kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Update cookbooks and add wordpress cookbook

Browse Source
This commit is contained in:
Greg Karékinian
2016-02-19 18:09:49 +01:00
parent 9ba973e3ac
commit 820b0ab3f8
606 changed files with 22421 additions and 14084 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
cookbooks/openssl/CHANGELOG.md
View File

@@ -2,13 +2,54 @@ openssl Cookbook CHANGELOG
==========================
This file is used to list changes made in each version of the openssl cookbook.
v4.0.0 (2014-02-19)
v4.4.0 (2015-08-28)
-------------------
- NEW: x509 certificates are now signed via SHA-256 instead of SHA-1
- FIX: gen_dhparam error now correctly fails with TypeError instead of ArgumentError if Generator argument isn't an integer
v4.3.2 (2015-08-01)
-------------------
- FIX: Updated changelog
v4.3 (2015-08-01)
-------------------
- NEW: Add rsa_key lwrp
- FIX: dhparam lwrp now correctly honors the generator parameter
v4.2 (2015-06-23)
-------------------
- NEW: Add dhparam lwrp
- FIX: x509 lwrp now updates resource count correctly
v4.1.2 (2015-06-20)
-------------------
- Add Serverspec suite
- Removed update suite from .kitchen.yml
- Add explicit license to test cookbook recipes
- Add Whyrun support to x509 LWRP
- Expand Chefspec tests for x509 LWRP to step_into LWRP
- Add helper library
- Update x509 LWRP to verify existing keys, if specified
v4.1.1 (2015-06-11)
-------------------
- README.md fixes
v4.1.0 (2015-06-11)
-------------------
- Add new random_password Mixin (Thanks, Seth!)
- Rewritten README.md
- Refactor specs
- Clear Rubocop violations
v4.0.0 (2015-02-19)
-------------------
- Reverting to Opscode module namespace
v3.0.2 (2014-12-30)
v3.0.2 (2015-12-18)
-------------------
- Accidently released 2.0.2 as 3.0.2
- Re-namespaced `Opscode::OpenSSL::Password` module as `Chef::OpenSSL::Password`
v2.0.2 (2014-12-30)
-------------------

220
cookbooks/openssl/README.md
View File

@@ -1,88 +1,54 @@
openssl Cookbook
OpenSSL Cookbook
================
[![Build Status](https://travis-ci.org/opscode-cookbooks/openssl.svg?branch=master)](https://travis-ci.org/opscode-cookbooks/openssl)
This cookbook provides a library method to generate secure random passwords in recipes using the Ruby OpenSSL library.
It also provides an attribute-driven recipe for upgrading OpenSSL packages.
This cookbook provides tools for working with the Ruby OpenSSL library. It includes:
- A library method to generate secure random passwords in recipes, using the Ruby SecureRandom library.
- An LWRP for generating RSA private keys.
- An LWRP for generating x509 certificates.
- An LWRP for generating dhparam.pem files.
- An attribute-driven recipe for upgrading OpenSSL packages.
Requirements
------------
The `secure_password` works on any platform with OpenSSL Ruby bindings installed, which are a requirement for Chef anyway.
The `random_password` mixin works on any platform with the Ruby SecureRandom module. This module is already included with Chef.
The upgrade recipe works on the following tested platforms:
The `openssl_x509`, `openssl_rsa_key` and `openssl_dhparam` LWRPs work on any platform with the OpenSSL Ruby bindings installed. These bindings are already included with Chef.
The `upgrade` recipe has been tested on the following platforms:
* Ubuntu 12.04, 14.04
* Debian 7.4
* CentOS 6.5
It may work on other platforms or versions of the above platforms with or without modification.
The recipe may work on other platforms or different versions of the above platforms, but this has not been tested.
[Chef Sugar](https://github.com/sethvargo/chef-sugar) was introduced as a dependency to provide helpers that make the default attribute settings (see Attributes) easier to reason about.
Dependencies
------------
This cookbook depends on the [Chef Sugar](http://supermarket.chef.io/cookbooks/chef-sugar/) cookbook. [Chef Sugar](http://supermarket.chef.io/cookbooks/chef-sugar/) is used to make the default attribute settings easier to reason about. (See [Attributes](#attributes))
Attributes
----------
* `node['openssl']['packages']` - An array of packages of openssl. The default attributes attempt to be smart about which packages are the default, but this may need to be changed by users of the `openssl::upgrade` recipe.
* `node['openssl']['restart_services']` - An array of service resources that use the `node['openssl']['packages']`. This is empty by default as Chef has no reliably reasonable way to detect which applications or services are compiled against these packages. *Note* These each need to be "`service`" resources specified somewhere in the recipes in the node's run list.
* `node['openssl']['packages']` - An array of packages required to use openssl. The default attributes attempt to be smart about which packages are the default, but this may need to be changed by users of the `openssl::upgrade` recipe.
* `node['openssl']['restart_services']` - An array of service resources that depend on the packages listed in the `node['openssl']['packages']` attribute. This array is empty by default, as Chef has no reasonable way to detect which applications or services are compiled against these packages. *Note* Each service listed in this array should represent a "`service`" resource specified in the recipes of the node's run list.
Recipes
-------
### default
An empty placeholder recipe. Takes no action.
### upgrade
The upgrade recipe iterates over the list of packages in the `node['openssl']['packages']` attribute and manages them with the `:upgrade` action. Each package will send `:restart` notification to service resources named by the `node['openssl']['restart_services']` attribute.
The upgrade recipe iterates over the list of packages in the `node['openssl']['packages']` attribute, and manages them with the `:upgrade` action. Each package will send a `:restart` notification to service resources named in the `node['openssl']['restart_services']` attribute.
Usage
-----
Most often this will be used to generate a secure password for an attribute. In a recipe:
```ruby
::Chef::Recipe.send(:include, Chef::OpenSSL::Password)
node.set_unless[:my_password] = secure_password
```
To use the `openssl::upgrade` recipe, set the attributes as mentioned above. For example, we have a "stats_collector" service that uses openssl. It has a recipe that looks like this:
LWRP
====
This cookbook includes an LWRP for generating Self Signed Certificates
## openssl_x509
generate a pem formatted x509 cert + key
### Attributes
`common_name` A String representing the `CN` ssl field
`org` A String representing the `O` ssl field
`org_unit` A String representing the `OU` ssl field
`country` A String representing the `C` ssl field
`expire` A Fixnum reprenting the number of days from _now_ to expire the cert
`key_file` Optional A string to the key file to use. If no key is present it will generate and store one.
`key_pass` A String that is the key's passphrase
`key_length` A Fixnum reprenting your desired Bit Length _Default: 2048_
`owner` The owner of the files _Default: "root"_
`group` The group of the files _Default: "root"_
`mode` The mode to store the files in _Default: "0400"_
### Example usage
openssl_x509 "/tmp/mycert.pem" do
common_name "www.f00bar.com"
org "Foo Bar"
org_unit "Lab"
country "US"
end
License and Author
==================
Author:: Jesse Nelson (<spheromak@gmail.com>)
Author:: Joshua Timberman (<joshua@chef.io>)
=======
#### Example Usage
In this example, assume the node is running the `stats_collector` daemon, which depends on the openssl library. Imagine that a new openssl vulnerability has been disclosed, and the operating system vendor has released an update to openssl to address this vulnerability. In order to protect the node, an administrator crafts this recipe:
```ruby
node.default['openssl']['restart_services'] = ['stats_collector']
@@ -95,11 +61,139 @@ end
include_recipe 'openssl::upgrade'
```
This will ensure that openssl is upgraded to the latest version so the `stats_collector` service won't be exploited (hopefully!).
When executed, this recipe will ensure that openssl is upgraded to the latest version, and that the `stats_collector` service is restarted to pick up the latest security fixes released in the openssl package.
Libraries & LWRPs
-----------------
There are two mixins packaged with this cookbook.
### random_password (`OpenSSLCookbook::RandomPassword`)
The `RandomPassword` mixin can be used to generate secure random passwords in Chef cookbooks, usually for assignment to a variable or an attribute. `random_password` uses Ruby's SecureRandom library and is customizable.
