cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-tools/templates/centos-7/sshd_config.erb

@@ -0,0 +1,215 @@
+#       $OpenBSD: sshd_config,v 1.93 2014/01/10 05:59:19 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/bin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+# If you want to change the port on a SELinux system, you have to tell
+# SELinux about this change.
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
+#
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# The default requires explicit activation of protocol 1
+#Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+SyslogFacility AUTHPRIV
+LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin yes
+#StrictModes yes
+MaxAuthTries 4
+#MaxSessions 10
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile .ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+PermitEmptyPasswords no
+<% begin
+	if node['application_attributes']['sshd_allow_password_auth'] %>
+PasswordAuthentication yes
+<%
+  else %>
+    PasswordAuthentication no
+<%  end
+rescue NoMethodError %>
+PasswordAuthentication no
+<% end %>
+
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+#KerberosUseKuserok yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+GSSAPIAuthentication yes
+GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+#GSSAPIEnablek5users no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
+# problems.
+UsePAM yes
+
+# Accept locale-related environment variables
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+AcceptEnv XMODIFIERS
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+UsePrivilegeSeparation sandbox          # Default for new installations.
+#PermitUserEnvironment no
+#Compression delayed
+ClientAliveInterval 300
+ClientAliveCountMax 0
+#ShowPatchLevel no
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+Banner /etc/issue.net
+
+# override default of no subsystems
+Subsystem sftp  /usr/libexec/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       PermitTTY no
+#       ForceCommand cvs server
+PermitRootLogin without-password
+UseDNS no
+
+Ciphers aes128-ctr,aes192-ctr,aes256-ctr
+
+# If we've set AllowGroups, use that instead of restricting to centos
+<%
+begin
+	if !node['application_attributes']['sshd_allow_groups'].empty? %>
+AllowGroups <%= node['application_attributes']['sshd_allow_groups'] %> root
+<%
+	else
+	%>
+AllowUsers centos root
+<%
+	end
+rescue NoMethodError %>
+AllowUsers centos root
+<%
+end
+%>
+
+# Support SVN-only servers, while we're at it
+<%
+begin
+	if node['application_attributes']['svn_only_group'] %>
+Match Group <%= node['application_attributes']['svn_only_group'] %>
+	ForceCommand /usr/bin/svnserve -t
+<%
+	end
+rescue NoMethodError
+end
+%>
+
+# Support SFTP-only servers, while we're at it
+<%
+begin
+	if node['application_attributes']['sftp_only_group'] %>
+Match Group <%= node['application_attributes']['sftp_only_group'] %>
+	ForceCommand internal-sftp
+<%  begin
+			if node['application_attributes']['sftp_chroot'] %>
+	ChrootDirectory <%= node['application_attributes']['sftp_chroot'] %>
+<%
+			end
+		rescue NoMethodError %>
+	ChrootDirectory /home/
+<%
+		end
+	end
+rescue NoMethodError
+end
+%>

data/cookbooks/mu-tools/templates/default/0-mu-log-client.conf.erb

@@ -0,0 +1,13 @@
+$LocalHostName <%= node.name %>
+
+<% if !@syslog_server.nil? %>
+# certificate files - just CA for a client
+$DefaultNetstreamDriverCAFile <%= @ssl_ca_path %>
+
+
+# set up the action
+$DefaultNetstreamDriver gtls # use gtls netstream driver
+$ActionSendStreamDriverMode 1 # require TLS for the connection
+$ActionSendStreamDriverAuthMode anon # server is NOT authenticated
+*.* @@(o)<%= @syslog_server %>:10514 # send (all) messages
+<% end rescue NoMethodError %>

