Skip to content

Commit 3d0042b

Browse files
authored
Add files via upload
1 parent 16922c8 commit 3d0042b

10 files changed

+623
-1
lines changed

README.md

+57-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,57 @@
1-
# ubuntu-pipeline-tf
1+
UBUNTU Testing
2+
# PIPELINE STIG & CIS for UBUNTU 18 & 20 TESTING
3+
#
4+
# To use this repo to create the testing environment
5+
# Execute the following commands - terraform init, terrafrom plan, terrafrom apply -auto-approve
6+
7+
./startup.sh
8+
9+
# This will create the ec2, private key and host files for the test bed
10+
11+
# Install Ansible, Git and other's resouces on the newly created EC2
12+
# The SSH command has a mode where you can run any single command on a remote server.
13+
14+
# Ubuntu18
15+
ssh -i Ubuntu-key.pem ubuntu@ec2-3-89-35-103.compute-1.amazonaws.com 'bash -s' < scripts/ubuntu-setup.sh
16+
17+
# Ubuntu20
18+
ssh -i Ubuntu-key.pem ubuntu@ec2-3-95-13-227.compute-1.amazonaws.com 'bash -s' < scripts/ubuntu-setup.sh
19+
20+
# Repeat for all EC2's that will be tested.
21+
22+
# ssh to the ec2 instances that you want to perform the testing
23+
24+
ssh -i Ubuntu-key.pem ubuntu@ec2-3-89-35-103.compute-1.amazonaws.com
25+
26+
# Git clone the repo from testing unto the EC2 Instance.
27+
28+
git clone https://github.com/ansible-lockdown/UBUNTU18-CIS.git
29+
30+
# Edit the site.yml to run on localhost
31+
32+
vi or nano UBUNTU18-CIS/site.yml
33+
- hosts: localhost
34+
35+
# Run the ansible-playbook against the localhost
36+
37+
ansible-playbook site.yml
38+
39+
# To get a listing of EC2 resouces within the project
40+
terrafrom refresh
41+
42+
# Emamples
43+
Outputs:
44+
45+
Ubuntu18 = "ssh -i Ubuntu-key.pem ubuntu@ec2-3-89-35-103.compute-1.amazonaws.com"
46+
Ubuntu20 = "ssh -i Ubuntu-key.pem ubuntu@ec2-3-95-13-227.compute-1.amazonaws.com"
47+
ec2_instance_ip_Ubuntu18 = "3.89.35.103"
48+
ec2_instance_ip_Ubuntu20 = "3.95.13.227"
49+
50+
Welcome to your PIPELINE testing
51+
52+
# To clean up the testing environment
53+
./cleanup.sh
54+
55+
# this will remove all EC2, Key name, hosts-dev, terraform state.
56+
57+
# NOTE: All terraform, git, ansible commands can be ran adhoc as well.

ansible.cfg

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# ansible.cfg
2+
3+
[defaults]
4+
inventory=./hosts-dev
5+
remote_user=ubuntu
6+
private_key_file=./-key.pem
7+
host_key_checking=False
8+
interpreter_python=auto_silent
9+
retry_files_enable=False
10+
command_warnings=False

ansible_setup.sh

+236
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
#!/bin/bash
2+
#------------------------------------------------------------------------------
3+
# Description: Install and setup ansible venv with python 3 and pip
4+
# License: MIT
5+
# Platform: rhel/centos 7/8
6+
# Author: Mark Bolwell
7+
# Requirements: Root user and access to update packages and install from pip - proxy is ok
8+
# if running older ubuntu e.g. 18 then ensure repositorys are update dto archive
9+
#------------------------------------------------------------------------------
10+
11+
# Change if required
12+
#ignore_os_check=true
13+
ansible_version=2.9.12
14+
python_major_vers=3
15+
python_minor_vers=6
16+
17+
## PROXY
18+
# Please add proxy settings suitable for pip.conf if not found in yum.conf
19+
# update the line below remove user:password if not authenticated
20+
#MANUAL_PROXY="[global]\nproxy = http://user:password@proxy_name:port"
21+
22+
#
23+
install_log=./install_ansible.log
24+
25+
## These shouldnt need changing unless requirements for ansible
26+
## or ansible-lockdown change
27+
28+
python_pkg=$python_major_vers$python_minor_vers
29+
rh_ansible_deps="python$python_pkg python$python_pkg-devel libffi-devel openssl-devel gcc git"
30+
deb_ansible_deps="python3 python3-pip libssl-dev"
31+
32+
# pip installation and module versions
33+
# Setup for std linux and window connections
34+
# if require more e.g. aws, azure these can be added to the list below
35+
pip_std_modules="
36+
ansible==$ansible_version
37+
certifi==2020.6.20
38+
cffi==1.14.2
39+
chardet==3.0.4
40+
cryptography==3.0
41+
idna==2.10
42+
Jinja2==3.0.1
43+
jmespath==0.10.0
44+
MarkupSafe==2.0.1
45+
ntlm-auth==1.5.0
46+
passlib==1.7.2
47+
pycparser==2.20
48+
pywinrm==0.4.1
49+
PyYAML==5.3.1
50+
requests==2.24.0
51+
requests-ntlm==1.1.0
52+
six==1.15.0
53+
urllib3==1.25.10
54+
xmltodict==0.12.0
55+
"
56+
pip_xtra_modules=""
57+
58+
59+
60+
61+
#-------------------------------------
62+
63+
usage() {
64+
# Provide usage detail to user
65+
66+
sed 's/^ //' <<EOF
67+
ansible_install.sh - Install or remove ansible packages & modules.
68+
Usage: ansible_setup.sh [-h] [-i] [-p] [-r]
69+
Arguments:
70+
-h Print this message
71+
-i Install/update packages & download modules.
72+
-p update/install pip modules only
73+
-r Remove packages & modules.
74+
EOF
75+
}
76+
############### Main Functions ##################
77+
echo $UID
78+
echo $EUID
79+
check_for_root_os() {
80+
echo "------------------------------"
81+
echo "Root user and OS Version check"
82+
echo "------------------------------"
83+
# Check to make sure we're being run by root.
84+
if [ $(id -u) -ne 0 ]; then
85+
echo "Please run as root"
86+
exit
87+
fi
88+
# Check to make sure correct OS version
89+
if [ -f /etc/os-release ]; then
90+
if [ `grep ID_LIKE /etc/os-release | grep -c fedora` -eq 1 ]; then
91+
export OS_FLAV=RH;
92+
elif [ `grep ID /etc/os-release | grep -ci ubuntu` -eq 1 ]; then
93+
export OS_FLAV=DEB;
94+
else
95+
echo "Incorrect OS - Script only runs on fedora or debian variants"; exit 1
96+
fi
97+
98+
elif [ -n "$ignore_os_check" ]; then
99+
echo "---- OS Check ignore option set ----"
100+
fi
101+
echo "------- Completed -------"
102+
}
103+
104+
check_for_proxy() {
105+
echo "------------------------------------"
106+
echo "Check for proxy server configuration"
107+
echo "------------------------------------"
108+
# Check to see if a proxy server is defined and if so return it.
109+
if [ -n "$MANUAL_PROXY" ]; then
110+
echo "----- Manual Proxy Server Variable Set -----"
111+
elif [ `grep -c ^proxy /etc/yum.conf` > 0 ]; then
112+
PROXY_SETTINGS=`grep ^proxy= /etc/yum.conf`
113+
fi
114+
echo "------- Completed -------"
115+
}
116+
117+
stop_ansible_os_pkg() {
118+
if [ "$OS_FLAV" = 'RH' ]; then
119+
# Check to see if Ansible is excluded in yum.conf
120+
echo "------------------------------------------"
121+
echo "Ensure ansible OS package ignored: Started"
122+
echo "------------------------------------------"
123+
124+
if [ `grep -v "#" /etc/yum.conf | grep -c ansible` = 0 ]; then
125+
echo -e "## Exclude ansible for OS pkg install - dependency issues when patching ## \nexclude=ansible*" >> /etc/yum.conf;
126+
fi
