provizioning 0.1.2 → 0.4.0

data/puppet/modules/ssh/manifests/init.pp

@@ -0,0 +1,74 @@
+import "*.pp"
+
+class ssh {
+
+    package { ssh:
+        name   => $operatingsystem ? {
+            default    => "openssh",
+            },
+        ensure => present,
+    }
+
+    package { ssh-client:
+        name   => $operatingsystem ? {
+            default    => "openssh-clients",
+            },
+        ensure => present,
+    }
+
+}
+
+class ssh::server {
+
+    include ssh
+
+    package { sshd:
+        name   => $operatingsystem ? {
+            default    => "openssh-server",
+            },
+        ensure => present,
+    }
+
+    service { sshd:
+        name => $operatingsystem ? {
+            default => "sshd",
+            },
+        ensure => running,
+        enable => true,
+        hasrestart => true,
+        hasstatus => true,
+        require => Package["sshd"],
+        subscribe => File["sshd.conf"],
+    }
+
+    file {    
+             "sshd_config":
+            mode => 600, owner => root, group => root,
+            require => Package[ssh-server],
+            ensure => present,
+            path => $operatingsystem ?{
+                default => "/etc/ssh/sshd_config",
+            },
+    }
+
+}
+
+define ssh::config ($value) {
+
+    # Augeas version. 
+    augeas {
+        "sshd_config_$name":
+        context =>  "/files/etc/ssh/sshd_config",
+        changes =>  "set $name $value",
+        onlyif  =>  "get $name != $value",
+        # onlyif  =>  "match $name/*[.='$value'] size == 0",
+    }
+
+    # Davids' replaceline version (to fix) 
+    # replaceline {
+    #    "sshd_config_$name":
+    #    file => "/etc/ssh/sshd_config",
+    #    pattern => "$name",
+    #    replacement => "^$name $value",
+    # }
+}

data/puppet/modules/stow/manifests/init.pp

@@ -0,0 +1,5 @@
+class stow {
+  package{ "stow":
+    ensure => installed,
+  }  
+}

data/puppet/modules/sudo/files/sudoers

@@ -0,0 +1,25 @@
+# /etc/sudoers
+#
+# This file MUST be edited with the 'visudo' command as root.
+#
+# See the man page for details on how to write a sudoers file.
+#
+
+Defaults	env_reset
+
+# Host alias specification
+
+# User alias specification
+
+# Cmnd alias specification
+
+# User privilege specification
+root	ALL=(ALL) ALL
+
+# Uncomment to allow members of group sudo to not need a password
+# (Note that later entries override this, so you might need to move
+# it further down)
+# %sudo ALL=NOPASSWD: ALL
+
+# Members of the admin group may gain root privileges
+%admin ALL=(ALL) ALL

data/puppet/modules/sudo/manifests/init.pp

@@ -0,0 +1 @@
+import "*"

data/puppet/modules/sudo/manifests/install.pp

@@ -0,0 +1,5 @@
+class sudo::install {
+  package{ "sudo":
+    ensure => installed,
+  }
+}

data/puppet/modules/sudo/manifests/sudoers.pp

@@ -0,0 +1,14 @@
+class sudo::sudoers {
+
+  file { "/tmp/sudoers":
+    mode => 440,
+    source => "puppet:///modules/sudo/sudoers",
+    notify => Exec["check-sudoers"],
+  }
+
+  exec { "check-sudoers":
+    command => "/usr/sbin/visudo -cf /tmp/sudoers && cp /tmp/sudoers /etc/sudoers",
+    refreshonly => true,
+  }
+
+}

data/puppet/modules/ufw/manifests/init.pp

@@ -0,0 +1,12 @@
+class ufw {
+  package{ "ufw":
+    ensure => installed,
+  }
+  
+  exec { "Set default rules":
+    user => "root",
+    path => "/usr/bin:/usr/sbin:/bin",
+    command => "ufw allow to 0.0.0.0/0 port 80 && ufw allow to 0.0.0.0/0 port 443 && ufw allow to 0.0.0.0/0 port 3000 && ufw allow 10000:10020/tcp && ufw allow to 0.0.0.0/0 port 22",
+    require => Package["ufw"],
+  }
+}

