|
+  chef_gem gem do
+    compile_time true
+    action :install
+		only_if { !get_google_metadata("name").nil? }
+  end
+}

data/cookbooks/mu-tools/recipes/maldet.rb

@@ -0,0 +1,67 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: maldet
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Installs maldetect and enables a cron job to scan all local filesystems at
+# a random time once per day.
+
+if node['maldet']['install'] == true and !node['application_attributes']['skip_recipes'].include?('maldet')
+  include_recipe "mu-tools::clamav"
+
+  if !platform_family?("windows")
+    execute "unpack maldetect" do
+      cwd Chef::Config[:file_cache_path]
+      command "tar xfz maldetect-current.tar.gz"
+      action :nothing
+    end
+
+    # XXX Probably ought to pick a version and checksum it.
+    remote_file "#{Chef::Config[:file_cache_path]}/maldetect-current.tar.gz" do
+      action :create
+      source "https://www.rfxn.com/downloads/maldetect-current.tar.gz"
+      owner "root"
+      group "root"
+      notifies :run, "execute[unpack maldetect]", :immediately
+    end
+
+
+    execute "install maldetect" do
+      command "dir=\"`tar -tzf #{Chef::Config[:file_cache_path]}/maldetect-current.tar.gz | head -1`\" ; cd #{Chef::Config[:file_cache_path]}/$dir && ./install.sh && /usr/local/maldetect/maldet --update ; rm -f /etc/cron.daily/maldet"
+      returns [0, 1]
+      not_if "test -f /usr/local/maldetect/maldet"
+    end
+
+    template "/usr/local/sbin/maldet_scanall.sh" do
+      source "maldet_scanall.sh.erb"
+      mode "0755"
+    end
+
+    template "/usr/local/sbin/conf.maldet" do
+      source "conf.maldet.erb"
+    end
+
+    cron "update maldet" do
+      minute Random.rand(0...59)
+      hour Random.rand(0...23)
+      command "/usr/local/maldetect/maldet --update > /dev/null; /usr/local/sbin/maldet_scanall.sh > /dev/null"
+    end
+  end
+elsif !platform_family?("windows")
+  cron "update maldet" do
+    action :delete
+  end
+end

data/cookbooks/mu-tools/recipes/nagios.rb

@@ -0,0 +1,19 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: nagios
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_recipe "nagios"

data/cookbooks/mu-tools/recipes/newclient.rb

@@ -0,0 +1,23 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if !node['application_attributes']['skip_recipes'].include?('newclient')
+  unless node['recipes'].include?("chef-server")
+    file Chef::Config[:validation_key] do
+      action :delete
+      backup false
+      only_if { ::File.exists?(Chef::Config[:client_key]) }
+    end
+  end
+end