cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-tools/templates/windows/sshd_config.erb

@@ -0,0 +1,136 @@
+#	$OpenBSD: sshd_config,v 1.99 2016/07/11 03:19:44 tedu Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/bin:/usr/sbin:/sbin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# The default requires explicit activation of protocol 1
+#Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh_host_rsa_key
+#HostKey /etc/ssh_host_dsa_key
+#HostKey /etc/ssh_host_ecdsa_key
+#HostKey /etc/ssh_host_ed25519_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Ciphers and keying
+#RekeyLimit default none
+
+Ciphers aes256-ctr
+KexAlgorithms diffie-hellman-group-exchange-sha256
+MACs hmac-sha2-256
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+StrictModes no
+#MaxAuthTries 6
+#MaxSessions 10
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/sbin/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server

data/cookbooks/mu-utility/CHANGELOG.md

@@ -0,0 +1,12 @@
+# CHANGELOG for chef-client
+
+This file is used to list changes made in each version of chef-client.
+
+## 0.1.0:
+
+* Initial release of chef-client
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

data/cookbooks/mu-utility/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/mu-utility/README.md

@@ -0,0 +1,6 @@
+chef-client Cookbook
+====================
+
+Utilities for Use in Mu
+
+TODO: Improve Readme.md

data/cookbooks/mu-utility/attributes/default.rb

@@ -0,0 +1 @@
+default['auto_generate_windows_password'] = true

data/cookbooks/mu-utility/libraries/matchers.rb

@@ -0,0 +1,21 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if defined?(ChefSpec)
+
+  def create_utility_active_directory_domain(resource_name)
+    ChefSpec::Matchers::ResourceMatcher.new(:utility_active_directory_domain, :create, resource_name)
+  end
+
+end

data/cookbooks/mu-utility/metadata.rb

@@ -0,0 +1,16 @@
+name 'mu-utility'
+maintainer 'Mu'
+maintainer_email 'mu-developers@googlegroups.com'
+license 'BSD-3-Clause'
+description 'Utility recipes'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 12.1' if respond_to?(:chef_version)
+version '0.6.0'
+
+%w( amazon centos redhat windows ).each do |os|
+	supports os
+end
+
+depends 'windows', '~> 5.1.1'

data/cookbooks/mu-utility/recipes/apt.rb

@@ -0,0 +1,23 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if platform_family?("debian")
+  bash "Straighten out apt" do
+    user "root"
+    code <<-EOH
+		apt-get -y clean
+		apt-get -y update
+    EOH
+  end
+end

data/cookbooks/mu-utility/recipes/cleanup_image_helper.rb

@@ -0,0 +1,118 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+case node['platform']
+  when "windows"
+    execute "del c:\\Mu-Bootstrap*"
+    %w{c:\\mu-installer-ran-update c:\\mu-configure-initial-ssh-user}.each { |file|
+      file file do
+        action :delete
+      end
+    }
+    file "C:\\Program Files\\Amazon\\Ec2ConfigService\\Scripts\\UserScript.ps1" do
+        action :delete
+    end
+    powershell_script "clean up WinRM" do
+      code <<-EOH
+        winrm delete winrm/config/Listener?Address=*+Transport=HTTP
+        winrm delete winrm/config/Listener?Address=*+Transport=HTTPS
+        Remove-Item -Path WSMan:/localhost/ClientCertificate/* -Force -Recurse
+        Remove-Item -Path Cert:/LocalMachine/My/* -Force -Recurse
+# XXX Would need a thumbprint to get this, so there's a whole find-by-name op
+#        Remove-Item -Path Cert:/LocalMachine/Root/Mu_CA.pem -Force -Recurse
+        Remove-Item -Path Cert:/LocalMachine/TrustedPeople/* -Force -Recurse
+      EOH
+    end
+
+    # admin_username = powershell_out("(Get-WmiObject -Query 'Select * from Win32_UserAccount Where (LocalAccount=True and SID like \"%-500\")').name").stdout.strip
+    # XXX can't do this here, Mu still needs to get back in
+    #	["Administrator", admin_username].each { |user|
+    #		file "c:\\bin\\cygwin\\home\\#{user}\\.ssh\\authorized_keys" do
+    #			action :delete
+    #		end
+    #	}
+
+    %w{config.xml BundleConfig.xml}.each { |file|
+      template "C:\\Program Files\\Amazon\\Ec2ConfigService\\Settings\\#{file}" do
+        source "#{file}.erb"
+        variables(
+            :auto_gen_password => node[:auto_generate_windows_password]
+        )
+      end
+    }
+
+    execute "sc config Ec2Config obj= \".\\LocalSystem\" password= \"\""
+    execute "sc config sshd obj= \".\\LocalSystem\" password= \"\""
+
+    %w{run-chef-client run-userdata}.each { |task|
+      windows_task task do
+        action :delete
+      end
+    }
+
+    user "ec2config" do
+      action :remove
+    end
+
+# XXX this breaks Chef mid-run
+#	if Dir.exists?("C:\\chef")
+#		%w{client.rb first-boot.json client.pem validation.pem}.each { |file|
+#			if File.exists?("C:\\chef\\#{file}")
+#				file "C:\\Users\\Administrator\\AppData\\Local\\Temp\\#{file}" do
+#					content IO.read("C:\\chef\\#{file}")
+#				end
+#
+#				file "C:\\chef\\#{file}" do
+#					action :delete
+#				end
+#			end
+#		}
+#	end
+  when platform_family?('rhel')
+    if node['platform_version'].to_i == 7
+      execute "sed -i '/^preserve_hostname/d' /etc/cloud/cloud.cfg" do
+        only_if "grep 'preserve_hostname: true' /etc/cloud/cloud.cfg"
+      end
+    end
+
+    execute "sed -i '/user-data.*$/d' /etc/rc.d/rc.local" do
+      only_if "grep '/bin/sh /var/lib/cloud/' /etc/rc.d/rc.local"
+    end
+
+    file "/.mu-installer-ran-updates" do
+      action :delete
+    end
+
+    file "/etc/yum.repos.d/mu-platform.repo" do
+      action :delete
+    end
+
+    directory "/etc/chef" do
+      action :delete
+      recursive true
+    end
+  when "ubuntu"
+    file "/.mu-installer-ran-updates" do
+      action :delete
+    end
+
+    execute "sed -i '_^/bin/sh /var/lib/cloud/instance/user-data.txt_d' /etc/rc.local" do
+      only_if "grep '/bin/sh /var/lib/cloud/instance/user-data.txt' /etc/rc.local"
+    end
+
+    directory "/etc/chef" do
+      action :delete
+      recursive true
+    end
+end

data/cookbooks/mu-utility/recipes/iptables.rb

@@ -0,0 +1,26 @@
+# Copyright:: Copyright (c) 2015 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+case node['platform']
+  when platform_family?('rhel')
+    if node['platform_version'].to_i == 7
+      package "firewalld" do
+        action :remove
+      end
+
+      package "iptables-services"
+    end
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end

data/cookbooks/mu-utility/recipes/luks.rb

@@ -0,0 +1,18 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#Installs cryptsetup and luks for encrypted volumes
+package "luks" do
+  package_name "cryptsetup-luks" # see attributes section below
+  action :install
+end