127+
# Check to see if Ansible is excluded in dnf.conf
128+
if [ -f /etc/dnf.conf ]; then
129+
if [ `grep -v "#" /etc/dnf.conf | grep -c ansible` = 0 ]; then
130+
echo -e "## Exclude ansible for OS pkg install - dependency issues when patching ## \nexclude=ansible*" >> /etc/dnf.conf;
131+
fi
132+
fi
133+
echo "------- Completed -------"
134+
fi
135+
}
136+
137+
install_os_deps() {
138+
echo "-----------------------------------------------"
139+
echo "Install python$python_pkg and ansible OS dependencies: Started"
140+
echo "-----------------------------------------------"
141+
if [ "$OS_FLAV" = 'RH' ]; then
142+
yum install $rhansible_deps -y >> $install_log 2>&1 &&
143+
if [ `echo $?` = 0 ]; then
144+
echo "------- Completed -------"
145+
else
146+
echo "--- Please check $install_log for errors ---"
147+
fi
148+
elif [ "$OS_FLAV" = 'DEB' ]; then
149+
apt install -y $deb_ansible_deps >> $install_log 2>&1 &&
150+
if [ `echo $?` = 0 ]; then
151+
echo "------- Completed -------"
152+
else
153+
echo "--- Please check $install_log for errors ---"
154+
fi
155+
fi
156+
157+
}
158+
159+
install_pip_ansible_os() {
160+
echo "--------------------------------------------------------"
161+
echo "Ansible Pip module install: Started - this may take time"
162+
echo "--------------------------------------------------------"
163+
check_for_proxy
164+
if [ -z $PROXY_SETTINGS ];then
165+
if [ ! -d ~/.pip ];then
166+
mkdir ~/.pip;
167+
echo "[global]\n$PROXY_SETTINGS" > ~/.pip/pip.conf
168+
fi
169+
fi
170+
umask 0022;
171+
pip3 install $pip_std_modules $pip_xtra_modules >> $install_log 2>&1
172+
if [ `echo $?` != 0 ]; then
173+
echo "----pip install failure please check $install_log ----"
174+
else
175+
echo "------- Completed -------"
176+
fi
177+
178+
}
179+
180+
remove_pip_ansible_os() {
181+
# Undo pip modules
182+
echo "--------------------------------------------------"
183+
echo "Pip Module Removal: Started"
184+
echo "--------------------------------------------------"
185+
pip3 uninstall -y $pip_std_modules $pip_xtra_modules
186+
echo "------- Completed -------"
187+
}
188+
189+
ansible_update () {
190+
echo "--------------------------------------------------"
191+
echo "Ansible update Started"
192+
echo "--------------------------------------------------"
193+
install_pip_ansible_os
194+
echo "------- Completed -------"
195+
}
196+
197+
198+
199+
final_checks() {
200+
# Check Installed Packages
201+
ok=0
202+
203+
echo "--------------------------------------------------"
204+
echo "Ansible Base Install & Configuration: Completed"
205+
echo "--------------------------------------------------"
206+
echo ""
207+
return "${ok}"
208+
209+
}
210+
211+
main() {
212+
#--------------------#
213+
# Main Program Entry #
214+
#--------------------#
215+
216+
# Check for root user and OS type
217+
check_for_root_os
218+
219+
220+
# Check what the user is asking to do
221+
local opt
222+
while getopts :hipr opt; do
223+
case "${opt}" in
224+
h) usage ;;
225+
i) stop_ansible_os_pkg && install_os_deps && install_pip_ansible_os && final_checks ;;
226+
p) ansible_update ;;
227+
r) remove_pip_ansible_os ;;
228+
esac
229+
done
230+
[ "${OPTIND}" -eq 1 ] && usage # This checks for no opts passed
231+
shift $((OPTIND-1))
232+
233+
}
234+
235+
236+
main $@

cleanup.sh

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
3+
echo "Running terraform to delete VMs in AWS ..."
4+
echo ""
5+
terraform destroy -auto-approve
6+
echo ""
7+
echo "Done"

host-local-Ubuntu

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#hosts-local for Ubuntu 18 & 20
2+
3+
localhost ansible_connection=local setup_audit=true run_audit=true system_is_ec2=true
4+
# all:
5+
# hosts:
6+
# ubuntu20:
7+
# vars:
8+
# ansible_connection: local
9+
# setup_audit: true
10+
# run_audit: true
11+
# audit_content: git
12+
# audit_git_version: devel

host-local-debian

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
localhost ansible_connection=local setup_audit=true run_audit=true system_is_ec2=true
2+
3+
# all:
4+
# hosts:
5+
# debian10:
6+
# vars:
7+
# ansible_connection: local
8+
# setup_audit: false
9+
# run_audit: false
10+
# audit_content: git
11+
# audit_git_version: devel

0 commit comments

Comments
 (0)