cloud-mu 2.1.0beta → 3.0.0beta

data/cookbooks/mu-tools/recipes/eks.rb

@@ -145,7 +145,7 @@ Environment='KUBELET_EXTRA_ARGS=$KUBELET_EXTRA_ARGS'
 
   ["/var/lib/kubelet/kubeconfig", "/root/.kube/config"].each { |kubecfg|
     template kubecfg do
-      source "kubeconfig.erb"
+      source "kubeconfig-eks.erb"
       variables(
         :endpoint => endpoint,
         :cluster => cluster,

data/cookbooks/mu-tools/recipes/gcloud.rb

@@ -28,49 +28,24 @@ if platform_family?("rhel") or platform_family?("amazon")
     end
     package "google-cloud-sdk"
   elsif node['platform_version'].to_i == 6
-    rpm_package "IUS" do
-      source "https://#{node['platform']}#{node['platform_version'].to_i}.iuscommunity.org/ius-release.rpm"
-    end
-    package ["python27", "python27-libs"]
+    version = "267.0.0"
     remote_file "#{Chef::Config[:file_cache_path]}/gcloud-cli.sh" do
       source "https://sdk.cloud.google.com"
       action :nothing
     end
     remote_file "#{Chef::Config[:file_cache_path]}/gcloud-cli.tar.gz" do
-      source "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-167.0.0-linux-x86_64.tar.gz"
+      source "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-#{version}-linux-x86_64.tar.gz"
       action :nothing
     end
     bash "install gcloud-cli" do
       cwd "/opt"
       code <<-EOH
-        # This broken-arsed package set install themselves in the wrong prefix
-        # for some reason, but if you do it manually they land in the right
-        # place. Whatever, just symlink it.
-        filelist=`rpm -qa | grep ^python27- | xargs rpm -ql`
-        for d in $filelist;do
-          if [ -d "$d" ];then
-            rightpath=`echo $d | sed 's/^\\/opt\\/rh\\/python27\\/root//'`
-            if [ "$rightpath" != "$d" -a ! -e "$rightpath" ];then
-              echo $rightpath | grep -v /
-              mkdir -p "$rightpath"
-            fi
-          fi
-        done
-        for f in $filelist;do
-          if [ -f "$f" ];then
-            rightpath=`echo $f | sed 's/^\\/opt\\/rh\\/python27\\/root//'`
-            if [ "$rightpath" != "$f" -a ! -e "$rightpath" ];then
-              ln -s "$f" "$rightpath"
-            fi
-          fi
-        done
         tar -xzf #{Chef::Config[:file_cache_path]}/gcloud-cli.tar.gz
-        CLOUDSDK_PYTHON=/usr/bin/python2.7 ./google-cloud-sdk/install.sh -q
-#        CLOUDSDK_PYTHON=/usr/bin/python2.7 sh #{Chef::Config[:file_cache_path]}/gcloud-cli.sh --install-dir=/opt --disable-prompts
+        CLOUDSDK_PYTHON="`/bin/rpm -ql muthon | grep '/bin/python$'`" ./google-cloud-sdk/install.sh -q
       EOH
       notifies :create, "remote_file[#{Chef::Config[:file_cache_path]}/gcloud-cli.sh]", :before
       notifies :create, "remote_file[#{Chef::Config[:file_cache_path]}/gcloud-cli.tar.gz]", :before
-      not_if { ::File.exist?("/opt/google-cloud-sdk/bin/gcloud") }
+      not_if "/opt/google-cloud-sdk/bin/gcloud version | grep 'Google Cloud SDK #{version}'"
     end
     link "/etc/bash_completion.d/gcloud" do
       to "/opt/google-cloud-sdk/completion.bash.inc"
@@ -79,7 +54,7 @@ if platform_family?("rhel") or platform_family?("amazon")
       to "/opt/google-cloud-sdk/path.bash.inc"
     end
     file "/etc/profile.d/gcloud_python.sh" do
-      content "export CLOUDSDK_PYTHON=/usr/bin/python2.7\n"
+      content "export CLOUDSDK_PYTHON=\"`/bin/rpm -ql muthon | grep '/bin/python$'`\"\n"
       mode 0644
     end
   end

