Initial Chef repository

cookbooks/users/CHANGELOG.md

@@ -0,0 +1,77 @@
+users Cookbook CHANGELOG
+========================
+This file is used to list changes made in each version of the users cookbook.
+
+v1.8.2 (2015-03-18)
+-------------------
+- No changes, just republishing 1.8.1
+
+v1.8.1 (2015-03-12)
+-------------------
+- Add `source_url` and `issues_url` to the metadata.rb so Supermarket can display 
+appropriate links
+
+v1.8.0 (2015-03-09)
+-------------------
+- Expose LWRP state attributes
+- [COOK-4401] - Add unit tests with ChefSpec
+- [COOK-4404] - Determine file system and add manage_nfs_home_dirs attribute to disable 
+managing NFS mounted home directories
+- Remove `converge_by` when creating home directory, the directory resource 
+already handles this
+- Do not manage home directory if the path does not exist
+- Add integration with TravisCI
+- "Opscode" to "Chef" replacements
+- Retire unsupported Ruby 1.9.3 and add Ruby 2.2 to the Travis integration tests
+- Updates for RSpec 3
+
+v1.7.0 (2014-02-14)
+-------------------
+- [COOK-4139] - users_manage resource always notifies
+- [COOK-4078] - users cookbook fails in why-run mode for .ssh directory
+- [COOK-3959] - Add support for Mac OS X to users cookbook
+
+
+v1.6.0
+------
+### Bug
+- **[COOK-3744](https://tickets.opscode.com/browse/COOK-3744)** - Allow passing an action option via the `data_bag` to the user resource
+
+
+v1.5.2
+------
+### Bug
+- **[COOK-3215](https://tickets.opscode.com/browse/COOK-3215)** - Make `group_id` optional
+
+v1.5.0
+------
+- [COOK-2427] - Mistakenly released instead of sudo :-).
+
+v1.4.0
+------
+- [COOK-2479] - Permit users cookbook to work with chef-solo if edelight/chef-solo-search is installed
+- [COOK-2486] - specify precedence when setting node attribute
+
+v1.3.0
+------
+- [COOK-1842] - allow specifying private SSH keys
+- [COOK-2021] - Empty default recipe for including users LWRPs
+
+v1.2.0
+------
+- [COOK-1398] - Provider manage.rb ignores username attribute
+- [COOK-1582] - ssh_keys should take an array in addition to a string separated by new lines
+
+v1.1.4
+------
+- [COOK-1396] - removed users get recreated
+- [COOK-1433] - resolve foodcritic warnings
+- [COOK-1583] - set passwords for users
+
+v1.1.2
+------
+- [COOK-1076] - authorized_keys template not found in another cookbook
+
+v1.1.0
+------
+- [COOK-623] - LWRP conversion

cookbooks/users/README.md

@@ -0,0 +1,193 @@
+users Cookbook
+==============
+![Build Status](https://travis-ci.org/opscode-cookbooks/users.svg?branch=master)
+
+Creates users from a databag search.
+
+
+Requirements
+------------
+### Platforms
+- Debian, Ubuntu
+- CentOS, Red Hat, Fedora
+- FreeBSD
+
+A data bag populated with user objects must exist. The default data
+bag in this recipe is `users`. See USAGE.
+
+
+Usage
+-----
+To include just the LWRPs in your cookbook, use:
+
+```ruby
+include_recipe "users"
+```
+
+Otherwise, this cookbook is specific for setting up `sysadmin` group and users with the sysadmins recipe for now.
+
+```ruby
+include_recipe "users::sysadmins"
+```
+
+Use knife to create a data bag for users.
+
+```bash
+$ knife data bag create users
+```
+
+Create a user in the data_bag/users/ directory.
+
+When using an [Omnibus ruby](http://tickets.opscode.com/browse/CHEF-2848), one can specify an optional password hash. This will be used as the user's password.
+
+The hash can be generated with the following command.
+
+```bash
+$ openssl passwd -1 "plaintextpassword"
+```
+
+Note: The ssh_keys attribute below can be either a String or an Array. However, we are recommending the use of an Array.
+
+```javascript
+{
+  "id": "bofh",
+  "ssh_keys": "ssh-rsa AAAAB3Nz...yhCw== bofh",
+}
+```
+
+```javascript
+{
+  "id": "bofh",
+  "password": "$1$d...HgH0",
+  "ssh_keys": [
+    "ssh-rsa AAA123...xyz== foo",
+    "ssh-rsa AAA456...uvw== bar"
+  ],
+  "groups": [ "sysadmin", "dba", "devops" ],
+  "uid": 2001,
+  "shell": "\/bin\/bash",
+  "comment": "BOFH",
+  "nagios": {
+    "pager": "8005551212@txt.att.net",
+    "email": "bofh@example.com"
+  },
+  "openid": "bofh.myopenid.com"
+}
+```
+
+You can pass any action listed in the [user](http://docs.chef.io/chef/resources.html#user) resource for Chef via the "action" option. For Example:
+
+Lock a user, johndoe1.
+
+```bash
+$ knife data bag edit users johndoe1
+```
+
+And then change the action to "lock":
+
+```javascript
+{
+  "id": "johndoe1",
+  "groups": ["sysadmin", "dba", "devops"],
+  "uid": 2002,
+  "action": "lock", // <--
+  "comment": "User violated access policy"
+}
+```
+
+Remove a user, johndoe1.
+
+```bash
+$ knife data bag edit users johndoe1
+```
+
+And then change the action to "remove":
+
+```javascript
+{
+  "id": "johndoe1",
+  "groups": [ "sysadmin", "dba", "devops" ],
+  "uid": 2002,
+  "action": "remove", // <--
+  "comment": "User quit, retired, or fired."
+}
+```
+
+* Note only user bags with the "action : remove" and a search-able "group" attribute will be purged by the :remove action.
+
+The sysadmins recipe makes use of the `users_manage` Lightweight Resource Provider (LWRP), and looks like this:
+
+```ruby
+users_manage "sysadmin" do
+  group_id 2300
+  action [ :remove, :create ]
+end
+```
+
+Note this LWRP searches the `users` data bag for the `sysadmin` group attribute, and adds those users to a Unix security group `sysadmin`. The only required attribute is group_id, which represents the numeric Unix gid and *must* be unique. The default action for the LWRP is `:create` only.
+
+If you have different requirements, for example:
+
+ * You want to search a different data bag specific to a role such as
+   mail. You may change the data_bag searched.
+   - data_bag `mail`
+ * You want to search for a different group attribute named
+   `postmaster`. You may change the search_group attribute. This
+   attribute defaults to the LWRP resource name.
+   - search_group `postmaster`
+ * You want to add the users to a security group other than the
+   lightweight resource name. You may change the group_name attribute.
+   This attribute also defaults to the LWRP resource name.
+   - group_name `wheel`
+
+Putting these requirements together our recipe might look like this:
+
+```ruby
+users_manage "postmaster" do
+  data_bag "mail"
+  group_name "wheel"
+  group_id 10
+end
+```
+
+The latest version of knife supports reading data bags from a file and automatically looks in a directory called +data_bags+ in the current directory. The "bag" should be a directory with JSON files of each item. For the above:
+
+```bash
+$ mkdir data_bags/users
+$EDITOR data_bags/users/bofh.json
+```
+
+Paste the user's public SSH key into the ssh_keys value. Also make sure the uid is unique, and if you're not using bash, that the shell is installed. The default search, and Unix group is sysadmin.
+
+The recipe, by default, will also create the sysadmin group. If you're using the chef sudo cookbook, they'll have sudo access in the default site-cookbooks template. They won't have passwords though, so the sudo cookbook's template needs to be adjusted so the sysadmin group has NOPASSWD.
+
+The sysadmin group will be created with GID 2300. This may become an attribute at a later date.
+
+The Apache cookbook can set up authentication using OpenIDs, which is set up using the openid key here. See the Chef Software 'apache2' cookbook for more information about this.
+
+
+Chef Solo
+---------
+As of version 1.4.0, this cookbook might work with Chef Solo when using [chef-solo-search by edelight](https://github.com/edelight/chef-solo-search). That cookbook is not a dependency of this one as Chef solo doesn't support dependency resolution using cookbook metadata - all cookbooks must be provided to the node manually when using Chef Solo.
+
+
+License & Authors
+-----------------
+- Author:: Joshua Timberman (<joshua@chef.io>)
+- Author:: Seth Chisamore (<schisamo@chef.io>)
+
+```text
+Copyright:: 2009-2015, Chef Software, Inc
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+```

cookbooks/users/libraries/helpers.rb

@@ -0,0 +1,29 @@
+require 'mixlib/shellout'
+
+module Users
+  # Helpers for Users
+  module Helpers
+    # Checks fs type.
+    #
+    # @return [String]
+    def fs_type(mount)
+      begin
+        # Doesn't support macosx
+        stat = Mixlib::ShellOut.new("stat -f -L -c %T #{mount} 2>&1").run_command
+        stat.stdout.chomp
+      rescue
+        'none'
+      end
+    end
+
+    # Determines if provided mount point is remote.
+    #
+    # @return [Boolean]
+    def fs_remote?(mount)
+      fs_type(mount) == 'nfs' ? true : false
+    end
+  end
+end
+
+Chef::Resource.send(:include, ::Users::Helpers)
+Chef::Provider.send(:include, ::Users::Helpers)

cookbooks/users/libraries/matchers.rb

@@ -0,0 +1,15 @@
+# Matchers for chefspec 3
+
+if defined?(ChefSpec)
+  def create_users_manage(resource_name)
+    ChefSpec::Matchers::ResourceMatcher.new(:users_manage,
+                                            :create,
+                                            resource_name)
+  end
+
+  def remove_users_manage(resource_name)
+    ChefSpec::Matchers::ResourceMatcher.new(:users_manage,
+                                            :remove,
+                                            resource_name)
+  end
+end

cookbooks/users/providers/manage.rb

@@ -0,0 +1,180 @@
+#
+# Cookbook Name:: users
+# Provider:: manage
+#
+# Copyright 2011, Eric G. Wolfe
+# Copyright 2009-2011, Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+use_inline_resources if defined?(use_inline_resources)
+
+def whyrun_supported?
+  true
+end
+
+def initialize(*args)
+  super
+  @action = :create
+end
+
+def chef_solo_search_installed?
+  klass = ::Search::const_get('Helper')
+  return klass.is_a?(Class)
+rescue NameError
+  return false
+end
+
+action :remove do
+  if Chef::Config[:solo] and not chef_solo_search_installed?
+    Chef::Log.warn("This recipe uses search. Chef Solo does not support search unless you install the chef-solo-search cookbook.")
+  else
+    search(new_resource.data_bag, "groups:#{new_resource.search_group} AND action:remove") do |rm_user|
+      user rm_user['username'] ||= rm_user['id'] do
+        action :remove
+      end
+    end
+  end
+end
+
+action :create do
+  security_group = Array.new
+
+  if Chef::Config[:solo] and not chef_solo_search_installed?
+    Chef::Log.warn("This recipe uses search. Chef Solo does not support search unless you install the chef-solo-search cookbook.")
+  else
+    search(new_resource.data_bag, "groups:#{new_resource.search_group} AND NOT action:remove") do |u|
+      u['username'] ||= u['id']
+      security_group << u['username']
+
+      if node['apache'] and node['apache']['allowed_openids']
+        Array(u['openid']).compact.each do |oid|
+          node.default['apache']['allowed_openids'] << oid unless node['apache']['allowed_openids'].include?(oid)
+        end
+      end
+
+      # Set home_basedir based on platform_family
+      case node['platform_family']
+      when 'mac_os_x'
+        home_basedir = '/Users'
+      when 'debian', 'rhel', 'fedora', 'arch', 'suse', 'freebsd'
+        home_basedir = '/home'
+      end
+
+      # Set home to location in data bag,
+      # or a reasonable default ($home_basedir/$user).
+      if u['home']
+        home_dir = u['home']
+      else
+        home_dir = "#{home_basedir}/#{u['username']}"
+      end
+
+      # The user block will fail if the group does not yet exist.
+      # See the -g option limitations in man 8 useradd for an explanation.
+      # This should correct that without breaking functionality.
+      if u['gid'] and u['gid'].kind_of?(Numeric)
+        group u['username'] do
+          gid u['gid']
+        end
+      end
+
+      # Create user object.
+      # Do NOT try to manage null home directories.
+      user u['username'] do
+        uid u['uid']
+        if u['gid']
+          gid u['gid']
+        end
+        shell u['shell']
+        comment u['comment']
+        password u['password'] if u['password']
+        if home_dir == "/dev/null"
+          supports :manage_home => false
+        else
+          supports :manage_home => true
+        end
+        home home_dir
+        action u['action'] if u['action']
+      end
+
+      if manage_home_files?(home_dir, u['username'])
+        Chef::Log.debug("Managing home files for #{u['username']}")
+
+        directory "#{home_dir}/.ssh" do
+          owner u['username']
+          group u['gid'] || u['username']
+          mode "0700"
+        end
+
+        if u['ssh_keys']
+          template "#{home_dir}/.ssh/authorized_keys" do
+            source "authorized_keys.erb"
+            cookbook new_resource.cookbook
+            owner u['username']
+            group u['gid'] || u['username']
+            mode "0600"
+            variables :ssh_keys => u['ssh_keys']
+          end
+        end
+
+        if u['ssh_private_key']
+          key_type = u['ssh_private_key'].include?("BEGIN RSA PRIVATE KEY") ? "rsa" : "dsa"
+          template "#{home_dir}/.ssh/id_#{key_type}" do
+            source "private_key.erb"
+            cookbook new_resource.cookbook
+            owner u['id']
+            group u['gid'] || u['id']
+            mode "0400"
+            variables :private_key => u['ssh_private_key']
+          end
+        end
+
+        if u['ssh_public_key']
+          key_type = u['ssh_public_key'].include?("ssh-rsa") ? "rsa" : "dsa"
+          template "#{home_dir}/.ssh/id_#{key_type}.pub" do
+            source "public_key.pub.erb"
+            cookbook new_resource.cookbook
+            owner u['id']
+            group u['gid'] || u['id']
+            mode "0400"
+            variables :public_key => u['ssh_public_key']
+          end
+        end
+      else
+        Chef::Log.debug("Not managing home files for #{u['username']}")
+      end
+    end
+  end
+
+  group new_resource.group_name do
+    if new_resource.group_id
+      gid new_resource.group_id
+    end
+    members security_group
+  end
+end
+
+private
+
+def manage_home_files?(home_dir, user)
+  # Don't manage home dir if it's NFS mount
+  # and manage_nfs_home_dirs is disabled
+  if home_dir == "/dev/null"
+    false
+  elsif fs_remote?(home_dir)
+    new_resource.manage_nfs_home_dirs ? true : false
+  else
+    true
+  end
+end

