Oded Simon puppet config

puppet/README.txt

@@ -0,0 +1,38 @@
+This file is how to use Oded Simon puppet module for:
+REA site performance pre-interview task puppet module
+
+Assumptions:
+1. The new server have one of the followings OSs RedHat, CentOS or Ubuntu 
+2. The new server get it IP and DNS setting from DHCP.
+3. The new server can connect to the puppet master server.
+4. The new server have access to the internet for downloading required packages and ruby gems.
+
+How to use this module
+1. Install puppet agent using the script install_puppet_agent.sh from this repo.
+2. Add the server to puppet master server.
+3. Configure the new server to receive this module by adding the following to the node config:
+   node 'server name' {
+       include rea
+   }
+4. run the puppet agent on the new server.
+
+This module will do the following:
+1. Will create the group rea-admin, and will set it to have full sudo permissions.
+2. Will create the user radmin, and add it to rea-admin group.
+3. Will disable selinux on RedHat/CentOS servers.
+4. Will set the iptables firewall to start at boot with the following settings:
+4.1. INPUT, FORWARD chain policy is DROP.
+4.2. OUTPUT chain policy is ACCEPT.
+4.3. Allow tcp connection on port 22 (management via SSH), 80 (HTTP).
+4.4. Allow all ICMP connections.
+5. Install Apache and mod_passenger via RPM/DEB packages.
+6. Pull the simple-sinatra-app from github, install require ruby gems and configure Apache server to server it on port 80.
+
+
+What can be improved:
+1. This module can be smarter by allowing the pull of the application to be variable, and as result it will be able to install additional ruby on rails application.
+2. The passenger module can be enhance to use NameVirtualHost option for Apache server.
+
+Tested on:
+CentOS 6.5 x64
+Ubuntu 12.04 LTS x64

puppet/install_puppet_agent.sh

@@ -0,0 +1,116 @@
+#/bin/bash
+
+usage () {
+    echo "This script install puppet agent and configure the agent"
+    echo "Usage:"
+    echo "$0 -s <fqdn of the puppet serve>"
+    exit 3
+}
+if [[ $# != 2 ]]
+then
+    usage
+fi    
+
+#read the args
+while getopts ":s:h" opt; do
+    case $opt in
+        s)
+            MASTER=$OPTARG
+            ;;
+        h)
+            usage
+            ;;
+        *)
+            usage
+            ;;
+    esac
+done
+
+#is puppet configured
+if [ -f /etc/puppet/puppet.conf ]
+then
+    CHECKMASTER=`grep "server" /etc/puppet/puppet.conf |awk -F'=' '{print $2}'`
+    echo "puppet agent is already install and configure with"
+    echo "confiugre master server is $CHECKMASTER"
+    exit 0
+fi
+if [ -z $MASTER ]
+then
+    echo "ERROR:  puppet master is not provided."
+    usage
+fi
+
+#Check the server OS
+if [ ! -f /etc/redhat-release ] && [ ! -f /etc/lsb-release ]
+then
+    echo "Error: can not detect the OS"
+    exit 1
+fi    
+if [ -f /etc/redhat-release ]
+then
+    VER5=`grep 5\.[0-9] /etc/redhat-release`
+    VER6=`grep 6\.[0-9] /etc/redhat-release`
+    PROC=`uname -p`
+    if [ -z "$VER6" ] && [ -z "$VER5" ]
+    then
+        echo "Error: could not detect the RedHat/CentOS version"
+        exit 1
+    fi    
+    #add puppet repo
+    if [ "$PROC" == "x86_64" ]
+    then
+        if [ ! -z "$VER6" ] && [ -z "$VER5" ]
+        then
+            sudo rpm -ivh https://yum.puppetlabs.com/el/6/products/x86_64/puppetlabs-release-6-7.noarch.rpm
+        fi
+        if [ -z "$VER6" ] && [ ! -z "$VER5" ]
+        then
+            sudo rpm -ivh https://yum.puppetlabs.com/el/5/products/x86_64/puppetlabs-release-5-7.noarch.rpm    
+        fi
+    else
+        if [ ! -z "$VER6" ] && [ -z "$VER5" ]
+        then
+            sudo rpm -ivh https://yum.puppetlabs.com/el/6/products/i386/puppetlabs-release-6-7.noarch.rpm
+        fi
+        if [ -z "$VER6" ] && [ ! -z "$VER5" ]
+        then
+            sudo rpm -ivh https://yum.puppetlabs.com/el/5/products/i386/puppetlabs-release-5-7.noarch.rpm
+        fi
+    fi
+    #install the agent
+    sudo yum -y install puppet
+    #add the service to startup
+    /sbin/chkconfig puppet on
+fi    
+if [ -f /etc/lsb-release ] && [ ! -f /etc/redhat-release ]
+then
+    VER=`grep DISTRIB_CODENAME /etc/lsb-release| awk -F'=' '{print $2}'`
+    wget https://apt.puppetlabs.com/puppetlabs-release-${VER}.deb
+    sudo dpkg -i puppetlabs-release-${VER}.deb
+    sudo apt-get update
+    sudo apt-get -y install puppet
+fi
+if [ -f /etc/puppet/puppet.conf ]
+then    
+    #edit the puppet.conf file
+    mv /etc/puppet/puppet.conf /etc/puppet/puppet.orig
+    echo "[main]" >>/etc/puppet/puppet.conf
+    echo "    server=${MASTER}" >>/etc/puppet/puppet.conf
+    echo "    pluginsync=true" >>/etc/puppet/puppet.conf
+    echo "    logdir=/var/log/puppet" >>/etc/puppet/puppet.conf
+    echo "    vardir=/var/lib/puppet" >>/etc/puppet/puppet.conf
+    echo "    ssldir=/var/lib/puppet/ssl" >>/etc/puppet/puppet.conf
+    echo "    rundir=/var/run/puppet" >>/etc/puppet/puppet.conf
+    echo "    factpath=$vardir/lib/facter" >>/etc/puppet/puppet.conf
+    echo "    templatedir=$confdir/templates" >>/etc/puppet/puppet.conf
+    echo "" >>/etc/puppet/puppet.conf
+    echo "[agent]" >>/etc/puppet/puppet.conf
+    echo "    report      = true" >>/etc/puppet/puppet.conf
+    echo "     show_diff   = true" >>/etc/puppet/puppet.conf
+    echo "    runinterval = 3600" >>/etc/puppet/puppet.conf
+    #run the agent for the first time
+    sudo puppet agent --noop --test
+    #echo to add the node to the puppet master
+    echo "Please add the new server certificat to the puppet master and re run the agent"
+    exit 0
+fi    

