CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Generate different Kafka certs for different SO nodetypes

Browse Source 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
This commit is contained in:
reyesj2
2024-05-01 13:02:47 -04:00
parent 3efdb4e532
commit e164d15ec6
1 changed files with 142 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

219
salt/ssl/init.sls
View File

@@ -662,31 +662,27 @@ elastickeyperms:
- mode: 640 - mode: 640
- group: 930 - group: 930
{%- endif %} kafka_logstash_key:
{% if grains['role'] in ['so-manager', 'so-receiver', 'so-searchnode'] %}
kafka_key:
x509.private_key_managed: x509.private_key_managed:
- name: /etc/pki/kafka.key - name: /etc/pki/kafka-logstash.key
- keysize: 4096 - keysize: 4096
- backup: True - backup: True
- new: True - new: True
{% if salt['file.file_exists']('/etc/pki/kafka.key') -%} {% if salt['file.file_exists']('/etc/pki/kafka-logstash.key') -%}
- prereq: - prereq:
- x509: /etc/pki/kafka.crt - x509: /etc/pki/kafka-logstash.crt
{%- endif %} {%- endif %}
- retry: - retry:
attempts: 5 attempts: 5
interval: 30 interval: 30
kafka_crt: kafka_logstash_crt:
x509.certificate_managed: x509.certificate_managed:
- name: /etc/pki/kafka.crt - name: /etc/pki/kafka-logstash.crt
- ca_server: {{ ca_server }} - ca_server: {{ ca_server }}
- subjectAltName: DNS:{{ GLOBALS.hostname }}, IP:{{ GLOBALS.node_ip }} - subjectAltName: DNS:{{ GLOBALS.hostname }}, IP:{{ GLOBALS.node_ip }}
- signing_policy: kafka - signing_policy: kafka
- private_key: /etc/pki/kafka.key - private_key: /etc/pki/kafka-logstash.key
- CN: {{ GLOBALS.hostname }} - CN: {{ GLOBALS.hostname }}
- days_remaining: 0 - days_remaining: 0
- days_valid: 820 - days_valid: 820
@@ -696,9 +692,37 @@ kafka_crt:
attempts: 5 attempts: 5
interval: 30 interval: 30
cmd.run: cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/kafka.key -in /etc/pki/kafka.crt -export -out /etc/pki/kafka.p12 -nodes -passout pass:changeit" - name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/kafka-logstash.key -in /etc/pki/kafka-logstash.crt -export -out /etc/pki/kafka-logstash.p12 -nodes -passout pass:changeit"
- onchanges: - onchanges:
- x509: /etc/pki/kafka.key - x509: /etc/pki/kafka-logstash.key
kafka_logstash_key_perms:
file.managed:
- replace: False
- name: /etc/pki/kafka-logstash.key
- mode: 640
- user: 960
- group: 939
kafka_logstash_crt_perms:
file.managed:
- replace: False
- name: /etc/pki/kafka-logstash.crt
- mode: 640
- user: 960
- group: 939
kafka_logstash_pkcs12_perms:
file.managed:
- replace: False
- name: /etc/pki/kafka-logstash.p12
- mode: 640
- user: 960
- group: 931
{%- endif %}
{% if grains['role'] in ['so-manager', 'so-managersearch', 'so-standalone'] %}
elasticfleet_kafka_key: elasticfleet_kafka_key:
x509.private_key_managed: x509.private_key_managed:
@@ -734,41 +758,30 @@ elasticfleet_kafka_crt:
- onchanges: - onchanges:
- x509: elasticfleet_kafka_key - x509: elasticfleet_kafka_key
kafka_logstash_key: elasticfleet_kafka_cert_perms:
x509.private_key_managed: file.managed:
- name: /etc/pki/kafka-logstash.key - replace: False
- keysize: 4096 - name: /etc/pki/elasticfleet-kafka.crt
- backup: True - mode: 640
- new: True - user: 960
{% if salt['file.file_exists']('/etc/pki/kafka-logstash.key') -%} - group: 939
- prereq:
- x509: /etc/pki/kafka-logstash.crt
{%- endif %}
- retry:
attempts: 5
interval: 30
kafka_logstash_crt: elasticfleet_kafka_key_perms:
x509.certificate_managed: file.managed:
- name: /etc/pki/kafka-logstash.crt - replace: False
- ca_server: {{ ca_server }} - name: /etc/pki/elasticfleet-kafka.key
- subjectAltName: DNS:{{ GLOBALS.hostname }}, IP:{{ GLOBALS.node_ip }} - mode: 640
- signing_policy: kafka - user: 960
- private_key: /etc/pki/kafka-logstash.key - group: 939
- CN: {{ GLOBALS.hostname }}
- days_remaining: 0 elasticfleet_kafka_pkcs8_perms:
- days_valid: 820 file.managed:
