mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
manage repo conf for ubuntu
This commit is contained in:
m0duspwnens
@@ -934,6 +934,9 @@ update_repo() {
|
||||
yum clean all
|
||||
yum repolist
|
||||
fi
|
||||
elif [[ "$OS" == "ubuntu" ]]; then
|
||||
cp $UPDATE_DIR/salt/repo/client/files/ubuntu/$ubuntu_version/* /etc/apt/sources.list.d/
|
||||
apt-get update
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
98
salt/repo/client/centos.sls
Normal file
98
salt/repo/client/centos.sls
Normal file
@@ -0,0 +1,98 @@
|
||||
{% from 'repo/client/map.jinja' import ABSENTFILES with context %}
|
||||
{% from 'repo/client/map.jinja' import REPOPATH with context %}
|
||||
{% set ISAIRGAP = salt['pillar.get']('global:airgap', False) %}
|
||||
{% set managerupdates = salt['pillar.get']('global:managerupdate', 0) %}
|
||||
{% set role = grains.id.split('_') | last %}
|
||||
|
||||
# from airgap state
|
||||
{% if ISAIRGAP and grains.os == 'CentOS' %}
|
||||
{% set MANAGER = salt['grains.get']('master') %}
|
||||
airgapyum:
|
||||
file.managed:
|
||||
- name: /etc/yum/yum.conf
|
||||
- source: salt://repo/client/files/centos/airgap/yum.conf
|
||||
|
||||
airgap_repo:
|
||||
pkgrepo.managed:
|
||||
- humanname: Airgap Repo
|
||||
- baseurl: https://{{ MANAGER }}/repo
|
||||
- gpgcheck: 0
|
||||
- sslverify: 0
|
||||
|
||||
{% endif %}
|
||||
|
||||
# from airgap and common
|
||||
{% if ABSENTFILES|length > 0%}
|
||||
{% for file in ABSENTFILES %}
|
||||
{{ file }}:
|
||||
file.absent:
|
||||
- name: {{ REPOPATH }}{{ file }}
|
||||
- onchanges_in:
|
||||
- cmd: cleanyum
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# from common state
|
||||
# Remove default Repos
|
||||
{% if grains['os'] == 'CentOS' %}
|
||||
repair_yumdb:
|
||||
cmd.run:
|
||||
- name: 'mv -f /var/lib/rpm/__db* /tmp && yum clean all'
|
||||
- onlyif:
|
||||
- 'yum check-update 2>&1 | grep "Error: rpmdb open failed"'
|
||||
|
||||
crsynckeys:
|
||||
file.recurse:
|
||||
- name: /etc/pki/rpm_gpg
|
||||
- source: salt://repo/client/files/centos/keys/
|
||||
|
||||
{% if not ISAIRGAP %}
|
||||
{% if role in ['eval', 'standalone', 'import', 'manager', 'managersearch'] or managerupdates == 0 %}
|
||||
remove_securityonionrepocache:
|
||||
file.absent:
|
||||
- name: /etc/yum.repos.d/securityonioncache.repo
|
||||
{% endif %}
|
||||
|
||||
{% if role not in ['eval', 'standalone', 'import', 'manager', 'managersearch'] and managerupdates == 1 %}
|
||||
remove_securityonionrepo:
|
||||
file.absent:
|
||||
- name: /etc/yum.repos.d/securityonion.repo
|
||||
{% endif %}
|
||||
|
||||
crsecurityonionrepo:
|
||||
file.managed:
|
||||
{% if role in ['eval', 'standalone', 'import', 'manager', 'managersearch'] or managerupdates == 0 %}
|
||||
- name: /etc/yum.repos.d/securityonion.repo
|
||||
- source: salt://repo/client/files/centos/securityonion.repo
|
||||
{% else %}
|
||||
- name: /etc/yum.repos.d/securityonioncache.repo
|
||||
- source: salt://repo/client/files/centos/securityonioncache.repo
|
||||
{% endif %}
|
||||
- mode: 644
|
||||
|
||||
yumconf:
|
||||
file.managed:
|
||||
- name: /etc/yum.conf
|
||||
- source: salt://repo/client/files/centos/yum.conf.jinja
|
||||
- mode: 644
|
||||
- template: jinja
|
||||
- show_changes: False
|
||||
|
||||
cleanairgap:
|
||||
file.absent:
|
||||
- name: /etc/yum.repos.d/airgap_repo.repo
|
||||
{% endif %}
|
||||
|
||||
cleanyum:
|
||||
cmd.run:
|
||||
- name: 'yum clean metadata'
|
||||
- onchanges:
|
||||
{% if ISAIRGAP %}
|
||||
- file: airgapyum
|
||||
- pkgrepo: airgap_repo
|
||||
{% else %}
|
||||
- file: crsecurityonionrepo
|
||||
- file: yumconf
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
1
salt/repo/client/files/ubuntu/18.04/saltstack.list
Normal file
1
salt/repo/client/files/ubuntu/18.04/saltstack.list
Normal file
@@ -0,0 +1 @@
|
||||