data/cookbooks/mu-tools/recipes/nagios.rb

@@ -16,4 +16,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-include_recipe "nagios"
+include_recipe "mu-nagios"

data/cookbooks/mu-tools/recipes/rsyslog.rb

@@ -24,6 +24,7 @@ if !node['application_attributes']['skip_recipes'].include?('rsyslog')
     execute "chcon -R -h -t var_log_t /Mu_Logs" do
       action :nothing
       only_if { ::Dir.exist?("/Mu_Logs") }
+      not_if "/sbin/getenforce | grep -cim1  disabled"
     end
     service "rsyslog" do
       action [:enable, :start]

data/cookbooks/mu-tools/recipes/selinux.rb

@@ -0,0 +1,19 @@
+#
+# Cookbook:: mu-tools
+# Recipe:: selinux
+#
+# Copyright:: 2019, The Authors, All Rights Reserved.
+
+if !node['application_attributes']['skip_recipes'].include?('selinux')
+
+  selinux_state "SELinux Enforcing" do
+    action :enforcing
+    notifies :request_reboot, 'reboot[now]', :immediately
+  end
+
+  reboot 'now' do
+    action :nothing
+    reason 'Must reboot to enable SELinux.'
+  end
+ 
+end

data/cookbooks/mu-tools/recipes/split_var_partitions.rb

@@ -23,7 +23,6 @@
 # make it part of your regular build process.
 
 if !node['application_attributes']['skip_recipes'].include?('split_var_partitions')
-  log "*************** "+node['platform']
   case node['platform']
     when "redhat", "rhel", "centos", "amazon"
 

data/cookbooks/mu-tools/recipes/windows-client.rb

@@ -19,16 +19,148 @@ if !node['application_attributes']['skip_recipes'].include?('windows-client')
   case node['platform']
     when "windows"
       include_recipe 'chef-vault'
-      ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+
+      windows_vault = chef_vault_item node['windows_auth_vault'], node['windows_auth_item']
+
+      sshd_user = 'SYSTEM' #windows_vault[node['windows_sshd_username_field']]
+
+      sshd_password = windows_vault[node['windows_sshd_password_field']]
+
+      windows_version = node['platform_version'].to_i
+      
+      public_keys = Array.new
+
+      if windows_version == 10
+        Chef::Log.info "version #{windows_version}, using openssh"
+
+        include_recipe 'chocolatey'
+
+        openssh_path = 'C:\Program Files\OpenSSH-Win64'
+
+        ssh_program_data = "#{ENV['ProgramData']}/ssh"
+
+        ssh_dir = "C:/Users/Administrator/.ssh"
+
+        authorized_keys = "#{ssh_dir}/authorized_keys"
+
+        public_key = node['deployment']['ssh_public_key']
+
+        files = []
+
+        packages = %w(openssh ruby)
+
+        chocolatey_package packages
+
+        windows_path 'Add OpenSSH to path' do
+          path openssh_path
+          action :add
+        end
+
+        powershell_script 'Install SSH' do
+          code '.\install-sshd.ps1'
+          cwd openssh_path
+        end
+
+#        firewall 'default' do
+#          ipv6_enabled node['firewall']['ipv6_enabled']
+#          action :disable
+#        end
+#            
+#        firewall_rule 'allow ssh' do
+#          port     22
+#          command  :allow
+#          description 'OpenSSH Server (sshd)'
+#        end
+#
+#        firewall_rule 'allow RDP' do
+#          port    3389
+#          command :allow
+#        end
+#
+#        firewall_rule 'allow winrm' do
+#          port    5989
+#          command :allow
+#        end
+
+        directory 'create ssh ProgramData' do
+          path ssh_program_data
+          owner sshd_user
+          rights :full_control, sshd_user
+          rights :full_control, 'Administrator'
+          notifies :run, 'powershell_script[Generate Host Key]', :immediately
+        end
+
+        powershell_script 'Generate Host Key' do
+          code '.\ssh-keygen.exe -A'
+          cwd openssh_path
+          action :nothing
+          notifies :create, "template[#{ssh_program_data}/sshd_config]", :immediately
+        end
+
+        template "#{ssh_program_data}/sshd_config" do
+          action :nothing
+          owner sshd_user
+          source "sshd_config.erb"
+          mode '0600'
+          cookbook "mu-tools"
+          notifies :run, 'ruby[find files to change ownership of]', :immediately
+        end
+
+        directory "set file ownership" do
+          action :nothing
+          path ssh_program_data
+          owner sshd_user
+          mode '0600'
+          rights :full_control, sshd_user
+          deny_rights :full_control, 'Administrator'
+        end
+
+        windows_service 'sshd' do
+          action :nothing #[ :enable, :start ]
+        end
+
+        group 'sshusers' do
+          members [sshd_user, 'Administrator']
+        end
+
+        ruby 'find files to change ownership of' do
+          action :nothing
+          code <<-EOH
+            files = Dir.entries ssh_program_data
+            puts files
+          EOH
+        end
+
+        log 'files in ssh' do
+          message files.join
+          level :info
+        end
+
+        files.each do |file|
+          file "#{ssh_program_data}#{file}" do
+            owner sshd_user
+            deny_rights :full_control, 'Administrator'
+          end
+        end
+
+        directory "create Admin's .ssh directory" do
+          path ssh_dir
+          recursive true
+          owner sshd_user
+        end
+
+        file authorized_keys do
+          owner 'Administrator'
+          content public_key
+        end
+
+      else
+        ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
 
 #      remote_file "cygwin-x86_64.exe" do
 #        path "#{Chef::Config[:file_cache_path]}/cygwin-x86_64.exe"
 #        source "http://cygwin.com/setup-x86_64.exe"
-# XXX guard with a version check
-#      end
-
-# XXX keep a local cache of packages... really our own damn mirror
-      cygwindir = "c:/bin/cygwin"
+        cygwindir = "c:/bin/cygwin"
 #      pkgs = ["bash", "mintty", "vim", "curl", "openssl", "wget", "lynx", "openssh"]
 
 #      powershell_script "install Cygwin" do
@@ -38,7 +170,7 @@ if !node['application_attributes']['skip_recipes'].include?('windows-client')
 #        not_if { ::File.exist?("#{cygwindir}/Cygwin.bat") }
 #      end
 
-      # Be prepared to reinit installs that are missing key utilities
+        # Be prepared to reinit installs that are missing key utilities
 #      file "#{cygwindir}/etc/setup/installed.db" do
 #        action :delete
 #        not_if { ::File.exist?("#{cygwindir}/bin/cygcheck.exe") }
@@ -52,138 +184,135 @@ if !node['application_attributes']['skip_recipes'].include?('windows-client')
 #        end
 #      }
 
-      reboot "Cygwin LSA" do
-        action :nothing
-        reason "Enabling Cygwin LSA support"
-      end
-
-      powershell_script "Configuring Cygwin LSA support" do
-        code <<-EOH
-          Invoke-Expression '& #{cygwindir}/bin/bash.exe --login -c "echo yes | /bin/cyglsa-config"'
-        EOH
-        not_if {
-          lsa_found = false
-          if registry_key_exists?("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa")
-            registry_get_values("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa").each { |val|
-              if val[:name] == "Authentication Packages"
-                lsa_found = true if val[:data].grep(/cyglsa64\.dll/)
-                break
-              end
-            }
-          end
-          lsa_found
-        }
-        notifies :reboot_now, "reboot[Cygwin LSA]", :immediately
-      end
+        reboot "Cygwin LSA" do
+          action :nothing
+          reason "Enabling Cygwin LSA support"
+        end
 
-      windows_vault = chef_vault_item(node['windows_auth_vault'], node['windows_auth_item'])
-      sshd_user = windows_vault[node['windows_sshd_username_field']]
-      sshd_password = windows_vault[node['windows_sshd_password_field']]
-      powershell_script "enable Cygwin sshd" do
-        code <<-EOH
-          Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "ssh-host-config -y -c ntsec -w ''#{sshd_password}'' -u #{sshd_user}"'
-          Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "sed -i.bak ''s/#.*StrictModes.*yes/StrictModes no/'' /etc/sshd_config"'
-          Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "sed -i.bak ''s/#.*PasswordAuthentication.*yes/PasswordAuthentication no/'' /etc/sshd_config"'
-          Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "chown #{sshd_user} /var/empty /var/log/sshd.log /etc/ssh*; chmod 755 /var/empty"'
-        EOH
-        sensitive true
-        not_if %Q{Get-Service "sshd"}
-      end
-      powershell_script "set unix-style Cygwin sshd permissions" do
-        code <<-EOH
-          if((Get-WmiObject win32_computersystem).partofdomain){
-            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkpasswd -d > /etc/passwd"'
-            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkgroup -l -d > /etc/group"'
-          } else {
-            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkpasswd -l > /etc/passwd"'
-            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkgroup -l > /etc/group"'
+        powershell_script "Configuring Cygwin LSA support" do
+          code <<-EOH
+            Invoke-Expression '& #{cygwindir}/bin/bash.exe --login -c "echo yes | /bin/cyglsa-config"'
+          EOH
+          not_if {
+            lsa_found = false
+            if registry_key_exists?("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa")
+              registry_get_values("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa").each { |val|
+                if val[:name] == "Authentication Packages"
+                  lsa_found = true if val[:data].grep(/cyglsa64\.dll/)
+                  break
+                end
+              }
+            end
+            lsa_found
           }
-          Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "chown #{sshd_user} /var/empty /var/log/sshd.log /etc/ssh*; chmod 755 /var/empty"'
-        EOH
-      end
+          notifies :reboot_now, "reboot[Cygwin LSA]", :immediately
+        end
 
-      include_recipe 'mu-activedirectory'
+        powershell_script "enable Cygwin sshd" do
+          code <<-EOH
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "ssh-host-config -y -c ntsec -w ''#{sshd_password}'' -u #{sshd_user}"'
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "sed -i.bak ''s/#.*StrictModes.*yes/StrictModes no/'' /etc/sshd_config"'
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash.exe --login -c "sed -i.bak ''s/#.*PasswordAuthentication.*yes/PasswordAuthentication no/'' /etc/sshd_config"'
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "chown #{sshd_user} /var/empty /var/log/sshd.log /etc/ssh*; chmod 755 /var/empty"'
+          EOH
+          sensitive true
+          not_if %Q{Get-Service "sshd"}
+        end
+        powershell_script "set unix-style Cygwin sshd permissions" do
+          code <<-EOH
+            if((Get-WmiObject win32_computersystem).partofdomain){
+              Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkpasswd -d > /etc/passwd"'
+              Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkgroup -l -d > /etc/group"'
+            } else {
+              Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkpasswd -l > /etc/passwd"'
+              Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "mkgroup -l > /etc/group"'
+            }
+            Invoke-Expression -Debug '& #{cygwindir}/bin/bash --login -c "chown #{sshd_user} /var/empty /var/log/sshd.log /etc/ssh*; chmod 755 /var/empty"'
+          EOH
+        end
 
-      ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
+        include_recipe 'mu-activedirectory'
 
-      template "c:/bin/cygwin/etc/sshd_config" do
-        source "sshd_config.erb"
-        mode 0644
-        cookbook "mu-tools"
-        ignore_failure true
-      end
+        ::Chef::Recipe.send(:include, Chef::Mixin::PowershellOut)
 
-      ec2config_user= windows_vault[node['windows_ec2config_username_field']]
-      ec2config_password = windows_vault[node['windows_ec2config_password_field']]
-      login_dom = "."
+        template "c:/bin/cygwin/etc/sshd_config" do
+          source "sshd_config.erb"
+          mode 0644
+          cookbook "mu-tools"
+          ignore_failure true
+        end
 
-      if in_domain?
+        ec2config_user= windows_vault[node['windows_ec2config_username_field']]
+        ec2config_password = windows_vault[node['windows_ec2config_password_field']]
+        login_dom = "."
 
-        ad_vault = chef_vault_item(node['ad']['domain_admin_vault'], node['ad']['domain_admin_item'])
-        login_dom = node['ad']['netbios_name']
+        if in_domain?
 