- backup: True - replace: False
- timeout: 30 - name: /etc/pki/elasticfleet-kafka.p8
- retry: - mode: 640
attempts: 5 - user: 960
interval: 30 - group: 939
cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/kafka-logstash.key -in /etc/pki/kafka-logstash.crt -export -out /etc/pki/kafka-logstash.p12 -nodes -passout pass:changeit"
- onchanges:
- x509: /etc/pki/kafka-logstash.key
{% if grains['role'] in ['so-manager', 'so-managersearch', 'so-standalone', 'so-receiver'] %}
kafka_client_key: kafka_client_key:
x509.private_key_managed: x509.private_key_managed:
- name: /etc/pki/kafka-client.key - name: /etc/pki/kafka-client.key
@@ -814,8 +827,44 @@ kafka_client_crt_perms:
- mode: 640 - mode: 640
- user: 960 - user: 960
- group: 939 - group: 939
{% endif %} {% endif %}
{% if grains['role'] in ['so-manager', 'so-managersearch','so-receiver', 'so-standalone'] %}
kafka_key:
x509.private_key_managed:
- name: /etc/pki/kafka.key
- keysize: 4096
- backup: True
- new: True
{% if salt['file.file_exists']('/etc/pki/kafka.key') -%}
- prereq:
- x509: /etc/pki/kafka.crt
{%- endif %}
- retry:
attempts: 5
interval: 30
kafka_crt:
x509.certificate_managed:
- name: /etc/pki/kafka.crt
- ca_server: {{ ca_server }}
- subjectAltName: DNS:{{ GLOBALS.hostname }}, IP:{{ GLOBALS.node_ip }}
- signing_policy: kafka
- private_key: /etc/pki/kafka.key
- CN: {{ GLOBALS.hostname }}
- days_remaining: 0
- days_valid: 820
- backup: True
- timeout: 30
- retry:
attempts: 5
interval: 30
cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/kafka.key -in /etc/pki/kafka.crt -export -out /etc/pki/kafka.p12 -nodes -passout pass:changeit"
- onchanges:
- x509: /etc/pki/kafka.key
kafka_key_perms: kafka_key_perms:
file.managed: file.managed:
- replace: False - replace: False
@@ -832,6 +881,51 @@ kafka_crt_perms:
- user: 960 - user: 960
- group: 939 - group: 939
kafka_pkcs12_perms:
file.managed:
- replace: False
- name: /etc/pki/kafka.p12
- mode: 640
- user: 960
- group: 939
{% endif %}
{# For automated testing standalone will need kafka-logstash key to pull logs from Kafka #}
{% if grains['role'] == 'so-standalone' %}
kafka_logstash_key:
x509.private_key_managed:
- name: /etc/pki/kafka-logstash.key
- keysize: 4096
- backup: True
- new: True
{% if salt['file.file_exists']('/etc/pki/kafka-logstash.key') -%}
- prereq:
- x509: /etc/pki/kafka-logstash.crt
{%- endif %}
- retry:
attempts: 5
interval: 30
kafka_logstash_crt:
x509.certificate_managed:
- name: /etc/pki/kafka-logstash.crt
- ca_server: {{ ca_server }}
- subjectAltName: DNS:{{ GLOBALS.hostname }}, IP:{{ GLOBALS.node_ip }}
- signing_policy: kafka
- private_key: /etc/pki/kafka-logstash.key
- CN: {{ GLOBALS.hostname }}
- days_remaining: 0
- days_valid: 820
- backup: True
- timeout: 30
- retry:
attempts: 5
interval: 30
cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/kafka-logstash.key -in /etc/pki/kafka-logstash.crt -export -out /etc/pki/kafka-logstash.p12 -nodes -passout pass:changeit"
- onchanges:
- x509: /etc/pki/kafka-logstash.key
kafka_logstash_key_perms: kafka_logstash_key_perms:
file.managed: file.managed:
- replace: False - replace: False
@@ -855,39 +949,8 @@ kafka_logstash_pkcs12_perms:
- mode: 640 - mode: 640
- user: 960 - user: 960
- group: 931 - group: 931
elasticfleet_kafka_pkcs8_perms:
file.managed:
- replace: False
- name: /etc/pki/elasticfleet-kafka.p8
- mode: 640
- user: 960
- group: 939
kafka_pkcs12_perms:
file.managed:
- replace: False
- name: /etc/pki/kafka.p12
- mode: 640
- user: 960
- group: 939
elasticfleet_kafka_cert_perms:
file.managed:
- replace: False
- name: /etc/pki/elasticfleet-kafka.crt
- mode: 640
- user: 960
- group: 939
elasticfleet_kafka_key_perms:
file.managed:
- replace: False
- name: /etc/pki/elasticfleet-kafka.key
- mode: 640
- user: 960
- group: 939
{% endif %} {% endif %}
{% else %} {% else %}
{{sls}}_state_not_allowed: {{sls}}_state_not_allowed: