From d8dd2fc39ae329ceefbb1a695579858403705880 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 14 Aug 2018 12:40:40 +0200 Subject: Modify generate password --- .../lib/puppet/functions/generate_password.rb | 49 ++++++++++++++++++++++ .../puppet/parser/functions/generate_password.rb | 31 -------------- 2 files changed, 49 insertions(+), 31 deletions(-) create mode 100644 modules/base_installation/lib/puppet/functions/generate_password.rb delete mode 100644 modules/base_installation/lib/puppet/parser/functions/generate_password.rb (limited to 'modules/base_installation') diff --git a/modules/base_installation/lib/puppet/functions/generate_password.rb b/modules/base_installation/lib/puppet/functions/generate_password.rb new file mode 100644 index 0000000..0ccd4d6 --- /dev/null +++ b/modules/base_installation/lib/puppet/functions/generate_password.rb @@ -0,0 +1,49 @@ +require "base64" +require "openssl" + +Puppet::Functions.create_function(:generate_password) do + dispatch :generate_password do + param 'Integer', :size + param 'String', :seed_file + param 'String', :password_key + optional_param 'String', :method + optional_param 'Boolean', :encode + return_type 'String' + end + + def generate_password(size, seed_file, password_key, method = nil, encode = false) + key = get_key(seed_file, password_key) + case method + when nil + pass = generate_string(size, key) + when "curve25519" + pass = generate_string(32, key, binary = true) + pass[0] = (pass[0].ord & 248).chr + pass[31] = ((pass[31].ord & 127) | 64).chr + else + raise "Unknown method" + end + + if encode + Base64.strict_encode64(pass).strip + else + pass + end + end + + def generate_string(size, key, binary = false) + if binary + set = (0 .. 255).map { |i| i.chr } + else + set = ('a' .. 'z').to_a + ('A' .. 'Z').to_a + ('0' .. '9').to_a + end + + size.times.collect do |i| + set[OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), key, i.to_s).to_i(16) % set.size] + end.join + end + + def get_key(seed_file, password_key) + "#{File.open(seed_file).read}:#{password_key}" + end +end diff --git a/modules/base_installation/lib/puppet/parser/functions/generate_password.rb b/modules/base_installation/lib/puppet/parser/functions/generate_password.rb deleted file mode 100644 index 384d81b..0000000 --- a/modules/base_installation/lib/puppet/parser/functions/generate_password.rb +++ /dev/null @@ -1,31 +0,0 @@ -module Puppet::Parser::Functions - newfunction(:generate_password, :type => :rvalue, :doc => <<-EOS -Returns a semi-random string based on a seed and a value. Will always generate the same value with the same entry. -Prototype: - generate_password(length, seed_file, password_key) -EOS -) do |*arguments| - arguments = arguments.shift if arguments.first.is_a?(Array) - - raise Puppet::ParseError, "generate_password(): Wrong number of arguments " + - "given (#{arguments.size} for 3)" if arguments.size != 3 - - size = arguments.shift - seed_file = arguments.shift - password_key = arguments.shift - - unless size.class.ancestors.include?(Numeric) or size.is_a?(String) - raise Puppet::ParseError, 'generate_password(): Requires a numeric first argument' - end - - size = size.to_i - - set = ('a' .. 'z').to_a + ('A' .. 