Merge branch 'develop' of Linux-Help/cookbook-freeipa into master

This commit is contained in:
psi-jack 2016-07-21 16:51:50 +00:00 committed by Gogs
commit 88e00d567a
6 changed files with 347 additions and 272 deletions

View file

@ -3,7 +3,7 @@ source "https://supermarket.chef.io"
metadata metadata
cookbook 'chef-vault' cookbook 'chef-vault'
cookbook 'ohai' #cookbook 'ohai'
cookbook 'ohai-rootsshkey', path: '../ohai-rootsshkey' #cookbook 'ohai-rootsshkey', path: '../ohai-rootsshkey'
cookbook 'sshroot2rootssh', path: '../sshroot2rootssh' #cookbook 'sshroot2rootssh', path: '../sshroot2rootssh'

View file

@ -4,8 +4,10 @@ maintainer_email 'psi-jack@linux-help.org'
license 'GPLv3' license 'GPLv3'
description 'Installs/Configures freeipa' description 'Installs/Configures freeipa'
long_description 'Installs/Configures freeipa' long_description 'Installs/Configures freeipa'
version '0.1.5' version '0.1.7'
issues_url 'http://git.linux-help.org/Linux-Help/freeipa/issues'
source_url 'http://git.linux-help.org/Linux-Help/freeipa'
depends 'ohai'
depends 'chef-vault' depends 'chef-vault'
depends 'sshroot2rootssh' #depends 'ohai'
#depends 'sshroot2rootssh'

View file

@ -2,6 +2,8 @@ def whyrun_supported?
true true
end end
use_inline_resources
action :remove do action :remove do
Chef::Log.warn('Remove ipa_group triggered') Chef::Log.warn('Remove ipa_group triggered')
end end

View file

@ -24,6 +24,10 @@ end
private private
def ipa_krblogin def ipa_krblogin
#File.open("/tmp/ipa.admin", "w") do |f|
# f.write(passwords["ipa_user_pwd"]
#end
if ::File.exist?('/etc/ipa/admin.password') then if ::File.exist?('/etc/ipa/admin.password') then
system 'kinit admin -l 1h < /etc/ipa/admin.password &>/dev/null' system 'kinit admin -l 1h < /etc/ipa/admin.password &>/dev/null'
if $? == 0 then if $? == 0 then

View file

@ -17,67 +17,70 @@
# limitations under the License. # limitations under the License.
# #
include_recipe 'chef-vault'
node.set[:freeipa][:client] = true
# become aware servers # become aware servers
freeipa_servers = search(:node, "freeipa_server:true") if Chef::Config[:solo]
freeipa_clients = search(:node, "freeipa_client:true") Chef::Log.warn('This recipe uses search. Chef solo does not support search.')
freeipa_masters = search(:node, "freeipa_master:true") else
include_recipe 'chef-vault'
node.normal["freeipa"]["client"] = true
unless freeipa_servers.empty? then freeipa_servers = search("node", "freeipa_server:true")
package "ipa-client" freeipa_clients = search("node", "freeipa_client:true")
package "openldap-clients" freeipa_masters = search("node", "freeipa_master:true")
package "dbus"
package "certmonger" unless freeipa_servers.empty? then
package "ipa-client"
puts "DEBUG: got here!" package "openldap-clients"
service "messagebus" do package "dbus"
action [:enable,:start] package "certmonger"
puts "DEBUG: got here!"
service "messagebus" do
action [:enable,:start]
end
service "certmonger" do
action [:enable,:start]
end
passwords = chef_vault_item(:freeipa, 'passwords')
#### Join node to freeipa 'domain'
# configures kerberos client to point to kdc on freeipa::server
# configures ldap to look up posix information via sssd/nss
execute "joining freeipa client to domain" do
not_if { File.exist?("/var/lib/ipa-client/sysrestore/sysrestore.index") }
cmd = "ipa-client-install"
cmd += " --server " + freeipa_masters[0][:fqdn]
cmd += " --domain " + node["domain"]
cmd += " --realm " + node["domain"].upcase
cmd += " --mkhomedir --unattended"
cmd += " -p admin -w " + passwords['ldap_server_admin_pwd']
sensitive true
command cmd
#ignore_failure true
end
#### pki enrollment
# gotta wait for ipav2 apparently
#
# generate csr
# submit csr
# enable dbus
# get host cert?
# execute "requesting host principal certificate" do
# cmd = "ipa-getcert request -r"
# cmd += " -f /tmp/affs-server.crt"
# cmd += " -k /tmp/affs-server.key"
# cmd += " -N CN= " + node[:fqdn]
# cmd += " -K host/" + node[:fqdn]
# cmd += " -D " + node[:fqdn]
# cmd += " -U id-kp-serverAuth"
# puts "DEBUG: #{cmd}"
# command cmd
# end
# get http cert?
end end
service "certmonger" do
action [:enable,:start]
end
passwords = chef_vault_item(:freeipa, 'passwords')
#### Join node to freeipa 'domain'
# configures kerberos client to point to kdc on freeipa::server
# configures ldap to look up posix information via sssd/nss
execute "joining freeipa client to domain" do
not_if { File.exist?("/var/lib/ipa-client/sysrestore/sysrestore.index") }
cmd = "ipa-client-install"
cmd += " --server " + freeipa_masters[0][:fqdn]
cmd += " --domain " + node[:domain]
cmd += " --realm " + node[:domain].upcase
cmd += " --mkhomedir --unattended"
cmd += " -p admin -w " + passwords['ldap_server_admin_pwd']
sensitive true
command cmd
#ignore_failure true
end
#### pki enrollment
# gotta wait for ipav2 apparently
#
# generate csr
# submit csr
# enable dbus
# get host cert?
# execute "requesting host principal certificate" do
# cmd = "ipa-getcert request -r"
# cmd += " -f /tmp/affs-server.crt"
# cmd += " -k /tmp/affs-server.key"
# cmd += " -N CN= " + node[:fqdn]
# cmd += " -K host/" + node[:fqdn]
# cmd += " -D " + node[:fqdn]
# cmd += " -U id-kp-serverAuth"
# puts "DEBUG: #{cmd}"
# command cmd
# end
# get http cert?
end end

View file

@ -19,217 +19,281 @@
include_recipe 'chef-vault' include_recipe 'chef-vault'
node.set[:freeipa][:server] = true node.normal["freeipa"]["server"] = true
# become aware of clients and servers # become aware of clients and servers
freeipa_servers = search(:node, "freeipa_server:true") if Chef::Config[:solo]
freeipa_clients = search(:node, "freeipa_client:true") Chef::Log.warn('This recipe uses search. Chef solo does not support search.')
else
freeipa_servers = search(:node, "freeipa_server:true")
freeipa_clients = search(:node, "freeipa_client:true")
# gather data bag secrets # gather data bag secrets
#secret = Chef::EncryptedDataBagItem.load_secret("/home/psi-jack/.chef/encrypted_data_bag_secret") passwords = chef_vault_item("freeipa", 'passwords')
#passwords = Chef::EncryptedDataBagItem.load("secrets", "passwords", secret)
passwords = chef_vault_item(:freeipa, 'passwords') # packages
#ldap_server_admin_pwd = data_bag_item('secrets','ldap_server_admin_pwd')['value'] package 'ipa-server' do
#kdc_database_master_key = data_bag_item('secrets','kdc_database_master_key')['value'] case node["platform"]
#ipa_user_pwd = data_bag_item('secrets','ipa_user_pwd')['value'] when 'redhat', 'centos'
package_name 'ipa-server'
# packages
#package "dbus"
#package "oddjob"
#package "ipa-client"
#package "ipa-server"
#package "rsync"
package 'ipa-server' do
case node[:platform]
when 'redhat', 'centos'
package_name 'ipa-server'
end
action :install
end
##### Security considerations
# All FreeIPA server hosts need to be able to ssh to each other as root to copy replication configs
# That kind of sucks, but what are the real consequences?
# Since they are replicants of each other, this can be justified, since the data is already compromised.
# Can selinux help mitigate this?
#include_recipe "ohai"
include_recipe "sshroot2rootssh"
##### Replication
# We're going to have to
# a) detect any new freeipa_servers
# b) generate ipa-replica-prepare output for them
# c) copy the configs to them
### Behavor
# First node sets special attribute "master"
# First node configures itself with newly generated crypto
# Subsequent nodes comes up
# Subsequent nodes try to to scp their fqdn's configuration from master
# Subsequent nodes negotiate for master
# negotiate for master
freeipa_masters = search(:node, "freeipa_master:true")
if freeipa_masters.empty? then
##### Do master stuff
# write better tests to see if freeipa is already set up.
## Bootstrap FreeIPA
execute "initializing freeipa-server" do
not_if { File.exist?('/var/liv/ipa/sysrestore/sysrestore.state') }
cmd = "ipa-server-install"
cmd += " --hostname " + node[:fqdn]
#cmd += " -u " + "ipaadmin"
cmd += " -r " + node[:domain].upcase
cmd += " -n " + node[:domain]
cmd += " -p " + passwords['ldap_server_admin_pwd']
cmd += " -P " + passwords['kdc_database_master_key']
cmd += " -a " + passwords['ipa_user_pwd']
cmd += " -N "
cmd += " -U "
cmd += " --no-host-dns --mkhomedir"
command cmd
#notifies :start, "service[dirsrv]"
end
# Compare list of freeipa_servers with contents of /var/lib/ipa/
#configured_replicants =`ipa-replica-manage -p #{ldap_server_admin_pwd} -H #{node[:fqdn]} list`.split
#configured_replicants = `ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{node[:fqdn]} list`.split
#configured_replicants.each { |r| puts "DEBUG: configured_replicant: #{r}" }
#freeipa_server_fqdns = Array.new
#freeipa_servers.each { |n| freeipa_server_fqdns << n[:fqdn] }
#freeipa_server_fqdns.compact!
#freeipa_server_fqdns.each do |f|
# unless node[:fqdn] == f then
# unless configured_replicants.include?( f ) then
# execute "generating replica config for #{f}" do
# not_if "ls /var/lib/ipa/replica-info-#{f}.gpg"
# command "ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']} #{f}"
# end
# end
# end
#end
node.set[:freeipa][:master] = true
#elsif (node[:freeipa][:master].nil? && node[:freeipa][:master] == false) && (node[:freeipa][:replica].nil? && node[:freeipa][:replica] == false) then
elsif (node[:freeipa][:master] && node[:freeipa][:master].respond_to?(:value) && node[:freeipa][:master] == false) &&
(node[:freeipa][:replica] && node[:freeipa][:replica].respond_to?(:value) && node[:freeipa][:replica] == false) then
### Subsequent Replica Nodes
# check to see if slave is setup to replicat from master
#"ipa-replica-manage -p 0123456789 -H authentication-1.dev.us-east-1.aws.afistfulofservers.net list"
ssh_noauth = "-o StrictHostKeyChecking=yes -o PasswordAuthentication=no"
execute "prepare replica from master" do
cmd = "ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']}"
command cmd
not_if "ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} test -f /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
#notifies :run, 'execute[rsyncing freeipa replication data]', :immediately
end
# Check for replication config
# Attempt to copy config from master.
# Fail gracefully if not found.
execute "scping freeipa replication data" do
#only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
only_if "ssh #{ssh_noauth} root@#{freeipa_masters[0][:fqdn]} test -f /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
not_if { File.exist?("/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg") }
#cmd = "rsync -a -e \"ssh " + ssh_noauth
cmd = "scp " + ssh_noauth
cmd += " root@" + freeipa_masters[0][:fqdn]
cmd += ":/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
cmd += " /var/lib/ipa/"
command cmd
notifies :run, 'execute[joining freeipa cluster]', :immediately
end
execute "joining freeipa cluster" do
not_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
#only_if "ls /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
only_if { File.exist?("/var/lib/ipa/replica-info-#{node[:fqdn]}.gpg") }
cmd = "ipa-replica-install"
cmd += " -p " + passwords['ldap_server_admin_pwd']
cmd += " --unattended --mkhomedir --skip-conncheck"
cmd += " /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
command cmd
sensitive true
action :nothing
notifies :run, 'execute[copying CA private key]', :immediately
end
# copy CA private key
# /etc/dirsrv/slapd-DEV-US-EAST-1-AWS-AFISTFULOFSERVERS-NET/pwdfile.txt
execute "copying CA private key" do
only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
only_if { File.exist?("/etc/dirsrv/slapd-#{node[:domain].upcase}/") }
not_if { File.exist?("/etc/dirsrv/slaved-#{node[:domain].upcase}/cacert.p12") }
cmd = "scp " + ssh_noauth
cmd += " root@" + freeipa_masters[0][:fqdn]
cmd += ":/etc/dirsrv/slapd-#{node[:domain].upcase}/cacert.p12"
cmd += " /etc/dirsrv/slapd-#{node[:domain].upcase}/"
command cmd
ignore_failure true
action :nothing
notifies :run, 'ruby_block[set node as replica]', :immediately
end
ruby_block "set node as replica" do
block do
node.set[:freeipa][:replica] = true
end end
action :nothing action :install
end end
##### Security considerations
# All FreeIPA server hosts need to be able to ssh to each other as root to copy replication configs
# That kind of sucks, but what are the real consequences?
# Since they are replicants of each other, this can be justified, since the data is already compromised.
# Can selinux help mitigate this?
#include_recipe "ohai"
#include_recipe "sshroot2rootssh"
##### Replication
# We're going to have to
# a) detect any new freeipa_servers
# b) generate ipa-replica-prepare output for them
# c) copy the configs to them
### Behavor
# First node sets special attribute "master"
# First node configures itself with newly generated crypto
# Subsequent nodes comes up
# Subsequent nodes try to to scp their fqdn's configuration from master
# Subsequent nodes negotiate for master
# negotiate for master
freeipa_masters = search(:node, "freeipa_master:true")
if freeipa_masters.empty? then
##### Do master stuff
# write better tests to see if freeipa is already set up.
## Bootstrap FreeIPA
execute "initializing freeipa-server" do
not_if { File.exist?('/var/liv/ipa/sysrestore/sysrestore.state') }
cmd = "ipa-server-install"
cmd += " --hostname " + node["fqdn"]
#cmd += " -u " + "ipaadmin"
cmd += " -r " + node["domain"].upcase
cmd += " -n " + node["domain"]
cmd += " -p " + passwords['ldap_server_admin_pwd']
#cmd += " -P " + passwords['kdc_database_master_key']
cmd += " -a " + passwords['ipa_user_pwd']
cmd += " -N "
cmd += " -U "
cmd += " --no-host-dns --mkhomedir"
command cmd
#notifies :start, "service[dirsrv]"
end
# Compare list of freeipa_servers with contents of /var/lib/ipa/
#configured_replicants =`ipa-replica-manage -p #{ldap_server_admin_pwd} -H #{node[:fqdn]} list`.split
#configured_replicants = `ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{node[:fqdn]} list`.split
#configured_replicants.each { |r| puts "DEBUG: configured_replicant: #{r}" }
#freeipa_server_fqdns = Array.new
#freeipa_servers.each { |n| freeipa_server_fqdns << n[:fqdn] }
#freeipa_server_fqdns.compact!
#freeipa_server_fqdns.each do |f|
# unless node[:fqdn] == f then
# unless configured_replicants.include?( f ) then
# execute "generating replica config for #{f}" do
# not_if "ls /var/lib/ipa/replica-info-#{f}.gpg"
# command "ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']} #{f}"
# end
# end
# end
#end
directory "/root/.ssh" do
owner "root"
group "root"
mode "0700"
action :create
end
file "/root/.ssh/id_rsa" do
content passwords["ssh-pvt"]
owner "root"
group "root"
mode "0600"
end
file "/root/.ssh/id_rsa.pub" do
content passwords["ssh-pub"]
owner "root"
group "root"
mode "0600"
end
ruby_block "add public key to authorized_keys" do
block do
file = Chef::Util::FileEdit.new("/root/.ssh/authorized_keys")
file.insert_line_if_no_match(Regexp.new(Regexp.escape(passwords["ssh-pub"].delete("\n"))), passwords["ssh-pub"])
file.write_file
end
end
node.normal["freeipa"]["master"] = true
#elsif (node[:freeipa][:master].nil? && node[:freeipa][:master] == false) && (node[:freeipa][:replica].nil? && node[:freeipa][:replica] == false) then
#elsif (node["freeipa"]["master"] && node["freeipa"]["master"].respond_to?(:value) && node["freeipa"]["master"] == false) &&
# (node["freeipa"]["replica"] && node["freeipa"]["replica"].respond_to?(:value) && node["freeipa"]["replica"] == false) then
elsif(node["freeipa"]["master"] != true && node["freeipa"]["replica"] != true) then
### Subsequent Replica Nodes
# check to see if slave is setup to replicat from master
#"ipa-replica-manage -p 0123456789 -H authentication-1.dev.us-east-1.aws.afistfulofservers.net list"
ssh_noauth = "-o StrictHostKeyChecking=yes -o PasswordAuthentication=no"
execute "prepare replica from master" do
cmd = "ssh #{ssh_noauth} root@#{freeipa_masters[0]['fqdn']} ipa-replica-prepare -p #{passwords['ldap_server_admin_pwd']}"
cmd += " " + node["fqdn"]
command cmd
sensitive true
not_if "ssh #{ssh_noauth} root@#{freeipa_masters[0]['fqdn']} test -f /var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
#notifies :run, 'execute[rsyncing freeipa replication data]', :immediately
end
# Check for replication config
# Attempt to copy config from master.
# Fail gracefully if not found.
execute "scping freeipa replication data" do
#only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0][:fqdn]} list | grep #{node[:fqdn]}"
only_if "ssh #{ssh_noauth} root@#{freeipa_masters[0]['fqdn']} test -f /var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
not_if { File.exist?("/var/lib/ipa/replica-info-#{node['fqdn']}.gpg") }
#cmd = "rsync -a -e \"ssh " + ssh_noauth
cmd = "scp " + ssh_noauth
cmd += " root@" + freeipa_masters[0]["fqdn"]