deb https://repo.securityonion.net/file/securityonion-repo/ubuntu/18.04/amd64/salt/ bionic main
|
||||
1
salt/repo/client/files/ubuntu/20.04/saltstack.list
Normal file
1
salt/repo/client/files/ubuntu/20.04/saltstack.list
Normal file
@@ -0,0 +1 @@
|
||||
deb https://repo.securityonion.net/file/securityonion-repo/ubuntu/20.04/amd64/salt/ focal main
|
||||
@@ -1,98 +1,2 @@
|
||||
{% from 'repo/client/map.jinja' import ABSENTFILES with context %}
|
||||
{% from 'repo/client/map.jinja' import REPOPATH with context %}
|
||||
{% set ISAIRGAP = salt['pillar.get']('global:airgap', False) %}
|
||||
{% set managerupdates = salt['pillar.get']('global:managerupdate', 0) %}
|
||||
{% set role = grains.id.split('_') | last %}
|
||||
|
||||
# from airgap state
|
||||
{% if ISAIRGAP and grains.os == 'CentOS' %}
|
||||
{% set MANAGER = salt['grains.get']('master') %}
|
||||
airgapyum:
|
||||
file.managed:
|
||||
- name: /etc/yum/yum.conf
|
||||
- source: salt://repo/client/files/centos/airgap/yum.conf
|
||||
|
||||
airgap_repo:
|
||||
pkgrepo.managed:
|
||||
- humanname: Airgap Repo
|
||||
- baseurl: https://{{ MANAGER }}/repo
|
||||
- gpgcheck: 0
|
||||
- sslverify: 0
|
||||
|
||||
{% endif %}
|
||||
|
||||
# from airgap and common
|
||||
{% if ABSENTFILES|length > 0%}
|
||||
{% for file in ABSENTFILES %}
|
||||
{{ file }}:
|
||||
file.absent:
|
||||
- name: {{ REPOPATH }}{{ file }}
|
||||
- onchanges_in:
|
||||
- cmd: cleanyum
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
# from common state
|
||||
# Remove default Repos
|
||||
{% if grains['os'] == 'CentOS' %}
|
||||
repair_yumdb:
|
||||
cmd.run:
|
||||
- name: 'mv -f /var/lib/rpm/__db* /tmp && yum clean all'
|
||||
- onlyif:
|
||||
- 'yum check-update 2>&1 | grep "Error: rpmdb open failed"'
|
||||
|
||||
crsynckeys:
|
||||
file.recurse:
|
||||
- name: /etc/pki/rpm_gpg
|
||||
- source: salt://repo/client/files/centos/keys/
|
||||
|
||||
{% if not ISAIRGAP %}
|
||||
{% if role in ['eval', 'standalone', 'import', 'manager', 'managersearch'] or managerupdates == 0 %}
|
||||
remove_securityonionrepocache:
|
||||
file.absent:
|
||||
- name: /etc/yum.repos.d/securityonioncache.repo
|
||||
{% endif %}
|
||||
|
||||
{% if role not in ['eval', 'standalone', 'import', 'manager', 'managersearch'] and managerupdates == 1 %}
|
||||
remove_securityonionrepo:
|
||||
file.absent:
|
||||
- name: /etc/yum.repos.d/securityonion.repo
|
||||
{% endif %}
|
||||
|
||||
crsecurityonionrepo:
|
||||
file.managed:
|
||||
{% if role in ['eval', 'standalone', 'import', 'manager', 'managersearch'] or managerupdates == 0 %}
|
||||
- name: /etc/yum.repos.d/securityonion.repo
|
||||
- source: salt://repo/client/files/centos/securityonion.repo
|
||||
{% else %}
|
||||
- name: /etc/yum.repos.d/securityonioncache.repo
|
||||
- source: salt://repo/client/files/centos/securityonioncache.repo
|
||||
{% endif %}
|
||||
- mode: 644
|
||||
|
||||
yumconf:
|
||||
file.managed:
|
||||
- name: /etc/yum.conf
|
||||
- source: salt://repo/client/files/centos/yum.conf.jinja
|
||||
- mode: 644
|
||||
- template: jinja
|
||||
- show_changes: False
|
||||
|
||||
cleanairgap:
|
||||
file.absent:
|
||||
- name: /etc/yum.repos.d/airgap_repo.repo
|
||||
{% endif %}
|
||||
|
||||
cleanyum:
|
||||
cmd.run:
|
||||
- name: 'yum clean metadata'
|
||||
- onchanges:
|
||||
{% if ISAIRGAP %}
|
||||
- file: airgapyum
|
||||
- pkgrepo: airgap_repo
|
||||
{% else %}
|
||||
- file: crsecurityonionrepo
|
||||
- file: yumconf
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
include:
|
||||
- repo.client.{{grains.os | lower}}
|
||||
|
||||
4
salt/repo/client/ubuntu.sls
Normal file
4
salt/repo/client/ubuntu.sls
Normal file
@@ -0,0 +1,4 @@
|
||||
ubuntu_repo_files:
|
||||
- file.recurse:
|
||||
- name: /etc/apt/sources.list.d/
|
||||
- source: salt://repo/client/files/ubuntu/{{grains.osrelease}}/
|
||||
@@ -29,7 +29,7 @@
|
||||