data/puppet/modules/users/README

@@ -0,0 +1,28 @@
+Puppet module: users 
+
+# Written by Lab42 #
+# http://www.example42.com
+
+Licence: GPLv3
+
+
+DESCRIPTION:
+This module provides users management on the system.
+It manages both local users (you have obviously to add them according to custom needs) and external authentication sources, such as ldap. It provides automount features.
+
+
+USER VARIABLES:
+In order to customize the behaviour of the module you can set the following variables:
+$users_auth  (default: "local") - Defines the authentication method to be used. Default uses only local authentication, set to "ldap" to ADD ldap authentication.
+$users_ldap_servers  (default: ["ldapm.example42.com","ldaps.example42.com"]) - Defines the ldap backend server(s) you want to use for ldap authentication
+$users_ldap_basedn (default: "dc=example42,dc=com") - Defines the ldap base dn for ldap authentication
+$users_ldap_ssl (default: "no") - Defines if you want to use SSL for ldap authentication 
+$users_automount (default: "no") - Set to "yes" if you want to enable homes automount
+
+
+USAGE:
+# Standard Classes 
+include users # Manages users via Puppet. Set the above variables to manage ldap authentication.
+              # If $my_project is set, it autoloads users::$my_project where you can define custom local users and custom configurations
+
+DEPENDENCIES:

data/puppet/modules/users/manifests/adduser.pp

@@ -0,0 +1,16 @@
+define adduser ( $uid='', $gid='', $shell='/bin/bash', $home='', $comment='', $password='', $groups='' ) {
+
+    user {
+        "$name":
+# Temp fix for err: //Node[test.example42.com]/general/hardening::eal4/users::admins/Adduser[admin]/User[admin]/uid: change from 500 to  failed: Could not set uid on user[admin]: Execution of '/usr/sbin/usermod -u  admin' returned 4: usermod: uid 0 is not unique
+# Uncomment and fix when necessary
+#            uid      => $uid,
+#            gid      => $gid,
+            shell    => $shell,
+            comment  => $comment,
+            home     => $home,
+            password => $password,
+            groups   => $groups,
+            ensure   => present,
+       }
+}

data/puppet/modules/users/manifests/admin.pp

@@ -0,0 +1,11 @@
+class users::admin {
+# Creates user: admin with wheel privileges
+# Default password = 'example'  CHANGE IT
+    user {
+        "admin":
+        ensure   => present,
+        groups   => 'wheel',
+# Default password = 'example'  CHANGE IT before uncommenting
+#        password => '$1$xd/jf97n$ZAhAz.CIGJ0gUECBohz/..',
+    }
+}

data/puppet/modules/users/manifests/automount.pp

@@ -0,0 +1,34 @@
+# Class: users::automount
+#
+# Manages users' home directory automount 
+#
+# Usage:
+# Set $users_auth = "ldap" and $users_automount = "yes" and
+# include users
+# NOTE/TODO: This class is made for automounter based on ldap. When and if other auth methods will be supported this class will be refactored.
+# 
+# Variables:
+# $users_automount (default: "no") - Set to "yes" if you want to enable homes automount
+#
+class users::automount {
+
+# Load the variables used in this module. Check the params.pp file
+    include users::params
+
+    $users_ldap_servers = $users::params::ldap_servers
+    $users_ldap_basedn = $users::params::ldap_basedn
+    $users_ldap_ssl = $users::params::ldap_ssl 
+    $users_automount = $users::params::automount 
+
+# Required packages
+    case $operatingsystem {
+        ubuntu,debian: {
+             package { "autofs": ensure => present }
+             package { "autofs-ldap": ensure => present }
+        }
+        redhat,centos: {
+        }
+    }
+
+}
+

data/puppet/modules/users/manifests/deluser.pp

@@ -0,0 +1,8 @@
+define deluser {
+
+    user {
+        "$name":
+            ensure   => absent,
+       }
+}
+