cmd += ":/var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
cmd += " /var/lib/ipa/"
command cmd
#notifies :run, 'execute[joining freeipa cluster]', :immediately
end
execute "joining freeipa cluster" do
not_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0]['fqdn']} list | grep #{node['fqdn']}"
#only_if "ls /var/lib/ipa/replica-info-#{node[:fqdn]}.gpg"
only_if { File.exist?("/var/lib/ipa/replica-info-#{node['fqdn']}.gpg") }
cmd = "ipa-replica-install"
cmd += " -p " + passwords['ldap_server_admin_pwd']
cmd += " --unattended --mkhomedir --skip-conncheck"
cmd += " /var/lib/ipa/replica-info-#{node['fqdn']}.gpg"
command cmd
#sensitive true
#action :nothing
notifies :run, 'execute[copying CA private key]', :immediately
end
# copy CA private key
# /etc/dirsrv/slapd-DEV-US-EAST-1-AWS-AFISTFULOFSERVERS-NET/pwdfile.txt
execute "copying CA private key" do
only_if "ipa-replica-manage -p #{passwords['ldap_server_admin_pwd']} -H #{freeipa_masters[0]['fqdn']} list | grep #{node['fqdn']}"
only_if { File.exist?("/etc/dirsrv/slapd-#{node['domain'].upcase}/") }
not_if { File.exist?("/etc/dirsrv/slaved-#{node['domain'].upcase}/cacert.p12") }
cmd = "scp " + ssh_noauth
cmd += " root@" + freeipa_masters[0]['fqdn']
cmd += ":/etc/dirsrv/slapd-#{node['domain'].upcase}/cacert.p12"
cmd += " /etc/dirsrv/slapd-#{node['domain'].upcase}/"
command cmd
ignore_failure true
action :nothing
notifies :run, 'ruby_block[set node as replica]', :immediately
end
ruby_block "set node as replica" do
block do
node.normal["freeipa"]["replica"] = true
end
action :nothing
end
end
### Admin Password for LWRP
#
file '/etc/ipa/admin.password' do
content passwords['ipa_user_pwd']
owner 'root'
group 'root'
mode '0600'
sensitive true
end
### SSH key for IPA server communications
#
directory "/root/.ssh" do
owner "root"
group "root"
mode "0700"
action :create
end
file "/root/.ssh/id_rsa" do
content passwords["ssh-pvt"]
owner "root"
group "root"
mode "0600"
sensitive true
end
file "/root/.ssh/id_rsa.pub" do
content passwords["ssh-pub"]
owner "root"
group "root"
mode "0600"
sensitive true
end
ruby_block "add public key to authorized_keys" do
block do
file = Chef::Util::FileEdit.new("/root/.ssh/authorized_keys")
file.insert_line_if_no_match(Regexp.new(Regexp.escape(passwords["ssh-pub"].delete("\n"))), passwords["ssh-pub"])
file.write_file
end
end
##### services
# enable all the default services recommended by the freeipa docs
#service "dirsrv" do
# service_name "dirsrv@#{node[:domain].upcase.gsub(".", "-")}"
# action [:enable,:start]
#end
#service "krb5kdc" do
# only_if service[:dirsrv] => running
# action [:enable,:start]
#end
#template "/etc/httpd/conf.d/ipa.conf" do
# source "ipa.conf.erb"
# mode 0644
# notifies :restart, "service[httpd]"
#end
service "httpd" do
action [:enable,:start]
end
#service "ipa_kpasswd" do
# action [:enable,:start]
#end
service "ipa" do
action [:enable,:start]
end
#service "messagebus" do
# action [:enable,:start]
#end
#
#service "oddjobd" do
# action [:enable,:start]
#end
end end
file '/etc/ipa/admin.password' do
content passwords['ipa_user_pwd']
owner 'root'
group 'root'
mode '0600'
sensitive true
end
##### services
# enable all the default services recommended by the freeipa docs
#service "dirsrv" do
# service_name "dirsrv@#{node[:domain].upcase.gsub(".", "-")}"
# action [:enable,:start]
#end
#service "krb5kdc" do
# only_if service[:dirsrv] => running
# action [:enable,:start]
#end
#template "/etc/httpd/conf.d/ipa.conf" do
# source "ipa.conf.erb"
# mode 0644
# notifies :restart, "service[httpd]"
#end
service "httpd" do
action [:enable,:start]
end
#service "ipa_kpasswd" do
# action [:enable,:start]
#end
service "ipa" do
action [:enable,:start]
end
#service "messagebus" do
# action [:enable,:start]
#end
#
#service "oddjobd" do
# action [:enable,:start]
#end