cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-tools/recipes/updates.rb

@@ -0,0 +1,96 @@
+# Cookbook Name:: mu-tools
+# Recipe:: updates
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#	  http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+
+if !node['application_attributes']['skip_recipes'].include?('updates')
+  case node['platform']
+  # Note- most of this Windows logic is now dealt with in userdata (setup)
+  # and initial Mu bootstrap (running updates), but this recipe is still
+  # useful for updating existing hosts.
+    when "windows"
+      ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+  
+      ["C:\\Users\\#{node['windows_admin_username']}", "C:\\Users\\#{node['windows_admin_username']}\\Documents", "C:\\Users\\#{node['windows_admin_username']}\\Documents\\WindowsPowerShell", "C:\\Users\\#{node['windows_admin_username']}\\Documents\\WindowsPowerShell\\Modules"].each { |dir|
+        directory dir
+      }
+  
+      remote_file "#{Chef::Config[:file_cache_path]}/PSWindowsUpdate.zip" do
+        source "https://s3.amazonaws.com/cloudamatic/PSWindowsUpdate.zip"
+      end
+  
+      ["C:/Users/#{node['windows_admin_username']}/Documents/WindowsPowerShell/Modules", "c:\\windows\\System32\\WindowsPowerShell\\v1.0\\Modules"].each { |dir|
+        windows_zipfile dir do
+          source "#{Chef::Config[:file_cache_path]}/PSWindowsUpdate.zip"
+          action :unzip
+          not_if { File.exists?("#{dir}/PSWindowsUpdate") }
+        end
+      }
+  
+      registry_key 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update' do
+        values [{
+                    :name => 'AUOptions',
+                    :type => :dword,
+                    :data => '3'
+                }]
+        action :create
+        recursive true
+      end
+  
+      if node['os_updates_using_chef'] or node['application_attributes']['os_updates_using_chef']
+        powershell_script "Install Windows Updates" do
+          # XXX Something in here throws a security error now. Whee.
+          #				 Set-ExecutionPolicy RemoteSigned -Force
+          #				 if (!(Test-Path -path c:\\windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\PSWindowsUpdate))
+          #				 {
+          #					 cmd /c mklink /D c:\\windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\PSWindowsUpdate C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\PSWindowsUpdate
+          #				 }
+          code <<-EOH
+  				Import-Module PSWindowsUpdate
+  				Get-WUInstall -AcceptAll -ignorereboot
+          EOH
+        end
+  
+        reboot "Windows updates" do
+          action :reboot_now
+          reason "Windows Update has requested a reboot"
+          only_if {
+            registry_key_exists?("HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired")
+          }
+        end
+
+      end
+    when "centos"
+      execute "yum -y update" if node['os_updates_using_chef']
+    when "ubuntu"
+      include_recipe "mu-utility::apt"
+  
+      if node['os_updates_using_chef']
+        bash "Install system updates" do
+          user "root"
+          code <<-EOH
+  				apt-get -y upgrade
+  				cat >> /etc/ssh/sshd_config << EOF
+  					PermitRootLogin without-password
+  				EOF
+  				cat /root/.ssh/authorized_keys | sed 's/^.*ssh-rsa//g' > /tmp/temp && mv /tmp/temp /root/.ssh/authorized_keys
+  				cat /root/.ssh/authorized_keys | sed '1s/^/ssh-rsa/' > /tmp/temp && mv /tmp/temp /root/.ssh/authorized_keys
+  				/etc/init.d/ssh restart
+          EOH
+        end
+      end
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end

