CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

update ssl state unless , check and upgrade salt minion if needed during install

Browse Source
This commit is contained in:
m0duspwnens
2020-07-30 11:16:37 -04:00
parent 14584b28e1
commit 3d4a96fae0
3 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/common/tools/sbin/soup
View File

@@ -258,10 +258,6 @@ update_version
echo "" echo ""
echo "Starting Salt Master service" echo "Starting Salt Master service"
systemctl start salt-master systemctl start salt-master
#echo ""
#echo "Starting Salt Minion service"
#systemctl start salt-minion
#echo ""
echo "" echo ""

6
salt/ssl/init.sls
View File

@@ -242,7 +242,7 @@ msslkeyperms:
- unless: - unless:
# https://github.com/saltstack/salt/issues/52167 # https://github.com/saltstack/salt/issues/52167
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/managerssl.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/fleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
fleetkeyperms: fleetkeyperms:
file.managed: file.managed:
@@ -289,7 +289,7 @@ fbcertdir:
- unless: - unless:
# https://github.com/saltstack/salt/issues/52167 # https://github.com/saltstack/salt/issues/52167
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/filebeat.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /opt/so/conf/filebeat/etc/pki/filebeat.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
# Convert the key to pkcs#8 so logstash will work correctly. # Convert the key to pkcs#8 so logstash will work correctly.
filebeatpkcs: filebeatpkcs:
@@ -378,7 +378,7 @@ msslkeyperms:
- unless: - unless:
# https://github.com/saltstack/salt/issues/52167 # https://github.com/saltstack/salt/issues/52167
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/managerssl.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/fleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
fleetkeyperms: fleetkeyperms:
file.managed: file.managed:

6
setup/so-setup
View File

@@ -457,6 +457,8 @@ fi
if [[ $is_minion ]]; then if [[ $is_minion ]]; then
set_progress_str 20 'Accepting Salt key on manager' set_progress_str 20 'Accepting Salt key on manager'
accept_salt_key_remote >> $setup_log 2>&1 accept_salt_key_remote >> $setup_log 2>&1
set_progress_str 21 'Checking if the Salt Minion needs to be updated'
salt-call state.apply salt.minion -l info >> $setup_log 2>&1
fi fi
if [[ $is_manager ]]; then if [[ $is_manager ]]; then
@@ -464,10 +466,10 @@ fi
salt-key -ya "$MINION_ID" >> $setup_log 2>&1 salt-key -ya "$MINION_ID" >> $setup_log 2>&1
fi fi
set_progress_str 21 'Copying minion pillars to manager' set_progress_str 22 'Copying minion pillars to manager'
copy_minion_tmp_files >> $setup_log 2>&1 copy_minion_tmp_files >> $setup_log 2>&1
set_progress_str 22 'Generating CA and checking in' set_progress_str 23 'Generating CA and checking in'
salt_checkin >> $setup_log 2>&1 salt_checkin >> $setup_log 2>&1
if [[ $is_manager || $is_helix ]]; then if [[ $is_manager || $is_helix ]]; then