puppet/rea/files/firewall/iptables.redhat

@@ -0,0 +1,10 @@
+*filter
+:INPUT DROP [13:2613]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [49:5900]
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -p tcp -m tcp -m state --state NEW --dport 22 -j LOG
+-A INPUT -p tcp -m tcp -m multiport --dports 22,80 -j ACCEPT
+COMMIT

puppet/rea/files/firewall/iptables.ubuntu

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+iptables -F INPUT
+iptables -F OUTPUT
+iptables -F FORWARD
+iptables -P INPUT DROP
+iptables -P OUTPUT ACCEPT
+iptables -P FORWARD DROP
+
+iptables -A INPUT -i lo -j ACCEPT
+iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A INPUT -p icmp -j ACCEPT
+iptables -A INPUT -p tcp -m tcp -m state --state NEW --dport 22 -j LOG
+iptables -A INPUT -p tcp -m tcp -m multiport --dports 22,80 -j ACCEPT

puppet/rea/files/firewall/iptablesload.ubuntu

@@ -0,0 +1,3 @@
+#!/bin/sh
+iptables-restore < /etc/iptables.rules
+exit 0

puppet/rea/files/firewall/iptablessave.ubuntu

@@ -0,0 +1,6 @@
+#!/bin/sh
+iptables-save -c > /etc/iptables.rules
+if [ -f /etc/iptables.downrules ]; then
+   iptables-restore < /etc/iptables.downrules
+fi
+exit 0

puppet/rea/files/selinux/config

@@ -0,0 +1,10 @@
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+#     enforcing - SELinux security policy is enforced.
+#     permissive - SELinux prints warnings instead of enforcing.
+#     disabled - No SELinux policy is loaded.
+SELINUX=disabled
+# SELINUXTYPE= can take one of these two values:
+#     targeted - Targeted processes are protected,
+#     mls - Multi Level Security protection.
+SELINUXTYPE=targeted

puppet/rea/files/sshd/sshd_config.redhat

@@ -0,0 +1,137 @@
+#	$OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# Disable legacy (protocol version 1) support in the server for new
+# installations. In future the default will change to require explicit
+# activation of protocol 1
+Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+SyslogFacility AUTHPRIV
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin no
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+#AuthorizedKeysFile	.ssh/authorized_keys
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandRunAs nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+#KerberosUseKuserok yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+GSSAPIAuthentication yes
+#GSSAPICleanupCredentials yes
+GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing, 
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+UsePAM yes
+
+# Accept locale-related environment variables
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+AcceptEnv XMODIFIERS
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#ShowPatchLevel no
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+#ChrootDirectory none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/libexec/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	ForceCommand cvs server