kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Update cookbooks and add wordpress cookbook

Browse Source
This commit is contained in:
Greg Karékinian
2016-02-19 18:09:49 +01:00
parent 9ba973e3ac
commit 820b0ab3f8
606 changed files with 22421 additions and 14084 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
cookbooks/ufw/CHANGELOG.md
View File

@@ -1,30 +1,32 @@
ufw Cookbook CHANGELOG
======================
# ufw Cookbook CHANGELOG
This file is used to list changes made in each version of the ufw cookbook.
## v1.0.0 (12-14-2015)
- Update to use / require the Firewall v2.0.0+ cookbook, which requires Chef 12
- Updated all Opscode references to Chef Software Inc.
- Updated testing, contributing, and maintainers docs
- Added source_url and issues_url metadata for supermarket
- Resolved all rubocop warnings and add the standard Chef rubocop file
- Added travis and supermarket version badges to the readme
- Added requirements section to the readme
- Added a chefignore file
- Added a Rakefile for simplified testing
- Added a basic converge chefspec
v0.7.4
------
## v0.7.4
No change. Version bump for toolchain
v0.7.2
------
## v0.7.2
Updating metadata to depend on firewall >= 0.9
v0.7.0
------
## v0.7.0
[COOK-3592] - allow source ports to be defined as a range in ufw
v0.6.4
------
## v0.6.4
### Bug
- **[COOK-3316](https://tickets.opscode.com/browse/COOK-3316)** - Fix README.md example
- **[COOK-3316](https://tickets.chef.io/browse/COOK-3316)** - Fix README.md example
v0.6.2
------
## v0.6.2
### Bug
- [COOK-2487]: when setting a node attribute you must specify the precedence
- [COOK-2982]: ufw cookbook has foodcritic failures

2
cookbooks/ufw/CONTRIBUTING.md Normal file
View File

@@ -0,0 +1,2 @@
Please refer to
https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD

19
cookbooks/ufw/MAINTAINERS.md Normal file
View File

@@ -0,0 +1,19 @@
<!-- This is a generated file. Please do not edit directly -->
# Maintainers
This file lists how this cookbook project is maintained. When making changes to the system, this
file tells you who needs to review your patch - you need a simple majority of maintainers
for the relevant subsystems to provide a :+1: on your pull request. Additionally, you need
to not receive a veto from a Lieutenant or the Project Lead.
Check out [How Cookbooks are Maintained](https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD)
for details on the process and how to become a maintainer or the project lead.
# Project Maintainer
* [Tim Smith](https://github.com/tas50)
# Maintainers
* [Jennifer Davis](https://github.com/sigje)
* [Sean OMeara](https://github.com/someara)
* [Tim Smith](https://github.com/tas50)
* [Thom May](https://github.com/thommay)

