CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix salt retries - https://github.com/Security-Onion-Solutions/securityonion/issues/3948

Browse Source
This commit is contained in:
m0duspwnens
2021-04-22 08:35:50 -04:00
parent 81581711da
commit 1d8e065902
2 changed files with 75 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/ca/init.sls
View File

@@ -43,8 +43,9 @@ pki_private_key:
- require: - require:
- file: /etc/pki - file: /etc/pki
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
x509_pem_entries: x509_pem_entries:
module.run: module.run:

120
salt/ssl/init.sls
View File

@@ -68,8 +68,9 @@ removeesp12dir:
- x509: /etc/pki/influxdb.crt - x509: /etc/pki/influxdb.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Create a cert for the talking to influxdb # Create a cert for the talking to influxdb
/etc/pki/influxdb.crt: /etc/pki/influxdb.crt:
@@ -86,8 +87,9 @@ removeesp12dir:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/influxdb.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/influxdb.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
influxkeyperms: influxkeyperms:
file.managed: file.managed:
@@ -111,8 +113,9 @@ influxkeyperms:
- x509: /etc/pki/redis.crt - x509: /etc/pki/redis.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
/etc/pki/redis.crt: /etc/pki/redis.crt:
x509.certificate_managed: x509.certificate_managed:
@@ -128,8 +131,9 @@ influxkeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/redis.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/redis.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
rediskeyperms: rediskeyperms:
file.managed: file.managed:
@@ -153,8 +157,9 @@ rediskeyperms:
- x509: /etc/pki/filebeat.crt - x509: /etc/pki/filebeat.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Request a cert and drop it where it needs to go to be distributed # Request a cert and drop it where it needs to go to be distributed
/etc/pki/filebeat.crt: /etc/pki/filebeat.crt:
@@ -175,8 +180,9 @@ rediskeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/filebeat.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/filebeat.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
cmd.run: cmd.run:
- name: "/usr/bin/openssl pkcs8 -in /etc/pki/filebeat.key -topk8 -out /etc/pki/filebeat.p8 -nocrypt" - name: "/usr/bin/openssl pkcs8 -in /etc/pki/filebeat.key -topk8 -out /etc/pki/filebeat.p8 -nocrypt"
- onchanges: - onchanges:
@@ -232,8 +238,9 @@ fbcrtlink:
- x509: /etc/pki/registry.crt - x509: /etc/pki/registry.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Create a cert for the docker registry # Create a cert for the docker registry
/etc/pki/registry.crt: /etc/pki/registry.crt:
@@ -250,8 +257,9 @@ fbcrtlink:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/registry.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/registry.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
regkeyperms: regkeyperms:
file.managed: file.managed:
@@ -273,8 +281,9 @@ regkeyperms:
- x509: /etc/pki/minio.crt - x509: /etc/pki/minio.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Create a cert for minio # Create a cert for minio
/etc/pki/minio.crt: /etc/pki/minio.crt:
@@ -291,8 +300,9 @@ regkeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/minio.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/minio.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
miniokeyperms: miniokeyperms:
file.managed: file.managed:
@@ -315,8 +325,9 @@ miniokeyperms:
- x509: /etc/pki/elasticsearch.crt - x509: /etc/pki/elasticsearch.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
/etc/pki/elasticsearch.crt: /etc/pki/elasticsearch.crt:
x509.certificate_managed: x509.certificate_managed:
@@ -332,8 +343,9 @@ miniokeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
cmd.run: cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:" - name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:"
- onchanges: - onchanges:
@@ -366,8 +378,9 @@ elasticp12perms:
- x509: /etc/pki/managerssl.crt - x509: /etc/pki/managerssl.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Create a cert for the reverse proxy # Create a cert for the reverse proxy
/etc/pki/managerssl.crt: /etc/pki/managerssl.crt:
@@ -385,8 +398,9 @@ elasticp12perms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/managerssl.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/managerssl.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
msslkeyperms: msslkeyperms:
file.managed: file.managed:
@@ -409,8 +423,9 @@ msslkeyperms:
- x509: /etc/pki/fleet.crt - x509: /etc/pki/fleet.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
/etc/pki/fleet.crt: /etc/pki/fleet.crt:
x509.certificate_managed: x509.certificate_managed:
@@ -425,8 +440,9 @@ msslkeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/fleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/fleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
fleetkeyperms: fleetkeyperms:
file.managed: file.managed:
@@ -456,8 +472,9 @@ fbcertdir:
- x509: /opt/so/conf/filebeat/etc/pki/filebeat.crt - x509: /opt/so/conf/filebeat/etc/pki/filebeat.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Request a cert and drop it where it needs to go to be distributed # Request a cert and drop it where it needs to go to be distributed
/opt/so/conf/filebeat/etc/pki/filebeat.crt: /opt/so/conf/filebeat/etc/pki/filebeat.crt:
@@ -478,8 +495,9 @@ fbcertdir:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /opt/so/conf/filebeat/etc/pki/filebeat.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /opt/so/conf/filebeat/etc/pki/filebeat.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Convert the key to pkcs#8 so logstash will work correctly. # Convert the key to pkcs#8 so logstash will work correctly.
filebeatpkcs: filebeatpkcs:
@@ -520,8 +538,9 @@ chownfilebeatp8:
- x509: /etc/pki/managerssl.crt - x509: /etc/pki/managerssl.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
# Create a cert for the reverse proxy # Create a cert for the reverse proxy
/etc/pki/managerssl.crt: /etc/pki/managerssl.crt:
@@ -539,8 +558,9 @@ chownfilebeatp8:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/managerssl.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/managerssl.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
msslkeyperms: msslkeyperms:
file.managed: file.managed:
@@ -563,8 +583,9 @@ msslkeyperms:
- x509: /etc/pki/fleet.crt - x509: /etc/pki/fleet.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
/etc/pki/fleet.crt: /etc/pki/fleet.crt:
x509.certificate_managed: x509.certificate_managed:
@@ -579,8 +600,9 @@ msslkeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/fleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/fleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
fleetkeyperms: fleetkeyperms:
file.managed: file.managed:
@@ -606,8 +628,9 @@ fleetkeyperms:
- x509: /etc/pki/elasticsearch.crt - x509: /etc/pki/elasticsearch.crt
{%- endif %} {%- endif %}
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
/etc/pki/elasticsearch.crt: /etc/pki/elasticsearch.crt:
x509.certificate_managed: x509.certificate_managed:
@@ -623,8 +646,9 @@ fleetkeyperms:
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
- timeout: 30 - timeout: 30
- retry: 5 - retry:
- interval: 30 attempts: 5
interval: 30
cmd.run: cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:" - name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:"
- onchanges: - onchanges: