cloud-mu 1.9.0.pre.beta

data/bin/mu-self-update

@@ -0,0 +1,228 @@
+#!/bin/sh
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if [ -t 0 ]; then
+  BOLD=`tput bold`
+  NORM=`tput sgr0`
+  BLACK=`tput setaf 0`
+  RED=`tput setaf 1`
+  GREEN=`tput setaf 2`
+  YELLOW=`tput setaf 3`
+  BLUE=`tput setaf 4`
+  PINK=`tput setaf 5`
+  CYAN=`tput setaf 6`
+  WHITE=`tput setaf 7`
+fi
+
+set -e
+
+#################################################
+################## SET VARIABLES ################
+#################################################
+
+scriptpath="`dirname $0`"
+
+USER=`whoami`
+HOMEDIR="`eval echo ~$USER`"
+if [ -z $MU_INSTALLDIR ];then
+  MU_INSTALLDIR="/opt/mu"
+fi
+bindir="$MU_INSTALLDIR/bin"
+MU_LIBDIR="$MU_INSTALLDIR/lib"
+MU_DATADIR="$MU_INSTALLDIR/var"
+
+#################################################
+################## Updated Cmds ################
+#################################################
+DEFAULT_BRANCH="master"
+
+usage()
+{
+  echo "Updates Mu scripts in $MU_INSTALLDIR/bin. Optionally refreshes from git."
+  echo "Usage: $0 [-b <branch>] [-f [-c <commit>] ] [-d] [-u] [-r]"
+  echo "    -f: Forcibly re-sync $MU_LIBDIR from Git.  Saves your"
+  echo "        working changes unless -d is specified."
+  echo "    -c <commit> (requires -f): Reset to a specific commit."
+  echo "    -b <branch>: Use a branch other than $DEFAULT_BRANCH."
+  echo "    -d: Discard local changes to current branch."
+  echo "    -u: Update chef artifacts after update, regardless of cookbook changes."
+  exit 1
+}
+
+rebuild_chef_artifacts=0
+run_chef_client=0
+while getopts "fb:c:sdruh" opt; do
+  case $opt in
+    f)
+      force_sync=1
+      ;;
+    c)
+      force_commit=$OPTARG
+      ;;
+    b)
+      branch=$OPTARG
+      ;;
+    d)
+      discard=1
+      ;;
+    r)
+      run_chef_client=1
+      ;;
+    u)
+      rebuild_chef_artifacts=1
+      ;;
+    h)
+      usage
+      ;;
+    \?)
+      usage
+      ;;
+  esac
+done
+
+if [ "$force_commit" != "" -a "$force_sync" != "1" ];then
+  usage
+fi
+
+mkdir -p $MU_DATADIR/tmp
+/bin/cp -a $MU_LIBDIR/cookbooks $MU_DATADIR/tmp/cookbook_changes.$$
+mkdir -p $MU_DATADIR/tmp/berks_changes.$$
+/bin/cp -a $MU_LIBDIR/Berksfile* $MU_DATADIR/tmp/berks_changes.$$/
+/bin/rm -f $MU_DATADIR/tmp/cookbook_changes.$$/cookbooks/mu-tools/files/default/Mu_CA.pem
+
+cd $MU_LIBDIR
+lastbranch="`git branch | egrep '^\* ' | awk '{print $2}'`"
+if [ "$branch" == "" ];then
+  branch=$lastbranch
+fi
+export MUBRANCH=$branch
+
+
+# Stash unchecked local changes so we can put things back how we found them
+if [ "$discard" != "1" ]; then
+  stashed_changes=1
+  if [ "`git stash | grep '^No local changes to save'`" ];then
+    stashed_changes=0
+  else
+    echo "${GREEN}Stashing changes from working tree${NORM}"
+    git --no-pager stash list | head -1
+  fi
+fi
+
+
+# Swap branches, if pertinent
+if [ "$branch" != "$lastbranch" ];then
+  echo "${YELLOW}Switching from $lastbranch to $branch${NORM} in `pwd`"
+  set +e
+  git fetch
+  set -e
+  git checkout $branch
+else
+  set +e
+  git fetch
+  set -e
+  git checkout -f $branch
+fi
+
+if [ "$force_sync" == "1" ]; then
+  echo "${RED}Forcibly resetting $repo_name to branch $branch${NORM}"
+  if [ ! -z $force_commit ];then
+    # We got asked to reset to a particular commit, do so
+    echo "${RED}Using comment $force_commit${NORM}"
+    git reset --hard $force_commit
+  else
+    git reset --hard
+  fi
+  echo "${YELLOW}Updating $repo_name branch $branch from origin${NORM}"
+  git pull origin $branch
+else
+  echo "${YELLOW}Updating $repo_name branch $branch from origin${NORM}"
+  set +e
+  git pull origin $branch
+  set -e
+fi
+git config branch.${branch}.remote origin
+git config branch.${branch}.merge refs/heads/$branch
+
+
+if [ "`diff -r $MU_LIBDIR/cookbooks $MU_DATADIR/tmp/cookbook_changes.$$`" != "" ];then
+	rebuild_chef_artifacts=1
+	set -- "-u" "$@"
+elif [ "`diff -r $MU_LIBDIR/Berksfile $MU_DATADIR/tmp/berks_changes.$$/Berksfile`" != "" ];then
+	rebuild_chef_artifacts=1
+	set -- "-u" "$@"
+elif [ "`diff -r $MU_LIBDIR/Berksfile.lock $MU_DATADIR/tmp/berks_changes.$$/Berksfile.lock`" != "" ];then
+	rebuild_chef_artifacts=1
+	set -- "-u" "$@"
+fi
+
+/bin/rm -rf $MU_DATADIR/tmp/cookbook_changes.$$
+/bin/rm -rf $MU_DATADIR/tmp/berks_changes.$$
+
+if [ "$rebuild_chef_artifacts" == "1" ];then
+  /bin/rm -rf /root/.berkshelf/cookbooks
+  $bindir/mu-upload-chef-artifacts -p
+else
+  $bindir/mu-upload-chef-artifacts -r mu
+fi
+
+set +e
+/sbin/service nagios stop
+/sbin/service mu-momma-cat stop
+set -e
+
+echo "${GREEN}Cleaning gems in ${BOLD}/usr/local/ruby-current${NORM}${GREEN}${NORM}"
+cd $MU_LIBDIR/modules
+/usr/local/ruby-current/bin/bundle update
+/usr/local/ruby-current/bin/bundle clean --force
+cd
+
+chef_major="`/opt/chef/bin/chef-apply --version | awk '{print $2}' | cut -d\. -f1`"
+if [ "$chef_major" == "12" ];then
+  DIST_VERSION=`rpm -qa \*-release\* | grep -Ei "redhat|^centos" | cut -d"-" -f3`
+  # IS_AMAZON=0
+  if [ "$DIST_VERSION" == "" ];then # funny package name in Amazon Linux
+    DIST_VERSION=6
+  # IS_AMAZON=1
+  elif [ "$DIST_VERSION" == "server" ];then # funny package name in RHEL6
+    DIST_VERSION="6"
+  fi
+  rpm -Uvh https://packages.chef.io/files/stable/chef/14.4.56/el/${DIST_VERSION}/chef-14.4.56-1.el${DIST_VERSION}.x86_64.rpm
+fi
+
+/opt/chef/bin/chef-apply $MU_LIBDIR/cookbooks/mu-master/recipes/init.rb
+$bindir/mu-configure -n
+for dir in $MU_LIBDIR /opt/chef/embedded /opt/opscode/embedded /usr/local/ruby-current/;do
+  echo "${GREEN}Sanitizing permissions in ${BOLD}$dir${NORM}${GREEN}${NORM}"
+  for tree in `ls -1 $dir/`;do
+    find $dir/$tree -type d -exec chmod go+rx {} \;
+    find $dir/$tree -type f -exec chmod go+r {} \;
+  done
+done
+chmod go+rx $MU_LIBDIR/bin/*
+
+set -e
+
+if [ "$branch" != "$lastbranch" -a "$discard" != "1" ];then
+  echo "${GREEN}You are now on ${BOLD}$branch${NORM}${GREEN} (you were on ${BOLD}$lastbranch${NORM}${GREEN})${NORM}"
+fi
+if [ "$stashed_changes" == "1" ];then
+  if [ "$branch" != "$lastbranch" ];then
+    echo "${GREEN}You have stashed changes from your working tree, see ${BOLD}git stash list${NORM}"
+  else
+    echo "${GREEN}Restoring stashed changes from your working tree${NORM}"
+    git stash pop
+  fi
+fi

data/bin/mu-ssh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+bindir="`dirname $0`"
+
+for host in $($bindir/mu-node-manage -l $@);do
+  echo $host
+  ssh $host
+done

data/bin/mu-tunnel-nagios

@@ -0,0 +1,144 @@
+#!/usr/local/ruby-current/bin/ruby
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'syslog'
+require 'syslog/logger'
+
+logger = Syslog::Logger.new "mu-tunnel-nagios"
+
+#Syslog.open("mu-tunnel-nagios", Syslog::LOG_PID, Syslog::LOG_DAEMON | Syslog::LOG_LOCAL3)
+
+require 'net/ssh/config'
+require 'net/ssh/gateway'
+require 'optimist'
+require 'etc'
+SSH_CMD = "env -i /usr/bin/ssh"
+NAGIOS_HOME = "/opt/mu/var/nagios_user_home"
+
+
+$opts = Optimist::options do
+  banner <<-EOS
+A utility to run a command through a remote SSH tunnel. Intended to serve as an intermediary for Nagios plugins attempting to contact private nodes through a bastion host.
+Usage:
+#{$0} -d <host> -p <port> -c <command> [-a <arg>] [-k </path/to/key>] [-g <host> [-u <user>]]
+  EOS
+  opt :desthost, "The host to which we'll be connecting on the other side of the tunnel.", :require => true, :type => :string
+  opt :port, "The port to which we'll be connecting on the other side of the tunnel.", :require => true, :type => :integer
+  opt :command, "The command which we will be tunneling to the remote host.", :require => true, :type => :string
+  opt :argument, "An argument to append to our command to specify a (local tunnel) port.", :require => false, :default => "-p", :type => :string
+  opt :gateway, "The gateway host to use. If not specified, we'll assume we have something correct in our global ssh config.", :require => false, :type => :string
+  opt :key, "Path to an SSH private key to use when connecting to the gateway host. If not specified, we'll assume we have something correct in our global ssh config.", :require => false, :type => :string
+  opt :user, "The SSH user with which to connect to the gateway. If not specified, we'll assume we have something correct in our global ssh config.", :require => false, :type => :string, :default => nil
+#	opt :local_ip, "The local (private) IP to which we'll be connecting on the other side of the tunnel.", :require => false, :type => :string, :default => "127.0.0.1"
+  opt :directcommand, "The command to run if we don't need to tunnel to get to the remote host.", :require => false, :type => :string
+  opt :verbose, "Debugging noise.", :require => false, :type => :boolean, :default => false
+end
+
+dest_host = $opts[:desthost]
+dest_port = $opts[:port]
+cmd = $opts[:command]
+nat_host = $opts[:gateway]
+nat_ssh_user = $opts[:user]
+port_arg = $opts[:argument]
+nat_ssh_key = $opts[:key]
+#local_ip = $opts[:local_ip]
+verbose = $opts[:verbose]
+
+if !dest_host or !dest_port or !cmd
+  Optimist::die "Missing required arguments"
+end
+nat_host = dest_host if !nat_host
+
+ENV.clear
+ENV['HOME'] = NAGIOS_HOME
+
+needs_gateway = true
+begin
+  ssh_conf = File.read("#{NAGIOS_HOME}/.ssh/config")
+  opts = Net::SSH::Config.for(dest_host, ["#{NAGIOS_HOME}/.ssh/config"])
+  needs_gateway = false if !$opts.has_key?(:proxy)
+rescue Errno::EACCES => e
+  Syslog.log(Syslog::LOG_NOTICE, "Couldn't read #{NAGIOS_HOME}/.ssh/config: #{e.message}")
+  puts "Couldn't read #{NAGIOS_HOME}/.ssh/config: #{e.message}"
+  exit 3
+end
+
+full_cmd = output = nil
+begin
+  if !needs_gateway
+    puts "No SSH gateway configured for #{dest_host}, running #{cmd} directly" if verbose
+    cmd = $opts[:directcommand] if $opts[:directcommand_given]
+    full_cmd = cmd
+  else
+    gateway = nil
+    if verbose
+      gateway = Net::SSH::Gateway.new(
+        nat_host,
+        nil,
+        :config => ["#{NAGIOS_HOME}/.ssh/config"],
+        :keys_only => true,
+        :logger => logger,
+        :auth_methods => ['publickey'],
+        :use_agent => false,
+        :verbose => :debug
+      )
+    else
+      gateway = Net::SSH::Gateway.new(
+        nat_host,
+        nil,
+        :config => ["#{NAGIOS_HOME}/.ssh/config"],
+        :keys_only => true,
+        :auth_methods => ['publickey'],
+        :use_agent => false
+      )
+    end
+    port = gateway.open("127.0.0.1", dest_port)
+    if port_arg.empty?
+      full_cmd = cmd
+    else
+      full_cmd = "#{cmd} #{port_arg} #{port}"
+    end
+    if verbose
+      puts "Opening gateway to #{dest_host}:#{dest_port} by tunneling local #{port} to #{nat_host} and running #{full_cmd}"
+      Syslog.log(Syslog::LOG_NOTICE, "Opening gateway to #{dest_host}:#{dest_port} by tunneling local #{port} to #{nat_host} and running #{full_cmd}")
+    end
+  end
+  output = %x{#{full_cmd} 2>&1}
+  to_return = $?.exitstatus > 3 ? 3 : $?.exitstatus
+  puts output
+rescue Net::SSH::AuthenticationFailed, Net::SSH::ConnectionTimeout  => e
+  Syslog.log(Syslog::LOG_NOTICE, e.message)
+  puts e
+  to_return = 2
+rescue Exception => e
+  Syslog.log(Syslog::LOG_NOTICE, "Tunnel failure for #{dest_host}:#{dest_port} from config #{NAGIOS_HOME}/.ssh/config, `#{full_cmd}`: #{e.inspect} **** #{output} **** ENV: #{envhash.to_s}")
+  puts e
+  to_return = 3
+ensure
+  begin
+    gateway.shutdown! if !gateway.nil?
+  rescue Exception => e
+    if verbose
+      puts "Got #{e.inspect} closing down gateway tunnel (remote port may have been dead)"
+      Syslog.log(Syslog::LOG_NOTICE, "Got #{e.inspect} closing down gateway tunnel (remote port may have been dead)")
+    end
+  end
+  if verbose
+    puts "Exiting with status #{to_return}"
+    Syslog.log(Syslog::LOG_NOTICE, "Exiting with status #{to_return}")
+  end
+  exit to_return.to_i
+end
+