Merge branch 'develop' of Linux-Help/cookbook-freeipa into master

Berksfile

@@ -3,7 +3,7 @@ source "https://supermarket.chef.io"
 metadata
 
 cookbook 'chef-vault'
-cookbook 'ohai'
+#cookbook 'ohai'
-cookbook 'ohai-rootsshkey', path: '../ohai-rootsshkey'
+#cookbook 'ohai-rootsshkey', path: '../ohai-rootsshkey'
-cookbook 'sshroot2rootssh', path: '../sshroot2rootssh'
+#cookbook 'sshroot2rootssh', path: '../sshroot2rootssh'
 

metadata.rb

@@ -4,8 +4,10 @@ maintainer_email 'psi-jack@linux-help.org'
 license          'GPLv3'
 description      'Installs/Configures freeipa'
 long_description 'Installs/Configures freeipa'
-version          '0.1.5'
+version          '0.1.7'
+issues_url       'http://git.linux-help.org/Linux-Help/freeipa/issues'
+source_url       'http://git.linux-help.org/Linux-Help/freeipa'
 
-depends 'ohai'
 depends 'chef-vault'
-depends 'sshroot2rootssh'
+#depends 'ohai'
+#depends 'sshroot2rootssh'

providers/group.rb

@@ -2,6 +2,8 @@ def whyrun_supported?
   true
 end
 
+use_inline_resources
+
 action :remove do
   Chef::Log.warn('Remove ipa_group triggered')
 end

providers/user.rb

@@ -24,6 +24,10 @@ end
 private
 
 def ipa_krblogin
+  #File.open("/tmp/ipa.admin", "w") do |f|
+  #  f.write(passwords["ipa_user_pwd"]
+  #end
+
   if ::File.exist?('/etc/ipa/admin.password') then
     system 'kinit admin -l 1h < /etc/ipa/admin.password &>/dev/null'
     if $? == 0 then

recipes/client.rb

@@ -17,16 +17,18 @@
 # limitations under the License.
 #
 
-include_recipe 'chef-vault'
-
-node.set[:freeipa][:client] = true
-
 # become aware servers
-freeipa_servers = search(:node, "freeipa_server:true")
+if Chef::Config[:solo]
-freeipa_clients = search(:node, "freeipa_client:true")
+  Chef::Log.warn('This recipe uses search. Chef solo does not support search.')
-freeipa_masters = search(:node, "freeipa_master:true")
+else
+  include_recipe 'chef-vault'
+  node.normal["freeipa"]["client"] = true
 
-unless freeipa_servers.empty? then
+  freeipa_servers = search("node", "freeipa_server:true")
+  freeipa_clients = search("node", "freeipa_client:true")
+  freeipa_masters = search("node", "freeipa_master:true")
+  
+  unless freeipa_servers.empty? then
     package "ipa-client"
     package "openldap-clients"
     package "dbus"
@@ -49,8 +51,8 @@ unless freeipa_servers.empty? then
       not_if	{ File.exist?("/var/lib/ipa-client/sysrestore/sysrestore.index") }
       cmd =	"ipa-client-install"
       cmd +=	" --server " + freeipa_masters[0][:fqdn]
-    cmd +=	" --domain " + node[:domain]
+      cmd +=	" --domain " + node["domain"]
-    cmd +=	" --realm " + node[:domain].upcase
+      cmd +=	" --realm " + node["domain"].upcase
       cmd +=	" --mkhomedir --unattended"
       cmd +=      " -p admin -w " + passwords['ldap_server_admin_pwd']
       sensitive	true
@@ -66,18 +68,19 @@ unless freeipa_servers.empty? then
     # submit csr
     # enable dbus
     # get host cert?
-#  execute "requesting host principal certificate" do 
+  #  execute "requesting host principal certificate" do 
-#    cmd = "ipa-getcert request -r"
+  #    cmd = "ipa-getcert request -r"
-#    cmd += " -f /tmp/affs-server.crt"
+  #    cmd += " -f /tmp/affs-server.crt"
-#    cmd += " -k /tmp/affs-server.key"
+  #    cmd += " -k /tmp/affs-server.key"
-#    cmd += " -N CN= " + node[:fqdn]
+  #    cmd += " -N CN= " + node[:fqdn]
-#    cmd += " -K host/" + node[:fqdn]
+  #    cmd += " -K host/" + node[:fqdn]
-#    cmd += " -D " + node[:fqdn]
+  #    cmd += " -D " + node[:fqdn]
-#    cmd += " -U id-kp-serverAuth"
+  #    cmd += " -U id-kp-serverAuth"
-#    puts "DEBUG: #{cmd}"
+  #    puts "DEBUG: #{cmd}"
-#    command cmd
+  #    command cmd
-#  end
+  #  end
   
     # get http cert?
+  end
 end
 

recipes/server.rb

@@ -19,60 +19,52 @@
 
 include_recipe 'chef-vault'
 
-node.set[:freeipa][:server] = true
+node.normal["freeipa"]["server"] = true
 
 # become aware of clients and servers
-freeipa_servers = search(:node, "freeipa_server:true")
+if Chef::Config[:solo]
-freeipa_clients = search(:node, "freeipa_client:true")
+  Chef::Log.warn('This recipe uses search. Chef solo does not support search.')
+else
+  freeipa_servers = search(:node, "freeipa_server:true")
+  freeipa_clients = search(:node, "freeipa_client:true")
 
-# gather data bag secrets
+  # gather data bag secrets
-#secret = Chef::EncryptedDataBagItem.load_secret("/home/psi-jack/.chef/encrypted_data_bag_secret")
+  passwords = chef_vault_item("freeipa", 'passwords')
-#passwords = Chef::EncryptedDataBagItem.load("secrets", "passwords", secret)
-passwords = chef_vault_item(:freeipa, 'passwords')
-#ldap_server_admin_pwd = data_bag_item('secrets','ldap_server_admin_pwd')['value']
-#kdc_database_master_key = data_bag_item('secrets','kdc_database_master_key')['value']
-#ipa_user_pwd = data_bag_item('secrets','ipa_user_pwd')['value']
   
-# packages
+  # packages
-#package "dbus"
+  package 'ipa-server' do
-#package "oddjob"
+    case node["platform"]
-#package "ipa-client"
-#package "ipa-server"
-#package "rsync"
-
-package 'ipa-server' do
-  case node[:platform]
     when 'redhat', 'centos'
       package_name 'ipa-server'
     end
     action	:install
-end
+  end
   
-##### Security considerations
+  ##### Security considerations
-# All FreeIPA server hosts need to be able to ssh to each other as root to copy replication configs
+  # All FreeIPA server hosts need to be able to ssh to each other as root to copy replication configs
-# That kind of sucks, but what are the real consequences?
+  # That kind of sucks, but what are the real consequences?
-# Since they are replicants of each other, this can be justified, since the data is already compromised.
+  # Since they are replicants of each other, this can be justified, since the data is already compromised.
-# Can selinux help mitigate this?
+  # Can selinux help mitigate this?
-#include_recipe "ohai"
+  #include_recipe "ohai"
-include_recipe "sshroot2rootssh" 
+  #include_recipe "sshroot2rootssh" 
   
-##### Replication
+  ##### Replication
-# We're going to have to 
+  # We're going to have to 
-# a) detect any new freeipa_servers
+  # a) detect any new freeipa_servers
-# b) generate ipa-replica-prepare output for them
+  # b) generate ipa-replica-prepare output for them
-# c) copy the configs to them
+  # c) copy the configs to them
   
-### Behavor
+  ### Behavor
-# First node sets special attribute "master"
+  # First node sets special attribute "master"
-# First node configures itself with newly generated crypto
+  # First node configures itself with newly generated crypto
   
-# Subsequent nodes comes up
+  # Subsequent nodes comes up
-# Subsequent nodes try to to scp their fqdn's configuration from master
+  # Subsequent nodes try to to scp their fqdn's configuration from master
-# Subsequent nodes negotiate for master
+  # Subsequent nodes negotiate for master
   
-# negotiate for master
+  # negotiate for master
-freeipa_masters = search(:node, "freeipa_master:true")
+  freeipa_masters = search(:node, "freeipa_master:true")
-if freeipa_masters.empty? then
+  if freeipa_masters.empty? then
     ##### Do master stuff
   
     # write better tests to see if freeipa is already set up.
@@ -80,12 +72,12 @@ if freeipa_masters.empty? then
     execute "initializing freeipa-server" do
       not_if	{ File.exist?('/var/liv/ipa/sysrestore/sysrestore.state') }
       cmd =	"ipa-server-install"
-    cmd +=	" --hostname " + node[:fqdn]
+      cmd +=	" --hostname " + node["fqdn"]
       #cmd +=	" -u " + "ipaadmin"
-    cmd +=	" -r " + node[:domain].upcase
+      cmd +=	" -r " + node["domain"].upcase
-    cmd +=	" -n " + node[:domain]
+      cmd +=	" -n " + node["domain"]
       cmd +=	" -p " + passwords['ldap_server_admin_pwd']
-    cmd +=	" -P " + passwords['kdc_database_master_key']
+      #cmd +=	" -P " + passwords['kdc_database_master_key']
       cmd +=	" -a " + passwords['ipa_user_pwd']
       cmd +=	" -N "
       cmd +=	" -U "
@@ -114,11 +106,41 @@ if freeipa_masters.empty? then
     #  end
     #end
     
-  node.set[:freeipa][:master] = true
+    directory "/root/.ssh" do
+      owner	"root"
+      group	"root"
+      mode	"0700"
+      action	:create
+    end
   
-#elsif (node[:freeipa][:master].nil? && node[:freeipa][:master] == false) && (node[:freeipa][:replica].nil? && node[:freeipa][:replica] == false) then
+    file "/root/.ssh/id_rsa" do
-elsif (node[:freeipa][:master] && node[:freeipa][:master].respond_to?(:value) && node[:freeipa][:master] == false) &&
+      content	passwords["ssh-pvt"]
-      (node[:freeipa][:replica] && node[:freeipa][:replica].respond_to?(:value) && node[:freeipa][:replica] == false) then
+      owner	"root"
+      group	"root"
+      mode	"0600"
+    end
+  
+    file "/root/.ssh/id_rsa.pub" do
+      content	passwords["ssh-pub"]
+      owner	"root"
+      group	"root"
+      mode	"0600"
+    end
+  
+    ruby_block "add public key to authorized_keys" do
+      block do
+        file = Chef::Util::FileEdit.new("/root/.ssh/authorized_keys")
+        file.insert_line_if_no_match(Regexp.new(Regexp.escape(passwords["ssh-pub"].delete("\n"))), passwords["ssh-pub"])
+        file.write_file
+      end
+    end
+  
+    node.normal["freeipa"]["master"] = true
+  
+  #elsif (node[:freeipa][:master].nil? && node[:freeipa][:master] == false) && (node[:freeipa][:replica].nil? && node[:freeipa][:replica] == false) then
+  #elsif (node["freeipa"]["master"] && node["freeipa"]["master"].respond_to?(:value) && node["freeipa"]["master"] == false) &&
+  #      (node["freeipa"]["replica"] && node["freeipa"]["replica"].respond_to?(:value) && node["freeipa"]["replica"] == false) then
+  elsif(node["freeipa"]["master"] != true && node["freeipa"]["replica"] != true) then
     ### Subsequent Replica Nodes 
   
     # check to see if slave is setup to replicat from master
@@ -126,9 +148,11 @@ elsif (node[:freeipa][:master] && node[:freeipa][:master].respond_to?(:value) &&
     ssh_noauth = "-o StrictHostKeyChecking=yes -o PasswordAuthentication=no"
   
     execute "prepare replica from master" do
-    cmd =	"ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']}"
+      cmd =	"ssh #{ssh_noauth} root@#{freeipa_masters[0]['fqdn']} ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']}"
+      cmd +=	" " + node["fqdn"]
       command	cmd
-    not_if	"ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} test -f /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+      sensitive	true
+      not_if	"ssh #{ssh_noauth} root@#{freeipa_masters[0]['fqdn']} test -f /var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
       #notifies :run, 'execute[rsyncing freeipa replication data]', :immediately
     end
   
@@ -137,41 +161,41 @@ elsif (node[:freeipa][:master] && node[:freeipa][:master].respond_to?(:value) &&
     # Fail gracefully if not found.
     execute "scping freeipa replication data" do
       #only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
-    only_if	"ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} test -f /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+      only_if	"ssh #{ssh_noauth} root@#{freeipa_masters[0]['fqdn']} test -f /var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
-    not_if	{ File.exist?("/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg") }
+      not_if	{ File.exist?("/var/lib/ipa/replica-info-#{node['fqdn']}.gpg") }
       #cmd = "rsync -a -e \"ssh " + ssh_noauth
       cmd =	"scp " + ssh_noauth
-    cmd +=	" root@" + freeipa_masters[0][:fqdn]
+      cmd +=	" root@" + freeipa_masters[0]["fqdn"]
-    cmd +=	":/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+      cmd +=	":/var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
       cmd +=	" /var/lib/ipa/"
       command	cmd
-    notifies	:run, 'execute[joining freeipa cluster]', :immediately
+      #notifies	:run, 'execute[joining freeipa cluster]', :immediately
     end
   
     execute "joining freeipa cluster" do
-    not_if	"ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
+      not_if	"ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0]['fqdn']} list | grep #{node['fqdn']}"
       #only_if "ls /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
-    only_if	{ File.exist?("/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg") }
+      only_if	{ File.exist?("/var/lib/ipa/replica-info-#{node['fqdn']}.gpg") }
       cmd =	"ipa-replica-install"
       cmd +=	" -p " + passwords['ldap_server_admin_pwd']
       cmd +=	" --unattended --mkhomedir --skip-conncheck"
-    cmd +=	" /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
+      cmd +=	" /var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
       command	cmd
-    sensitive	true
+      #sensitive	true
-    action 	:nothing
+      #action 	:nothing
       notifies	:run, 'execute[copying CA private key]', :immediately
     end
   