data/cookbooks/mu-tools/templates/default/conf.maldet.erb

@@ -0,0 +1,137 @@
+#!/bin/bash
+#
+##
+# Linux Malware Detect v1.4.2
+#             (C) 2002-2013, R-fx Networks <proj@r-fx.org>
+#             (C) 2013, Ryan MacDonald <ryan@r-fx.org>
+# inotifywait (C) 2007, Rohan McGovern  <rohan@mcgovern.id.au>
+# This program may be freely redistributed under the terms of the GNU GPL v2
+##
+#
+
+##
+# [ EMAIL ALERTS ]
+##
+# The default email alert toggle
+# [0 = disabled, 1 = enabled]
+email_alert=1
+
+# The subject line for email alerts
+email_subj="maldet alert from $(hostname)"
+
+# The destination addresses for email alerts
+# [ values are comma (,) spaced ]
+<% if !node.nil? and !node['admins'].nil? %>
+email_addr="<%= node['admins'].join(', ') %>"
+<% else %>
+email_addr="root@localhost"
+<% end rescue NoMethodError %>
+
+# Ignore e-mail alerts for reports in which all hits have been cleaned.
+# This is ideal on very busy servers where cleaned hits can drown out
+# other more actionable reports.
+email_ignore_clean=0
+
+##
+# [ QUARANTINE OPTIONS ]
+##
+# The default quarantine action for malware hits
+# [0 = alert only, 1 = move to quarantine & alert]
+quar_hits=0
+
+# Try to clean string based malware injections
+# [NOTE: quar_hits=1 required]
+# [0 = disabled, 1 = clean]
+quar_clean=1
+
+# The default suspend action for users wih hits
+# Cpanel suspend or set shell /bin/false on non-Cpanel
+# [NOTE: quar_hits=1 required]
+# [0 = disabled, 1 = suspend account]
+quar_susp=0
+# minimum userid that can be suspended
+quar_susp_minuid=500
+
+##
+# [ SCAN OPTIONS ]
+##
+# The maximum directory depth that the scanner will search
+# [ changing this may have an impact on scan performance ]
+maxdepth=15
+
+# The minimum in bytes for a file to be included in a scan
+# [ changing this may have an impact on scan performance ]
+minfilesize=32
+
+# The maximum file size for a file to be included in scan
+# search results; use man find for accepted values
+# [ changing this may have an impact on scan performance ]
+maxfilesize="768k"
+
+# The maximum byte depth that the scanner will search into
+# a files contents; default rules expect a 1024*60 depth
+# [ changing this may have an impact on scan performance ]
+hexdepth=61440
+
+# Use named pipe (FIFO) for passing file contents hex data
+# instead of stdin default; improved performance and greater
+# scanning depth
+# [ 0 = disabled, 1 = enabled; enabled by default ] 
+hex_fifo_scan=1
+
+# The maximum byte depth that the scanner will search into
+# a files contents; default rules expect a 1024*60 depth
+# [ changing this may have an impact on scan performance ]
+hex_fifo_depth=524288
+
+# Attempt to detect the presence of ClamAV clamscan binary
+# and use as default scanner engine; up to four times faster
+# scan performance and superior hex analysis. This option
+# only uses ClamAV as the scanner engine, LMD signatures
+# are still the basis for detecting threats.
+# [ 0 = disabled, 1 = enabled; enabled by default ] 
+clamav_scan=1
+
+# Allow non-root users to perform malware scans. This must be
+# enabled when using mod_security2 upload scanning or if you
+# want to allow users to perform scans. When enabled, this will
+# populate the /usr/local/maldetect/pub/ path with user owned
+# quarantine, session and temporary paths to faciliate scans.
+# These paths are populated through cron every 10min with the
+# /etc/cron.d/maldet_pub cronjob.
+public_scan=0
+
+##
+# [ STATISTICAL ANALYSIS ]
+##
+# The string length test is used to identify threats based on the
+# length of the longest uninterrupted string within a file. This is
+# useful as obfuscated code is often stored using encoding methods
+# that produce very long strings without spaces (e.g: base64)
+# [ string length in characters, default = 150000 ]
+string_length_scan="0"		# [ 0 = disabled, 1 = enabled ]
+string_length="150000"		# [ max string length ]
+
+##
+# [ MONITORING OPTIONS ]
+##
+# The base number of files that can be watched under a path
+# [ maximum file watches = inotify_base_watches*users ]
+inotify_base_watches=15360
+
+# The sleep time in seconds between monitor runs to scan files
+# that have been created/modified/moved
+inotify_stime=30
+
+# The minimum userid that will be added to path monitoring when
+# the USERS option is specified
+inotify_minuid=500
+
+# This is the html/web root for users relative to homedir, when
+# this option is set, users will only have the webdir monitored
+# [ clear option to default monitor entire user homedir ]
+inotify_webdir=public_html
+
+# The priority that monitoring process will run as
+# [ -19 = high prio , 19 = low prio, default = 10 ]
+inotify_nice=10

data/cookbooks/mu-tools/templates/default/etc_hosts.erb

@@ -0,0 +1,30 @@
+::1             localhost6.localdomain6 localhost6
+<%= @ipaddress %> <%= @hostname %>
+127.0.0.1 localhost
+<% if !@nodes.nil? and !@nodes.empty?
+  @nodes.each{ |n|
+# doing only private IPs although that can be problematic 
+# if the same deploy has cross VPC or cross region resources
+  if n.name != @hostname %>
+<%= n.ipaddress %> <%= n.name %>
+<%
+  end
+  }
+else
+  if !node['deployment'].nil? and !node['deployment']['servers'].nil?
+    node['deployment']['servers'].each_pair { |nodetype, sibling_struct|
+      next if !sibling_struct.is_a?(Hash)
+      sibling = sibling_struct.values.each { |sibling|
+        next if !sibling.is_a?(Hash)
+        next if sibling['nodename'] == @hostname
+        if !sibling['public_ip_address'].nil? %>
+<%= sibling['public_ip_address'] %> <%= sibling['nodename'] %>
+  <%		else %>
+<%= sibling['private_ip_address'] %> <%= sibling['nodename'] %>
+  <%
+        end
+      }
+    }
+  end
+end
+%>

data/cookbooks/mu-tools/templates/default/etc_pamd_password-auth.erb

@@ -0,0 +1,14 @@
+#%PAM-1.0
+auth        required      pam_faillock.so preauth audit silent deny=<%= node['sec']['accnt_lckout'] %> unlock_time=<%= node['sec']['accnt_lckout_duration'] %>
+auth        include       password-auth-ac
+auth        [default=die] pam_faillock.so authfail audit deny=<%= node['sec']['accnt_lckout'] %> unlock_time=<%= node['sec']['accnt_lckout_duration'] %>
+auth        sufficient    pam_faillock.so authsucc audit deny=<%= node['sec']['accnt_lckout'] %> unlock_time=<%= node['sec']['accnt_lckout_duration'] %>
+
+account     required      pam_faillock.so
+account     include       password-auth-ac
+
+
+password    requisite     pam_cracklib.so try_first_pass retry=<%= node['sec']['pwd']['retry'] %> minlen=<%= node['sec']['pwd']['min_length'] %> dcredit=<%= node['sec']['pwd']['numeric'] %> ucredit=<%= node['sec']['pwd']['uppercase'] %> ocredit=<%= node['sec']['pwd']['special'] %> lcredit=<%= node['sec']['pwd']['lowercase'] %>
+password    include       password-auth-ac
+
+session     include       password-auth-ac

data/cookbooks/mu-tools/templates/default/etc_pamd_system-auth.erb

@@ -0,0 +1,14 @@
+#%PAM-1.0
+auth        required      pam_faillock.so preauth audit silent deny=<%= node['sec']['accnt_lckout'] %> unlock_time=<%= node['sec']['accnt_lckout_duration'] %>
+account     include       system-auth-ac
+auth        [default=die] pam_faillock.so authfail audit deny=<%= node['sec']['accnt_lckout'] %> unlock_time=<%= node['sec']['accnt_lckout_duration'] %>
+auth        sufficient    pam_faillock.so authsucc audit deny=<%= node['sec']['accnt_lckout'] %> unlock_time=<%= node['sec']['accnt_lckout_duration'] %>
+
+account     required      pam_faillock.so
+account     include       system-auth-ac
+
+password    requisite     pam_cracklib.so try_first_pass retry=<%= node['sec']['pwd']['retry'] %> minlen=<%= node['sec']['pwd']['min_length'] %> dcredit=<%= node['sec']['pwd']['numeric'] %> ucredit=<%= node['sec']['pwd']['uppercase'] %> ocredit=<%= node['sec']['pwd']['special'] %> lcredit=<%= node['sec']['pwd']['lowercase'] %>
+account     include       system-auth-ac
+password    sufficient    pam_unix.so remember=<%= node['sec']['pwd']['remember'] %>
+
+session     include       system-auth-ac

data/cookbooks/mu-tools/templates/default/etc_sysconfig_network.erb

@@ -0,0 +1,12 @@
+NETWORKING_IPV6=no
+HOSTNAME=<%= @hostname %>
+NETWORKING=yes
+<% if @platform == "amazon" %>
+NOZEROCONF=yes
+IPV6INIT=no
+IPV6_ROUTER=no
+IPV6_AUTOCONF=no
+IPV6FORWARDING=no
+IPV6TO4INIT=no
+IPV6_CONTROL_RADVD=no
+<% end %>

data/cookbooks/mu-tools/templates/default/kubeconfig.erb

@@ -0,0 +1,29 @@
+apiVersion: v1
+clusters:
+- cluster:
+    server: <%= @endpoint %>
+    certificate-authority-data: <%= @cacert %>
+  name: kubernetes
+contexts:
+- context:
+    cluster: kubernetes
+    user: aws
+  name: aws
+current-context: aws
+kind: Config
+preferences: {}
+users:
+- name: aws
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1alpha1
+      command: aws-iam-authenticator
+      args:
+        - "token"
+        - "-i"
+        - "<%= @cluster %>"
+#        - "-r"
+#        - "<%= @rolearn %>"
+      # env:
+        # - name: AWS_PROFILE
+        #   value: "<aws-profile>"

data/cookbooks/mu-tools/templates/default/kubelet.service.erb

@@ -0,0 +1,35 @@
+[Unit]
+Description=Kubernetes Kubelet
+Documentation=https://github.com/kubernetes/kubernetes
+After=docker.service
+Requires=docker.service
+
+[Service]
+ExecStart=/usr/bin/kubelet \
+  --address=0.0.0.0 \
+  --authentication-token-webhook \
+  --authorization-mode=Webhook \
+  --allow-privileged=true \
+  --cloud-provider=aws \
+  --cluster-dns=<%= @dns %> \
+  --cluster-domain=cluster.local \
+  --cni-bin-dir=/opt/cni/bin \
+  --cni-conf-dir=/etc/cni/net.d \
+  --container-runtime=docker \
+  --max-pods=10 \
+  --node-ip=<%= @node_ip %> \
+  --network-plugin=cni \
+  --pod-infra-container-image=602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/pause-amd64:3.1 \
+  --cgroup-driver=cgroupfs \
+  --register-node=true \
+  --kubeconfig=/var/lib/kubelet/kubeconfig \
+  --feature-gates=RotateKubeletServerCertificate=true \
+  --anonymous-auth=false \
+  --resolv-conf=/etc/resolv.conf \
+  --client-ca-file=/etc/kubernetes/pki/ca.crt
+
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

data/cookbooks/mu-tools/templates/default/maldet_scanall.sh.erb

@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# A default scan wrapper for maldetect. Scans every local-looking filesystem.
+
+for fs in `cat /etc/mtab | egrep -v ' (ext2|ext3|ext4) ' | cut -d' ' -f2`;do
+	if ! grep "^$fs$" /usr/local/maldetect/ignore_paths;then
+		echo "$fs" >> /usr/local/maldetect/ignore_paths
+	fi
+done
+
+if ( ps auxww | grep -v grep | grep maldet );then
+	echo "Not running maldet scan, a previous scan was already running"
+	exit 1
+fi
+/usr/local/maldetect/maldet -a /