cookbooks/users/recipes/default.rb

@@ -0,0 +1,20 @@
+#
+# Cookbook Name:: users
+# Recipe:: default
+#
+# Copyright 2009-2012, Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Empty default recipe for including LWRPs.

cookbooks/users/recipes/sysadmins.rb

@@ -0,0 +1,26 @@
+#
+# Cookbook Name:: users
+# Recipe:: sysadmins
+#
+# Copyright 2011, Eric G. Wolfe
+# Copyright 2009-2011, Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Searches data bag "users" for groups attribute "sysadmin".
+# Places returned users in Unix group "sysadmin" with GID 2300.
+users_manage "sysadmin" do
+  group_id 2300
+  action [ :remove, :create ]
+end

cookbooks/users/resources/manage.rb

@@ -0,0 +1,44 @@
+#
+# Cookbook Name:: users
+# Resources:: manage
+#
+# Copyright 2011, Eric G. Wolfe
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Data bag user object needs an "action": "remove" tag to actually be removed by the action.
+actions :create, :remove
+
+state_attrs :cookbook,
+            :data_bag,
+            :group_id,
+            :group_name,
+            :search_group
+
+# :data_bag is the object to search
+# :search_group is the groups name to search for, defaults to resource name
+# :group_name is the string name of the group to create, defaults to resource name
+# :group_id is the numeric id of the group to create, default is to allow the OS to pick next
+# :cookbook is the name of the cookbook that the authorized_keys template should be found in
+attribute :data_bag, :kind_of => String, :default => "users"
+attribute :search_group, :kind_of => String, :name_attribute => true
+attribute :group_name, :kind_of => String, :name_attribute => true
+attribute :group_id, :kind_of => Integer
+attribute :cookbook, :kind_of => String, :default => "users"
+attribute :manage_nfs_home_dirs, :kind_of => [TrueClass, FalseClass], :default => true
+
+def initialize(*args)
+  super
+  @action = :create
+end

cookbooks/users/templates/default/authorized_keys.erb

@@ -0,0 +1,6 @@
+# Generated by Chef for <%= node['fqdn'] %>
+# Local modifications will be overwritten.
+
+<% Array(@ssh_keys).each do |key| %>
+<%= key %>
+<% end -%>

cookbooks/users/templates/default/private_key.erb

@@ -0,0 +1 @@
+<%= @private_key %>

cookbooks/users/templates/default/public_key.pub.erb

@@ -0,0 +1 @@
+<%= @public_key %>