#### Example Usage
```ruby
Chef::Recipe.send(:include, OpenSSLCookbook::RandomPassword)
node.set['my_secure_attribute'] = random_password
node.set_unless['my_secure_attribute'] = random_password
node.set['my_secure_attribute'] = random_password(length: 50)
node.set['my_secure_attribute'] = random_password(length: 50, mode: :base64)
node.set['my_secure_attribute'] = random_password(length: 50, mode: :base64, encoding: 'ASCII')
```
Note that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.
### ~~secure_password (`Opscode::OpenSSL::Password`)~~
This library should be considered deprecated and will be removed in a future version. Please use `OpenSSLCookbook::RandomPassword` instead. The documentation is kept here for historical reasons.
#### ~~Example Usage~~
```ruby
::Chef::Recipe.send(:include, Opscode::OpenSSL::Password)
node.set_unless['my_password'] = secure_password
```
~~Note that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.~~
### openssl_x509
This LWRP generates self-signed, PEM-formatted x509 certificates. If no existing key is specified, the LWRP will automatically generate a passwordless key with the certificate.
#### Attributes
| Name | Type | Description |
| ----- | ---- | ------------ |
| `common_name` | String (Required) | Value for the `CN` certificate field. |
| `org` | String (Required) | Value for the `O` certificate field. |
| `org_unit` | String (Required) | Value for the `OU` certificate field. |
| `country` | String (Required) | Value for the `C` ssl field. |
| `expire` | Fixnum (Optional) | Value representing the number of days from _now_ through which the issued certificate cert will remain valid. The certificate will expire after this period. |
| `key_file` | String (Optional) | The path to a certificate key file on the filesystem. If the `key_file` attribute is specified, the LWRP will attempt to source a key from this location. If no key file is found, the LWRP will generate a new key file at this location. If the `key_file` attribute is not specified, the LWRP will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate.
| `key_pass` | String (Optional) | The passphrase for an existing key's passphrase
| `key_length` | Fixnum (Optional) | The desired Bit Length of the generated key. _Default: 2048_ |
| `owner` | String (optional) | The owner of all files created by the LWRP. _Default: "root"_ |
| `group` | String (optional) | The group of all files created by the LWRP. _Default: "root"_ |
| `mode` | String or Fixnum (Optional) | The permission mode of all files created by the LWRP. _Default: "0400"_ |
#### Example Usage
In this example, an administrator wishes to create a self-signed x509 certificate for use with a web server. In order to create the certificate, the administrator crafts this recipe:
```ruby
openssl_x509 '/etc/httpd/ssl/mycert.pem' do
common_name 'www.f00bar.com'
org 'Foo Bar'
org_unit 'Lab'
country 'US'
end
```
When executed, this recipe will generate a key certificate at `/etc/httpd/ssl/mycert.key`. It will then use that key to generate a new certificate file at `/etc/httpd/ssl/mycert.pem`.
### openssl_dhparam
This LWRP generates dhparam.pem files. If a valid dhparam.pem file is found at the specified location, no new file will be created. If a file is found at the specified location but it is not a valid dhparam file, it will be overwritten.
#### Attributes
| Name | Type | Description |
| ----- | ---- | ------------ |
| `key_length` | Fixnum (Optional) | The desired Bit Length of the generated key. _Default: 2048_ |
| `generator` | Fixnum (Optional) | The desired Diffie-Hellmann generator. Can be _2_ or _5_. |
| `owner` | String (optional) | The owner of all files created by the LWRP. _Default: "root"_ |
| `group` | String (optional) | The group of all files created by the LWRP. _Default: "root"_ |
| `mode` | String or Fixnum (Optional) | The permission mode of all files created by the LWRP. _Default: "0644"_ |
#### Example Usage
In this example, an administrator wishes to create a dhparam.pem file for use with a web server. In order to create the .pem file, the administrator crafts this recipe:
```ruby
openssl_dhparam '/etc/httpd/ssl/dhparam.pem' do
key_length 2048
generator 2
end
```
When executed, this recipe will generate a dhparam file at `/etc/httpd/ssl/dhparam.pem`.
### openssl_rsa_key
This LWRP generates rsa key files. If a valid rsa key file can be opened at the specified location, no new file will be created. If the RSA key file cannot be opened, either because it does not exist or because the password to the RSA key file does not match the password in the recipe, it will be overwritten.
#### Attributes
| Name | Type | Description |
| ----- | ---- | ------------ |
| `key_length` | Fixnum (Optional) | The desired Bit Length of the generated key. _Default: 2048_ |
| `key_pass` | String (Optional) | The desired passphrase for the key. |
| `owner` | String (optional) | The owner of all files created by the LWRP. _Default: "root"_ |
| `group` | String (optional) | The group of all files created by the LWRP. _Default: "root"_ |
| `mode` | String or Fixnum (Optional) | The permission mode of all files created by the LWRP. _Default: "0644"_ |
#### Example Usage
In this example, an administrator wishes to create a new RSA private key file in order to generate other certificates and public keys. In order to create the key file, the administrator crafts this recipe:
```ruby
openssl_rsa_key '/etc/httpd/ssl/server.key' do
key_length 2048
end
```
When executed, this recipe will generate a passwordless RSA key file at `/etc/httpd/ssl/server.key`.
License and Author
------------------
Author:: Jesse Nelson (<spheromak@gmail.com>)
Author:: Seth Vargo (<sethvargo@gmail.com>)
Author:: Charles Johnson (<charles@chef.io>)
Author:: Joshua Timberman (<joshua@chef.io>)
=======
```text
Copyright:: 2009-2011, Chef Software, Inc
Copyright:: 2014, Chef Software, Inc <legal@chef.io>
Copyright:: 2009-2015, Chef Software, Inc <lega@chef.io>
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.

60
cookbooks/openssl/libraries/helpers.rb Normal file
View File

@@ -0,0 +1,60 @@
module OpenSSLCookbook
# Helper functions for the OpenSSL cookbook.
module Helpers
def self.included(_base)
require 'openssl' unless defined?(OpenSSL)
end
# Path helpers
def get_key_filename(cert_filename)
cert_file_path, cert_filename = ::File.split(cert_filename)
cert_filename = ::File.basename(cert_filename, ::File.extname(cert_filename))
cert_file_path + ::File::SEPARATOR + cert_filename + '.key'
end
# Validation helpers
def key_length_valid?(number)
number >= 1024 && number & (number - 1) == 0
end
def dhparam_pem_valid?(dhparam_pem_path)
# Check if the dhparam.pem file exists
# Verify the dhparam.pem file contains a key
return false unless File.exist?(dhparam_pem_path)
dhparam = OpenSSL::PKey::DH.new File.read(dhparam_pem_path)
dhparam.params_ok?
end
def key_file_valid?(key_file_path, key_password = nil)
# Check if the key file exists
# Verify the key file contains a private key
return false unless File.exist?(key_file_path)
key = OpenSSL::PKey::RSA.new File.read(key_file_path), key_password
key.private?
