Skip to content

Commit 5cfcac1

Browse files
author
Brian Pontarelli
committed
Refactored Chef
1 parent 505521b commit 5cfcac1

File tree

15 files changed

+337
-258
lines changed

15 files changed

+337
-258
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
.idea/workspace.xml
22
output
33
bundle
4+
.kitchen

‎chef-repo/cookbooks/2016-security-guide/.kitchen.yml

+4-7
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,15 @@
11
---
22
driver:
33
name: vagrant
4+
network:
5+
- ['private_network', {ip: '192.168.34.34'}]
46

57
provisioner:
68
name: chef_zero
79

8-
# Uncomment the following verifier to leverage Inspec instead of Busser (the
9-
# default verifier)
10-
# verifier:
11-
# name: inspec
12-
1310
platforms:
14-
- name: ubuntu-14.04
15-
- name: centos-7.1
11+
- name: ubuntu-16.04
12+
# - name: centos-7.1
1613

1714
suites:
1815
- name: default

‎chef-repo/cookbooks/2016-security-guide/attributes/default.rb

+46-13
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,46 @@
1-
default['security_guide'] = {
2-
:users => [],
3-
:sudo_group => 'sudo',
4-
:monit => {
5-
:email_server => 'localhost',
6-
:email_port => '25',
7-
:slack_url => '',
8-
:slack_enabled => 'false',
9-
:pushover_application => '',
10-
:pushover_user => '',
11-
:pushover_enabled => 'false'
12-
}
13-
}
1+
# Users to create and users to delete
2+
default['security_guide']['users'] = []
3+
default['security_guide']['home_directory'] = '/home'
4+
default['security_guide']['default_shell'] = '/bin/bash'
5+
6+
# The Sudo group name
7+
case node[:platform]
8+
when "centos", "redhat", "fedora", "suse", "arch"
9+
default['security_guide']['sudo_group'] = 'wheel'
10+
else
11+
default['security_guide']['sudo_group'] = 'sudo'
12+
end
13+
14+
# SSH config
15+
default['security_guide']['sshd']['listen_port'] = 22
16+
17+
# Two-factor config
18+
default['security_guide']['two_factor_enabled'] = true
19+
20+
# Strong password config
21+
default['security_guide']['strong_passwords']['uppercase'] = 1
22+
default['security_guide']['strong_passwords']['lowercase'] = 2
23+
default['security_guide']['strong_passwords']['numbers'] = 1
24+
default['security_guide']['strong_passwords']['other'] = 1
25+
default['security_guide']['strong_passwords']['min_length'] = 10
26+
default['security_guide']['strong_passwords']['different_than_last_by'] = 3
27+
default['security_guide']['strong_passwords']['retry_attempts'] = 3
28+
29+
# Monit configuration for emailing and Slack/Pushover integration
30+
default['security_guide']['monit']['email_server'] = 'localhost'
31+
default['security_guide']['monit']['email_port'] = '25'
32+
default['security_guide']['monit']['slack_url'] = ''
33+
default['security_guide']['monit']['slack_enabled'] = false
34+
default['security_guide']['monit']['pushover_application'] = ''
35+
default['security_guide']['monit']['pushover_user'] = ''
36+
default['security_guide']['monit']['pushover_user'] = ''
37+
default['security_guide']['monit']['pushover_enabled'] = false
38+
39+
# IPTable config
40+
# node['security_guide']['iptables']['tcp']['listen_ports'] is an array of integers that sets the listen ports
41+
# node['security_guide']['iptables']['tcp']['source_ips'] is a hash that sets the source IP addresses for each listen port (if any)
42+
# i.e. {22 => '192.168.32.42'}
43+
# node['security_guide']['iptables']['tcp']['forward_ports'] is a hash that configures port forwarding i.e. {80 => 3000}
44+
default['security_guide']['iptables']['tcp']['listen_ports'] = [22, 80, 443, 3000, 3003]
45+
default['security_guide']['iptables']['tcp']['source_ips'] = {}
46+
default['security_guide']['iptables']['tcp']['forward_ports'] = {80 => 3000, 443 => 3003}

‎chef-repo/cookbooks/2016-security-guide/files/default/sshd

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
@include common-auth
55

66
#
7-
# 2016-SECURITY-SCRIPT ADDITION: Google Authenticator module
7+
# 2016-SECURITY-GUIDE ADDITION: Google Authenticator module
88
#
99
auth [success=done new_authtok_reqd=done default=die] pam_google_authenticator.so nullok
1010

‎chef-repo/cookbooks/2016-security-guide/files/default/sshd_config

-97
This file was deleted.

‎chef-repo/cookbooks/2016-security-guide/recipes/default.rb

+8-130
Original file line numberDiff line numberDiff line change
@@ -4,133 +4,11 @@
44
#
55
# Copyright (c) 2016 Inversoft, All Rights Reserved.
66

7-
# Validate the attributes
8-
if node['security_guide']['users'].length == 0 || node['security_guide']['monit'].attribute?('alert_email') == false
9-
Chef::Application.fatal!('You must specify at least one user and an alert email for Monit')
10-
end
11-
12-
apt_update 'Update the apt cache daily' do
13-
frequency 86_400
14-
action :periodic
15-
end
16-
17-
# Create the ordinary users
18-
node['security_guide']['users'].each do |user|
19-
user user.username do
20-
home "/home/#{user.username}"
21-
manage_home true
22-
shell '/bin/bash'
23-
password user.password
24-
end
25-
26-
# Add the ordinary user to the sudo group
27-
group node['security_guide']['sudo_group'] do
28-
action :modify
29-
members user.username
30-
append true
31-
end
32-
33-
# Setup SSH key's for the ordinary user
34-
directory "/home/#{user.username}/.ssh" do
35-
owner user.username
36-
group user.username
37-
mode '0700'
38-
action :create
39-
end
40-
file "/home/#{user.username}/.ssh/authorized_keys" do
41-
content user.public_key
42-
owner user.username
43-
group user.username
44-
mode '0600'
45-
end
46-
end
47-
48-
# Disable rot user's password
49-
user 'root' do
50-
password '!'
51-
action :modify
52-
end
53-
54-
# Install all the security packages
55-
package 'libpam-cracklib'
56-
package 'libpam-google-authenticator'
57-
package 'ntp'
58-
package 'monit'
59-
package 'ruby'
60-
61-
# Configure the Debian answers for the iptables-persistent package
62-
ruby_block 'debconf-iptables-persistent' do
63-
block do
64-
`echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections`
65-
`echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections`
66-
end
67-
action :create
68-
end
69-
package 'iptables-persistent'
70-
71-
# Install the SSH server configuration file
72-
cookbook_file '/etc/ssh/sshd_config' do
73-
source 'sshd_config'
74-
owner 'root'
75-
group 'root'
76-
mode '0644'
77-
end
78-
79-
# Install the PAM SSH configuration file for two-factor authentication
80-
cookbook_file '/etc/pam.d/sshd' do
81-
source 'sshd'
82-
owner 'root'
83-
group 'root'
84-
mode '0644'
85-
end
86-
87-
# Install the IPTables IPv4 configuration file
88-
cookbook_file '/etc/iptables/rules.v4' do
89-
source 'rules.v4'
90-
owner 'root'
91-
group 'root'
92-
mode '0644'
93-
end
94-
95-
# Install the PAM password module for strong passwords
96-
cookbook_file '/etc/pam.d/common-password' do
97-
source 'common-password'
98-
owner 'root'
99-
group 'root'
100-
mode '0644'
101-
end
102-
103-
# Install the Monit configuration for generating alerts on SSH logins
104-
cookbook_file '/etc/monit/conf.d/ssh-logins' do
105-
source 'ssh-logins'
106-
owner 'root'
107-
group 'root'
108-
mode '0600'
109-
end
110-
111-
# Install the main Monit configuration file that sends the emails
112-
template '/etc/monit/monitrc' do
113-
source 'monitrc.erb'
114-
owner 'root'
115-
group 'root'
116-
mode '0600'
117-
end
118-
119-
# Install the Monit script to send alerts to Slack and Pushover
120-
template '/etc/monit/monit-slack-pushover.rb' do
121-
source 'monit-slack-pushover.rb.erb'
122-
owner 'root'
123-
group 'root'
124-
mode '0700'
125-
end
126-
127-
# Restart all the services
128-
service 'ssh' do
129-
action :restart
130-
end
131-
service 'netfilter-persistent' do
132-
action :restart
133-
end
134-
service 'monit' do
135-
action :restart
136-
end
7+
include_recipe '2016_security_guide::users'
8+
include_recipe '2016_security_guide::strong-passwords'
9+
include_recipe '2016_security_guide::iptables'
10+
include_recipe '2016_security_guide::sshd'
11+
if node['security_guide']['two_factor_enabled']
12+
include_recipe '2016_security_guide::two-factor'
13+
end
14+
include_recipe '2016_security_guide::monit'

‎chef-repo/cookbooks/2016-security-guide/recipes/iptables.rb

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#
2+
# Cookbook Name:: 2016_security_guide
3+
# Recipe:: default
4+
#
5+
# Copyright (c) 2016 Inversoft, All Rights Reserved.
6+
7+
# Configure the Debian answers for the iptables-persistent package
8+
ruby_block 'debconf-iptables-persistent' do
9+
block do
10+
`echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections`
11+
`echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections`
12+
end
13+
action :create
14+
end
15+
package 'iptables-persistent'
16+
17+
# Install the IPTables IPv4 configuration file
18+
template '/etc/iptables/rules.v4' do
19+
source 'rules.v4.erb'
20+
owner 'root'
21+
group 'root'
22+
mode '0644'
23+
end
24+
25+
# Restart the IPTables service
26+
service 'netfilter-persistent' do
27+
action :restart
28+
end

0 commit comments

Comments
 (0)