data/cookbooks/mu-utility/recipes/nat.rb

@@ -0,0 +1,104 @@
+#
+# Cookbook Name:: mu-utility
+# Recipe:: nat
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if platform_family?("windows")
+  Chef::Log.info "I don't know how to make Windows be a NAT host"
+else
+  $ip_block = "10.0.0.0/16"
+  if !node['application_attributes']['nat']['private_net'].empty?
+    $ip_block = node['application_attributes']['nat']['private_net']
+  end rescue NoMethodError
+
+  if platform_family?("rhel")
+    $ssh_service_name = "sshd"
+
+    if node['platform_version'].to_i == 7
+      # Iptables or FirewallD are not installed by default on CentOS7. Using iptables for backwards compatibility.
+      # Looks like only the AWS marketplace image doesn't have FirewallD installed by default. Clean installation of CentOS7 minimal does, so removing.
+      package "firewalld" do
+        action :remove
+      end
+
+      package "iptables-services"
+    end
+
+    node.default['firewall']['iptables']['defaults']['ruleset'] = {
+      '*filter' => 1,
+      ':INPUT DROP' => 2,
+      ':FORWARD ACCEPT' => 3, # we'll add a DROP after the other stuff
+      ':OUTPUT ACCEPT_FILTER' => 4,
+      'COMMIT_FILTER' => 100,
+      '*nat' => 101,
+      ':OUTPUT ACCEPT_NAT' => 104,
+      'COMMIT_NAT' => 200
+    }
+
+    firewall_rule "NAT postrouting" do
+      raw "-A POSTROUTING -o eth0 -s #{$ip_block} -j MASQUERADE"
+      position 150
+    end
+    firewall_rule "NAT stateful connections" do
+      raw "-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT"
+      position 97
+    end
+    firewall_rule "NAT forwarding" do
+      raw "-A FORWARD -s #{$ip_block} -j ACCEPT"
+      position 98
+    end
+    firewall_rule "NAT forwarding drop other traffic" do
+      raw "-A FORWARD -j DROP"
+      position 99
+    end
+    bash "make sure ip forwarding is enabled for NAT traffic" do
+      code <<-EOH
+        sysctl -w net.ipv4.ip_forward=1
+        sysctl -w net.ipv4.conf.eth0.send_redirects=0
+      EOH
+    end
+  elsif platform_family?("debian")
+    $ssh_service_name = "ssh"
+# XXX port this to firewall_rule
+    bash "enable NAT with ufw" do
+      not_if "grep '^*nat' /etc/ufw/before.rules"
+      code <<-EOH
+				sed -i 's/DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
+				echo "net.ipv4.ip_forward=1" >> /etc/ufw/sysctl.conf
+				echo '*nat' >> /etc/ufw/before.rules
+				echo ':POSTROUTING ACCEPT [0:0]' >> /etc/ufw/before.rules
+				echo ':POSTROUTING ACCEPT [0:0]' >> /etc/ufw/before.rules
+				echo '-A POSTROUTING -s #{$ip_block} -o eth0 -j MASQUERADE' >> /etc/ufw/before.rules
+				echo 'COMMIT' >> /etc/ufw/before.rules
+      EOH
+    end
+  end
+
+  execute "restart sshd" do
+    command "/sbin/service #{$ssh_service_name} restart"
+    action :nothing
+  end
+  bash "enable SSH tunneling" do
+    not_if "grep '^PermitTunnel yes' /etc/ssh/sshd_config"
+    code <<-EOH
+			echo "" >> /etc/ssh/sshd_config
+			echo "PermitTunnel yes" >> /etc/ssh/sshd_config
+			echo "" >> /etc/ssh/sshd_config
+			echo "AllowTcpForwarding yes" >> /etc/ssh/sshd_config
+    EOH
+    notifies :run, "execute[restart sshd]", :immediately
+  end
+end

data/cookbooks/mu-utility/recipes/php.rb

@@ -0,0 +1,33 @@
+#
+# Cookbook Name:: mu-utility
+# Recipe:: PHP
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+case node['platform']
+
+  when "centos"
+
+
+  when "ubuntu"
+
+    ["php5", "php5-mysql", "libapache2-mod-php5", "php5-mysql", "php5-curl", "php5-gd", "php5-intl", "php-pear", "php5-imagick", "php5-imap", "php5-mcrypt", "php5-memcache", "php5-ming", "php5-ps", "php5-pspell", "php5-recode", "php5-snmp", "php5-sqlite", "php5-tidy", "php5-xmlrpc", "php5-xsl", "php5-fpm"].each { |pkg|
+      package pkg
+    }
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end
+
+

data/cookbooks/mu-utility/recipes/rdp_gateway.rb

@@ -0,0 +1,83 @@
+#
+# Cookbook Name:: mu-utility
+# Recipe:: rdp_gateway
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if !platform_family?("windows")
+  Chef::Log.info "I don't know how to enable RDP gateway behavior on a non-Windows host"
+else
+
+  powershell_script "Install Remote Desktop Gateway services" do
+    guard_interpreter :powershell_script
+    not_if "Import-Module RemoteDesktopServices"
+    code <<-EOH
+			Add-WindowsFeature -Name RDS-Gateway -IncludeAllSubFeature
+    EOH
+  end
+
+  powershell_script "Configure Remote Desktop Gateway services" do
+    guard_interpreter :powershell_script
+    code <<-EOH
+			Import-Module RemoteDesktopServices
+			cd RDS:\\GatewayServer\\CAP
+			New-Item -Name StandardAccess -UserGroups 'Remote Desktop Users@BUILTIN' -AuthMethod 1
+			New-Item -Name AdminAccess -UserGroups 'Administrators@BUILTIN' -AuthMethod 1
+			cd RDS:\\GatewayServer\\RAP
+			New-Item -Name StandardAccess -UserGroups 'Remote Desktop Users@BUILTIN' -ComputerGroupType 2
+			New-Item -Name AdminAccess -UserGroups 'Administrators@BUILTIN' -ComputerGroupType 2
+
+			# This bleeding horror lifted from: http://blogs.technet.com/b/vishalagarwal/archive/2009/08/22/generating-a-certificate-self-signed-using-powershell-and-certenroll-interfaces.aspx
+			$name = new-object -com "X509Enrollment.CX500DistinguishedName.1"
+			$name.Encode("CN=RDS", 0)
+
+			$key = new-object -com "X509Enrollment.CX509PrivateKey.1"
+			$key.ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
+			$key.KeySpec = 1
+			$key.Length = 1024
+			$key.SecurityDescriptor = "D:PAI(A;;0xd01f01ff;;;SY)(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)"
+			$key.MachineContext = 1
+			$key.Create()
+
+			$serverauthoid = new-object -com "X509Enrollment.CObjectId.1"
+			$serverauthoid.InitializeFromValue("1.3.6.1.5.5.7.3.1")
+			$ekuoids = new-object -com "X509Enrollment.CObjectIds.1"
+			$ekuoids.add($serverauthoid)
+			$ekuext = new-object -com "X509Enrollment.CX509ExtensionEnhancedKeyUsage.1"
+			$ekuext.InitializeEncode($ekuoids)
+
+			$cert = new-object -com "X509Enrollment.CX509CertificateRequestCertificate.1"
+			$cert.InitializeFromPrivateKey(2, $key, "")
+			$cert.Subject = $name
+			$cert.Issuer = $cert.Subject
+			$cert.NotBefore = get-date
+			$cert.NotAfter = $cert.NotBefore.AddDays(3650)
+			$cert.X509Extensions.Add($ekuext)
+			$cert.Encode()
+
+			$enrollment = new-object -com "X509Enrollment.CX509Enrollment.1"
+			$enrollment.InitializeFromRequest($cert)
+			$certdata = $enrollment.CreateRequest(0)
+			$enrollment.InstallResponse(2, $certdata, 0, "")
+
+			# Thumbprint bit: http://www.frontiertown.co.uk/jclouds/activate-winrm.ps1
+			$thumbprints = Get-Childitem -path cert:\\LocalMachine\\My | Where-Object { $_.Subject -eq "CN=RDS" } | Select-Object -Property Thumbprint
+			$thumbprint = @($thumbprints)[0].Thumbprint
+			Set-Item -Path RDS:\\GatewayServer\\SSLCertificate\\Thumbprint -Value $thumbprint
+
+			Restart-Service TSGateway
+    EOH
+  end
+end