modules/debian-org/manifests/init.pp

   1 define sysctl($key, $value, $ensure=present) {
   2     file { "/etc/sysctl.d/$name.conf":
   3         ensure  => $ensure,
   4         owner   => root,
   5         group   => root,
   6         mode    => 0644,
   7         content => "$key = $value\n",
   8         notify  => Exec["procps restart"],
   9     }
  10 }
  11
  12 define set_alternatives($linkto) {
  13         exec { "/usr/sbin/update-alternatives --set $name $linkto":
  14             unless => "/bin/sh -c '! [ -e $linkto ] || ! [ -e /etc/alternatives/$name ] || ([ -L /etc/alternatives/$name ] && [ /etc/alternatives/$name -ef $linkto ])'"
  15         }
  16 }
  17
  18
  19 class debian-org {
  20    ferm::rule { "dsa-ssh":
  21            description     => "Allow SSH from DSA",
  22            rule            => "proto tcp mod state state (NEW) dport (ssh) @subchain 'ssh' { saddr (\$SSH_SOURCES) ACCEPT; }"
  23    }
  24    ferm::rule { "dsa-ssh-v6":
  25            description     => "Allow SSH from DSA",
  26            domain          => "ip6",
  27            rule            => "proto tcp mod state state (NEW) dport (ssh) @subchain 'ssh' { saddr (\$SSH_V6_SOURCES) ACCEPT; }"
  28    }
  29    ferm::rule { "dsa-munin":
  30            description     => "Allow munin from munin master",
  31            rule            => "proto tcp mod state state (NEW) dport (munin) @subchain 'munin' { saddr (\$HOST_MUNIN) ACCEPT; }"
  32    }
  33    ferm::rule { "dsa-nagios":
  34            description     => "Allow nrpe from nagios master",
  35            rule            => "proto tcp mod state state (NEW) dport (5666) @subchain 'nagios' { saddr (\$HOST_NAGIOS) ACCEPT; }"
  36    }
  37
  38    package { "userdir-ldap": ensure => installed;
  39              "zsh": ensure => installed;
  40              "cron": ensure => installed;
  41              "apt-utils": ensure => installed;
  42              "tcsh": ensure => installed;
  43              "pdksh": ensure => installed;
  44              "ksh": ensure => installed;
  45              "csh": ensure => installed;
  46              "locales-all": ensure => installed;
  47              "libpam-pwdfile": ensure => installed;
  48              "vim": ensure => installed;
  49              "gnupg": ensure => installed;
  50              "bzip2": ensure => installed;
  51              "less": ensure => installed;
  52              "ed": ensure => installed;
  53              "puppet": ensure => installed;
  54              "mtr-tiny": ensure => installed;
  55              "nload": ensure => installed;
  56              "pciutils": ensure => installed;
  57              "dnsutils": ensure => installed;
  58              "bash-completion": ensure => installed;
  59              "libfilesystem-ruby1.8": ensure => installed;
  60              "syslog-ng": ensure => installed;
  61              "sysklogd": ensure => purged;
  62              "klogd": ensure => purged;
  63              "rsyslog": ensure => purged;
  64    }
  65    file {
  66       "/etc/apt/preferences":
  67              source => "puppet:///files/etc/apt/preferences";
  68       "/etc/apt/sources.list.d/backports.org.list":
  69              content => template("debian-org/etc/apt/sources.list.d/backports.org.list.erb"),
  70              notify  => Exec["apt-get update"];
  71       "/etc/apt/sources.list.d/debian.org.list":
  72              content => template("debian-org/etc/apt/sources.list.d/debian.org.list.erb"),
  73              notify  => Exec["apt-get update"];
  74       "/etc/apt/sources.list.d/security.list":
  75              content => template("debian-org/etc/apt/sources.list.d/security.list.erb"),
  76              notify  => Exec["apt-get update"];
  77       "/etc/apt/sources.list.d/volatile.list":
  78              content => template("debian-org/etc/apt/sources.list.d/volatile.list.erb"),
  79              notify  => Exec["apt-get update"];
  80       "/etc/apt/apt.conf.d/local-recommends":
  81              source => "puppet:///files/etc/apt/apt.conf.d/local-recommends";
  82       "/etc/apt/apt.conf.d/local-pdiffs":
  83              source => "puppet:///files/etc/apt/apt.conf.d/local-pdiffs";
  84       "/etc/timezone":
  85              source => "puppet:///files/etc/timezone",
  86              notify => Exec["dpkg-reconfigure tzdata -pcritical -fnoninteractive"];
  87       "/etc/puppet/puppet.conf":
  88              require => Package["puppet"],
  89              source => "puppet:///files/etc/puppet/puppet.conf"
  90              ;
  91       "/etc/default/puppet":
  92              require => Package["puppet"],
  93              source => "puppet:///files/etc/default/puppet"
  94              ;
  95
  96       "/etc/syslog-ng/syslog-ng.conf":
  97              content => template("syslog-ng.conf.erb"),
  98              require => Package["syslog-ng"],
  99              notify  => Exec["syslog-ng reload"],
 100              ;
 101       "/etc/logrotate.d/syslog-ng":
 102              require => Package["syslog-ng"],
 103              source => "puppet:///files/etc/logrotate.d/syslog-ng",
 104              ;
 105       "/etc/cron.d/dsa-puppet-stuff":
 106              source => "puppet:///files/etc/cron.d/dsa-puppet-stuff",
 107              require => Package["cron"]
 108              ;
 109       "/etc/ldap/ldap.conf":
 110              require => Package["userdir-ldap"],
 111              source => "puppet:///files/etc/ldap/ldap.conf",
 112              ;
 113       "/etc/pam.d/common-session":
 114              require => Package["libpam-pwdfile"],
 115              source => "puppet:///files/etc/pam.d/common-session",
 116              ;
 117    }
 118    case $hostname {
 119         handel: {
 120             file {
 121                "/etc/puppet/lib":
 122                       ensure  => directory,
 123                       source => "puppet:///files/etc/puppet/lib",
 124                       recurse => true,
 125                       notify  => Exec["puppetmaster restart"];
 126             }
 127         }
 128         default: {}
 129    }
 130
 131    # set mmap_min_addr to 4096 to mitigate
 132    # Linux NULL-pointer dereference exploits
 133    sysctl { "mmap_min_addr" :
 134              key         => "vm.mmap_min_addr",
 135              value       => 4096,
 136    }
 137
 138    set_alternatives { "editor":
 139            linkto => "/usr/bin/vim.basic",
 140    }
 141
 142    exec { "syslog-ng reload":
 143              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 144              refreshonly => true,
 145    }
 146    exec { "dpkg-reconfigure tzdata -pcritical -fnoninteractive":
 147            path        => "/usr/bin:/usr/sbin:/bin:/sbin",
 148            refreshonly => true,
 149    }
 150    exec { "apt-get update":
 151              command => 'apt-get update',
 152              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 153              refreshonly => true
 154    }
 155    exec { "puppetmaster restart":
 156              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 157              refreshonly => true,
 158    }
 159    exec { "procps restart":
 160              path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
 161              refreshonly => true,
 162    }
 163 }
 164
 165 class debian-proliant inherits debian-org {
 166    package {
 167       "hpacucli": ensure => installed;
 168       "hp-health": ensure => installed;
 169       "cpqarrayd": ensure => installed;
 170       "arrayprobe": ensure => installed;
 171    }
 172    case $debarchitecture {
 173       "amd64": {
 174          package { "lib32gcc1": ensure => installed; }
 175       }
 176    }
 177    file {
 178       "/etc/apt/sources.list.d/debian.restricted.list":
 179              content => template("debian-org/etc/apt/sources.list.d/debian.restricted.list.erb"),
 180              notify  => Exec["apt-get update"];
 181    }
 182 }