214
cookbooks/ufw/README.md
View File

@@ -1,136 +1,151 @@
Description
===========
# Description
[![Build Status](https://travis-ci.org/chef-cookbooks/ufw.svg?branch=master)](http://travis-ci.org/chef-cookbooks/ufw) [![Cookbook Version](https://img.shields.io/cookbook/v/ufw.svg)](https://supermarket.chef.io/cookbooks/ufw)
Configures Uncomplicated Firewall (ufw) on Ubuntu. Including the `ufw` recipe in a run list means the firewall will be enabled and will deny everything except SSH and ICMP ping by default.
Rules may be added to the node by adding them to the `['firewall']['rules']` attributes in roles or on the node directly. The `firewall` cookbook has an LWRP that may be used to apply rules directly from other recipes as well. There is no need to explicitly remove rules, they are reevaluated on changes and reset. Rules are applied in the order of the run list, unless ordering is explictly added.
Requirements
============
Tested with Ubuntu 10.04 and 11.04.
## Requirements
### Platforms
- Ubuntu
### Chef
- Chef 12+
Since this cookbook has an open-ended dependency on 'firewall', users of Chef11 or earlier should pin 'firewall' to '~>0.9' via the caller's metadata. Otherwise 'poise' v2+ will be invoked which is Chef12+ only.
### Cookbooks
- firewall 2.0+
## Recipes
###default
Recipes
=======
default
-------
The `default` recipe looks for the list of firewall rules to apply from the `['firewall']['rules']` attribute added to roles and on the node itself. The list of rules is then applied to the node in the order specified.
disable
-------
###disable
The `disable` recipe is used if there is a need to disable the existing firewall, perhaps for testing. It disables the ufw firewall even if other ufw recipes attempt to enable it.
If you remove this recipe, the firewall does not get automatically re-enabled. You will need clear the value of the `['firewall']['state']` to force a recalculation of the firewall rules. This can be done with `knife node edit`.
databag
-------
###databag
The `databag` recipe looks in the `firewall` data bag for to apply firewall rules based on inspecting the runlist for roles and recipe names for keys that map to the data bag items and are applied in the the order specified.
The `databag` recipe calls the `default` recipe after the `['firewall']['rules']` attribute is set to appy the rules, so you may mix roles with databag items if you want (roles apply first, then data bag contents).
recipes
-------
###recipes
The `recipes` recipe applies firewall rules based on inspecting the runlist for recipes that have node[<recipe>]['firewall']['rules'] attributes. These are appended to node['firewall']['rules'] and applied to the node. Cookbooks may define attributes for recipes like so:
# attributes/default.rb for test cookbook
default['test']['firewall']['rules'] = [
{"test"=> {
"port"=> "27901",
"protocol"=> "udp"
}
}
]
default['test::awesome']['firewall']['rules'] = [
{"awesome"=> {
"port"=> "99427",
"protocol"=> "udp"
}
},
{"awesome2"=> {
"port"=> "99428"
}
}
]
### attributes/default.rb for test cookbook
```
default['test']['firewall']['rules'] = [
{"test"=> {
"port"=> "27901",
"protocol"=> "udp"
}
}
]
default['test::awesome']['firewall']['rules'] = [
{"awesome"=> {
"port"=> "99427",
"protocol"=> "udp"
}
},
{"awesome2"=> {
"port"=> "99428"
}
}
]
```
Note that the 'test::awesome' rules are only applied if that specific recipe is in the runlist. Recipe-applied firewall rules are applied after any rules defined in role attributes.
securitylevel
-------------
The `securitylevel` recipe is used if there are any node['firewall']['securitylevel'] settings that need to be enforced. It is a reference implementation with nothing configured.
###
Attributes
==========
securitylevel The `securitylevel` recipe is used if there are any node['firewall']['securitylevel'] settings that need to be enforced. It is a reference implementation with nothing configured.