'Z').to_a + ('0' .. '9').to_a - - key = "#{File.open(seed_file).read}:#{password_key}" - - size.times.collect do |i| - set[OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), key, i.to_s).to_i(16) % set.size] - end.join -end -end -- cgit v1.2.3 From 7dc85dc776e158e26202362f11a72d7491ef07c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 14 Aug 2018 22:49:29 +0200 Subject: Change host_ldap to concat --- modules/base_installation/manifests/puppet.pp | 32 ++++++++++++++--- .../templates/puppet/host_ldap.info.erb | 41 ---------------------- .../templates/puppet/host_ldap_add_top.info.erb | 16 +++++++++ .../templates/puppet/host_ldap_mod_top.info.erb | 23 ++++++++++++ 4 files changed, 67 insertions(+), 45 deletions(-) delete mode 100644 modules/base_installation/templates/puppet/host_ldap.info.erb create mode 100644 modules/base_installation/templates/puppet/host_ldap_add_top.info.erb create mode 100644 modules/base_installation/templates/puppet/host_ldap_mod_top.info.erb (limited to 'modules/base_installation') diff --git a/modules/base_installation/manifests/puppet.pp b/modules/base_installation/manifests/puppet.pp index 05fe9a1..10b3773 100644 --- a/modules/base_installation/manifests/puppet.pp +++ b/modules/base_installation/manifests/puppet.pp @@ -109,10 +109,34 @@ class base_installation::puppet ( } $ips = lookup("ips", { 'default_value' => undef }) - file { "$base_installation::puppet_conf_path/host_ldap.info": - content => template("base_installation/puppet/host_ldap.info.erb"), - require => File[$base_installation::puppet_conf_path], - notify => Notify_refresh["notify-ldap-password"], + concat { "$base_installation::puppet_conf_path/host_ldap.info": + ensure => "present", + mode => "0600", + require => File[$base_installation::puppet_conf_path], + notify => Notify_refresh["notify-ldap-password"], + ensure_newline => true, + } + + concat::fragment { "host_ldap add top": + target => "$base_installation::puppet_conf_path/host_ldap.info", + content => template("base_installation/puppet/host_ldap_add_top.info.erb"), + order => "00-01", + } + concat::fragment { "host_ldap add bottom": + target => "$base_installation::puppet_conf_path/host_ldap.info", + content => "EOF", + order => "00-99", + } + + concat::fragment { "host_ldap mod top": + target => "$base_installation::puppet_conf_path/host_ldap.info", + content => template("base_installation/puppet/host_ldap_mod_top.info.erb"), + order => "01-01", + } + concat::fragment { "host_ldap mod bottom": + target => "$base_installation::puppet_conf_path/host_ldap.info", + content => "EOF", + order => "01-99", } notify_refresh { "notify-ldap-password": diff --git a/modules/base_installation/templates/puppet/host_ldap.info.erb b/modules/base_installation/templates/puppet/host_ldap.info.erb deleted file mode 100644 index 7afdf2d..0000000 --- a/modules/base_installation/templates/puppet/host_ldap.info.erb +++ /dev/null @@ -1,41 +0,0 @@ -#### Please add this node to LDAP: -ldapadd -D "cn=root,<%= @ldap_base %>" -W << 'EOF' -dn: <%= @ldap_dn %> -cn: <%= @ldap_cn %> -objectclass: device -objectclass: top -objectclass: simpleSecurityObject -objectclass: puppetClient -<%- unless @ips.empty? -%> -objectclass: ipHost -<% unless @ips["v4"].nil? -%>ipHostNumber: <%= @ips["v4"]["ipAddress"] %><%- end %> -<% unless @ips["v6"].nil? -%>ipHostNumber: <%= @ips["v6"]["ipAddress"] %>/<%= @ips["v6"]["mask"] %><%- end %> -<%- end -%> -environment: <%= @environment %> -puppetVar: real_hostname=<%= @real_hostname %> -userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> -EOF -#### Or modify an existing entry: -ldapmodify -D "cn=root,<%= @ldap_base %>" -W << 'EOF' -dn: <%= @ldap_dn %> -changetype: modify -replace: userPassword -userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> -- -replace: environment -environment: <%= @environment %> -<%- unless @ips.empty? -%> -- -delete: ipHostNumber -<%- unless @ips["v4"].nil? -%> -- -add: ipHostNumber -ipHostNumber: <%= @ips["v4"]["ipAddress"] %> -<%- end -%> -<%- unless @ips["v6"].nil? -%> -- -add: ipHostNumber -ipHostNumber: <%= @ips["v6"]["ipAddress"] %>/<%= @ips["v6"]["mask"] %> -<%- end -%> -<%- end -%> -EOF diff --git a/modules/base_installation/templates/puppet/host_ldap_add_top.info.erb b/modules/base_installation/templates/puppet/host_ldap_add_top.info.erb new file mode 100644 index 0000000..3aafc19 --- /dev/null +++ b/modules/base_installation/templates/puppet/host_ldap_add_top.info.erb @@ -0,0 +1,16 @@ +#### Please add this node to LDAP: +ldapadd -D "cn=root,<%= @ldap_base %>" -W << 'EOF' +dn: <%= @ldap_dn %> +cn: <%= @ldap_cn %> +objectclass: device +objectclass: top +objectclass: simpleSecurityObject +objectclass: puppetClient +<%- unless @ips.empty? -%> +objectclass: ipHost +<% unless @ips["v4"].nil? -%>ipHostNumber: <%= @ips["v4"]["ipAddress"] %><%- end %> +<% unless @ips["v6"].nil? -%>ipHostNumber: <%= @ips["v6"]["ipAddress"] %>/<%= @ips["v6"]["mask"] %><%- end %> +<%- end -%> +environment: <%= @environment %> +puppetVar: real_hostname=<%= @real_hostname %> +userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> diff --git a/modules/base_installation/templates/puppet/host_ldap_mod_top.info.erb b/modules/base_installation/templates/puppet/host_ldap_mod_top.info.erb new file mode 100644 index 0000000..d7a1294 --- /dev/null +++ b/modules/base_installation/templates/puppet/host_ldap_mod_top.info.erb @@ -0,0 +1,23 @@ +#### Or modify an existing entry: +ldapmodify -D "cn=root,<%= @ldap_base %>" -W << 'EOF' +dn: <%= @ldap_dn %> +changetype: modify +replace: userPassword +userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> +- +replace: environment +environment: <%= @environment %> +<%- unless @ips.empty? -%> +- +delete: ipHostNumber +<%- unless @ips["v4"].nil? -%> +- +add: ipHostNumber +ipHostNumber: <%= @ips["v4"]["ipAddress"] %> +<%- end -%> +<%- unless @ips["v6"].nil? -%> +- +add: ipHostNumber +ipHostNumber: <%= @ips["v6"]["ipAddress"] %>/<%= @ips["v6"]["mask"] %> +<%- end -%> +<%- end -%> -- cgit v1.2.3 From a7b985dd3cc4af68875733eb135335a31504f472 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 17 Aug 2018 12:51:33 +0200 Subject: Add cat_files report to notify of important changes --- .../lib/puppet/reports/cat_files.rb | 17 +++++++++++ modules/base_installation/manifests/init.pp | 33 +++++++++++----------- modules/base_installation/manifests/params.pp | 33 +++++++++++----------- modules/base_installation/manifests/puppet.pp | 28 +++++++++--------- .../templates/puppet/puppet.conf.erb | 2 +- 5 files changed, 67 insertions(+), 46 deletions(-) create mode 100644 modules/base_installation/lib/puppet/reports/cat_files.rb (limited to 'modules/base_installation') diff --git a/modules/base_installation/lib/puppet/reports/cat_files.rb b/modules/base_installation/lib/puppet/reports/cat_files.rb new file mode 100644 index 0000000..9d9c068 --- /dev/null +++ b/modules/base_installation/lib/puppet/reports/cat_files.rb @@ -0,0 +1,17 @@ +require 'puppet' + +Puppet::Reports.register_report(:cat_files) do + FOLLOWED_RESOURCES = [ + "File[/etc/puppetlabs/notifies/host_ldap.info]", + ] + + def process + self.resource_statuses.each do |name, status| + if FOLLOWED_RESOURCES.include?