Steve Shipway Secret Server v2.1

Author: nanliu

Makefile

@@ -0,0 +1,6 @@
+MANIFESTS=manifests/cert.pp manifests/init.pp manifests/password.pp
+PLUGINS=lib/puppet/parser/functions/ss_fetch_key.rb lib/puppet/parser/functions/password_age.rb lib/puppet/parser/functions/ss_fetch_cert.rb lib/puppet/parser/functions/ss_setpass.rb lib/puppet/parser/functions/ss_check.rb lib/puppet/parser/functions/generate_password.rb lib/facter/passwords.rb
+
+all: $(MANIFESTS) $(PLUGINS) secretserver.rb
+	@puppet-module build
+	@echo Done

Modulefile

@@ -0,0 +1,11 @@
+name 'sshipway-ss'
+version '2.1.0'
+description "Module to integrate Puppet with SecretServer from Thycotic.com.
+This manages passwords, regularly rotating them and ensuring they are
+stored in the SecretServer database as Unix Password objects.
+It also synchronises certificate and key files on the client with Certificate
+objects in the SecretServer database."
+author 'Steve Shipway'
+summary 'Integration with SecretServer from Thycotic to manage passwords and certificates'
+project_page 'http://www.steveshipway.org/forum'
+license 'GPLv2 or later'

README

@@ -0,0 +1,109 @@
+Steve Shipway
+University of Auckland
+[email protected]
+Version 2.0: Dec 2011
+Tested with RHEL(5.3,6.2), Ubuntu(Lucid), SecretServer(7.8)
+
+Requires Savon Ruby Gem to be installed on Puppet Master: 'gem install savon'
+This probably means you need RHEL6 since RHEL6 Ruby did not support gems.
+
+Also requires the secretserver.rb module file to be installed in 
+/usr/lib/ruby/site_ruby/1.8/secretserver.rb
+
+# PARAMETERS
+
+Set these in the init.pp file
+
+   $ss_hostname = 'secretserver.auckland.ac.nz'
+   $ss_username = 'puppet'
+   $ss_password = 'mypassword'
+   $ss_folder   = 'Drop-box'
+
+# PASSWORD CLASS
+Change password if older than 30 days, updating secret server (thycotic.com)
+database to reflect changes.
+
+Allows you to have regularly rotating passwords, stored centrally and audited, 
+but with noone actually knowing what they are.
+
+This will also change and update if password is not yet defined on SecretSvr
+It will NOT verify that SS record contains the correct password though as
+this is not necessarily possible with various backends
+
+Only users with UID<500 are checked; to change this, edit the facter module
+to set facts for ALL users. (see comments at start of lib/facter/password.rb )
+Note that ubuntu/debian people may wish to make this threshold <1000 instead.
+
+Facter should set facts: pwage_(.*) for all accounts <500
+
+To use:
+   ss::password { 'root': }
+   ss::password { 'oracle': maxage=>60, folder=>'Oracle Passwords' }
+
+Attributes:
+   maxage: number of days old a password must be before it gets auto changed
+           default is 30
+   folder: which SecretServer folder to place the secret into, if not the
+           default
+   username: (namevar) username to set password for
+   minchange: minimum number of days before password can be changed by user
+           default is 0 (may not be supported by your unix)
+
+SecretServer:
+   The new password secure is of type 'Unix Account (SSH)'
+   The secret name is $username@$fqdn
+
+Assumptions:
+   1. The specified user exists as a Local user with no 2FA rules
+   2. The specified folder exists, is writeable, and defaults to appropriate
+      sharing rules
+   3. All passwords for servers are shared with the puppet user
+   4. All newly created passwords will be with 'Unix Account (SSH)' template
+   5. Passwords can be changed via /usr/sbin/chpasswd (install this if it is
+      not present).  This works for ubuntu, debian, redhat, centos, fedora,
+      and solaris (if chpasswd is installed from sunfreeware)
+   6. Password ages are in /etc/shadow in standard format (OK for redhat, 
+      centos, fedora, ubuntu, debian, solaris)
+   7. Secretserver v7.x API available
+
+Bugs:
+   1. No way to detect noop mode from functions, so secretserver will be 
+      updated even though the password is not changed on the client.
+
+
+# SSL CERTIFICATE CLASS
+This will synchronise certificate/key files on the client with the certificate
+and key data held in SecretServer.
+
+It will optionally restart Apache after making changes.
+
+Allows you to have certificates stored centrally, and multiple servers using 
+the same certificate automatically updated together by puppet.
+
+Should also work with Windows if you have service=>false and specify a
+windows file location with key=> and crt=>, though this is not tested.
+
+To use:
+ss::cert { 'www.auckland.ac.nz': }
+ss::cert { $fqdn: service=>false; }
+
+Attributes:
+  key, crt: Specify alternate locations for the files.  Default is to put them
+    into /etc/httpd/conf/$name.crt and /etc/httpd/conf/$name.key
+  service: set to false if you dont want it to restart httpd if cert changes
+  ss: set to false if you want it to pull from a file instead of secretserver
+
+SecretServer:
+  The certificates MUST be stored in an object with a Certificate template.
+  The secret name MUST correspond exactly to the namevar.
+
+Assumptions:
+  1. The puppet master must have read access to the certificate secret
+  2. The files are stored in the correct format.  No conversion or validation
+     is performed.
+  3. SecretServer API 7.6 or later available
+
+Bugs:
+  1. If you have service=>true (the default) then the definition of the httpd
+     service may conflict with something you subsequently define elsewhere.
+

