Class: CemAcpt::Provision::Linux

Inherits:
OsData
  • Object
show all
Defined in:
lib/cem_acpt/provision/terraform/linux.rb

Overview

Class provides methods for gathering provision data for Linux nodes

Constant Summary collapse

GOSS_VERSION = 
'v0.4.9'
GOSS_DOWNLOAD_URL = 
"https://github.com/goss-org/goss/releases/download/#{GOSS_VERSION}/goss-linux-amd64"

Constants included from Logging

Logging::LEVEL_MAP

Instance Attribute Summary

Attributes inherited from OsData

#base_provision_directory

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from OsData

#goss_files, #implementation_name, #initialize, os_family_for, #provision_directory, #puppet_manifest_file, #remote_module_package_name, use_for?

Methods included from Logging

current_log_config, #current_log_config, current_log_format, #current_log_format, current_log_level, #current_log_level, included, logger, #logger, new_log_config, #new_log_config, new_log_formatter, #new_log_formatter, new_log_level, #new_log_level, new_logger, #new_logger, verbose?, #verbose?

Constructor Details

This class inherits a constructor from CemAcpt::Provision::OsData

Class Method Details

.valid_names ⇒ Object 



12
13
14
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 12

def self.valid_names
  %w[centos rhel oel alma rocky ubuntu]
end

.valid_versions ⇒ Object 



16
17
18
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 16

def self.valid_versions
  %w[7 8 9 10 2004 2204 2404]
end

Instance Method Details

#destination_provision_directory ⇒ Object 



28
29
30
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 28

def destination_provision_directory
  '/opt/cem_acpt'
end

#provision_commands ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 32

def provision_commands
  commands = [
    "sudo /opt/puppetlabs/puppet/bin/puppet module install #{destination_provision_directory}/#{remote_module_package_name}",
    "sudo curl -fsSL #{GOSS_DOWNLOAD_URL} -o /usr/local/bin/goss && sudo chmod +rx /usr/local/bin/goss",
    'sudo /opt/puppetlabs/puppet/bin/gem install webrick',
    'sudo chmod +x /opt/cem_acpt/log_service/log_service.rb',
    'sudo /opt/cem_acpt/log_service/log_service.rb',
  ]
  unless systemd_files.empty?
    systemd_files.each do |file|
      commands << "sudo cp /opt/cem_acpt/systemd/#{file} /etc/systemd/system/#{file}"
    end
    commands << 'sudo systemctl daemon-reload'
    systemd_files.each do |file|
      commands << "sudo systemctl start #{file} && sudo systemctl enable #{file}"
    end
  end

  commands << apply_command
end

#provision_commands_wrapper(image_name, scan_mode: false) ⇒ Array<String>

A wrapper around provision_commands that allows for extra commands to be added for a specific OS version(i.e EL 8)

Parameters:

  • image_name (String) —

    The name of the OS image being provisioned.

  • scan_mode (Boolean) (defaults to: false) —

    When true, returns the scan-mode command list (Goss-free, scan-daemon-installed) wrapped with the same OS-specific prefixes.

Returns:

  • (Array<String>) —

    An array of shell commands to be run on the provisioned nodes to set up the necessary environment for running the Puppet manifest, including any additional commands needed for specific OS versions.



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 85

def provision_commands_wrapper(image_name, scan_mode: false)
  base = scan_mode ? scan_provision_commands : provision_commands
  if ['rhel-8', 'oel-8', 'alma-8', 'rocky-8'].any? { |el8| image_name.include?(el8) }
    commands = [
      'sudo dnf upgrade --refresh -y rpm glibc',
      'sudo rm /var/lib/rpm/.rpm.lock',
      'sudo dnf upgrade -y dnf',
    ]
    (commands << base).flatten
  elsif image_name.include?('ubuntu')
    commands = ['sudo apt purge -y unattended-upgrades', 'sudo apt-get update -y']
    (commands << base).flatten
  else
    base
  end
end

#puppet_bin_path ⇒ Object 



24
25
26
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 24

def puppet_bin_path
  '/opt/puppetlabs/puppet/bin/puppet'
end

#scan_provision_commands ⇒ Array<String>

Commands to run on a scan-mode node. Skips Goss installation and the Goss systemd units (they are not used in scan mode), installs the scan daemon and its scanners (including a Java JRE because CIS-CAT Pro's Assessor-CLI is a Java app), then applies the puppet manifest. The CIS-CAT Pro tarball is uploaded and extracted by the cis_cat_pro_upload null_resource in main.tf, so this method does not touch /opt/cis-cat-pro/.

Returns:

  • (Array<String>) —

    commands for provisioner "remote-exec".



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 61

def scan_provision_commands
  commands = [
    "sudo /opt/puppetlabs/puppet/bin/puppet module install #{destination_provision_directory}/#{remote_module_package_name}",
    'sudo /opt/puppetlabs/puppet/bin/gem install webrick',
    'sudo chmod +x /opt/cem_acpt/log_service/log_service.rb',
    'sudo /opt/cem_acpt/log_service/log_service.rb',
    install_scanner_packages_command,
    install_java_command,
    'sudo chmod +x /opt/cem_acpt/scan/scan_service.rb',
    'sudo cp /opt/cem_acpt/scan/scan_service.service /etc/systemd/system/scan_service.service',
    'sudo systemctl daemon-reload',
    'sudo systemctl start scan_service.service && sudo systemctl enable scan_service.service',
  ]
  commands << apply_command
  commands
end

#systemd_files ⇒ Object 



20
21
22
 
# File 'lib/cem_acpt/provision/terraform/linux.rb', line 20

def systemd_files
  Dir.glob(File.join(provision_directory, 'systemd', '*.service')).map { |f| File.basename(f) }
end