cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-activedirectory/files/default/password-auth

@@ -0,0 +1,32 @@
+#%PAM-1.0
+auth        required      pam_env.so
+auth        sufficient    pam_unix.so try_first_pass
+auth        requisite     pam_succeed_if.so uid >= 500 quiet
+auth        sufficient    pam_krb5.so use_first_pass
+auth        sufficient    pam_winbind.so use_first_pass
+auth        required      pam_deny.so
+auth        required      pam_faillock.so preauth audit silent deny=5 unlock_time=900
+auth        [success=1 default=bad] pam_unix.so
+auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
+auth        sufficient    pam_faillock.so authsucc audit deny=5 unlock_time=900
+
+account     required      pam_access.so
+account     required      pam_unix.so broken_shadow
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 500 quiet
+account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
+account     [default=bad success=ok user_unknown=ignore] pam_winbind.so
+account     required      pam_permit.so
+
+password    requisite     pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
+password    sufficient    pam_krb5.so use_authtok
+password    sufficient    pam_winbind.so use_authtok
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+session     optional      pam_oddjob_mkhomedir.so umask=0077
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+session     optional      pam_krb5.so

data/cookbooks/mu-activedirectory/files/default/sshd_pol.te

@@ -0,0 +1,32 @@
+
+module sshd_pol 1.0;
+
+require {
+	type sshd_t;
+	type file_t;
+	type default_t;
+	type chroot_user_t;
+	type fusefs_t;
+	class sock_file write;
+	class lnk_file read;
+	class dir { search getattr };
+}
+
+#============= chroot_user_t ==============
+
+#!!!! This avc is allowed in the current policy
+allow chroot_user_t file_t:dir { getattr search };
+
+#!!!! This avc is allowed in the current policy
+allow chroot_user_t file_t:lnk_file read;
+
+#!!!! This avc is allowed in the current policy
+allow chroot_user_t fusefs_t:dir { search getattr };
+
+#============= sshd_t ==============
+allow sshd_t default_t:sock_file write;
+allow sshd_t file_t:dir search;
+allow sshd_t file_t:lnk_file read;
+
+#!!!! This avc can be allowed using the boolean 'use_fusefs_home_dirs'
+allow sshd_t fusefs_t:dir search;

data/cookbooks/mu-activedirectory/files/default/syslogd_oddjobd.te

@@ -0,0 +1,10 @@
+
+module syslogd_oddjobd 1.0;
+
+require {
+	type oddjob_t;
+	class capability dac_override;
+}
+
+#============= oddjob_t ==============
+allow oddjob_t self:capability dac_override;

data/cookbooks/mu-activedirectory/files/default/system-auth

@@ -0,0 +1,34 @@
+#%PAM-1.0
+
+auth        required      pam_env.so
+auth        sufficient    pam_unix.so try_first_pass
+auth        requisite     pam_succeed_if.so uid >= 500 quiet
+auth        sufficient    pam_krb5.so use_first_pass
+auth        sufficient    pam_winbind.so use_first_pass
+auth        required      pam_deny.so
+auth        required      pam_faillock.so preauth audit silent deny=5 unlock_time=900
+auth        [success=1 default=bad] pam_unix.so
+auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
+auth        sufficient    pam_faillock.so authsucc audit deny=5 unlock_time=900
+
+account     required      pam_access.so
+account     required      pam_unix.so broken_shadow
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 500 quiet
+account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
+account     [default=bad success=ok user_unknown=ignore] pam_winbind.so
+account     required      pam_permit.so
+
+password    requisite     pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1
+password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
+password    sufficient    pam_krb5.so use_authtok
+password    sufficient    pam_winbind.so use_authtok
+password    required      pam_deny.so
+password    sufficient    pam_unix.so remember=5
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+session     optional      pam_oddjob_mkhomedir.so umask=0077
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+session     optional      pam_krb5.so