lib/facter/passwords.rb

@@ -0,0 +1,31 @@
+username = nil
+pwage = nil
+test = {}
+uids = {}
+# For just the system users
+maxuid = 500
+# For ALL users
+maxuid = 100000
+
+File.open("/etc/passwd").each do |line|
+    uids[$1] = $2.to_i if line =~ /^([^:\s]+):[^:]+:(\d+):/
+end
+
+File.open("/etc/shadow").each do |line|
+    username = $1 and pwage = $2 if line =~ /^([^:\s]+):[^:]+:(\d+):/ && uids[$1] && uids[$1] < maxuid
+    if username != nil && pwage != nil
+	test['pwage_'+username] = 
+		((Time.now-Time.at(pwage.to_i*24*3600))/(24*3600)).floor
+	username = nil
+	pwage = nil
+    end
+end
+
+test.each { |name,age|
+	Facter.add(name) do
+		setcode do
+			age
+		end
+	end
+}
+

lib/puppet/parser/functions/generate_password.rb

@@ -0,0 +1,15 @@
+module Puppet::Parser::Functions
+
+# Generate a sufficiently random string to use as a password
+
+  newfunction(:generate_password,:type=>:rvalue) do |args|
+    pwlen = args[0]
+    if pwlen then
+      pwlen = 10 if(pwlen < 8)
+    else
+      pwlen = 10
+    end
+    pass = rand.to_s  + $$.to_s + Time.now.to_s 
+    pass.crypt(Time.now.sec.to_s*2)[-pwlen,pwlen]
+  end
+end

lib/puppet/parser/functions/password_age.rb

@@ -0,0 +1,10 @@
+module Puppet::Parser::Functions
+
+# Return the age of the password for the specified user, using the custom facts
+
+  newfunction(:password_age,:type=>:rvalue) do |args|
+	v = lookupvar("pwage_"+args[0])
+	v = -1 if(v == nil)
+	v.to_i
+  end
+end

lib/puppet/parser/functions/ss_check.rb

@@ -0,0 +1,53 @@
+require "secretserver"
+
+module Puppet::Parser::Functions
+
+# This should check the password in SecretServer
+
+  newfunction(:ss_check,:type=>:rvalue) do |args|
+	itemusername = args[0]
+	itemhostname = args[1]
+	ssuser     = args[2]
+	sspassword = args[3]
+	sshostname = args[4]
+
+	Savon.configure do |config|
+	  config.log = false            # disable logging
+	  config.log_level = :error     # changing the log level
+	  config.raise_errors = false
+	end
+	HTTPI.log = false
+
+	# Establish session
+	begin
+	  ss = SecretServer.new(sshostname, "secretserver", 
+	    ssuser, sspassword, '', 'Local' )
+	rescue
+	  return 'unknown'
+	end
+	
+
+	# Seek the item
+	begin
+	  dunnit = 0
+	  s = ss.search( itemusername+'@'+itemhostname )
+	  if s.size == 0
+	    return 'false'
+	  else
+	    s.each {|r|
+		x = ss.get_secret(r)
+		if ( x.secret[:name] == ( itemusername+'@'+itemhostname) ) 
+			dunnit = 1
+		end
+  	    }
+            if dunnit 
+	      return 'true'
+            end
+	    return 'false'
+          end
+	rescue
+	  return "Unknown: ERROR: #{$!}"
+	end
+	return 'unknown'
+  end # function
+end # module

lib/puppet/parser/functions/ss_fetch_cert.rb

@@ -0,0 +1,47 @@
+require "secretserver"
+
+module Puppet::Parser::Functions
+
+  newfunction(:ss_fetch_cert,:type=>:rvalue) do |args|
+	itemhostname = args[0]
+	ssuser     = args[1]
+	sspassword = args[2]
+	sshostname = args[3]
+
+	Savon.configure do |config|
+	  config.log = false            # disable logging
+	  config.log_level = :error     # changing the log level
+	  config.raise_errors = false
+	end
+	HTTPI.log = false
+
+	# Establish session
+	begin
+	  ss = SecretServer.new(sshostname, "secretserver", 
+	    ssuser, sspassword, '', 'Local' )
+	rescue
+	  return ''
+	end
+	
+	# Seek the item
+	s = ss.search( itemhostname )
+	if s.size == 0
+	  return ''
+	else
+          certificate = ''
+          s.each {|r|
+            if ( r.secret_name == itemhostname ) and ( r.secret_type_name == 'Certificate' )
+              x = ss.get_secret(r)
+              itemid = 0
+              x.secret[:items][:secret_item].each { |si|
+                itemid = si[:id] if si[:field_name] == 'Certificate'
+              }
+              certificate = ss.download(r,itemid)
+              certificate = 'Located but not retrieved' if ! certificate
+            end
+          }
+          return certificate
+	end
+	return ''
+  end
+end

lib/puppet/parser/functions/ss_fetch_key.rb

@@ -0,0 +1,47 @@
+require "secretserver"
+
+module Puppet::Parser::Functions
+
+  newfunction(:ss_fetch_key,:type=>:rvalue) do |args|
+	itemhostname = args[0]
+	ssuser     = args[1]
+	sspassword = args[2]
+	sshostname = args[3]
+
+	Savon.configure do |config|
+	  config.log = false            # disable logging
+	  config.log_level = :error     # changing the log level
+	  config.raise_errors = false
+	end
+	HTTPI.log = false
+
+	# Establish session
+	begin
+	  ss = SecretServer.new(sshostname, "secretserver", 
+	    ssuser, sspassword, '', 'Local' )
+	rescue
+	  return ''
+	end
+	
+	# Seek the item
+	s = ss.search( itemhostname )
+	if s.size == 0
+	  return ''
+	else
+          privatekey  = ''
+          s.each {|r|
+            if ( r.secret_name == itemhostname ) and ( r.secret_type_name == 'Certificate' )
+              x = ss.get_secret(r)
+              itemid = 0
+              x.secret[:items][:secret_item].each { |si|
+                itemid = si[:id] if si[:field_name] == 'Private Key'
+              }
+              privatekey  = ss.download(r,itemid)
+              privatekey  = 'Located but not retrieved' if ! privatekey 
+            end
+          }
+          return privatekey 
+	end
+	return ''
+  end
+end