cloud-mu 1.9.0.pre.beta

data/extras/image-generators/aws/windows.yaml

@@ -0,0 +1,18 @@
+---
+  appname: mu
+  servers: 
+    - 
+      name: win2k12
+      platform: windows
+      size: t2.large
+      scrub_groomer: true
+      run_list:
+      - recipe[mu-tools::updates]
+      - recipe[mu-utility::cleanup_image_helper]
+      application_attributes:
+        os_updates_using_chef: true
+      create_image:
+        image_then_destroy: true
+        public: true
+        copy_to_regions:
+        - "#ALL"

data/extras/image-generators/gcp/centos6.yaml

@@ -0,0 +1,17 @@
+---
+  appname: mu
+  servers: 
+  - name: centos6
+    cloud: Google
+    platform: centos6
+    ssh_user: centos
+    size: g1-small
+    associate_public_ip: true
+    run_list:
+    - recipe[mu-tools::cloudinit]
+    - recipe[mu-tools::apply_security]
+    - recipe[mu-tools::updates]
+    - recipe[mu-tools::split_var_partitions]
+    create_image:
+      image_then_destroy: true
+      public: true

data/extras/lambda_waf_domain_blacklist.py

@@ -0,0 +1,103 @@
+from __future__ import print_function
+
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# This Lambda function reads Elastic Load Balancer and Application Load
+# Balancer logs from an S3 bucket, searches for requests whose source IPs
+# resolve to domains in our blacklist, and adds matching IPs to a WAF IP
+# blacklist named DomListFromLBLogs.
+#
+# When using this function, you must (in Lambda) define a trigger or triggers
+# on the ObjectCreated event in your S3 bucket(s) where Load Balancer logs are
+# written.
+#
+# You must also grant the Lambda function an IAM role or roles that grant it
+# GetObject permission to your S3 bucket(s), as well as at least the
+# UpdateIPSet permission on the appropriate IPSet in WAF. NB: Our production
+# implementation has additional privileges for other uses, so the minimal
+# permission set required may be broader than listed here.
+
+import json
+import urllib
+import boto3
+import socket
+import re
+import gzip
+
+s3 = boto3.client('s3')
+waf = boto3.client('waf-regional')
+
+def lookup(addr):
+    try:
+        return socket.gethostbyaddr(addr)[0]
+    except socket.herror:
+        return None
+
+# Is a persistent cache across requests possible? That'd be a nice new feature.
+# Might have to use ElastiCache if we needed something like that.
+results = {}
+current_ips = []
+
+blacklist = [
+    'adomainidontlike.com',
+    'rudeintrusion.ru'
+]
+
+def addIPToWAFBlacklist(ip):
+    cidr = ip+"/32"
+    for ipset in waf.list_ip_sets()['IPSets']:
+        if ipset['Name'] == "DomListFromLBLogs":
+            if len(current_ips) == 0:
+                for desc in waf.get_ip_set(IPSetId=ipset['IPSetId'])['IPSet']['IPSetDescriptors']:
+                    current_ips.append(desc['Value'])
+            if cidr not in current_ips:
+                chtok = waf.get_change_token()['ChangeToken']
+                waf.update_ip_set(IPSetId=ipset['IPSetId'], ChangeToken=chtok, Updates=[{'Action': 'INSERT','IPSetDescriptor': {'Type': 'IPV4', 'Value':cidr}}])
+
+
+def lambda_handler(event, context):
+    # Get the object from the event and show its content type
+    bucket = event['Records'][0]['s3']['bucket']['name']
+    key = urllib.unquote_plus(event['Records'][0]['s3']['object']['key'].encode('utf8'))
+    text = ""
+    if re.search('\.gz$', key):
+        path = key
+        while re.search('\/', path):
+            path = re.sub('^.*?/', "", path)
+        path = '/tmp/' + path
+        with open(path, 'wb') as data:
+            s3.download_fileobj(bucket, key, data)
+        with gzip.open(path, 'rb') as f:
+            text = f.read()
+    else:
+        response = s3.get_object(Bucket=bucket, Key=key)
+        text = response['Body'].read()
+    for line in text.splitlines():
+        fields = line.split()
+        ipfield = fields[2]
+        # new LBs have a slightly different format
+        if(not re.search(':', ipfield)):
+            ipfield = fields[3]
+        ip, port = ipfield.split(':')
+        if ip not in results:
+            results[ip] = lookup(ip)
+            if results[ip] != None and results[ip] != ".":
+                for dom in blacklist:
+                    regex = re.compile(r'^.*?\.%s$' % re.escape(dom), re.IGNORECASE)
+                    if re.search(regex, results[ip]) or results[ip] == dom:
+                        print("Blocking IP "+ip+". Request from '"+results[ip]+"' matched blacklist entry. LB log was: "+key)
+                        addIPToWAFBlacklist(ip)
+    return True

data/extras/platform_berksfile_base

@@ -0,0 +1,50 @@
+# --- AUTO-INCLUDE STANDARD MU COOKBOOKS --- #
+# --- DO NOT DELETE THESE COMMENTS UNLESS YOU HAVE A PLAN --- #
+addtl_cookbooks = {}
+if ENV.include? "MU_COOKBOOK_ROOT"
+  cookbookPath = "#{ENV['MU_COOKBOOK_ROOT']}/cookbooks"
+  siteCookbookPath = "#{ENV['MU_COOKBOOK_ROOT']}/site_cookbooks"
+  if ENV.include? "MU_DEPRESOLVE"
+    ["cookbooks", "site_cookbooks"].each { |dir|
+      next if !Dir.exists?(ENV['MU_COOKBOOK_ROOT']+"/"+dir)
+      Dir.foreach(ENV['MU_COOKBOOK_ROOT']+"/"+dir).each { |cb|
+        next if cb == "." or cb == ".."
+        path = ENV['MU_COOKBOOK_ROOT']+"/"+dir+"/"+cb
+        next if !File.exists?(path+"/metadata.rb") and !File.exists?(path+"/metadata.json")
+        addtl_cookbooks[cb] = { "path" => path }
+      }
+    }
+    # now to smoke some rocks
+    if File.exists?("#{ENV['MU_COOKBOOK_ROOT']}/Berksfile.lock")
+      in_deps = false
+      File.open("#{ENV['MU_COOKBOOK_ROOT']}/Berksfile.lock").each { |line|
+        if in_deps
+          if line.match(/^  ([^\s]+)\s+\((.*?)\)/)
+            cb = Regexp.last_match[1]
+            vers = Regexp.last_match[2]
+            if vers
+              addtl_cookbooks[cb] ||= {}
+              addtl_cookbooks[cb]["version"] = vers
+            end
+          elsif line.match(/^\s*$/)
+            break
+          end
+        end
+        in_deps = true if line.match(/^DEPENDENCIES$/)
+      }
+    end
+  end
+end
+
+
+source "https://supermarket.getchef.com"
+
+addtl_cookbooks.each_pair { |cb, cfg|
+  if cfg.has_key?("version") and cfg.has_key?("path")
+    cookbook cb, cfg["version"], path: cfg["path"]
+  elsif cfg.has_key?("version")
+    cookbook cb, cfg["version"]
+  else
+    cookbook cb, path: cfg["path"]
+  end
+}

data/extras/ruby_rpm/build.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+rpm -q rpm-build || yum -y install rpm-build
+
+base="/opt/mu/lib/extras/ruby_rpm"
+
+for d in BUILD BUILDROOT RPMS SOURCES SPECS SRPMS;do
+  mkdir -p ~/rpmbuild/$d
+done
+cd ~/rpmbuild
+
+echo "Temporarily deleting /usr/local/ruby-current so rpmbuild can create it"
+oldlink="`readlink /usr/local/ruby-current`"
+rm -f /usr/local/ruby-current
+/usr/bin/rpmbuild -ba $base/muby.spec
+find ~/rpmbuild/ -type f -name 'muby*' -exec ls -la {} \;
+ln -s "$oldlink" /usr/local/ruby-current