data/cookbooks/mu-activedirectory/files/default/winbindpol.te

@@ -0,0 +1,37 @@
+
+module winbindpol 1.0;
+
+require {
+	type postfix_pickup_t;
+	type sshd_t;
+	type default_t;
+	type winbind_t;
+	type postfix_cleanup_t;
+	type postfix_master_t;
+	class sock_file { getattr unlink create };
+	class dir { write remove_name add_name };
+	class file { write read lock create unlink open };
+}
+
+#============= postfix_cleanup_t ==============
+allow postfix_cleanup_t default_t:sock_file getattr;
+
+#============= postfix_master_t ==============
+allow postfix_master_t default_t:sock_file getattr;
+
+#============= postfix_pickup_t ==============
+allow postfix_pickup_t default_t:sock_file getattr;
+
+#============= sshd_t ==============
+allow sshd_t default_t:sock_file getattr;
+
+#============= winbind_t ==============
+#!!!! The source type 'winbind_t' can write to a 'dir' of the following types:
+# user_home_t, var_run_t, var_log_t, samba_etc_t, samba_log_t, samba_var_t, ctdbd_var_lib_t, pcscd_var_run_t, smbd_var_run_t, user_home_dir_t, winbind_var_run_t, tmp_t, var_t, user_tmp_t, auth_cache_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t
+
+allow winbind_t default_t:dir { write remove_name add_name };
+#!!!! The source type 'winbind_t' can write to a 'file' of the following types:
+# winbind_log_t, user_home_t, samba_secrets_t, samba_log_t, samba_var_t, ctdbd_var_lib_t, pcscd_var_run_t, smbd_var_run_t, winbind_var_run_t, user_tmp_t, auth_cache_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t
+
+allow winbind_t default_t:file { write read lock create unlink open };
+allow winbind_t default_t:sock_file { create unlink };