-        windows_users node['ad']['computer_name'] do
-          username ad_vault[node['ad']['domain_admin_username_field']]
-          password ad_vault[node['ad']['domain_admin_password_field']]
-          domain_name node['ad']['domain_name']
-          netbios_name node['ad']['netbios_name']
-          dc_ips node['ad']['dc_ips']
-          ssh_user sshd_user
-          ssh_password sshd_password
-          ec2config_user ec2config_user
-          ec2config_password ec2config_password
-        end
+          ad_vault = chef_vault_item(node['ad']['domain_admin_vault'], node['ad']['domain_admin_item'])
+          login_dom = node['ad']['netbios_name']
 
-        aws_windows "ec2" do
-          username ec2config_user
-          service_username "#{node['ad']['netbios_name']}\\#{ec2config_user}"
-          password ec2config_password
-        end
+          windows_users node['ad']['computer_name'] do
+            username ad_vault[node['ad']['domain_admin_username_field']]
+            password ad_vault[node['ad']['domain_admin_password_field']]
+            domain_name node['ad']['domain_name']
+            netbios_name node['ad']['netbios_name']
+            dc_ips node['ad']['dc_ips']
+            ssh_user sshd_user
+            ssh_password sshd_password
+            ec2config_user ec2config_user
+            ec2config_password ec2config_password
+          end
 
-        scheduled_tasks "tasks" do
-          username ad_vault[node['ad']['domain_admin_username_field']]
-          password ad_vault[node['ad']['domain_admin_password_field']]
-        end
+          aws_windows "ec2" do
+            username ec2config_user
+            service_username "#{node['ad']['netbios_name']}\\#{ec2config_user}"
+            password ec2config_password
+          end
 
-        sshd_service "sshd" do
-          service_username "#{node['ad']['netbios_name']}\\#{sshd_user}"
-          username sshd_user
-          password sshd_password
-        end
+          scheduled_tasks "tasks" do
+            username ad_vault[node['ad']['domain_admin_username_field']]
+            password ad_vault[node['ad']['domain_admin_password_field']]
+          end
 
-        begin
-          resources('service[sshd]')
-        rescue Chef::Exceptions::ResourceNotFound
-          service "sshd" do
-            action [:enable, :start]
-            sensitive true
+          sshd_service "sshd" do
+            service_username "#{node['ad']['netbios_name']}\\#{sshd_user}"
+            username sshd_user
+            password sshd_password
           end
-        end
-      else
-        windows_users node['hostname'] do
-          username node['windows_admin_username']
-          password windows_vault[node['windows_auth_password_field']]
-          ssh_user sshd_user
-          ssh_password sshd_password
-          ec2config_user ec2config_user
-          ec2config_password ec2config_password
-        end
 
-        aws_windows "ec2" do
-          username ec2config_user
-          service_username ".\\#{ec2config_user}"
-          password ec2config_password
-        end
+          begin
+            resources('service[sshd]')
+          escue Chef::Exceptions::ResourceNotFound
+            service "sshd" do
+              action [:enable, :start]
+              sensitive true
+            end
+          end
+        else
+          windows_users node['hostname'] do
+            username node['windows_admin_username']
+            password windows_vault[node['windows_auth_password_field']]
+            ssh_user sshd_user
+            ssh_password sshd_password
+            ec2config_user ec2config_user
+            ec2config_password ec2config_password
+          end
 
-        scheduled_tasks "tasks" do
-          username node['windows_admin_username']
-          password windows_vault[node['windows_auth_password_field']]
-        end
+          aws_windows "ec2" do
+            username ec2config_user
+            service_username ".\\#{ec2config_user}"
+            password ec2config_password
+          end
 
-        sshd_service "sshd" do
-          username sshd_user
-          service_username ".\\#{sshd_user}"
-          password sshd_password
+          scheduled_tasks "tasks" do
+            username node['windows_admin_username']
+            password windows_vault[node['windows_auth_password_field']]
+          end
+
+          sshd_service "sshd" do
+            username sshd_user
+            service_username ".\\#{sshd_user}"
+            password sshd_password
         end
         begin
           resources('service[sshd]')
@@ -195,8 +324,13 @@ if !node['application_attributes']['skip_recipes'].include?('windows-client')
           end
         end
       end
+    end
 
     else
       Chef::Log.info("mu-tools::windows-client: Unsupported platform #{node['platform']}")
   end
 end
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Cookbook Name:: mu-tools
+# Recipe:: windows-client