(status.resource) && status.events.any? { |e| e.status == "success" } + puts File.open(status.title, "r").read() + end + end + end + +end + diff --git a/modules/base_installation/manifests/init.pp b/modules/base_installation/manifests/init.pp index d8abcaf..a1b5ca8 100644 --- a/modules/base_installation/manifests/init.pp +++ b/modules/base_installation/manifests/init.pp @@ -1,20 +1,21 @@ class base_installation ( - Optional[String] $grub_device = $base_installation::params::grub_device, - Optional[String] $ldap_base = $base_installation::params::ldap_base, - Optional[String] $ldap_cert_path = $base_installation::params::ldap_cert_path, - Optional[String] $ldap_cn = $base_installation::params::ldap_cn, - Optional[String] $ldap_dn = $base_installation::params::ldap_dn, - Optional[String] $ldap_server = $base_installation::params::ldap_server, - Optional[String] $ldap_uri = $base_installation::params::ldap_uri, - Optional[String] $puppet_code_path = $base_installation::params::puppet_code_path, - Optional[String] $puppet_conf_path = $base_installation::params::puppet_conf_path, - Optional[String] $puppet_pass_seed = $base_installation::params::puppet_pass_seed, - Optional[String] $puppet_ssl_path = $base_installation::params::puppet_ssl_path, - Optional[String] $real_hostname = $base_installation::params::real_hostname, - Optional[String] $system_hostname = $base_installation::params::system_hostname, - Optional[Array[String]] $system_locales = $base_installation::params::system_locales, - Optional[String] $system_timezone = $base_installation::params::system_timezone, - Optional[Array[Hash]] $system_users = $base_installation::params::system_users, + Optional[String] $grub_device = $base_installation::params::grub_device, + Optional[String] $ldap_base = $base_installation::params::ldap_base, + Optional[String] $ldap_cert_path = $base_installation::params::ldap_cert_path, + Optional[String] $ldap_cn = $base_installation::params::ldap_cn, + Optional[String] $ldap_dn = $base_installation::params::ldap_dn, + Optional[String] $ldap_server = $base_installation::params::ldap_server, + Optional[String] $ldap_uri = $base_installation::params::ldap_uri, + Optional[String] $puppet_code_path = $base_installation::params::puppet_code_path, + Optional[String] $puppet_conf_path = $base_installation::params::puppet_conf_path, + Optional[String] $puppet_notifies_path = $base_installation::params::puppet_notifies_path, + Optional[String] $puppet_pass_seed = $base_installation::params::puppet_pass_seed, + Optional[String] $puppet_ssl_path = $base_installation::params::puppet_ssl_path, + Optional[String] $real_hostname = $base_installation::params::real_hostname, + Optional[String] $system_hostname = $base_installation::params::system_hostname, + Optional[Array[String]] $system_locales = $base_installation::params::system_locales, + Optional[String] $system_timezone = $base_installation::params::system_timezone, + Optional[Array[Hash]] $system_users = $base_installation::params::system_users, ) inherits base_installation::params { contain ::base_installation::packages contain ::base_installation::locales diff --git a/modules/base_installation/manifests/params.pp b/modules/base_installation/manifests/params.pp index 5ade838..f336b65 100644 --- a/modules/base_installation/manifests/params.pp +++ b/modules/base_installation/manifests/params.pp @@ -1,20 +1,21 @@ class base_installation::params { - $puppet_code_path = "/etc/puppetlabs/code" - $puppet_conf_path = "/etc/puppetlabs/puppet" - $puppet_pass_seed = "/etc/puppetlabs/puppet/password_seed" - $puppet_ssl_path = "/etc/puppetlabs/ssl" - $grub_device = "/dev/sda" - $ldap_base = "dc=example,dc=com" - $ldap_cn = "node" - $ldap_dn = "cn=node,ou=hosts,dc=example,dc=com" - $ldap_cert_path = "/etc/ssl/certs/ca-certificates.crt" - $ldap_uri = "ldaps://ldap.example.com" - $ldap_server = "ldap.example.com" - $real_hostname = "example.com" - $system_hostname = "example.com" - $system_locales = ["en_US.UTF-8"] - $system_timezone = "UTC" - $system_users = [ + $puppet_code_path = "/etc/puppetlabs/code" + $puppet_conf_path = "/etc/puppetlabs/puppet" + $puppet_notifies_path = "/etc/puppetlabs/notifies" + $puppet_pass_seed = "/etc/puppetlabs/puppet/password_seed" + $puppet_ssl_path = "/etc/puppetlabs/ssl" + $grub_device = "/dev/sda" + $ldap_base = "dc=example,dc=com" + $ldap_cn = "node" + $ldap_dn = "cn=node,ou=hosts,dc=example,dc=com" + $ldap_cert_path = "/etc/ssl/certs/ca-certificates.crt" + $ldap_uri = "ldaps://ldap.example.com" + $ldap_server = "ldap.example.com" + $real_hostname = "example.com" + $system_hostname = "example.com" + $system_locales = ["en_US.UTF-8"] + $system_timezone = "UTC" + $system_users = [ { userid => 1000, username => "example", diff --git a/modules/base_installation/manifests/puppet.pp b/modules/base_installation/manifests/puppet.pp index 10b3773..603a961 100644 --- a/modules/base_installation/manifests/puppet.pp +++ b/modules/base_installation/manifests/puppet.pp @@ -103,45 +103,47 @@ class base_installation::puppet ( } } - if file("$base_installation::puppet_conf_path/host_ldap.info", "/dev/null") != "" and + if file("$base_installation::puppet_notifies_path/host_ldap.info", "/dev/null") != "" and empty($facts["ldapvar"]) { fail("LDAP was activated but facts are not available") } + file { $base_installation::puppet_notifies_path: + ensure => directory, + require => [Package["puppet"], Package["gem:xmpp4r"], Package["gem:ruby-ldap"]], + recurse => true, + purge => true, + force => true, + } + $ips = lookup("ips", { 'default_value' => undef }) - concat { "$base_installation::puppet_conf_path/host_ldap.info": + concat { "$base_installation::puppet_notifies_path/host_ldap.info": ensure => "present", mode => "0600", - require => File[$base_installation::puppet_conf_path], - notify => Notify_refresh["notify-ldap-password"], + require => File[$base_installation::puppet_notifies_path], ensure_newline => true, } concat::fragment { "host_ldap add top": - target => "$base_installation::puppet_conf_path/host_ldap.info", + target => "$base_installation::puppet_notifies_path/host_ldap.info", content => template("base_installation/puppet/host_ldap_add_top.info.erb"), order => "00-01", } concat::fragment { "host_ldap add bottom": - target => "$base_installation::puppet_conf_path/host_ldap.info", + target => "$base_installation::puppet_notifies_path/host_ldap.info", content => "EOF", order => "00-99", } concat::fragment { "host_ldap mod top": - target => "$base_installation::puppet_conf_path/host_ldap.info", + target => "$base_installation::puppet_notifies_path/host_ldap.info", content => template("base_installation/puppet/host_ldap_mod_top.info.erb"), order => "01-01", } concat::fragment { "host_ldap mod bottom": - target => "$base_installation::puppet_conf_path/host_ldap.info", + target => "$base_installation::puppet_notifies_path/host_ldap.info", content => "EOF", order => "01-99", } - - notify_refresh { "notify-ldap-password": - message => template("base_installation/puppet/host_ldap.info.erb"), - refreshonly => true - } } } diff --git a/modules/base_installation/templates/puppet/puppet.conf.erb b/modules/base_installation/templates/puppet/puppet.conf.erb index da39468..38a0c1b 100644 --- a/modules/base_installation/templates/puppet/puppet.conf.erb +++ b/modules/base_installation/templates/puppet/puppet.conf.erb @@ -1,6 +1,6 @@ [main] <% - reports = ["store"] + reports = ["store", "cat_files"] if @xmpp.count > 0 reports << "xmpp" end -- cgit v1.2.3