data/cookbooks/mu-activedirectory/libraries/config.rb

@@ -0,0 +1,106 @@
+require 'chef/mixin/shell_out'
+include Chef::Mixin::PowershellOut
+include Chef::Mixin::ShellOut
+
+module Activedirectory
+  module Config
+    def inspect_exit_status(output, description)
+      Chef::Application.fatal!("Failed to #{description}: #{output.stderr}") unless output.exitstatus == 0
+      Chef::Log.info(description)
+    end
+
+    def admin_creds
+      "(New-Object System.Management.Automation.PSCredential('#{new_resource.netbios_name}\\#{new_resource.domain_admin_user}', (ConvertTo-SecureString '#{new_resource.domain_admin_password}' -AsPlainText -Force)))"
+    end
+
+    def set_computer_name(creds)
+      # Theoretically this should have been done for us already, but let's cover the oddball cases.
+      Chef::Log.info("node_hostname: #{node['hostname'].downcase}, computer_name: #{new_resource.computer_name.downcase}")
+      if node['hostname'].downcase != new_resource.computer_name.downcase
+        cmd = powershell_out("Rename-Computer -NewName '#{new_resource.computer_name}' -Force -PassThru -Restart -DomainCredential #{creds}")
+        execute "kill ssh for reboot" do
+          command "Taskkill /im sshd.exe /f /t"
+          returns [0, 128]
+          action :nothing
+        end
+        reboot "Renaming computer to #{new_resource.computer_name}" do
+          action :reboot_now
+          reason "Renaming computer to #{new_resource.computer_name}"
+          notifies :run, "execute[kill ssh for reboot]", :immediately
+        end
+        kill_ssh
+        Chef::Application.fatal!("Failed to rename computer from #{node['hostname']} to #{new_resource.computer_name}: #{cmd.stdout}\n#{cmd.stderr}") if cmd.exitstatus != 0
+      end
+    end
+
+    def elevate_remote_access
+      unless uac_remote_restrictions_enabled?
+        cmd = powershell_out("New-ItemProperty -Path HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System -Name 'LocalAccountTokenFilterPolicy' -PropertyType DWord -Force -Value 1")
+        Chef::Log.info("Allowing remote access with UAC")
+        # inspect_exit_status(cmd, "UAC remote access")
+      end
+    end
+
+    def network_interface_code
+      dc_ips = nil
+      dc_ips = new_resource.existing_dc_ips.join(",") unless new_resource.existing_dc_ips.empty?
+      code =<<-EOH
+				Stop-Process -ProcessName sshd -force -ErrorAction SilentlyContinue
+				$netipconfig = Get-NetIPConfiguration
+				$netadapter = Get-NetAdapter
+				$netipaddress = $netadapter | Get-NetIPAddress -AddressFamily IPv4
+				$netadapter | Set-NetIPInterface -Dhcp Disabled
+				$netadapter | New-NetIPAddress -IPAddress #{node['ipaddress']} -PrefixLength $netipaddress.PrefixLength -DefaultGateway $netipconfig.IPv4DefaultGateway.NextHop
+				$netadapter | Set-DnsClientServerAddress -PassThru -ServerAddresses #{dc_ips}
+      EOH
+      return code
+    end
+
+    def configure_network_interface
+      dc_ips = nil
+      dc_ips = new_resource.existing_dc_ips.join(",") unless new_resource.existing_dc_ips.empty?
+
+      if dhcp_enabled?
+        code =<<-EOH
+#{network_interface_code}
+					Start-Service sshd -ErrorAction SilentlyContinue
+        EOH
+        cmd = powershell_out(code)
+        Chef::Log.info("Set network interface to use static address")
+        # inspect_exit_status(cmd, "set network interface")
+      end
+
+      unless dc_ips.nil?
+        cmd = powershell_out("Get-NetAdapter | Set-DnsClientServerAddress -PassThru -ServerAddresses #{dc_ips}")
+        Chef::Log.info("set DNS addresses to #{new_resource.existing_dc_ips.join(",")}")
+        # inspect_exit_status(cmd, "set DNS addresses to #{new_resource.existing_dc_ips.join(",")}")
+      end
+    end
+
+    def install_ad_features
+      # Can't inspect exist code. Windows is reporting wrong exit code
+      powershell_out("Install-WindowsFeature AD-Domain-Services, rsat-adds, FS-DFS-Replication, RSAT-DFS-Mgmt-Con -IncludeAllSubFeature")
+    end
+
+    def set_replication_static_ports
+      # Can't inspect exist code of any of those. exit code 0 doesn't seem to mean what it should mean on Windows
+      powershell_out("New-ItemProperty -Path HKLM:\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters -Name 'TCP/IP Port' -PropertyType DWord -Force -Value #{new_resource.ntds_static_port}") unless replication_tcp_port_set?
+      powershell_out("New-ItemProperty -Path HKLM:\\SYSTEM\\CurrentControlSet\\Services\\NTFRS\\Parameters -Name 'RPC TCP/IP Port Assignment' -PropertyType DWord -Force -Value #{new_resource.ntfrs_static_port}") unless replication_rpc_port_set?
+      powershell_out("New-ItemProperty -Path HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters -Name 'DCTcpipPort' -PropertyType DWord -Force -Value #{new_resource.netlogon_static_port}") unless netlogon_port_set?
+      powershell_out("Set-DfsrServiceConfiguration -RPCPort #{new_resource.dfsr_static_port}") unless dfsr_rpc_port_set?
+    end
+
+    # Workaround for a really crappy issue with cygwin/ssh and windows where we need to end all ssh process,
+    # or Mu's SSH session / chef client run won't disconnect even though the client chef run has finished or the SSH session has closed.
+    def kill_ssh
+      execute "Taskkill /im sshd.exe /f /t" do
+        returns [0, 128]
+      end
+    end
+
+  end
+end
+
+Chef::Recipe.send(:include, Activedirectory::Config)
+Chef::Resource.send(:include, Activedirectory::Config)
+Chef::Provider.send(:include, Activedirectory::Config)

