From 55058a11aaf1fb35f61487ad2e8b96590b0eaee2 Mon Sep 17 00:00:00 2001 From: William Wernert Date: Tue, 29 Sep 2020 11:12:09 -0400 Subject: [PATCH 1/2] Generate passwords for Grafana + Playbook default users --- salt/grafana/init.sls | 3 ++- salt/playbook/files/playbook_db_init.sh | 23 ++++++++++++++++++++--- salt/playbook/files/playbook_db_init.sql | 12 +++++++++++- salt/playbook/init.sls | 2 +- setup/so-functions | 10 ++++++++-- 5 files changed, 42 insertions(+), 8 deletions(-) diff --git a/salt/grafana/init.sls b/salt/grafana/init.sls index 401d2d7d7..39c2cc26c 100644 --- a/salt/grafana/init.sls +++ b/salt/grafana/init.sls @@ -7,6 +7,7 @@ {% set MANAGER = salt['grains.get']('master') %} {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %} {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} +{% set ADMINPASS = salt['pillar.get']('secrets:grafana_admin') %} {% if grains['role'] in ['so-manager', 'so-managersearch', 'so-eval', 'so-standalone'] and GRAFANA == 1 %} @@ -229,7 +230,7 @@ so-grafana: - /opt/so/conf/grafana/etc/dashboards:/etc/grafana/provisioning/dashboards:rw - /opt/so/conf/grafana/grafana_dashboards:/etc/grafana/grafana_dashboards:rw - environment: - - GF_SECURITY_ADMIN_PASSWORD=augusta + - GF_SECURITY_ADMIN_PASSWORD={{ ADMINPASS }} - port_bindings: - 0.0.0.0:3000:3000 - watch: diff --git a/salt/playbook/files/playbook_db_init.sh b/salt/playbook/files/playbook_db_init.sh index 713575f97..4b6832935 100644 --- a/salt/playbook/files/playbook_db_init.sh +++ b/salt/playbook/files/playbook_db_init.sh @@ -1,7 +1,24 @@ -{%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} -#!/bin/sh - +#!/bin/bash +# {%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} +# {%- set admin_pass = salt['pillar.get']('secrets:playbook_admin', None) -%} +# {%- set automation_pass = salt['pillar.get']('secrets:playbook_automation', None) %} +vi re default_salt_dir=/opt/so/saltstack/default +# Generate salt + hash for admin user +admin_salt=$(tr -dc "a-zA-Z0-9" < /dev/urandom | fold -w 32 | head -n 1) +admin_stage1_hash=$(echo -n '{{ admin_pass }}' | sha1sum | awk '{print $1}') +admin_hash=$(echo -n "${admin_salt}${admin_stage1_hash}" | sha1sum | awk '{print $1}') +sed -i "s/ADMIN_HASH/${admin_hash}/g" $default_salt_dir/salt/playbook/files/playbook_db_init.sql +sed -i "s/ADMIN_SALT/${admin_salt}/g" $default_salt_dir/salt/playbook/files/playbook_db_init.sql + +# Generate salt + hash for automation user +automation_salt=$(tr -dc "a-zA-Z0-9" < /dev/urandom | fold -w 32 | head -n 1) +auto_stage1_hash=$(echo -n '{{ automation_pass }}' | sha1sum | awk '{print $1}') +automation_hash=$(echo -n "${automation_salt}${auto_stage1_hash}" | sha1sum | awk '{print $1}') +sed -i "s/AUTO_HASH/${automation_hash}/g" $default_salt_dir/salt/playbook/files/playbook_db_init.sql +sed -i "s/AUTO_SALT/${automation_salt}/g" $default_salt_dir/salt/playbook/files/playbook_db_init.sql + +# Copy file to destination docker cp $default_salt_dir/salt/playbook/files/playbook_db_init.sql so-mysql:/tmp/playbook_db_init.sql docker exec so-mysql /bin/bash -c "/usr/bin/mysql -b -uroot -p{{MYSQLPASS}} < /tmp/playbook_db_init.sql" \ No newline at end of file diff --git a/salt/playbook/files/playbook_db_init.sql b/salt/playbook/files/playbook_db_init.sql index 83e5d6f54..4fffeb3fa 100644 --- a/salt/playbook/files/playbook_db_init.sql +++ b/salt/playbook/files/playbook_db_init.sql @@ -1481,7 +1481,17 @@ CREATE TABLE `users` ( LOCK TABLES `users` WRITE; /*!40000 ALTER TABLE `users` DISABLE KEYS */; -INSERT INTO `users` VALUES (1,'admin','95535e9f7a386c412f20134ebb869c00cf346477','Admin','Admin',1,1,'2020-08-17 18:03:20','',NULL,'2020-04-26 13:08:34','2020-04-26 13:10:45','User',NULL,'all','5ceb2c95ce1593d4ba034d385ceefb2f',0,'2020-04-26 13:10:27'),(2,'','','','Anonymous users',0,1,NULL,'',NULL,'2020-04-26 13:08:38','2020-04-26 13:08:38','GroupAnonymous',NULL,'',NULL,0,NULL),(3,'','','','Non member users',0,1,NULL,'',NULL,'2020-04-26 13:08:38','2020-04-26 13:08:38','GroupNonMember',NULL,'',NULL,0,NULL),(4,'','','','Anonymous',0,0,NULL,'',NULL,'2020-04-26 13:09:44','2020-04-26 13:09:44','AnonymousUser',NULL,'only_my_events',NULL,0,NULL),(5,'','','','Analysts',0,1,NULL,'',NULL,'2020-04-26 18:43:40','2020-04-26 18:43:40','Group',NULL,'',NULL,0,NULL),(6,'','','','Automation',0,1,NULL,'',NULL,'2020-04-26 18:43:47','2020-04-26 