data/cookbooks/mu-tools/recipes/windows-client.rb

@@ -0,0 +1,202 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Cookbook Name:: mu-tools
+# Recipe:: windows-client
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#	  http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if !node['application_attributes']['skip_recipes'].include?('windows-client')
+  case node['platform']
+    when "windows"
+      include_recipe 'chef-vault'
+      ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+
+#      remote_file "cygwin-x86_64.exe" do
+#        path "#{Chef::Config[:file_cache_path]}/cygwin-x86_64.exe"
+#        source "http://cygwin.com/setup-x86_64.exe"
+# XXX guard with a version check
+#      end
+
+# XXX keep a local cache of packages... really our own damn mirror
+      cygwindir = "c:/bin/cygwin"
+#      pkgs = ["bash", "mintty", "vim", "curl", "openssl", "wget", "lynx", "openssh"]
+
+#      powershell_script "install Cygwin" do
+#        code <<-EOH
+#          Start-Process -wait -FilePath "#{Chef::Config[:file_cache_path]}/cygwin-x86_64.exe" -ArgumentList "-q -n -l #{Chef::Config[:file_cache_path]} -L -R c:/bin/cygwin -s http://mirror.cs.vt.edu/pub/cygwin/cygwin/ -P #{pkgs.join(",")}"
+#        EOH
+#        not_if { ::File.exists?("#{cygwindir}/Cygwin.bat") }
+#      end
+
+      # Be prepared to reinit installs that are missing key utilities
+#      file "#{cygwindir}/etc/setup/installed.db" do
+#        action :delete
+#        not_if { ::File.exists?("#{cygwindir}/bin/cygcheck.exe") }
+#      end
+
+#      pkgs.each { |pkg|
+#        execute "install Cygwin package: #{pkg}" do
+#          cwd Chef::Config[:file_cache_path]
+#          command "#{Chef::Config[:file_cache_path]}/cygwin-x86_64.exe -f -A -q -R #{cygwindir} -s http://mirror.cs.vt.edu/pub/cygwin/cygwin/ -P #{pkg}"
+#          not_if "#{cygwindir}/bin/cygcheck -c #{pkg}".include? "OK"
+#        end
+#      }
+
+      reboot "Cygwin LSA" do
+        action :nothing
+        reason "Enabling Cygwin LSA support"
+      end
+
+      powershell_script "Configuring Cygwin LSA support" do
+        code <<-EOH
+          Invoke-Expression '& #{cygwindir}/bin/bash.exe --login -c "echo yes | /bin/cyglsa-config"'
+        EOH
+        not_if {
+          lsa_found = false
+          if registry_key_exists?("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa")
+            registry_get_values("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa").each { |val|
+              if val[:name] == "Authentication Packages"
+                lsa_found = true if val[:data].grep(/cyglsa64\.dll/)
+                break
+              end
+            }
+          end
+          lsa_found
+        }
+        notifies :reboot_now, "reboot[Cygwin LSA]", :immediately
+      end
+
+      windows_vault = chef_vault_item(node['windows_auth_vault'], node['windows_auth_item'])
+      sshd_user = windows_vault[node['windows_sshd_username_field']]
+      sshd_password = windows_vault[node['windows_sshd_password_field']]
+      powershell_script "enable Cygwin sshd" do
+        code <<-EOH
+          Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "ssh-host-config -y -c ntsec -w ''#{sshd_password}'' -u #{sshd_user}"'
+          Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "sed -i.bak ''s/#.*StrictModes.*yes/StrictModes no/'' /etc/sshd_config"'
+          Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "sed -i.bak ''s/#.*PasswordAuthentication.*yes/PasswordAuthentication no/'' /etc/sshd_config"'
+          Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "chown #{sshd_user} /var/empty /var/log/sshd.log /etc/ssh*; chmod 755 /var/empty"'
+        EOH
+        sensitive true
+        not_if %Q{Get-Service "sshd"}
+      end
+      powershell_script "set unix-style Cygwin sshd permissions" do
+        code <<-EOH
+          if((Get-WmiObject win32_computersystem).partofdomain){
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkpasswd -d > /etc/passwd"'
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkgroup -l -d > /etc/group"'
+          } else {
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkpasswd -l > /etc/passwd"'
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkgroup -l > /etc/group"'
+          }
+          Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "chown #{sshd_user} /var/empty /var/log/sshd.log /etc/ssh*; chmod 755 /var/empty"'
+        EOH
+      end
+
+      include_recipe 'mu-activedirectory'
+
+      ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+
+      template "c:/bin/cygwin/etc/sshd_config" do
+        source "sshd_config.erb"
+        mode 0644
+        cookbook "mu-tools"
+        ignore_failure true
+      end
+
+      ec2config_user= windows_vault[node['windows_ec2config_username_field']]
+      ec2config_password = windows_vault[node['windows_ec2config_password_field']]
+      login_dom = "."
+
+      if in_domain?
+
+        ad_vault = chef_vault_item(node['ad']['domain_admin_vault'], node['ad']['domain_admin_item'])
+        login_dom = node['ad']['netbios_name']
+
+        windows_users node['ad']['computer_name'] do
+          username ad_vault[node['ad']['domain_admin_username_field']]
+          password ad_vault[node['ad']['domain_admin_password_field']]
+          domain_name node['ad']['domain_name']
+          netbios_name node['ad']['netbios_name']
+          dc_ips node['ad']['dc_ips']
+          ssh_user sshd_user
+          ssh_password sshd_password
+          ec2config_user ec2config_user
+          ec2config_password ec2config_password
+        end
+
+        aws_windows "ec2" do
+          username ec2config_user
+          service_username "#{node['ad']['netbios_name']}\\#{ec2config_user}"
+          password ec2config_password
+        end
+
+        scheduled_tasks "tasks" do
+          username ad_vault[node['ad']['domain_admin_username_field']]
+          password ad_vault[node['ad']['domain_admin_password_field']]
+        end
+
+        sshd_service "sshd" do
+          service_username "#{node['ad']['netbios_name']}\\#{sshd_user}"
+          username sshd_user
+          password sshd_password
+        end
+
+        begin
+          resources('service[sshd]')
+        rescue Chef::Exceptions::ResourceNotFound
+          service "sshd" do
+            action [:enable, :start]
+            sensitive true
+          end
+        end
+      else
+        windows_users node['hostname'] do
+          username node['windows_admin_username']
+          password windows_vault[node['windows_auth_password_field']]
+          ssh_user sshd_user
+          ssh_password sshd_password
+          ec2config_user ec2config_user
+          ec2config_password ec2config_password
+        end
+
+        aws_windows "ec2" do
+          username ec2config_user
+          service_username ".\\#{ec2config_user}"
+          password ec2config_password
+        end
+
+        scheduled_tasks "tasks" do
+          username node['windows_admin_username']
+          password windows_vault[node['windows_auth_password_field']]
+        end
+
+        sshd_service "sshd" do
+          username sshd_user
+          service_username ".\\#{sshd_user}"
+          password sshd_password
+        end
+        begin
+          resources('service[sshd]')
+        rescue Chef::Exceptions::ResourceNotFound
+          service "Cygwin sshd as '#{sshd_user}'" do
+						service_name "sshd"
+            action [:enable, :start]
+            sensitive true
+          end
+        end
+      end
+
+    else
+      Chef::Log.info("mu-tools::windows-client: Unsupported platform #{node['platform']}")
+  end
+end

data/cookbooks/mu-tools/resources/aws_windows.rb

@@ -0,0 +1,33 @@
+resource_name :aws_windows
+
+property :username, String, required: true
+property :password, String, required: true
+property :service_username, String, required: true
+
+default_action :config
+
+action :config do
+  require 'chef/win32/version'
+  version = Chef::ReservedNames::Win32::Version.new
+
+  if version.windows_server_2012? || version.windows_server_2012_r2?
+    unless service_user_set?("Ec2Config", new_resource.service_username)
+    converge_by("configure Ec2Config service to run under #{new_resource.username}") do
+      cmd = powershell_out("(Get-WmiObject Win32_service | Where-Object {$_.Name -eq 'Ec2Config'}).StartName")
+      Chef::Log.info("ec2config Service start name before change: #{cmd.stdout}")
+    end
+
+    converge_by("configure Ec2Config service to run under #{new_resource.username}") do
+      cmd = powershell_out("$ec2config_service = Get-WmiObject Win32_service | Where-Object {$_.Name -eq 'Ec2Config'}; $ec2config_service.Change($Null,$Null,$Null,$Null,$Null,$Null,'#{new_resource.service_username}','#{new_resource.password}',$Null,$Null,$Null)")
+      Chef::Log.error("Error configuring Ec2Config service: #{cmd.stderr}") unless cmd.exitstatus == 0
+      cmd = powershell_out("(Get-WmiObject Win32_service | Where-Object {$_.Name -eq 'Ec2Config'}).StartName")
+      Chef::Log.info("ec2config Service start name after change: #{cmd.stdout}")
+    end
+      # service "Ec2Config" do
+      # action :restart
+      # end
+    end
+  elsif version.windows_server_2016?
+    # do EC2Launch http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/windows-ami-version-history.html#win2k16-amis
+  end
+end

data/cookbooks/mu-tools/resources/disk.rb

@@ -0,0 +1,88 @@
+
+property :mountpoint, String, name_property: true
+property :device, String, required: true
+property :preserve_data, :kind_of => [TrueClass, FalseClass], :required => false, :default => false
+property :reboot_after_create, :kind_of => [TrueClass, FalseClass], :required => false, :default => false
+property :size, Integer, default: 8
+
+actions :create
+default_action :create
+
+action :create do
+  device = new_resource.device
+  path = new_resource.mountpoint
+  devicename = device
+
+  if set_gcp_cfg_params
+    devicename.gsub!(/.*?\//, "")
+    device = "/dev/disk/by-id/google-"+devicename
+  end
+
+  mu_tools_mommacat_request "create #{path}" do
+    request "add_volume"
+    passparams(
+      :dev => devicename,
+      :size => new_resource.size
+    )
+    not_if { ::File.exists?(device) }
+  end
+
+  reboot "Rebooting after adding #{path}" do
+    action :nothing
+  end
+
+  backupname = path.gsub(/[^a-z0-9]/i, "_")
+  directory "/mnt#{backupname}" do
+    action :nothing
+  end
+  mount "/mnt#{backupname}" do
+    device device
+    options "nodev"
+    action :nothing
+    notifies :create, "directory[/mnt#{backupname}]", :before
+  end
+  execute "back up #{backupname}" do
+    # also expunge files so we don't eat up a bunch of disk space quietly
+    # underneath our new mount
+    command "( cd #{path} && tar -cpf - . | su -c 'cd /mnt#{backupname}/ && tar -xpf -' ) && find #{path}/ -type f -exec rm -f {} \\;"
+    only_if { ::Dir.exists?(path) and ::Dir.exists?("/mnt#{backupname}") }
+    action :nothing
+  end
+
+  mkfs_cmd = node['platform_version'].to_i == 6 ? "mkfs.ext4 -F #{device}" : "mkfs.xfs -i size=512 #{device}"
+  guard_cmd = node['platform_version'].to_i == 6 ? "tune2fs -l #{device} > /dev/null" : "xfs_admin -l #{device} > /dev/null"
+
+  execute mkfs_cmd do
+    if new_resource.preserve_data
+      notifies :mount, "mount[/mnt#{backupname}]", :immediately
+      notifies :run, "execute[back up #{backupname}]", :immediately
+      notifies :unmount, "mount[/mnt#{backupname}]", :immediately
+    end
+    if new_resource.reboot_after_create
+      notifies :request_reboot, "reboot[Rebooting after adding #{path}]", :delayed
+    end
+    not_if guard_cmd
+  end
+
+  if !new_resource.reboot_after_create
+    directory "Ensure existence of #{path} for #{device}" do
+      recursive true
+      path path
+    end
+
+    execute "/sbin/restorecon -R #{path}" do
+      only_if { ::File.exists?("/sbin/restorecon") }
+      action :nothing
+    end
+
+    mount path do
+      device device
+      options "nodev"
+      action [:mount, :enable]
+      notifies :run, "execute[/sbin/restorecon -R #{path}]", :immediately
+    end
+
+  end
+
+
+end

data/cookbooks/mu-tools/resources/mommacat_request.rb

@@ -0,0 +1,11 @@
+
+property :request, String, name_property: true
+property :passparams, Hash
+
+actions :run
+default_action :run
+
+action :run do
+  params = Base64.urlsafe_encode64(JSON.generate(new_resource.passparams))
+  mommacat_request(new_resource.request, params)
+end

