Merge pull request #6301 from Security-Onion-Solutions/dev

2.3.90

README.md

@@ -1,6 +1,6 @@
-## Security Onion 2.3.80
+## Security Onion 2.3.90
 
-Security Onion 2.3.80 is here!
+Security Onion 2.3.90 is here!
 
 ## Screenshots
 

VERIFY_ISO.md

@@ -1,18 +1,18 @@
-### 2.3.80 ISO image built on 2021/09/27
+### 2.3.90 ISO image built on 2021/11/19
 
 
 
 ### Download and Verify
 
-2.3.80 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-2.3.80.iso
+2.3.90 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-2.3.90.iso
 
-MD5: 24F38563860416F4A8ABE18746913E14  
-SHA1: F923C005F54EA2A17AB225ADA0DA46042707AAD9  
-SHA256: 8E95D10AF664D9A406C168EC421D943CB23F0D0C1813C6C2DBA9B4E131984018 
+MD5: F214ECE9F32A6F881D9A735DEAF90E46  
+SHA1: 0B04FAA0FEC704CF6AD2030AA7A4AE80D9379AFA  
+SHA256: BE0E1516D83D7782AEAE9D52449FED45A45D72981515672C761C2A17B7AA613C 
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.80.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.90.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS  
@@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.80.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.90.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-2.3.80.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-2.3.90.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-2.3.80.iso.sig securityonion-2.3.80.iso
+gpg --verify securityonion-2.3.90.iso.sig securityonion-2.3.90.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Mon 27 Sep 2021 08:55:01 AM EDT using RSA key ID FE507013
+gpg: Signature made Fri 19 Nov 2021 05:15:29 PM EST using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

pillar/top.sls

@@ -2,7 +2,6 @@ base:
   '*':
     - patch.needs_restarting
     - logrotate
-    - users
 
   '*_eval or *_helixsensor or *_heavynode or *_sensor or *_standalone or *_import':
     - match: compound

pillar/users/init.sls

@@ -1,2 +0,0 @@
-# users pillar goes in /opt/so/saltstack/local/pillar/users/init.sls
-# the users directory may need to be created under /opt/so/saltstack/local/pillar

pillar/users/pillar.example

@@ -1,19 +0,0 @@
-users:
-  sclapton:
-    # required fields
-    status: present
-    # node_access determines which node types the user can access.
-    # this can either be by grains.role or by final part of the minion id after the _
-    node_access:
-      - standalone
-      - searchnode
-    # optional fields
-    fullname: Stevie Claptoon
-    uid: 1001
-    gid: 1001
-    homephone: does not have a phone
-    groups:
-      - mygroup1
-      - mygroup2
-      - wheel # give sudo access
-      

pillar/users/pillar.usage

@@ -1,20 +0,0 @@
-users:
-  sclapton:
-    # required fields
-    status: <present | absent>
-    # node_access determines which node types the user can access.
-    # this can either be by grains.role or by final part of the minion id after the _
-    node_access:
-      - standalone
-      - searchnode
-    # optional fields
-    fullname: <string>
-    uid: <integer>
-    gid: <integer>
-    roomnumber: <string>
-    workphone: <string>
-    homephone: <string>
-    groups:
-      - <string>
-      - <string>
-      - wheel # give sudo access

salt/common/tools/sbin/soup

@@ -635,6 +635,8 @@ up_to_2.3.90() {
         >> /opt/so/saltstack/local/pillar/secrets.sls
 
   fi
+
+  sed -i -re 's/^(playbook_admin.*|playbook_automation.*)/  \1/g' /opt/so/saltstack/local/pillar/secrets.sls
   
   INSTALLEDVERSION=2.3.90
 }
@@ -807,16 +809,22 @@ upgrade_to_2.3.50_repo() {
 }
 
 verify_latest_update_script() {
+  #we need to render soup and so-common first since they contain jinja
+  salt-call slsutil.renderer $UPDATE_DIR/salt/common/tools/sbin/soup default_renderer='jinja' --local --out=newline_values_only --out-indent=-4 --out-file=/tmp/soup
+  sed -i -e '$a\' /tmp/soup
+  salt-call slsutil.renderer $UPDATE_DIR/salt/common/tools/sbin/so-common default_renderer='jinja' --local --out=newline_values_only --out-indent=-4 --out-file=/tmp/so-common
+  sed -i -e '$a\' /tmp/so-common
   # Check to see if the update scripts match. If not run the new one.
-  CURRENTSOUP=$(md5sum /opt/so/saltstack/default/salt/common/tools/sbin/soup | awk '{print $1}')
-  GITSOUP=$(md5sum $UPDATE_DIR/salt/common/tools/sbin/soup | awk '{print $1}')
-  CURRENTCMN=$(md5sum /opt/so/saltstack/default/salt/common/tools/sbin/so-common | awk '{print $1}')
-  GITCMN=$(md5sum $UPDATE_DIR/salt/common/tools/sbin/so-common | awk '{print $1}')
-  CURRENTIMGCMN=$(md5sum /opt/so/saltstack/default/salt/common/tools/sbin/so-image-common | awk '{print $1}')
+  CURRENTSOUP=$(md5sum /usr/sbin/soup | awk '{print $1}')
+  GITSOUP=$(md5sum /tmp/soup | awk '{print $1}')
+  CURRENTCMN=$(md5sum /usr/sbin/so-common | awk '{print $1}')
+  GITCMN=$(md5sum /tmp/so-common | awk '{print $1}')
+  CURRENTIMGCMN=$(md5sum /usr/sbin/so-image-common | awk '{print $1}')
   GITIMGCMN=$(md5sum $UPDATE_DIR/salt/common/tools/sbin/so-image-common | awk '{print $1}')
 
   if [[ "$CURRENTSOUP" == "$GITSOUP" && "$CURRENTCMN" == "$GITCMN" && "$CURRENTIMGCMN" == "$GITIMGCMN" ]]; then
     echo "This version of the soup script is up to date. Proceeding."
+    rm -f /tmp/soup /tmp/so-common
   else
     echo "You are not running the latest soup version. Updating soup and its components. Might take multiple runs to complete"
     cp $UPDATE_DIR/salt/common/tools/sbin/soup $DEFAULT_SALT_DIR/salt/common/tools/sbin/
@@ -1144,4 +1152,3 @@ fi
 
 echo "### Preparing soup at $(date) ###"
 main "$@" | tee -a $SOUP_LOG
-  

salt/top.sls

@@ -34,7 +34,6 @@ base:
     - match: compound
     - salt.minion
     - common
-    - users
     - patch.os.schedule
     - motd
     - salt.minion-check

salt/users/init.sls

@@ -1,110 +0,0 @@
-# The creation of a user will require a pub key placed in /opt/so/saltstack/local/salt/users/authorized_keys/<username>
-
-# If a user is changed from present to absent, their usergroup will be removed, but any additional usergroups that were created
-# for that user will remain.
-
-{% from 'users/map.jinja' import reserved_usernames with context %}
-
-{% for username, userdeets in pillar.get('users', {}).items() if username not in reserved_usernames %}
-  {% if 'status' in userdeets %}
-    {% if userdeets.status == 'absent' %}
-
-remove_user_{{username}}:
-  user.absent:
-    - name: {{ username }}
-    {% if 'purge' in userdeets %}
-    - purge: {{ userdeets.purge }}
-    {% endif %}
-    - force: True
-
-  {% elif userdeets.status == 'present' %}
-
-    {% if 'node_access' in userdeets %}
-      {% if grains.role in userdeets.node_access or grains.id.split('_')|last in userdeets.node_access %}
-
-add_user_group_{{username}}:
-  group.present:
-    - name: {{ username }}
-        {% if 'uid' in userdeets %}
-    - gid: {{ userdeets.uid }}
-        {% endif %}
-
-add_user_{{username}}:
-  user.present:
-    - name: {{ username }}
-    - home: {{ userdeets.get('home', "/home/%s" % username) }}
-    - shell: {{ userdeets.get('shell', '/bin/bash') }}
-    - usergroup: True
-
-        {% if 'fullname' in userdeets %}
-    - fullname: {{ userdeets.fullname }}
-        {% endif %}
-
-        {% if 'uid' in userdeets %}
-    - uid: {{ userdeets.uid }}
-        {% endif %}
-
-        {% if 'gid' in userdeets %}
-    - gid: {{ userdeets.gid }}
-        {% endif %}
-
-        {% if 'roomnumber' in userdeets %}
-    - roomnumber: {{ userdeets.roomnumber }}
-        {% endif %}
-
-        {% if 'workphone' in userdeets %}
-    - workphone: {{ userdeets.workphone }}
-        {% endif %}
-
-        {% if 'homephone' in userdeets %}
-    - homephone: {{ userdeets.homephone }}
-        {% endif %}
-
-        {% if 'groups' in userdeets %}
-    - groups:
-          {% for group in userdeets.groups %}
-      - {{ group }}
-          {% endfor %}
-        {% endif %}
-
-{{username}}_authorized_keys:
-  file.managed:
-    - name: /home/{{username}}/.ssh/authorized_keys
-    - source: salt://users/authorized_keys/{{username}}
-    - user: {{username}}
-    - group: {{username}}
-    - mode: 644
-    - show_diff: False
-    - makedirs: True
-    - require:
-      - user: add_user_{{username}}
-
-      {% endif %}
-    {% endif %}
-
-  {% else %}
-
-unknown_status_or_password_not_provided_for_user_{{username}}:
-  test.fail_without_changes:
-    - comment: "Verify status is 'present' or 'absent' and a password is provided for {{username}} in the users pillar."
-
-    {% endif %}
-
-  {% else %}
-
-status_not_provided_for_user_{{username}}:
-  test.fail_without_changes:
-    - comment: "Status should be 'present' or 'absent'."
-
-  {% endif %}
-{% endfor %}
-
-disable_wheel_pwd_required:
-  file.comment:
-    - name: /etc/sudoers
-    - regex: "%wheel\\s+ALL=\\(ALL\\)\\s+ALL"
-
-allow_wheel_no_pwd:
-  file.uncomment:
-    - name: /etc/sudoers
-    - regex: "%wheel\\s+ALL=\\(ALL\\)\\s+NOPASSWD: ALL"

salt/users/map.jinja

@@ -1,58 +0,0 @@
-{% set reserved_usernames = [
-    'root',
-    'bin',
-    'daemon',
-    'adm',
-    'lp',
-    'sync',
-    'shutdown',
-    'halt',
-    'mail',
-    'operator',
-    'games',
-    'ftp',
-    'nobody',
-    'systemd-network',
-    'dbus',
-    'polkitd',
-    'tss',
-    'sshd',
-    'ossec',
-    'postfix',
-    'chrony',
-    'ntp',
-    'tcpdump',
-    'socore',
-    'soremote',
-    'elasticsearch',
-    'stenographer',
-    'suricata',
-    'zeek',
-    'curator',
-    'kratos',
-    'kibana',
-    'elastalert',
-    'ossecm',
-    'ossecr',
-    'logstash',
-    'sys',
-    'man',
-    'news',
-    'uucp',
-    'proxy',
-    'www-data',
-    'backup',
-    'list',
-    'irc',
-    'gnats',
-    'systemd-resolve',
-    'syslog',
-    'messagebus',
-    '_apt',
-    'lxd',
-    'uuidd',
-    'dnsmasq',
-    'landscape',
-    'pollinate',
-    'ossec'
-] %}