18:43:47','Group',NULL,'',NULL,0,NULL),(7,'','','','Admins',0,1,NULL,'',NULL,'2020-04-26 18:43:58','2020-04-26 18:43:58','Group',NULL,'',NULL,0,NULL),(9,'automation','d2e7d78af1f0c0637765ae8cf1a359c4a30034c9','SecOps','Automation',0,1,'2020-05-01 18:26:17','en',NULL,'2020-04-26 18:47:46','2020-05-01 18:26:10','User',NULL,'none','41043e596f70e327e34fc99c861f5b31',0,'2020-05-01 18:26:10'); +INSERT INTO `users` + VALUES + (1,'admin','ADMIN_HASH','Admin','Admin',1,1,'2020-08-17 18:03:20','',NULL,'2020-04-26 13:08:34','2020-04-26 13:10:45','User',NULL,'all','ADMIN_SALT',0,'2020-04-26 13:10:27'), + (2,'','','','Anonymous users',0,1,NULL,'',NULL,'2020-04-26 13:08:38','2020-04-26 13:08:38','GroupAnonymous',NULL,'',NULL,0,NULL), + (3,'','','','Non member users',0,1,NULL,'',NULL,'2020-04-26 13:08:38','2020-04-26 13:08:38','GroupNonMember',NULL,'',NULL,0,NULL), + (4,'','','','Anonymous',0,0,NULL,'',NULL,'2020-04-26 13:09:44','2020-04-26 13:09:44','AnonymousUser',NULL,'only_my_events',NULL,0,NULL), + (5,'','','','Analysts',0,1,NULL,'',NULL,'2020-04-26 18:43:40','2020-04-26 18:43:40','Group',NULL,'',NULL,0,NULL), + (6,'','','','Automation',0,1,NULL,'',NULL,'2020-04-26 18:43:47','2020-04-26 18:43:47','Group',NULL,'',NULL,0,NULL), + (7,'','','','Admins',0,1,NULL,'',NULL,'2020-04-26 18:43:58','2020-04-26 18:43:58','Group',NULL,'',NULL,0,NULL), + (9,'automation','AUTO_HASH','SecOps','Automation',0,1,'2020-05-01 18:26:17','en',NULL,'2020-04-26 18:47:46','2020-05-01 18:26:10','User',NULL,'none','AUTO_SALT',0,'2020-05-01 18:26:10') +; /*!40000 ALTER TABLE `users` ENABLE KEYS */; UNLOCK TABLES; diff --git a/salt/playbook/init.sls b/salt/playbook/init.sls index 9d02dfce2..6e2397347 100644 --- a/salt/playbook/init.sls +++ b/salt/playbook/init.sls @@ -9,7 +9,7 @@ {% set MANAGER = salt['grains.get']('master') %} {% set MAINIP = salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('manager:mainint', salt['pillar.get']('elasticsearch:mainint', salt['pillar.get']('host:mainint')))))[0] %} {%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} -{%- set PLAYBOOKPASS = salt['pillar.get']('secrets:playbook', None) -%} +{%- set PLAYBOOKPASS = salt['pillar.get']('secrets:playbook_db', None) -%} include: - mysql diff --git a/setup/so-functions b/setup/so-functions index 2c028174a..45ec12c65 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -184,7 +184,10 @@ secrets_pillar(){ printf '%s\n'\ "secrets:"\ " mysql: $MYSQLPASS"\ - " playbook: $PLAYBOOKPASS"\ + " playbook_db: $PLAYBOOKDBPASS"\ + " playbook_admin: $PLAYBOOKADMINPASS"\ + " playbook_automation: $PLAYBOOKAUTOMATIONPASS"\ + " grafana_admin: $GRAFANAPASS"\ " fleet: $FLEETPASS"\ " fleet_jwt: $FLEETJWT"\ " fleet_enroll-secret: False" > $local_salt_dir/pillar/secrets.sls @@ -973,9 +976,12 @@ fleet_pillar() { generate_passwords(){ # Generate Random Passwords for Things MYSQLPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) - PLAYBOOKPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) + PLAYBOOKDBPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) + PLAYBOOKADMINPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) + PLAYBOOKAUTOMATIONPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) FLEETPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) FLEETJWT=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) + GRAFANAPASS=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) if [[ "$THEHIVE" == "1" ]]; then HIVEKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) HIVEPLAYSECRET=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) From 7d43d48aca59c8e3f6068ad9cd47b543f1443b78 Mon Sep 17 00:00:00 2001 From: William Wernert Date: Tue, 29 Sep 2020 11:13:09 -0400 Subject: [PATCH 2/2] Remove bad line in playbook_db_init.sh --- salt/playbook/files/playbook_db_init.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/playbook/files/playbook_db_init.sh b/salt/playbook/files/playbook_db_init.sh index 4b6832935..32221c51b 100644 --- a/salt/playbook/files/playbook_db_init.sh +++ b/salt/playbook/files/playbook_db_init.sh @@ -2,7 +2,7 @@ # {%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} # {%- set admin_pass = salt['pillar.get']('secrets:playbook_admin', None) -%} # {%- set automation_pass = salt['pillar.get']('secrets:playbook_automation', None) %} -vi re + default_salt_dir=/opt/so/saltstack/default # Generate salt + hash for admin user