## Attributes
Roles and the node may have the `['firewall']['rules']` attribute set. This attribute is a list of hashes, the key will be rule name, the value will be the hash of parameters. Application order is based on run list.
# Example Role
name "fw_example"
description "Firewall rules for Examples"
override_attributes(
"firewall" => {
"rules" => [
{"tftp" => {}},
{"http" => {
"port" => "80"
}
},
{"block tomcat from 192.168.1.0/24" => {
"port" => "8080",
"source" => "192.168.1.0/24",
"action" => "deny"
}
},
{"Allow access to udp 1.2.3.4 port 5469 from 1.2.3.5 port 5469" => {
"protocol" => "udp",
"port" => "5469",
"source" => "1.2.3.4",
"destination" => "1.2.3.5",
"dest_port" => "5469"
}
},
{"allow to tcp ports 8000-8010 from 192.168.1.0/24" => {
"port_range" => "8000..8010",
"source" => "192.168.1.0/24",
"protocol" => "tcp" //protocol is mandatory when using port ranges
}
}
]
}
)
### Example Role
Data Bags
=========
The `firewall` data bag may be used with the `databag` recipe. It will contain items that map to role names (eg. the 'apache' role will map to the 'apache' item in the 'firewall' data bag). Either roles or recipes may be keys (role[webserver] is 'webserver', recipe[apache2] is 'apache2'). If you have recipe-specific firewall rules, you will need to replace the '::' with '__' (double underscores) (eg. recipe[apache2::mod_ssl] is 'apache2__mod_ssl' in the data bag item).
```
name "fw_example"
description "Firewall rules for Examples"
override_attributes(
"firewall" => {
"rules" => [
{"tftp" => {}},
{"http" => {
"port" => "80"
}
},
{"block tomcat from 192.168.1.0/24" => {
"port" => "8080",
"source" => "192.168.1.0/24",
"action" => "deny"
}
},
{"Allow access to udp 1.2.3.4 port 5469 from 1.2.3.5 port 5469" => {
"protocol" => "udp",
"port" => "5469",
"source" => "1.2.3.4",
"destination" => "1.2.3.5",
"dest_port" => "5469"
}
},
{"allow to tcp ports 8000-8010 from 192.168.1.0/24" => {
"port_range" => "8000..8010",
"source" => "192.168.1.0/24",
"protocol" => "tcp" //protocol is mandatory when using port ranges
}
}
]
}
)
```
## Data Bags
The `firewall` data bag may be used with the `databag` recipe. It will contain items that map to role names (eg. the 'apache' role will map to the 'apache' item in the 'firewall' data bag). Either roles or recipes may be keys (role[webserver] is 'webserver', recipe[apache2] is 'apache2'). If you have recipe-specific firewall rules, you will need to replace the '::' with '**' (double underscores) (eg. recipe[apache2::mod_ssl] is 'apache2**mod_ssl' in the data bag item).
The items in the data bag will contain a 'rules' array of hashes to apply to the `['firewall']['rules']` attribute.
% knife data bag create firewall
% knife data bag from file firewall examples/data_bags/firewall/apache2.json
% knife data bag from file firewall examples/data_bags/firewall/apache2__mod_ssl.json
```
% knife data bag create firewall
% knife data bag from file firewall examples/data_bags/firewall/apache2.json
% knife data bag from file firewall examples/data_bags/firewall/apache2__mod_ssl.json
```
# Example 'firewall' data bag item
### Example 'firewall' data bag item
{
"id": "apache2",
"rules": [
{"http": {
"port": "80"
}},
{"block http from 192.168.1.0/24": {
"port": "80",
"source": "192.168.1.0/24",
"action": "deny"
}}
]
}
```
{
"id": "apache2",
"rules": [
{"http": {
"port": "80"
}},
{"block http from 192.168.1.0/24": {
"port": "80",
"source": "192.168.1.0/24",
"action": "deny"
}}
]
}
```
Resources/Providers
===================
## Resources/Providers
The `firewall` cookbook provides the `firewall` and `firewall_rule` LWRPs, for which there is a ufw provider.
License and Author
==================
Author:: Matt Ray (<matt@opscode.com>)
## License & Authors
**Author:** Cookbook Engineering Team ([cookbooks@chef.io](mailto:cookbooks@chef.io))
Copyright:: 2011 Opscode, Inc.
**Copyright:** 2011-2015, Chef Software, Inc.
```
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
@@ -142,3 +157,4 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
```

2
cookbooks/ufw/attributes/default.rb
View File

@@ -1,2 +1,2 @@
default['firewall']['rules'] = []
default['firewall']['securitylevel'] = ""
default['firewall']['securitylevel'] = ''

41
cookbooks/ufw/metadata.json
View File

File diff suppressed because one or more lines are too long

21
cookbooks/ufw/metadata.rb
View File

@@ -1,21 +0,0 @@
name "ufw"
maintainer "Opscode, Inc."
maintainer_email "matt@opscode.com"
license "Apache 2.0"
description "Installs/Configures ufw"
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
version "0.7.4"
depends "firewall", ">= 0.9"
%w{ ubuntu }.each do |os|
supports os
end
attribute "firewall/rules",
:display_name => "List of firewall rules for the node.",
:description => "List of firewall rules for the node. Possibly set by node, roles or data bags.",
:type => "array"
attribute "firewall/securitylevel",
:display_name => "Security level of the node.",
:description => "Security level of the node, may be set by node, roles or environment."

26
cookbooks/ufw/recipes/databag.rb
View File

@@ -1,9 +1,9 @@
#
# Author:: Matt Ray <matt@opscode.com>
# Author:: Matt Ray <matt@chef.io>
# Cookbook Name:: ufw
# Recipe:: databag
#
# Copyright 2011, Opscode, Inc
# Copyright 2011-2015, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -18,12 +18,12 @@
# limitations under the License.
#
#flatten the run_list to just the names of the roles and recipes in order
# flatten the run_list to just the names of the roles and recipes in order
def run_list_names(run_list)
names = []
run_list.each do |entry|
Chef::Log.debug "ufw::databag:run_list_names+name: #{entry.name}"
if entry.name.index('::') #cookbook::recipe
if entry.name.index('::') # cookbook::recipe
names.push(entry.name.sub('::', '__'))
else
names.push(entry.name)
@@ -34,7 +34,7 @@ def run_list_names(run_list)
end
end
Chef::Log.debug "ufw::databag:run_list_names+names: #{names}"
return names
names
end
rlist = run_list_names(node.run_list)
@@ -46,13 +46,13 @@ Chef::Log.debug "ufw::databag:firewall:#{fw_db}"
rlist.each do |entry|
Chef::Log.debug "ufw::databag: \"#{entry}\""
if fw_db.member?(entry)
#add the list of firewall rules to the current list
item = data_bag_item('firewall', entry)
rules = item['rules']
node.set['firewall']['rules'].concat(rules) unless rules.nil?
end
next unless fw_db.member?(entry)
# add the list of firewall rules to the current list
item = data_bag_item('firewall', entry)
rules = item['rules']
node.set['firewall']['rules'].concat(rules) unless rules.nil?
end
#now go apply the rules
include_recipe "ufw::default"
# now go apply the rules
include_recipe 'ufw::default'

40
cookbooks/ufw/recipes/default.rb
View File

@@ -1,9 +1,9 @@
#
# Author:: Matt Ray <matt@opscode.com>
# Author:: Matt Ray <matt@chef.io>
# Cookbook Name:: ufw
# Recipe:: default
#
# Copyright 2011, Opscode, Inc
# Copyright 2011-2015, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -18,32 +18,32 @@
# limitations under the License.
#
package "ufw"
package 'ufw'
old_state = node['firewall']['state']
new_state = node['firewall']['rules'].to_s
Chef::Log.debug "Old firewall state:#{old_state}"
Chef::Log.debug "New firewall state:#{new_state}"
#check to see if the firewall rules changed.
#the rules are always changed the first run
# check to see if the firewall rules changed.
# the rules are always changed the first run
if old_state == new_state
Chef::Log.info "Firewall rules unchanged."
Chef::Log.info 'Firewall rules unchanged.'
else
Chef::Log.info "Firewall rules updated."
Chef::Log.info 'Firewall rules updated.'
node.set['firewall']['state'] = new_state
#drop rules and re-enable
execute "ufw --force reset"
# drop rules and re-enable
execute 'ufw --force reset'
firewall "ufw" do
action :enable
firewall 'ufw' do
action :install
end
#leave this on by default
firewall_rule "ssh" do
# leave this on by default
firewall_rule 'ssh' do
port 22
action :allow
action :create
end
node['firewall']['rules'].each do |rule_mash|
@@ -64,8 +64,8 @@ else
Chef::Log.debug "ufw:rule:dest_port #{params['dest_port']}" if params['dest_port']
Chef::Log.debug "ufw:rule:position #{params['position']}" if params['position']
act = params['action']
act ||= "allow"
raise "ufw: port_range was specified to firewall_rule without protocol" if params['port_range'] && !params['protocol']
act ||= 'create'
fail 'ufw: port_range was specified to firewall_rule without protocol' if params['port_range'] && !params['protocol']
Chef::Log.debug "ufw:rule:action :#{act}"
firewall_rule rule do
name params['name'] if params['name']
@@ -74,10 +74,10 @@ else
interface params['interface'] if params['interface']
logging params['logging'].to_sym if params['logging']
port params['port'].to_i if params['port']
if params['port_range']
ends = params['port_range'].split('..').map{|d| Integer(d)}
port_range ends[0]..ends[1]
end
if params['port_range']
ends = params['port_range'].split('..').map { |d| Integer(d) }
port_range ends[0]..ends[1]
end
source params['source'] if params['source']
destination params['destination'] if params['destination']
dest_port params['dest_port'].to_i if params['dest_port']