data/extras/ruby_rpm/muby.spec

@@ -0,0 +1,44 @@
+Summary: Ruby for Mu(by)
+BuildArch: x86_64
+Name: muby
+Version: 2.5.3
+Release: 1%{dist}
+Group: Development/Languages
+License: Ruby License/GPL - see COPYING
+URL: http://www.ruby-lang.org/
+Prefix: /opt/rubies
+Source: https://cache.ruby-lang.org/pub/ruby/2.5/ruby-%{version}.tar.gz
+
+%description
+I was drunk when I wrote this spec file
+    
+%prep
+rm -rf $RPM_BUILD_DIR/ruby-%{version}
+rm -rf %{prefix}
+test -f $RPM_SOURCE_DIR/ruby-%{version}.tar.gz || ( cd $RPM_SOURCE_DIR && curl -O https://cache.ruby-lang.org/pub/ruby/2.5/ruby-%{version}.tar.gz )
+tar -xzvf $RPM_SOURCE_DIR/ruby-%{version}.tar.gz
+mkdir -p $RPM_BUILD_ROOT%{prefix}
+ln -s %{prefix}/ruby-%{version} $RPM_BUILD_ROOT%{prefix}/ruby-%{version}
+    
+%build
+cd $RPM_BUILD_DIR/ruby-%{version}
+./configure --prefix=%{prefix}/ruby-%{version}  --enable-load-relative --enable-shared
+make
+
+%install
+cd $RPM_BUILD_DIR/ruby-%{version}
+make install
+mkdir -p %{prefix}
+%{prefix}/ruby-%{version}/bin/gem install bundler
+mkdir -p $RPM_BUILD_ROOT%{prefix}
+mv %{prefix}/ruby-%{version} $RPM_BUILD_ROOT%{prefix}/
+mkdir -p $RPM_BUILD_ROOT/usr/local/
+ln -s %{prefix}/ruby-%{version} $RPM_BUILD_ROOT/usr/local/ruby-current
+
+%clean
+cd $RPM_BUILD_DIR/ruby-%{version}
+make clean
+    
+%files
+%{prefix}/ruby-%{version}/*
+/usr/local/ruby-current

data/extras/vault_tools/README.md

@@ -0,0 +1,6 @@
+These tools validate vaults, recreate them and  migrate vaults from one Mu server to another. The vaults are stored unencrypted, with each item in it's own JSON file. This will create a directory structure that looks like this:
+-vault --item1.json --item2.json -vault2 --item1.json ...
+
+* On original server, export vaults to a folder structure using export_vaults.sh
+* Transfer the ‘vaults’ directory to another Mu server by any convenient means.  Scripts will look for vaults directory in the current home directory, e.g. ~
+* Recreate the vaults with recreate_vaults.sh

data/extras/vault_tools/export_vaults.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Exports existing vaults to a vaults directory for use by test_vaults and recreate_vaults
+mkdir -p ~/vaults ; for i in `knife data bag list | grep -v -- -`;do echo $i; mkdir -p vaults/$i ; for j in `knife data bag show $i | grep -v '_keys$'`;do echo "   $j"; knife vault show $i $j -F json > vaults/$i/$j.json;done;done ; find vaults -empty -delete

data/extras/vault_tools/recreate_vaults.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# This is a destructive operation!  Recreates all vaults listed in the ~/vaults directory, which must exist.
+cd ~/vaults
+for i in `ls`;do knife data bag delete -y $i ; for j in `ls $i`;do item="`echo $j | cut -d. -f1`"; echo "$i $item" ; knife vault create $i $item -J $i/$j;done;done
+

data/extras/vault_tools/test_vaults.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Tests access to vaults listed in ~/vaults directory, which must exist
+cd ~/vaults
+for i in `ls`;do for j in `ls $i`;do item="`echo $j | cut -d. -f1`"; knife vault show $i $item ; done; done;
+

data/install/README.md

@@ -0,0 +1,8 @@
+# Cloudamatic Mu Master Installation
+There are two paths to creating a Mu Master.  
+
+- **Typical Installation**: The simplest and recommended path is to use our CloudFormation script to configure an appropriate Virtual Private Cloud and master with all features enabled, including both a command line and Jenkins GUI user interface.
+- **Custom Installation:** If you prefer, you can also create your own VPC and manually provision a Mu Master.  This gives you more control over the shape of the master VPC and individual settings
+
+For detailed instructions on both installation techniques see [our Wiki Installation page](https://github.com/cloudamatic/mu/wiki/Install-Home)
+For mu master usage instructions see [our Wiki usage page](https://github.com/cloudamatic/mu/wiki/Usage)