data/cookbooks/mu-activedirectory/libraries/helper.rb

@@ -0,0 +1,86 @@
+require 'chef/mixin/shell_out'
+include Chef::Mixin::PowershellOut
+include Chef::Mixin::ShellOut
+
+module Activedirectory
+  module Helper
+    def elversion
+      return 6 if node['platform_version'].to_i == 2013
+      return 6 if node['platform_version'].to_i == 2014
+      return 6 if node['platform_version'].to_i == 2015
+      return 6 if node['platform_version'].to_i == 2016
+      node['platform_version'].to_i
+    end
+
+    def in_domain?
+      cmd = powershell_out("((Get-WmiObject win32_computersystem).partofdomain -eq $true)")
+      return cmd.stdout.match(/True/)
+    end
+
+    def is_domain_controller?(hostname)
+      # cmd = powershell_out("(Get-ADDomainController).name -eq '#{new_resource.computer_name}'")
+      cmd = powershell_out("(Get-ADDomainController).name -eq '#{hostname}'")
+      return cmd.stdout.match(/True/)
+    end
+
+    def dhcp_enabled?
+      cmd = powershell_out("(Get-NetIPInterface -InterfaceAlias Ethernet* -AddressFamily IPv4).Dhcp -eq 'Enabled'")
+      return cmd.stdout.match(/True/)
+    end
+
+    def domain_exists?
+      cmd = powershell_out("(Get-ADDomain).DNSRoot -eq '#{new_resource.dns_name}'")
+      return cmd.stdout.match(/True/)
+    end
+
+    def replication_rpc_port_set?
+      cmd = powershell_out("(Get-ItemProperty HKLM:\\SYSTEM\\CurrentControlSet\\Services\\NTFRS\\Parameters 'RPC TCP/IP Port Assignment').'RPC TCP/IP Port Assignment' -eq \"#{new_resource.ntfrs_static_port}\"")
+      return cmd.stdout.match(/True/)
+    end
+
+    def replication_tcp_port_set?
+      cmd = powershell_out("(Get-ItemProperty HKLM:\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters 'TCP/IP Port').'TCP/IP Port' -eq \"#{new_resource.ntds_static_port}\"")
+      return cmd.stdout.match(/True/)
+    end
+
+    def dfsr_rpc_port_set?
+      cmd = powershell_out("(Get-DfsrServiceConfiguration).RPCPort -eq #{new_resource.dfsr_static_port}")
+      return cmd.stdout.match(/True/)
+    end
+
+    def netlogon_port_set?
+      cmd = powershell_out("(Get-ItemProperty HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters 'DCTcpipPort').'DCTcpipPort' -eq \"#{new_resource.netlogon_static_port}\"")
+      return cmd.stdout.match(/True/)
+    end
+
+    def domain_user_exist?(user)
+      cmd = powershell_out("(Get-ADUser -Filter {Name -eq '#{user}'}).Name -eq '#{user}'")
+      return cmd.stdout.match(/True/)
+    end
+
+    def uac_remote_restrictions_enabled?
+      cmd = powershell_out("(Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System 'LocalAccountTokenFilterPolicy').'LocalAccountTokenFilterPolicy' -eq 1")
+      return cmd.stdout.match(/True/)
+    end
+
+    def default_site_name_set?
+      cmd = powershell_out("(Get-ADReplicationSite).name -eq '#{new_resource.site_name}'")
+      return cmd.stdout.match(/True/)
+    end
+
+    def gpo_exist?(gpo_name)
+      cmd = powershell_out("(Get-GPO -Name #{gpo_name}).DisplayName -eq '#{gpo_name}'")
+      return cmd.stdout.match(/True/)
+    end
+
+    def is_schemamaster?(domain_name, hostname)
+      cmd = powershell_out("(Get-ADForest #{domain_name}).SchemaMaster -eq '#{hostname.downcase}.#{domain_name}'")
+      return cmd.stdout.match(/True/)
+    end
+  end
+end
+
+Chef::Node.send(:include, Activedirectory::Helper)
+Chef::Recipe.send(:include, Activedirectory::Helper)
+Chef::Resource.send(:include, Activedirectory::Helper)
+Chef::Provider.send(:include, Activedirectory::Helper)