     # copy CA private key 
     # /etc/dirsrv/slapd-DEV-US-EAST-1-AWS-AFISTFULOFSERVERS-NET/pwdfile.txt
     execute "copying CA private key" do 
-    only_if	"ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
+      only_if	"ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0]['fqdn']} list | grep #{node['fqdn']}"
-    only_if	{ File.exist?("/etc/dirsrv/slapd-#{node[:domain].upcase}/") }
+      only_if	{ File.exist?("/etc/dirsrv/slapd-#{node['domain'].upcase}/") }
-    not_if	{ File.exist?("/etc/dirsrv/slaved-#{node[:domain].upcase}/cacert.p12") }
+      not_if	{ File.exist?("/etc/dirsrv/slaved-#{node['domain'].upcase}/cacert.p12") }
       cmd =	"scp " + ssh_noauth
-    cmd +=	" root@" + freeipa_masters[0][:fqdn]
+      cmd +=	" root@" + freeipa_masters[0]['fqdn']
-    cmd +=	":/etc/dirsrv/slapd-#{node[:domain].upcase}/cacert.p12"
+      cmd +=	":/etc/dirsrv/slapd-#{node['domain'].upcase}/cacert.p12"
-    cmd +=	" /etc/dirsrv/slapd-#{node[:domain].upcase}/"
+      cmd +=	" /etc/dirsrv/slapd-#{node['domain'].upcase}/"
       command	cmd
       ignore_failure true
       action	:nothing
@@ -180,56 +204,96 @@ elsif (node[:freeipa][:master] && node[:freeipa][:master].respond_to?(:value) &&
   
     ruby_block "set node as replica" do
       block do
-      node.set[:freeipa][:replica] = true
+        node.normal["freeipa"]["replica"] = true
       end
       action	:nothing
     end
-end
+  end
 
-file '/etc/ipa/admin.password' do
+
+  ### Admin Password for LWRP
+  #
+  file '/etc/ipa/admin.password' do
     content	passwords['ipa_user_pwd']
     owner		'root'
     group		'root'
     mode		'0600'
     sensitive	true
-end
+  end
   
-##### services
-# enable all the default services recommended by the freeipa docs
   
-#service "dirsrv" do
+  ### SSH key for IPA server communications
-#  service_name	"dirsrv@#{node[:domain].upcase.gsub(".", "-")}"
+  #
-#  action	[:enable,:start]
+  directory "/root/.ssh" do
-#end
+    owner		"root"
+    group		"root"
+    mode		"0700"
+    action	:create
+  end
   
-#service "krb5kdc" do
+  file "/root/.ssh/id_rsa" do
-#  only_if	service[:dirsrv] => running
+    content	passwords["ssh-pvt"]
-#  action	[:enable,:start]
+    owner		"root"
-#end
+    group		"root"
+    mode		"0600"
+    sensitive	true
+  end
   
-#template "/etc/httpd/conf.d/ipa.conf" do
+  file "/root/.ssh/id_rsa.pub" do
-#  source "ipa.conf.erb"
+    content	passwords["ssh-pub"]
-#  mode 0644
+    owner		"root"
-#  notifies :restart, "service[httpd]"
+    group		"root"
-#end
+    mode		"0600"
+    sensitive	true
+  end
   
-service "httpd" do
+  ruby_block "add public key to authorized_keys" do
+    block do
+      file = Chef::Util::FileEdit.new("/root/.ssh/authorized_keys")
+      file.insert_line_if_no_match(Regexp.new(Regexp.escape(passwords["ssh-pub"].delete("\n"))), passwords["ssh-pub"])
+      file.write_file
+    end
+  end
+  
+  
+  
+  ##### services
+  # enable all the default services recommended by the freeipa docs
+  
+  #service "dirsrv" do
+  #  service_name	"dirsrv@#{node[:domain].upcase.gsub(".", "-")}"
+  #  action	[:enable,:start]
+  #end
+  
+  #service "krb5kdc" do
+  #  only_if	service[:dirsrv] => running
+  #  action	[:enable,:start]
+  #end
+  
+  #template "/etc/httpd/conf.d/ipa.conf" do
+  #  source "ipa.conf.erb"
+  #  mode 0644
+  #  notifies :restart, "service[httpd]"
+  #end
+  
+  service "httpd" do
     action	[:enable,:start]
-end
+  end
   
-#service "ipa_kpasswd" do
+  #service "ipa_kpasswd" do
-#  action [:enable,:start]
+  #  action [:enable,:start]
-#end
+  #end
   
-service "ipa" do
+  service "ipa" do
     action	[:enable,:start]
+  end
+  
+  #service "messagebus" do
+  #  action [:enable,:start]
+  #end
+  #
+  #service "oddjobd" do
+  #  action [:enable,:start]
+  #end
 end
 
-#service "messagebus" do
-#  action [:enable,:start]
-#end
-#
-#service "oddjobd" do
-#  action [:enable,:start]
-#end
-