data/cookbooks/mu-tools/resources/scheduled_tasks.rb

@@ -0,0 +1,29 @@
+resource_name :scheduled_tasks
+
+property :username, String, required: true
+property :password, String, required: true
+
+default_action :config
+
+action :config do
+  %w{run-userdata_scheduledtask.xml}.each { |file|
+    remote_file "#{Chef::Config[:file_cache_path]}/#{file}" do
+      source "https://s3.amazonaws.com/cloudamatic/#{file}"
+      action :nothing
+    end.run_action(:create)
+  }
+
+  # TO DO for Windows 2016 create a scheduled task that executes C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Scripts\Invoke-Userdata.ps1 with a username and a password instead of this scheduled task
+  converge_by("Creating run-userdata Scheduled Task") do
+    cmd = powershell_out("Register-ScheduledTask -Xml (get-content '#{Chef::Config[:file_cache_path]}/run-userdata_scheduledtask.xml' | out-string) -TaskName 'run-userdata' -User #{new_resource.username} -Password '#{new_resource.password}' -Force")
+    Chef::Log.error("Failed to configure run-userdata Scheduled Task: #{cmd.stderr}") unless cmd.exitstatus == 0
+  end
+
+  windows_task 'run-userdata' do
+    action :nothing
+  end
+
+#  windows_task 'run-chef-client' do
+#    action :nothing
+#  end
+end

data/cookbooks/mu-tools/resources/sshd_service.rb

@@ -0,0 +1,45 @@
+resource_name :sshd_service
+
+property :name, String, name_property: true
+property :username, String, required: true
+property :password, String, required: true
+property :service_username, String, required: true
+
+default_action :config
+
+action :config do
+  converge_by("Configuring SSH service to run under #{new_resource.service_username}") do
+    ssh_user_set = service_user_set?(new_resource.name, new_resource.service_username)
+    failed = false
+  
+    cmd = powershell_out("$sshd_service = Get-WmiObject Win32_service | Where-Object {$_.Name -eq '#{new_resource.name}'}; $sshd_service.Change($Null,$Null,$Null,$Null,$Null,$Null,'#{new_resource.service_username}','#{new_resource.password}',$Null,$Null,$Null)")
+    if cmd.exitstatus != 0
+      Chef::Log.error("Failed to change ssh service user #{cmd.stderr}")
+      failed = true
+    end
+
+    cmd = powershell_out("(Get-WmiObject Win32_service | Where-Object {$_.Name -eq '#{new_resource.name}'}).StartName")
+    if !(cmd.stdout =~ /#{new_resource.username}/)
+      Chef::Log.error("Failed to change ssh service user to #{new_resource.username}")
+      failed = true
+    end
+
+    # if cmd.exitstatus == 0 and !ssh_user_set
+    unless ssh_user_set or failed
+      # cmd = powershell_out("c:/bin/cygwin/bin/bash --login -c 'chown -R #{new_resource.username} /var/empty && chown #{new_resource.username} /var/log/sshd.log /etc/ssh*\'; Stop-Process -ProcessName #{new_resource.name} -force; Stop-Service #{new_resource.name} -Force; Start-Service #{new_resource.name}; sleep 5; Start-Service #{new_resource.name}")
+      # We would much prefer to use the above because that wouldn't  require another reboot, but in some cases the session dosen't get terminated from  Mu. Throwing Chef::Application.fatal seems to work more reliably
+      cmd = powershell_out("c:/bin/cygwin/bin/bash --login -c 'chown -R #{new_resource.username} /var/empty && chown #{new_resource.username} /var/log/sshd.log /etc/ssh*\'")
+#      execute "kill ssh for reboot" do
+#        command "Taskkill /im sshd.exe /f /t"
+#        returns [0, 128, 1115]
+#        action :nothing
+#      end
+      reboot "Setting Cygwin ssh user to #{new_resource.username}" do
+        action :request_reboot
+        reason "Setting Cygwin ssh user to #{new_resource.username}"
+#        notifies :run, "execute[kill ssh for reboot]", :immediately
+      end
+#      kill_ssh
+    end
+  end
+end