data/cookbooks/mu-activedirectory/metadata.rb

@@ -0,0 +1,17 @@
+name 'mu-activedirectory'
+maintainer 'eGlobalTech,'
+maintainer_email 'ecap-developers@googlegroups.com'
+license 'BSD-3-Clause'
+description 'Installs/Configures mu-activedirectory'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 14.0' if respond_to?(:chef_version)
+version '0.2.0'
+depends "windows", '~> 5.1.1'
+depends "chef-vault", '~> 3.1.1'
+depends "yum-epel", '~> 3.2.0'
+
+%w( amazon centos redhat windows ).each do |os|
+	supports os
+end

data/cookbooks/mu-activedirectory/providers/domain.rb

@@ -0,0 +1,152 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Provider:: domain
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include Chef::Mixin::PowershellOut
+
+def whyrun_supported?
+  true
+end
+
+action :create do
+  case node['platform']
+    when "windows"
+      install_ad_features
+      elevate_remote_access
+      set_computer_name(admin_creds)
+      create_domain
+      configure_network_interface
+      configure_domain
+    when platform_family?('rhel')
+      # To do: Do Active Directory on Linux
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end
+
+action :delete do
+  case node['platform']
+    when "windows"
+      delete_domain
+    when platform_family?('rhel')
+      # To do: Do Active Directory on Linux
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end
+
+# def load_current_resource
+# @current_resource = @new_resource.dup
+# end
+
+def create_domain_admin_user
+  unless domain_user_exist?(new_resource.domain_admin_user)
+    code =<<-EOH
+			New-ADUser -Name #{new_resource.domain_admin_user} -UserPrincipalName #{new_resource.domain_admin_user}@#{new_resource.dns_name} -AccountPassword (ConvertTo-SecureString -AsPlainText '#{new_resource.domain_admin_password}' -force) -Enabled $true -PasswordNeverExpires $true
+			Add-ADGroupMember 'Domain Admins' -Members #{new_resource.domain_admin_user}
+    EOH
+    cmd = powershell_out(code)
+    Chef::Log.info("Create Domain Admin User #{new_resource.domain_admin_user}")
+    # inspect_exit_status(cmd, "Create Domain Admin User #{new_resource.domain_admin_user}")
+  end
+end
+
+#This will restart the OS. The OS needs to be restated after creating the domain
+# Workaround for a really crappy issue with cygwin/ssh and windows where we need to end all ssh process,
+# or Mu's SSH session / chef client run won't disconnect even though the client chef run has finished or the SSH session has closed.
+# Running configure_network_interface before creating a domain, and re-running chef-client will cause DNS name resolution to fail if the domain hasn't been created, 
+# which is why we add the configure_network_interface code to the domain creation execution itself.
+def create_domain
+  unless domain_exists?
+    require 'chef/win32/version'
+    version = Chef::ReservedNames::Win32::Version.new
+
+    Chef::Log.info("Configuring network interface settings and creating domain")
+    if version.windows_server_2012?
+      code =<<-EOH
+#{network_interface_code}
+				$DCPromoFile = @"
+				[DCINSTALL]
+				InstallDNS=yes
+				NewDomain=forest
+				NewDomainDNSName=#{new_resource.dns_name}
+				DomainNetBiosName=#{new_resource.netbios_name}
+				SiteName=#{new_resource.site_name}
+				ReplicaorNewDomain=domain
+				ForestLevel=5
+				DomainLevel=5
+				ConfirmGC=Yes
+				SafeModeAdminPassword="#{new_resource.restore_mode_password}"
+				RebootonCompletion=Yes
+				"@