{% if grains.os|lower in ['centos', 'redhat'] %}
|
||||
{% set UPGRADECOMMAND = 'yum clean all ; /usr/sbin/bootstrap-salt.sh -s 120 -r -F -x python3 stable ' ~ SALTVERSION %}
|
||||
{% elif grains.os|lower == 'ubuntu' %}
|
||||
{% set UPGRADECOMMAND = '/usr/sbin/bootstrap-salt.sh -s 120 -F -x python3 stable ' ~ SALTVERSION %}
|
||||
{% set UPGRADECOMMAND = '/usr/sbin/bootstrap-salt.sh -s 120 -r -F -x python3 stable ' ~ SALTVERSION %}
|
||||
{% endif %}
|
||||
{% else %}
|
||||
{% set UPGRADECOMMAND = 'echo Already running Salt Minion version ' ~ SALTVERSION %}
|
||||
|
||||
@@ -21,16 +21,15 @@ base:
|
||||
|
||||
'*':
|
||||
- cron.running
|
||||
- repo.client
|
||||
|
||||
'not G@saltversion:{{saltversion}}':
|
||||
- match: compound
|
||||
- salt.minion-state-apply-test
|
||||
- repo.client
|
||||
- salt.minion
|
||||
|
||||
'G@os:CentOS and G@saltversion:{{saltversion}}':
|
||||
- match: compound
|
||||
- repo.client
|
||||
- yum.packages
|
||||
|
||||
'* and G@saltversion:{{saltversion}}':
|
||||
|
||||
@@ -2277,7 +2277,7 @@ saltify() {
|
||||
# Download Ubuntu Keys in case manager updates = 1
|
||||
logCmd "mkdir -vp /opt/so/gpg"
|
||||
if [[ ! $is_airgap ]]; then
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/py3/ubuntu/18.04/amd64/archive/3004.1/SALTSTACK-GPG-KEY.pub"
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.securityonion.net/file/securityonion-repo/ubuntu/$ubuntu_version/amd64/salt/SALTSTACK-GPG-KEY.pub"
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg"
|
||||
logCmd "wget -q --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH"
|
||||
fi
|
||||
@@ -2334,8 +2334,8 @@ saltify() {
|
||||
'MANAGER' | 'EVAL' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT' | 'HELIXSENSOR')
|
||||
|
||||
# Add saltstack repo(s)
|
||||
wget -q --inet4-only -O - https://repo.saltstack.com/py3/ubuntu/"$ubuntu_version"/amd64/archive/3004.1/SALTSTACK-GPG-KEY.pub | apt-key add - >> "$setup_log" 2>&1
|
||||
echo "deb http://repo.saltstack.com/py3/ubuntu/$ubuntu_version/amd64/archive/3004.1 $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
wget -q --inet4-only -O - https://repo.securityonion.net/file/securityonion-repo/ubuntu/"$ubuntu_version"/amd64/salt/SALTSTACK-GPG-KEY.pub | apt-key add - >> "$setup_log" 2>&1
|
||||
echo "https://repo.securityonion.net/file/securityonion-repo/ubuntu/$ubuntu_version/amd64/salt/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
|
||||
# Add Docker repo
|
||||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - >> "$setup_log" 2>&1
|
||||
@@ -2343,7 +2343,7 @@ saltify() {
|
||||
|
||||
# Get gpg keys
|
||||
mkdir -p /opt/so/gpg >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/py3/ubuntu/"$ubuntu_version"/amd64/archive/3004.1/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.securityonion.net/file/securityonion-repo/ubuntu/"$ubuntu_version"/amd64/salt/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg >> "$setup_log" 2>&1
|
||||
wget -q --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH >> "$setup_log" 2>&1
|
||||
|
||||
@@ -2367,7 +2367,7 @@ saltify() {
|
||||
echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH" >> "$setup_log" 2>&1
|
||||
apt-key add "$temp_install_dir"/gpg/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1
|
||||
apt-key add "$temp_install_dir"/gpg/GPG-KEY-WAZUH >> "$setup_log" 2>&1
|
||||
echo "deb http://repo.saltstack.com/py3/ubuntu/$ubuntu_version/amd64/archive/3004.1/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
echo "deb https://repo.securityonion.net/file/securityonion-repo/ubuntu/$ubuntu_version/amd64/salt/ $OSVER main" > /etc/apt/sources.list.d/saltstack.list 2>> "$setup_log"
|
||||
echo "deb https://packages.wazuh.com/3.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list 2>> "$setup_log"
|
||||
;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user