end
# Generators
def gen_dhparam(key_length, generator)
fail ArgumentError, 'Key length must be a power of 2 greater than or equal to 1024' unless key_length_valid?(key_length)
fail TypeError, 'Generator must be an integer' unless generator.is_a?(Integer)
OpenSSL::PKey::DH.new(key_length, generator)
end
def gen_rsa_key(key_length)
fail ArgumentError, 'Key length must be a power of 2 greater than or equal to 1024' unless key_length_valid?(key_length)
OpenSSL::PKey::RSA.new(key_length)
end
# Key manipulation helpers
# Returns a pem string
def encrypt_rsa_key(rsa_key, key_password)
fail TypeError, 'rsa_key must be a Ruby OpenSSL::PKey::RSA object' unless rsa_key.is_a?(OpenSSL::PKey::RSA)
fail TypeError, 'RSA key password must be a string' unless key_password.is_a?(String)
cipher = OpenSSL::Cipher::Cipher.new('des3')
rsa_key.to_pem(cipher, key_password)
end
end
end

13
cookbooks/openssl/libraries/matchers.rb Normal file
View File

@@ -0,0 +1,13 @@
if defined?(ChefSpec)
def create_x509_certificate(name)
ChefSpec::Matchers::ResourceMatcher.new(:openssl_x509, :create, name)
end
def create_dhparam_pem(name)
ChefSpec::Matchers::ResourceMatcher.new(:openssl_dhparam, :create, name)
end
def create_rsa_key(name)
ChefSpec::Matchers::ResourceMatcher.new(:openssl_rsa_key, :create, name)
end
end

82
cookbooks/openssl/libraries/random_password.rb Normal file
View File

@@ -0,0 +1,82 @@
#
# Cookbook Name:: openssl
# Library:: random_password
# Author:: Seth Vargo <sethvargo@gmail.com>
#
# Copyright 2015, Seth Vargo
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# rubocop:disable UnusedMethodArgument, Style/RaiseArgs
module OpenSSLCookbook
module RandomPassword
# Override the included method to require securerandom if it is not defined.
# This avoids the need to load the class on each Chef run unless the user is
# explicitly requiring it.
def self.included(base)
require 'securerandom' unless defined?(SecureRandom)
end
class InvalidPasswordMode < StandardError
def initialize(given, acceptable)
super <<-EOH
The given password mode '#{given}' is not valid. Valid password modes are :hex,
:base64, and :random_bytes!
EOH
end
end
#
# Generates a random password using {SecureRandom}.
#
# @example Generating a random (hex) password (of 20 characters)
# random_password #=> "1930e99aa035083bdd93d1d8f11cb7ac8f625c9c"
#
# @example Generating a random base64 password that is 50 characters
# random_password(mode: :base64, length: 50) #=> "72o5oVbKHHEVYj1nOgFB2EijnzZfnrbfasVuF+oRH8wMgb0QWoYZF/OkrQricp1ENoI="
#
# @example Generate a password with a forced encoding
# random_password(encoding: "ASCII")
#
# @param [Hash] options
# @option options [Fixnum] :length
# the number of bits to use in the password
# @option options [Symbol] :mode
# the type of random password to generate - valid values are
# `:hex`, `:base64`, or `:random_bytes`
# @option options [String, Symbol, Constant] :encoding
# the encoding to force (default is "UTF-8")
#
# @return [String]
#
def random_password(options = {})
length = options[:length] || 20
mode = options[:mode] || :hex
encoding = options[:encoding] || 'UTF-8'
# Convert to a "proper" length, since the size is actually in bytes
length = case mode
when :hex
length / 2
when :base64
length * 3 / 4
when :random_bytes
length
else
fail InvalidPasswordMode.new(mode)
end
SecureRandom.send(mode, length).force_encoding(encoding)
end
end
end

5
cookbooks/openssl/libraries/secure_password.rb
View File

@@ -18,13 +18,14 @@
# limitations under the License.
#
require 'openssl'
include OpenSSLCookbook::Helpers
module Opscode
module OpenSSL
# Generate secure passwords with OpenSSL
module Password
def secure_password(length = 20)
pw = String.new
pw = ''
while pw.length < length
pw << ::OpenSSL::Random.random_bytes(1).gsub(/\W/, '')

32
cookbooks/openssl/metadata.json
View File

File diff suppressed because one or more lines are too long

33
cookbooks/openssl/providers/dhparam.rb Normal file
View File

@@ -0,0 +1,33 @@
#
# dhparam.pem provider
#
# Author:: Charles Johnson <charles@chef.io>
#
include OpenSSLCookbook::Helpers
use_inline_resources
def whyrun_supported?
true
end
action :create do
converge_by("Create a dhparam file #{@new_resource}") do
unless dhparam_pem_valid?(new_resource.name)
dhparam_content = gen_dhparam(new_resource.key_length, new_resource.generator).to_pem
log "Generating #{new_resource.key_length} bit "\
"dhparam file at #{new_resource.name}, this may take some time"
file new_resource.name do
action :create
owner new_resource.owner
group new_resource.group
mode new_resource.mode
sensitive true
content dhparam_content
end
end
end
end

39
cookbooks/openssl/providers/rsa_key.rb Normal file
View File

@@ -0,0 +1,39 @@
#
# dhparam.pem provider
#
# Author:: Charles Johnson <charles@chef.io>
#
include OpenSSLCookbook::Helpers
use_inline_resources
def whyrun_supported?
true
end
action :create do
converge_by("Create an RSA key #{@new_resource}") do
unless key_file_valid?(new_resource.name, new_resource.key_pass)
log "Generating #{new_resource.key_length} bit "\
"RSA key file at #{new_resource.name}, this may take some time"
if new_resource.key_pass
unencrypted_rsa_key = gen_rsa_key(new_resource.key_length)
rsa_key_content = encrypt_rsa_key(unencrypted_rsa_key, new_resource.key_pass)
else
rsa_key_content = gen_rsa_key(new_resource.key_length).to_pem
end
file new_resource.name do
action :create
owner new_resource.owner
group new_resource.group
mode new_resource.mode
sensitive true
content rsa_key_content
end
end
end
end

80
cookbooks/openssl/providers/x509.rb
View File

@@ -3,51 +3,61 @@
#
# Author:: Jesse Nelson <spheromak@gmail.com>
#
require 'openssl'
include OpenSSLCookbook::Helpers
use_inline_resources
def whyrun_supported?
true
end
attr_reader :key_file, :key, :cert, :ef
action :create do
unless ::File.exists? new_resource.name
create_keys
cert_content = cert.to_pem
key_content = key.to_pem
action :create do
converge_by("Create #{@new_resource}") do
unless ::File.exist? new_resource.name
create_keys
cert_content = cert.to_pem
key_content = key.to_pem
file new_resource.name do
action :create_if_missing
mode new_resource.mode
owner new_resource.owner
group new_resource.group
content cert_content
file new_resource.name do
action :create_if_missing
mode new_resource.mode
owner new_resource.owner
group new_resource.group
sensitive true
content cert_content
end
file new_resource.key_file do
action :create_if_missing
mode new_resource.mode
owner new_resource.owner
group new_resource.group
sensitive true
content key_content
end
new_resource.updated_by_last_action(true)
end
file new_resource.key_file do
action :create_if_missing
mode new_resource.mode
owner new_resource.owner
group new_resource.group
content key_content
end
end
end
protected
# rubocop:disable Metrics/AbcSize, Style/IndentationConsistency
def key_file
unless new_resource.key_file
path, file= ::File.split(new_resource.name)
filename = ::File.basename(file, ::File.extname(file) )
new_resource.key_file path + "/" + filename + ".key"
path, file = ::File.split(new_resource.name)
filename = ::File.basename(file, ::File.extname(file))
new_resource.key_file path + '/' + filename + '.key'
end
new_resource.key_file
end
def key
@key ||= if ::File.exists? key_file
OpenSSL::PKey::RSA.new File.read(key_file), new_resource.key_pass
@key ||= if key_file_valid?(key_file, new_resource.key_pass)
OpenSSL::PKey::RSA.new ::File.read(key_file), new_resource.key_pass
else
OpenSSL::PKey::RSA.new(new_resource.key_length)
end
@@ -69,16 +79,16 @@ protected
end
def subject
@subject ||= "/C=" + new_resource.country +
"/O=" + new_resource.org +
"/OU=" + new_resource.org_unit +
"/CN=" + new_resource.common_name
@subject ||= '/C=' + new_resource.country +
'/O=' + new_resource.org +
'/OU=' + new_resource.org_unit +
'/CN=' + new_resource.common_name
end
def extensions
[
ef.create_extension("basicConstraints","CA:TRUE", true),
ef.create_extension("subjectKeyIdentifier", "hash"),
ef.create_extension('basicConstraints', 'CA:TRUE', true),
ef.create_extension('subjectKeyIdentifier', 'hash')
]
end
@@ -88,7 +98,7 @@ protected
ef.subject_certificate = cert
ef.issuer_certificate = cert
cert.extensions = extensions
cert.add_extension ef.create_extension("authorityKeyIdentifier",
"keyid:always,issuer:always")
cert.sign key, OpenSSL::Digest::SHA1.new
cert.add_extension ef.create_extension('authorityKeyIdentifier',
'keyid:always,issuer:always')
cert.sign key, OpenSSL::Digest::SHA256.new
end

24
cookbooks/openssl/recipes/upgrade.rb
View File

@@ -2,7 +2,7 @@
# Cookbook Name:: openssl
# Recipe:: upgrade
#
# Copyright 2014, Chef Software, Inc. <legal@chef.io>
# Copyright 2015, Chef Software, Inc. <legal@chef.io>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -18,16 +18,18 @@
#
include_recipe 'chef-sugar'
node.default['openssl']['packages'] = case
when debian_before_or_at_squeeze?, ubuntu_before_or_at_lucid?
%w{libssl0.9.8 openssl}
when debian_after_or_at_wheezy?, ubuntu_after_or_at_precise?
%w{libssl1.0.0 openssl}
when rhel?
%w{openssl}
else
[]
end
# Attributes are set here and not in attributes/default.rb because of the
# chef-sugar dependency for the methods evaluated in the case statement.
case
when debian_before_or_at_squeeze?, ubuntu_before_or_at_lucid?
node.default['openssl']['packages'] = %w(libssl0.9.8 openssl)
when debian_after_or_at_wheezy?, ubuntu_after_or_at_precise?
node.default['openssl']['packages'] = %w(libssl1.0.0 openssl)
when rhel?
node.default['openssl']['packages'] = %w(openssl)
else
node.default['openssl']['packages'] = []
end
node['openssl']['packages'].each do |ssl_pkg|
package ssl_pkg do

10
cookbooks/openssl/resources/dhparam.rb Normal file
View File

@@ -0,0 +1,10 @@
actions [:create]
default_action :create
attribute :name, :kind_of => String, :name_attribute => true
attribute :key_length, :equal_to => [1024, 2048, 4096, 8192], :default => 2048
attribute :generator, :equal_to => [2, 5], :default => 2
attribute :owner, :kind_of => String
attribute :group, :kind_of => String
attribute :mode, :kind_of => [Integer, String]

10
cookbooks/openssl/resources/rsa_key.rb Normal file
View File

@@ -0,0 +1,10 @@
actions [:create]
default_action :create
attribute :name, :kind_of => String, :name_attribute => true
attribute :key_length, :equal_to => [1024, 2048, 4096, 8192], :default => 2048
attribute :key_pass, :kind_of => String, :default => nil
attribute :owner, :kind_of => String
attribute :group, :kind_of => String
attribute :mode, :kind_of => [Integer, String]

22
cookbooks/openssl/resources/x509.rb
View File

@@ -1,16 +1,16 @@
actions [ :create ]
actions [:create]
default_action :create
attribute :name, :kind_of => String, :name_attribute => true
attribute :name, :kind_of => String, :name_attribute => true
attribute :owner, :kind_of => String
attribute :group, :kind_of => String
attribute :expire, :kind_of => Fixnum
attribute :mode
attribute :org, :kind_of => String, :required => true
attribute :org_unit, :kind_of => String, :required => true
attribute :country, :kind_of => String, :required => true
attribute :group, :kind_of => String
attribute :expire, :kind_of => Integer
attribute :mode, :kind_of => [Integer, String]
attribute :org, :kind_of => String, :required => true
attribute :org_unit, :kind_of => String, :required => true
attribute :country, :kind_of => String, :required => true
attribute :common_name, :kind_of => String, :required => true
attribute :key_file, :kind_of => String, :default => nil
attribute :key_pass, :kind_of => String, :default => nil
attribute :key_length, :kind_of => Fixnum, :default => 2048
attribute :key_file, :kind_of => String, :default => nil
attribute :key_pass, :kind_of => String, :default => nil
attribute :key_length, :equal_to => [1024, 2048, 4096, 8192], :default => 2048