+				$DCPromoFile | out-file c:/dcpromoanswerfile.txt -Force
+				dcpromo.exe /unattend:c:/dcpromoanswerfile.txt
+      EOH
+    elsif version.windows_server_2012_r2?
+      code =<<-EOH
+#{network_interface_code}
+				Install-ADDSForest -DomainName #{new_resource.dns_name} -SafeModeAdministratorPassword (convertto-securestring '#{new_resource.restore_mode_password}' -asplaintext -force) -DomainMode Win2012R2 -DomainNetbiosName #{new_resource.netbios_name} -ForestMode Win2012R2 -Confirm:$false -Force
+				Stop-Process -ProcessName sshd -force -ErrorAction SilentlyContinue
+      EOH
+      # cmd = powershell_out("Install-ADDSForest -DomainName #{new_resource.dns_name} -SafeModeAdministratorPassword (convertto-securestring '#{new_resource.restore_mode_password}' -asplaintext -force) -DomainMode Win2012R2 -DomainNetbiosName #{new_resource.netbios_name} -ForestMode Win2012R2 -Confirm:$false -Force")
+    end
+    Chef::Log.info("Creating Active Directory Domain #{new_resource.dns_name}")
+    cmd = powershell_out(code)
+    kill_ssh
+    Chef::Application.fatal!("Failed to create Active Directory Domain #{new_resource.dns_name}") if cmd.exitstatus != 0
+    reboot "Active Directory Domain #{new_resource.dns_name} created" do
+      action :reboot_now
+      reason "Active Directory Domain #{new_resource.dns_name} created"
+    end
+  end
+end
+
+def rename_default_site
+  unless default_site_name_set?
+    cmd = powershell_out("Get-ADObject -Credential #{admin_creds} -SearchBase (Get-ADRootDSE).ConfigurationNamingContext -filter {Name -eq 'Default-First-Site-Name'} | Rename-ADObject -Credential #{admin_creds} -NewName #{new_resource.site_name}")
+    Chef::Log.info("Renamed default site to #{new_resource.site_name}")
+    # inspect_exit_status(cmd, "Renamed default site to #{new_resource.site_name}")
+  end
+end
+
+def configure_replication
+  new_resource.sites.each { |site|
+    if site[:name] != new_resource.site_name
+      powershell_script "Creating AD ReplicationSite #{site[:name]}" do
+        guard_interpreter :powershell_script
+        code "New-ADReplicationSite #{site[:name]} -Credential #{admin_creds}"
+        not_if "(Get-ADObject -Credential #{admin_creds} -SearchBase (Get-ADRootDSE).ConfigurationNamingContext -filter {Name -eq '#{site[:name]}'}).name -eq '#{site[:name]}'"
+        sensitive true
+      end
+
+      powershell_script "Configure AD Replication between AD sites and" do
+        guard_interpreter :powershell_script
+        code "Get-ADReplicationSiteLink -Credential #{admin_creds} -Filter * | Set-ADReplicationSiteLink -Credential #{admin_creds} -SitesIncluded @{add='#{site[:name]}'} -ReplicationFrequencyInMinutes 15"
+        sensitive true
+      end
+    end
+
+    powershell_script "Create AD Replication subnet #{site[:ip_block]} for site #{site[:name]}" do
+      guard_interpreter :powershell_script
+      code "New-ADReplicationSubnet -Credential #{admin_creds} -Name #{site[:ip_block]} -Site #{site[:name]}"
+      not_if "(Get-ADReplicationSubnet -Credential #{admin_creds} -Identity #{site[:ip_block]}).name -eq '#{site[:ip_block]}'"
+      sensitive true
+    end
+  }
+end
+
+def configure_domain
+  # Move these to somewhere that makes sense
+  powershell_out("Set-Service NTDS -StartupType Automatic")
+  powershell_out("Set-Service ADWS -StartupType Automatic")
+
+  create_domain_admin_user
+  rename_default_site
+  configure_replication
+  set_replication_static_ports
+end