data/puppet/modules/users/manifests/example42.pp

@@ -0,0 +1,16 @@
+class users::example42 {
+# Adds a local "example42" user, With password "example42".
+       user {
+        "example42":
+            comment  => "Example 42 default user",
+            password => '$1$xd/jf97n$ZAhAz.CIGJ0gUECBohz/..',
+            ensure   => present,
+       }
+
+# Uncomment below to remove example42 user
+#       user {
+#        "example42":
+#            ensure   => absent,
+#       }
+
+}

data/puppet/modules/users/manifests/init.pp

@@ -0,0 +1,31 @@
+# Class: users
+#
+# Manages local users and external authentication methods 
+#
+# Usage:
+# include users
+#
+# Variables:
+# $users_auth  (default: "local") - Defines the authentication method to be used. Default uses only local authentication, set to "ldap" to ADD ldap authentication.
+# $users_ldap_servers  (default: ["ldapm.example42.com","ldaps.example42.com"]) - Defines the ldap backend server(s) you want to use for ldap authentication
+# $users_ldap_basedn (default: "dc=example42,dc=com") - Defines the ldap base dn for ldap authentication
+# $users_ldap_ssl (default: "no") - Defines if you want to use SSL for ldap authentication 
+# $users_automount (default: "no") - Set to "yes" if you want to enable homes automount
+#
+class users {
+
+# Load the variables used in this module. Check the params.pp file
+    include users::params
+
+# Include the relevant subclass according to $users_auth settings
+    case $users::params::auth {
+        ldap: { include users::ldap }
+# TODO  ads: { include users::ads }
+# TODO  nis: { include users::nis }
+    }
+
+# Autoloads users::$my_project if $my_project is defined
+# Place in users::$my_project your customizatios
+    if $my_project { include "users::${my_project}" }
+
+}

data/puppet/modules/users/manifests/ldap.pp

@@ -0,0 +1,114 @@
+# Class: users::ldap
+#
+# Manages ldap authentication 
+#
+# Usage:
+# Set $users_auth = "ldap" and
+# include users
+#
+# Variables:
+# $users_ldap_servers  (default: ["ldapm.example42.com","ldaps.example42.com"]) - Defines the ldap backend server(s) you want to use for ldap authentication
+# $users_ldap_basedn (default: "dc=example42,dc=com") - Defines the ldap base dn for ldap authentication
+# $users_ldap_ssl (default: "no") - Defines if you want to use SSL for ldap authentication 
+# $users_automount (default: "no") - Set to "yes" if you want to enable homes automount
+#
+class users::ldap {
+
+# Load the variables used in this module. Check the params.pp file
+    include users::params
+
+    $users_ldap_servers = $users::params::ldap_servers
+    $users_ldap_basedn = $users::params::ldap_basedn
+    $users_ldap_ssl = $users::params::ldap_ssl 
+    $users_ldap_cacert = $users::params::ldap_cacert 
+    $users_automount = $users::params::automount 
+
+# PAM's configurations for ldap are managed in the dedicated pam::ldap class
+    include pam::ldap
+
+# Include autofs::ldap if $users_automount = "yes"
+    if $users::params::automount == "yes" { include "autofs::ldap" }
+
+# Systems' config files for LDAP 
+    file { "nsswitch.conf":
+        path    => "/etc/nsswitch.conf",
+        mode    => "644",
+        owner   => "root",
+        group   => "root",
+        require => [ File["ldap.conf"] ],
+        ensure  => present,
+        content => template("users/ldap/nsswitch.conf.erb"),
+    }
+
+    file { "ldap.conf":
+        path    => $users::params::configfile_ldap ,
+        mode    => "644",
+        owner   => "root",
+        group   => "root",
+        ensure  => present,
+        content => template("users/ldap/ldap.conf.erb"),
+    }
+
+# Openldap client config
+    file { "openldap-ldap.conf":
+        path    => $operatingsystem ? {
+            debian => "/etc/ldap/ldap.conf",
+            ubuntu => "/etc/ldap/ldap.conf",
+            redhat => "/etc/openldap/ldap.conf",
+            centos => "/etc/openldap/ldap.conf",
+        },
+        mode    => "644",
+        owner   => "root",
+        group   => "root",
+        ensure  => present,
+        content => template("users/ldap/openldap-ldap.conf.erb"),
+    # TOTO - Breaks on ubuntu804 - Verify
+    #    notify  => $users_automount ? {
+    #        "yes"   => "Service[autofs]",
+    #        default => undef,
+    #    },
+    }
+
+    case $users_ldap_ssl {
+        yes: {
+            file { "ldap_cacert":
+                path    => "${users::params::ldap_cacert}",
+                mode    => "644",
+                owner   => "root",
+                group   => "root",
+                ensure  => present,
+                source => "${users::params::users_source}/ldap/cacert.pem",
+            }
+        }
+    }
+
+
+# Required packages
+    case $operatingsystem {
+        Ubuntu,Debian: {
+             package { "libpam-ldap": ensure => present }
+             package { "libnss-ldap": ensure => present }
+             package { "ldap-utils": ensure => present }
+
+             case $lsbdistcodename {
+                 lenny: {
+                     # Debian 5, by default, uses a separated file for pam ldap settings 
+                     file { "pam_ldap.conf":
+                         path    => "/etc/pam_ldap.conf",
+                         mode    => "644",
+                         owner   => "root",
+                         group   => "root",
+                         ensure  => present,
+                         content => template("users/ldap/ldap.conf.erb"),
+                     }
+                 }
+             }
+
+        }
+        redhat,centos: {
+             package { "nss_ldap": ensure => present }
+        }
+    }
+
+}
+

data/puppet/modules/users/manifests/params.pp

@@ -0,0 +1,84 @@
+# Class: users::params
+#
+# Defines users parameters
+# In this class are defined as variables values that are used in other users classes
+# This class should be included, where necessary, and eventually be enhanced with support for more OS
+# You don't have generally to modify this file.
+#
+class users::params  {
+
+## DEFAULTS FOR VARIABLES USERS CAN SET
+# (Here are set the defaults, provide your custom variables externally)
+
+# Define the authentication method to be used 
+    $auth = $users_auth ? {
+        ''      => "local",
+        default => $users_auth,
+    }
+
+# Define the ldap server(s) to use (If $users_auth=ldap) 
+    $ldap_servers = $users_ldap_servers ? {
+        ''      => [ "ldapm.example42.com" , "ldaps.example42.com" ],
+        default => $users_ldap_servers,
+    }
+
+# Define the ldap basdn to use (If $users_auth=ldap)
+    $ldap_basedn = $users_ldap_basedn ? {
+        ''      => "dc=example42,dc=com",
+        default => $users_ldap_basedn,
+    }
+
+# Define if you want to use SSL for ldap authentication (If $users_auth=ldap)
+    $ldap_ssl = $users_ldap_ssl ? {
+        ''      => "no",
+        default => $users_ldap_ssl,
+    }
+
+# Define if you want to use automount (If $users_auth=ldap)
+    $automount = $users_automount ? {
+        ''      => "no",
+        default => $users_automount,
+    }
+
+
+
+## MODULES INTERNAL VARIABLES
+# (Modify only to adapt to unsupported OSes)
+
+    $ldap_cacert = $operatingsystem ? {
+        'debian' => "/etc/ldap/cacert.pem",
+        'ubuntu' => "/etc/ldap/cacert.pem",
+        default  => "/etc/openldap/cacert.pem",
+    }
+
+    $configfile_ldap = $operatingsystem ? {
+            debian => $lsbdistid ? {
+                 debian => "/etc/libnss-ldap.conf",
+                 ubuntu => "/etc/ldap.conf",
+            },
+            ubuntu => "/etc/ldap.conf",
+            redhat => "/etc/ldap.conf",
+            centos => "/etc/ldap.conf",
+    }
+
+
+## FILE SERVING SOURCE
+# Sets the correct source for static files
+# In order to provide files from different sources without modifying the module
+# you can override the default source path setting the variable $base_source
+# Ex: $base_source="puppet://ip.of.fileserver" or $base_source="puppet://$servername/myprojectmodule"
+ 
+# What follows automatically manages the new source standard (with /modules/) from 0.25 
+
+    case $base_source {
+        '': { $general_base_source="puppet://$servername" }
+        default: { $general_base_source=$base_source }
+    }
+
+    $users_source = $puppetversion ? {
+        /(^0.25)/ => "$general_base_source/modules/users",
+        /(^0.)/   => "$general_base_source/users",
+        default   => "$general_base_source/modules/users",
+    }
+
+}

data/puppet/modules/users/templates/ldap/ldap.conf.erb

@@ -0,0 +1,13 @@
+# File managed by Puppet
+host <% users_ldap_servers.each do |ldap| %><%= ldap %> <% end %>
+base <%= users_ldap_basedn %>
+pam_password exop
+pam_lookup_policy yes
+
+<% if users_ldap_ssl == "yes" && operatingsystem != "Ubuntu" -%>
+ssl start_tls
+tls_cacertfile <%= users_ldap_cacert %>
+tls_checkpeer yes
+<% end -%>
+
+nss_initgroups_ignoreusers Debian-exim,backup,bin,daemon,dhcp,games,gnats,irc,klog,libuuid,list,lp,mail,man,news,ntpd,proxy,root,snmp,sshd,statd,sync,sys,syslog,uucp,www-data

data/puppet/modules/users/templates/ldap/nsswitch.conf.erb

@@ -0,0 +1,23 @@
+# /etc/nsswitch.conf
+#
+# File managed by Puppet
+
+passwd:         files ldap
+group:          files
+shadow:         files ldap
+<% if users_automount == "yes" -%>
+automount:	ldap
+<% else -%>
+automount:	files
+<% end -%>
+
+hosts:          files dns
+networks:       files
+
+protocols:      db files
+services:       db files
+ethers:         db files
+rpc:            db files
+
+# netgroup:       nis
+

data/puppet/modules/users/templates/ldap/openldap-ldap.conf.erb

@@ -0,0 +1,8 @@
+# File Managed by Puppet
+HOST <% users_ldap_servers.each do |ldap| -%><%= ldap -%> <% end %>
+URI ldap://<%= users_ldap_servers.first %>
+BASE <%= users_ldap_basedn %>
+<% if users_ldap_ssl == "yes" -%>
+TLS_CACERT <%= users_ldap_cacert %>
+TLS_REQCERT demand
+<% end -%>

data/puppet/modules/webmin/manifests/init.pp

@@ -0,0 +1,31 @@
+class webmin {
+    $base = "webmin_1.480_all.deb"
+    $url = "http://prdownloads.sourceforge.net/webadmin/"
+    $archive = "/root/$base"
+    $installed = "/etc/webmin/version"
+
+    package { "libnet-ssleay-perl": ensure => installed }
+    package { "libauthen-pam-perl": ensure => installed }
+    package { "libio-pty-perl": ensure => installed }
+    package { "libmd5-perl": ensure => installed }
+
+    service { webmin:
+        ensure => running,
+        require => Exec["InstallWebmin"],
+        provider => init;
+    }
+
+    exec { "DownloadWebmin":
+        cwd => "/root",
+        command => "wget $url$base",
+        creates => $archive,
+    }
+
+    exec { "InstallWebmin":
+        cwd => "/root",
+        command => "dpkg -i $archive",
+        creates => $installed,
+        require => Exec["DownloadWebmin"],
+        notify => Service[webmin],
+    }
+}

data/puppet/roles/blank.pp

@@ -0,0 +1 @@
+# This role intentionally left blank

data/puppet/site.pp

@@ -0,0 +1,8 @@
+Exec {
+  path => "/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
+}
+
+import "classes/*"
+include base, gemrc, postfix, logrotate, ufw, imagemagick
+
+import "roles/*"