CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 10:42:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #125 from m0duspwnens/master

Browse Source 
Upgrade Salt to 2019.2.2 and fix module.run deprecation warnings
This commit is contained in:
Mike Reeves
2019-11-11 13:48:28 -05:00
committed by GitHub
parent 59cdf05fad f1d7dff565
commit e495f85b19
6 changed files with 53 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
salt/ca/init.sls
View File

@@ -39,10 +39,10 @@ pki_private_key:
- require: - require:
- file: /etc/pki - file: /etc/pki
mine.send: send_x509_pem_entries_to_mine:
module.run: module.run:
- func: x509.get_pem_entries - mine.send:
- kwargs: - func: x509.get_pem_entries
glob_path: /etc/pki/ca.crt - glob_path: /etc/pki/ca.crt
- onchanges: - onchanges:
- x509: /etc/pki/ca.crt - x509: /etc/pki/ca.crt

8
salt/common/init.sls
View File

@@ -316,7 +316,7 @@ grafanaconf:
- source: salt://common/grafana/etc - source: salt://common/grafana/etc
{% if salt['pillar.get']('mastertab', False) %} {% if salt['pillar.get']('mastertab', False) %}
{%- for SN, SNDATA in salt['pillar.get']('mastertab', {}).iteritems() %} {%- for SN, SNDATA in salt['pillar.get']('mastertab', {}).items() %}
dashboard-master: dashboard-master:
file.managed: file.managed:
- name: /opt/so/conf/grafana/grafana_dashboards/master/{{ SN }}-Master.json - name: /opt/so/conf/grafana/grafana_dashboards/master/{{ SN }}-Master.json
@@ -337,7 +337,7 @@ dashboard-master:
{% endif %} {% endif %}
{% if salt['pillar.get']('sensorstab', False) %} {% if salt['pillar.get']('sensorstab', False) %}
{%- for SN, SNDATA in salt['pillar.get']('sensorstab', {}).iteritems() %} {%- for SN, SNDATA in salt['pillar.get']('sensorstab', {}).items() %}
dashboard-{{ SN }}: dashboard-{{ SN }}:
file.managed: file.managed:
- name: /opt/so/conf/grafana/grafana_dashboards/forward_nodes/{{ SN }}-Sensor.json - name: /opt/so/conf/grafana/grafana_dashboards/forward_nodes/{{ SN }}-Sensor.json
@@ -358,7 +358,7 @@ dashboard-{{ SN }}:
{% endif %} {% endif %}
{% if salt['pillar.get']('nodestab', False) %} {% if salt['pillar.get']('nodestab', False) %}
{%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).iteritems() %} {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
dashboard-{{ SN }}: dashboard-{{ SN }}:
file.managed: file.managed:
- name: /opt/so/conf/grafana/grafana_dashboards/storage_nodes/{{ SN }}-Node.json - name: /opt/so/conf/grafana/grafana_dashboards/storage_nodes/{{ SN }}-Node.json
@@ -379,7 +379,7 @@ dashboard-{{ SN }}:
{% endif %} {% endif %}
{% if salt['pillar.get']('evaltab', False) %} {% if salt['pillar.get']('evaltab', False) %}
{%- for SN, SNDATA in salt['pillar.get']('evaltab', {}).iteritems() %} {%- for SN, SNDATA in salt['pillar.get']('evaltab', {}).items() %}
dashboard-{{ SN }}: dashboard-{{ SN }}:
file.managed: file.managed:
- name: /opt/so/conf/grafana/grafana_dashboards/eval/{{ SN }}-Node.json - name: /opt/so/conf/grafana/grafana_dashboards/eval/{{ SN }}-Node.json

10
salt/patch/os/schedule.sls
View File

@@ -15,7 +15,7 @@ patch_os_schedule:
- patch.os - patch.os
- when: - when:
{% for days in os_schedule.patch.os.schedule %} {% for days in os_schedule.patch.os.schedule %}
{% for day, times in days.iteritems() %} {% for day, times in days.items() %}
{% for time in times %} {% for time in times %}
- {{day}} {{time}} - {{day}} {{time}}
{% endfor %} {% endfor %}
@@ -64,13 +64,13 @@ remove_patch_os_schedule:
{% else %} {% else %}
no_os_patch_schedule_name_set: no_patch_os_schedule_name_set:
test.fail_without_changes: test.fail_without_changes:
- name: "Set a pillar value for patch:os:schedule_name in this minion's .sls file. If an OS patch schedule is not listed as enabled in show_schedule output below, then OS patches will need to be applied manually until this is corrected." - name: "Set a pillar value for patch:os:schedule_name in this minion's .sls file. If an OS patch schedule is not listed as enabled in show_schedule output below, then OS patches will need to be applied manually until this is corrected."
show_schedule: show_patch_os_schedule:
module.run: module.run:
- name: schedule.is_enabled - schedule.is_enabled:
- m_name: patch_os_schedule - name: patch_os_schedule
{% endif %} {% endif %}

6
salt/playbook/init.sls
View File

@@ -11,9 +11,9 @@ playbookdb:
playbookwebhook: playbookwebhook:
module.run: module.run:
- name: sqlite3.modify - sqlite3.modify:
- db: /opt/so/conf/playbook/redmine.db - db: /opt/so/conf/playbook/redmine.db
- sql: "update webhooks set url = 'http://{{MASTERIP}}:7000/playbook/webhook' where project_id = 1" - sql: "update webhooks set url = 'http://{{MASTERIP}}:7000/playbook/webhook' where project_id = 1"
navigatorconfig: navigatorconfig:
file.managed: file.managed:

2
salt/utility/bin/crossthestreams.sh
View File

@@ -31,6 +31,6 @@ echo "Applying cross cluster search config..."
# Add all the storage nodes to cross cluster searching. # Add all the storage nodes to cross cluster searching.
{%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).iteritems() %} {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
curl -XPUT http://{{ ES }}:9200/_cluster/settings -H'Content-Type: application/json' -d '{"persistent": {"search": {"remote": {"{{ SN }}": {"skip_unavailable": "true", "seeds": ["{{ SNDATA.ip }}:9300"]}}}}}' curl -XPUT http://{{ ES }}:9200/_cluster/settings -H'Content-Type: application/json' -d '{"persistent": {"search": {"remote": {"{{ SN }}": {"skip_unavailable": "true", "seeds": ["{{ SNDATA.ip }}:9300"]}}}}}'
{%- endfor %} {%- endfor %}

58
so-setup-network.sh
View File

@@ -255,6 +255,9 @@ configure_minion() {
fi fi
echo "use_superseded:" >> /etc/salt/minion
echo " - module.run" >> /etc/salt/minion
service salt-minion restart service salt-minion restart
} }
@@ -352,7 +355,9 @@ docker_install() {
yum -y install yum-utils device-mapper-persistent-data lvm2 openssl yum -y install yum-utils device-mapper-persistent-data lvm2 openssl
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum -y update yum -y update
yum -y install docker-ce docker-python python-docker yum -y install docker-ce
pip3 install docker
set_environment_var "PYTHONPATH=$PYTHONPATH:/usr/local/lib/python3.6/site-packages/"
if [ $INSTALLTYPE != 'EVALMODE' ]; then if [ $INSTALLTYPE != 'EVALMODE' ]; then
docker_registry docker_registry
fi fi
@@ -500,7 +505,7 @@ install_master() {
wget --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH wget --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH
else else
apt-get install -y salt-common=2018.3.4+ds-1 salt-master=2018.3.4+ds-1 salt-minion=2018.3.4+ds-1 python-m2crypto apt-get install -y salt-common=2019.2.2+ds-1 salt-master=2019.2.2+ds-1 salt-minion=2019.2.2+ds-1 python-m2crypto
apt-mark hold salt-common salt-master salt-minion apt-mark hold salt-common salt-master salt-minion
apt-get install -y python-m2crypto apt-get install -y python-m2crypto
fi fi
@@ -696,9 +701,9 @@ saltify() {
ADDUSER=adduser ADDUSER=adduser
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ]; then
yum -y install https://repo.saltstack.com/yum/redhat/salt-repo-latest-2.el7.noarch.rpm yum -y install https://repo.saltstack.com/py3/redhat/salt-py3-repo-latest-2.el7.noarch.rpm
cp /etc/yum.repos.d/salt-latest.repo /etc/yum.repos.d/salt-2018-3.repo cp /etc/yum.repos.d/salt-latest.repo /etc/yum.repos.d/salt-2019-2.repo
sed -i 's/latest/2018.3/g' /etc/yum.repos.d/salt-2018-3.repo sed -i 's/latest/2019.2/g' /etc/yum.repos.d/salt-2019-2.repo
cat > /etc/yum.repos.d/wazuh.repo <<\EOF cat > /etc/yum.repos.d/wazuh.repo <<\EOF
[wazuh_repo] [wazuh_repo]
gpgcheck=1 gpgcheck=1
@@ -812,13 +817,13 @@ EOF
echo "gpgkey=file:///etc/pki/rpm-gpg/saltstack-signing-key" >> /etc/yum.repos.d/salt-latest.repo echo "gpgkey=file:///etc/pki/rpm-gpg/saltstack-signing-key" >> /etc/yum.repos.d/salt-latest.repo
# Proxy is hating on me.. Lets just set it manually # Proxy is hating on me.. Lets just set it manually
echo "[salt-2018.3]" > /etc/yum.repos.d/salt-2018-3.repo echo "[salt-2019.2]" > /etc/yum.repos.d/salt-2019-2.repo
echo "name=SaltStack Latest Release Channel for RHEL/Centos \$releasever" >> /etc/yum.repos.d/salt-2018-3.repo echo "name=SaltStack Latest Release Channel for RHEL/Centos \$releasever" >> /etc/yum.repos.d/salt-2019-2.repo
echo "baseurl=https://repo.saltstack.com/yum/redhat/7/\$basearch/2018.3" >> /etc/yum.repos.d/salt-2018-3.repo echo "baseurl=https://repo.saltstack.com/yum/redhat/7/\$basearch/2019.2" >> /etc/yum.repos.d/salt-2019-2.repo
echo "failovermethod=priority" >> /etc/yum.repos.d/salt-2018-3.repo echo "failovermethod=priority" >> /etc/yum.repos.d/salt-2019-2.repo
echo "enabled=1" >> /etc/yum.repos.d/salt-2018-3.repo echo "enabled=1" >> /etc/yum.repos.d/salt-2019-2.repo
echo "gpgcheck=1" >> /etc/yum.repos.d/salt-2018-3.repo echo "gpgcheck=1" >> /etc/yum.repos.d/salt-2019-2.repo
echo "gpgkey=file:///etc/pki/rpm-gpg/saltstack-signing-key" >> /etc/yum.repos.d/salt-2018-3.repo echo "gpgkey=file:///etc/pki/rpm-gpg/saltstack-signing-key" >> /etc/yum.repos.d/salt-2019-2.repo
cat > /etc/yum.repos.d/wazuh.repo <<\EOF cat > /etc/yum.repos.d/wazuh.repo <<\EOF
[wazuh_repo] [wazuh_repo]
@@ -831,8 +836,8 @@ protect=1
EOF EOF
else else
yum -y install https://repo.saltstack.com/yum/redhat/salt-repo-latest-2.el7.noarch.rpm yum -y install https://repo.saltstack.com/yum/redhat/salt-repo-latest-2.el7.noarch.rpm