data/cookbooks/mu-activedirectory/providers/domain_controller.rb

@@ -0,0 +1,89 @@
+#
+# Cookbook Name:: mu-activedirectory
+# Provider:: domain_controller
+#
+# Copyright 2015, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include Chef::Mixin::PowershellOut
+require 'chef/mixin/shell_out'
+include Chef::Mixin::ShellOut
+
+def whyrun_supported?
+  true
+end
+
+action :add do
+  case node['platform']
+    when "windows"
+      install_ad_features
+      elevate_remote_access
+      join_domain
+      promote
+      configure_network_interface
+      set_replication_static_ports
+      set_computer_name(admin_creds)
+    when platform_family?('rhel')
+      # To do: Do Active Directory on Linux
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end
+
+action :remove do
+  case node['platform']
+    when "windows"
+      demote
+    when platform_family?('rhel')
+      # To do: Do Active Directory on Linux
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end
+
+# def load_current_resource
+# @current_resource = @new_resource.dup
+# end
+
+def promote
+  unless is_domain_controller?(new_resource.computer_name)
+    Chef::Log.info("Promoting #{new_resource.computer_name} to domain controller in #{new_resource.dns_name} domain")
+    cmd = powershell_out("Stop-Process -ProcessName sshd -force -ErrorAction SilentlyContinue; Install-ADDSDomainController -InstallDns -DomainName #{new_resource.dns_name} -Credential #{admin_creds} -SafeModeAdministratorPassword (convertto-securestring '#{new_resource.restore_mode_password}' -asplaintext -force) -Force -Confirm:$false; Restart-Computer -Force")
+    kill_ssh
+    Chef::Application.fatal!("Failed to promote #{new_resource.computer_name} to Domain Controller in #{new_resource.dns_name} domain") unless cmd.exitstatus == 0
+    Chef::Application.fatal!("Promoted #{new_resource.computer_name} to Domain Controller in #{new_resource.dns_name} domain. Will have to run chef again")
+  end
+end
+
+def demote
+  if is_domain_controller?(new_resource.computer_name)
+    Chef::Log.info("Demoting domain controller #{new_resource.computer_name} in #{new_resource.dns_name} domain")
+    cmd = powershell_out("Stop-Process -ProcessName sshd -force -ErrorAction SilentlyContinue; Uninstall-WindowsFeature DNS; Uninstall-ADDSDomainController -Credential #{admin_creds} -LocalAdministratorPassword (convertto-securestring '#{new_resource.domain_admin_password}'  -asplaintext -force) -Force -Confirm:$false; Restart-Computer -Force")
+    kill_ssh
+    Chef::Application.fatal!("Failed to demote Domain Controller #{new_resource.computer_name} in #{new_resource.dns_name} domain") unless cmd.exitstatus == 0
+    Chef::Application.fatal!("Demoted Domain Controller #{new_resource.computer_name} in #{new_resource.dns_name} domain. Will have to run chef again")
+  end
+  powershell_out("Uninstall-WindowsFeature AD-Domain-Services, rsat-adds, FS-DFS-Replication, RSAT-DFS-Mgmt-Con -IncludeManagementTools")
+end
+
+def join_domain
+  unless in_domain?
+    # Workaround for a really crappy issue with cygwin/ssh and windows where we need to end all ssh process,
+    # or Mu's SSH session / chef client run won't disconnect even though the client chef run has finished or the SSH session has closed.
+    # Running configure_network_interface before joining a domain, and re-running chef-client will cause DNS name resolution to fail if the node wasn't successfully added to the domain,
+    # which is why we add the configure_network_interface code to join_domain directly.
+    code =<<-EOH
+#{network_interface_code}
+			Add-Computer -DomainName #{new_resource.dns_name} -Credential #{admin_creds} -Restart -PassThru
+			Restart-Computer -Force
+    EOH
+    Chef::Log.info("Joining #{new_resource.computer_name} node to #{new_resource.dns_name} domain")
+    cmd = powershell_out(code)
+    # cmd = powershell_out("Add-Computer -DomainName #{new_resource.dns_name} -Credential #{admin_creds} -Restart -PassThru")
+    kill_ssh
+    Chef::Application.fatal!("Failed to join #{new_resource.computer_name} to #{new_resource.dns_name} domain") unless cmd.exitstatus == 0
+    Chef::Application.fatal!("Joined #{new_resource.computer_name} to #{new_resource.dns_name} domain. Will have to run chef again")
+  end
+end