6
cookbooks/ufw/recipes/disable.rb
View File

@@ -1,9 +1,9 @@
#
# Author:: Matt Ray <matt@opscode.com>
# Author:: Matt Ray <matt@chef.io>
# Cookbook Name:: ufw
# Recipe:: disable
#
# Copyright 2011, Opscode, Inc
# Copyright 2011-2015, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -18,6 +18,6 @@
# limitations under the License.
#
firewall "ufw" do
firewall 'ufw' do
action :disable
end

24
cookbooks/ufw/recipes/recipes.rb
View File

@@ -1,9 +1,9 @@
#
# Author:: Matt Ray <matt@opscode.com>
# Author:: Matt Ray <matt@chef.io>
# Cookbook Name:: ufw
# Recipe:: recipes
#
# Copyright 2011, Opscode, Inc
# Copyright 2011-2015, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -23,19 +23,19 @@
node.expand!.recipes.each do |recipe|
Chef::Log.debug "ufw::recipes: #{recipe}"
cookbook = recipe.split('::')[0]
#get the cookbook attributes if there are any
if recipe != cookbook and node[cookbook] and node[cookbook]['firewall'] and node[cookbook]['firewall']['rules']
# get the cookbook attributes if there are any
if recipe != cookbook && node[cookbook] && node[cookbook]['firewall'] && node[cookbook]['firewall']['rules']
rules = node[cookbook]['firewall']['rules']
Chef::Log.debug "ufw::recipes:#{cookbook}:rules #{rules}"
node.set['firewall']['rules'].concat(rules) unless rules.nil?
end
#get the recipe attributes if there are any
if node[recipe] and node[recipe]['firewall'] and node[recipe]['firewall']['rules']
rules = node[recipe]['firewall']['rules']
Chef::Log.debug "ufw::recipes:#{recipe}:rules #{rules}"
node.set['firewall']['rules'].concat(rules) unless rules.nil?
end
# get the recipe attributes if there are any
next unless node[recipe] && node[recipe]['firewall'] && node[recipe]['firewall']['rules']
rules = node[recipe]['firewall']['rules']
Chef::Log.debug "ufw::recipes:#{recipe}:rules #{rules}"
node.set['firewall']['rules'].concat(rules) unless rules.nil?
end
#now go apply the rules
include_recipe "ufw::default"
# now go apply the rules
include_recipe 'ufw::default'

20
cookbooks/ufw/recipes/securitylevel.rb
View File

@@ -1,9 +1,9 @@
#
# Author:: Matt Ray <matt@opscode.com>
# Author:: Matt Ray <matt@chef.io>
# Cookbook Name:: ufw
# Recipe:: securitylevel
#
# Copyright 2011, Opscode, Inc
# Copyright 2011-2015, Chef Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -22,20 +22,20 @@ securitylevel = node['firewall']['securitylevel']
Chef::Log.info "ufw::securitylevel:#{securitylevel}"
#verify that only 1 "color" security group is applied"
count = node.expand!.roles.count {|role| role =~ /SecurityLevel-(Red|Green|Yellow)/ }
# verify that only 1 "color" security group is applied"
count = node.expand!.roles.count { |role| role =~ /SecurityLevel-(Red|Green|Yellow)/ }
if count > 1
raise Chef::Exceptions::AmbiguousRunlistSpecification, "conflicting SecurityLevel-'color' roles, only 1 may be applied."
fail Chef::Exceptions::AmbiguousRunlistSpecification, "conflicting SecurityLevel-'color' roles, only 1 may be applied."
end
case securitylevel
when 'red'
#put special stuff for red here
# put special stuff for red here
when 'yellow'
#put special stuff for red here
# put special stuff for red here
when 'green'
#put special stuff for red here
# put special stuff for red here
end
#now go apply the rules
include_recipe "ufw::default"
# now go apply the rules
include_recipe 'ufw::default'