cp /etc/yum.repos.d/salt-latest.repo /etc/yum.repos.d/salt-2018-3.repo cp /etc/yum.repos.d/salt-latest.repo /etc/yum.repos.d/salt-2019-2.repo
sed -i 's/latest/2018.3/g' /etc/yum.repos.d/salt-2018-3.repo sed -i 's/latest/2019.2/g' /etc/yum.repos.d/salt-2019-2.repo
cat > /etc/yum.repos.d/wazuh.repo <<\EOF cat > /etc/yum.repos.d/wazuh.repo <<\EOF
[wazuh_repo] [wazuh_repo]
gpgcheck=1 gpgcheck=1
@@ -846,16 +851,16 @@ EOF
fi fi
yum clean expire-cache yum clean expire-cache
yum -y install salt-minion-2018.3.4 yum-utils device-mapper-persistent-data lvm2 openssl python-dateutil yum -y install salt-minion-2019.2.2 yum-utils device-mapper-persistent-data lvm2 openssl python-dateutil
yum -y update exclude=salt* yum -y update exclude=salt*
systemctl enable salt-minion systemctl enable salt-minion
# Nasty hack but required for now # Nasty hack but required for now
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ]; then
yum -y install salt-master-2018.3.4 python-m2crypto salt-minion-2018.3.4 m2crypto yum -y install salt-master-2019.2.2 python-m2crypto salt-minion-2019.2.2 m2crypto
systemctl enable salt-master systemctl enable salt-master
else else
yum -y install salt-minion-2018.3.4 python-m2m2crypto m2crypto yum -y install salt-minion-2019.2.2 python-m2m2crypto m2crypto
fi fi
echo "exclude=salt*" >> /etc/yum.conf echo "exclude=salt*" >> /etc/yum.conf
@@ -874,9 +879,9 @@ EOF
# Install the repo for salt # Install the repo for salt
wget --inet4-only -O - https://repo.saltstack.com/apt/ubuntu/$UVER/amd64/latest/SALTSTACK-GPG-KEY.pub | apt-key add - wget --inet4-only -O - https://repo.saltstack.com/apt/ubuntu/$UVER/amd64/latest/SALTSTACK-GPG-KEY.pub | apt-key add -
wget --inet4-only -O - https://repo.saltstack.com/apt/ubuntu/$UVER/amd64/2018.3/SALTSTACK-GPG-KEY.pub | apt-key add - wget --inet4-only -O - https://repo.saltstack.com/apt/ubuntu/$UVER/amd64/2019.2/SALTSTACK-GPG-KEY.pub | apt-key add -
echo "deb http://repo.saltstack.com/apt/ubuntu/$UVER/amd64/latest xenial main" > /etc/apt/sources.list.d/saltstack.list echo "deb http://repo.saltstack.com/py3/ubuntu/$UVER/amd64/latest xenial main" > /etc/apt/sources.list.d/saltstack.list
echo "deb http://repo.saltstack.com/apt/ubuntu/$UVER/amd64/2018.3 xenial main" > /etc/apt/sources.list.d/saltstack2018.list echo "deb http://repo.saltstack.com/py3/ubuntu/$UVER/amd64/2019.2 xenial main" > /etc/apt/sources.list.d/saltstack2019.list
# Lets get the docker repo added # Lets get the docker repo added
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
@@ -895,7 +900,7 @@ EOF
# Initialize the new repos # Initialize the new repos
apt-get update >> $SETUPLOG 2>&1 apt-get update >> $SETUPLOG 2>&1
apt-get -y install salt-minion=2018.3.4+ds-1 salt-common=2018.3.4+ds-1 python-m2cryptoi python-dateutil >> $SETUPLOG 2>&1 apt-get -y install salt-minion=2019.2.2+ds-1 salt-common=2019.2.2+ds-1 python-m2cryptoi python-dateutil >> $SETUPLOG 2>&1
apt-mark hold salt-minion salt-common apt-mark hold salt-minion salt-common
else else
@@ -909,7 +914,7 @@ EOF
echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
# Initialize the new repos # Initialize the new repos
apt-get update >> $SETUPLOG 2>&1 apt-get update >> $SETUPLOG 2>&1
apt-get -y install salt-minion=2018.3.4+ds-1 salt-common=2018.3.4+ds-1 python-m2crypto python-dateutil >> $SETUPLOG 2>&1 apt-get -y install salt-minion=2019.2.2+ds-1 salt-common=2019.2.2+ds-1 python-m2crypto python-dateutil >> $SETUPLOG 2>&1
apt-mark hold salt-minion salt-common apt-mark hold salt-minion salt-common
fi fi
@@ -1020,6 +1025,15 @@ sensor_pillar() {
} }
set_environment_var() {
echo "Setting environment variable: $1"
export "$1"
echo "export $1" >> /etc/profile.d/set_env_vars.sh
}
set_hostname() { set_hostname() {
hostnamectl set-hostname --static $HOSTNAME hostnamectl set-hostname --static $HOSTNAME