X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fdebian_org%2Fmanifests%2Finit.pp;h=9b023abef32c20e88bd113fc821fbb2ab23a550d;hb=2ab3fafdddbc54a0568679956460fcd7001fa85e;hp=a7ff786d8bde24196526d055e8fff64a08d48306;hpb=b529b139a60ea8355089511737c8264185d8d074;p=mirror%2Fdsa-puppet.git

diff --git a/modules/debian_org/manifests/init.pp b/modules/debian_org/manifests/init.pp
index a7ff786d8..9b023abef 100644
--- a/modules/debian_org/manifests/init.pp
+++ b/modules/debian_org/manifests/init.pp
@@ -6,19 +6,21 @@ class debian_org {
 	include debian_org::apt
 
 	if $systemd {
-		include systemd
+		include dsa_systemd
 		$servicefiles = 'present'
 	} else {
 		$servicefiles = 'absent'
 	}
 
-	$debianadmin = [
-		'debian-archive-debian-samhain-reports@master.debian.org',
-		'debian-admin@ftbfs.de',
-		'weasel@debian.org',
-		'steve@lobefin.net',
-		'zumbi@oron.es'
-	]
+	# the virtual facter needs virt-what on jessie to work
+	if versioncmp($::lsbmajdistrelease, '9') < 0 {
+		package { 'virt-what': ensure => installed }
+	} else {
+		package { 'virt-what': ensure => purged }
+	}
+
+	$samhain_recipients = hiera('samhain_recipients')
+	$root_mail_alias = hiera('root_mail_alias')
 
 	package { [
 			'klogd',
@@ -26,39 +28,32 @@ class debian_org {
 			'rsyslog',
 			'os-prober',
 			'apt-listchanges',
+			'mlocate',
 		]:
 		ensure => purged,
 	}
 	package { [
 			'debian.org',
+			'debian.org-recommended',
 			'dsa-munin-plugins',
+			'userdir-ldap',
 		]:
 		ensure => installed,
 		tag    => extra_repo,
 	}
-	file { '/etc/ssh/ssh_known_hosts':
-		ensure  => present,
-		replace => false,
-		mode    => '0644',
-		source  => 'puppet:///modules/debian_org/basic-ssh_known_hosts'
-	}
 
-	if versioncmp($::lsbmajdistrelease, '8') >= 0 {
-		$rubyfs_package = 'ruby-filesystem'
-	} else {
-		$rubyfs_package = 'libfilesystem-ruby1.9'
-	}
 	package { [
 			'apt-utils',
 			'bash-completion',
 			'dnsutils',
 			'less',
 			'lsb-release',
-			$rubyfs_package,
+			'ruby-filesystem',
 			'mtr-tiny',
 			'nload',
 			'pciutils',
 			'lldpd',
+			'ncurses-term',
 		]:
 		ensure => installed,
 	}
@@ -127,9 +122,16 @@ class debian_org {
 		content => template('debian_org/debian_facts.yaml.erb')
 	}
 	file { '/etc/timezone':
-		source => 'puppet:///modules/debian_org/timezone',
+		content => "Etc/UTC\n",
 		notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 	}
+	if versioncmp($::lsbmajdistrelease, '9') >= 0 { # jessie has a regular file there, for instance
+		file { '/etc/localtime':
+			ensure => 'link',
+			target => '/usr/share/zoneinfo/Etc/UTC',
+			notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
+		}
+	}
 	if $::hostname == handel {
 		include puppetmaster::db
 		$dbpassword = $puppetmaster::db::password
@@ -173,7 +175,20 @@ class debian_org {
 		notify => Exec['systemctl daemon-reload'],
 	}
 
-	file { '/etc/cron.d/dsa-puppet-stuff':
+	concat { '/etc/cron.d/dsa-puppet-stuff': }
+	concat::fragment { 'dsa-puppet-stuff---header':
+		target => '/etc/cron.d/dsa-puppet-stuff',
+		order  => '000',
+		content  => @(EOF)
+			## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+			SHELL=/bin/bash
+			MAILTO=root
+			PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/nagios/plugins
+			| EOF
+	}
+	concat::fragment { 'dsa-puppet-stuff---all':
+		target => '/etc/cron.d/dsa-puppet-stuff',
+		order  => '010',
 		content => template('debian_org/dsa-puppet-stuff.cron.erb'),
 		require => Package['debian.org'],
 	}
@@ -203,7 +218,7 @@ class debian_org {
 		require => Package['debian.org']
 	}
 	file { '/etc/nsswitch.conf':
-		mode   => '0755',
+		mode   => '0444',
 		source => 'puppet:///modules/debian_org/nsswitch.conf',
 	}
 
@@ -218,6 +233,14 @@ class debian_org {
 		mode   => '0444',
 		source => 'puppet:///modules/debian_org/etc.zsh/zprofile',
 	}
+	file { '/etc/environment':
+		content => "",
+		mode => '0440',
+	}
+	file { '/etc/default/locale':
+		content => "",
+		mode => '0444',
+	}
 
 	# set mmap_min_addr to 4096 to mitigate
 	# Linux NULL-pointer dereference exploits
@@ -240,7 +263,12 @@ class debian_org {
 	}
 	mailalias { 'samhain-reports':
 		ensure    => present,
-		recipient => $debianadmin,
+		recipient => $samhain_recipients,
+		require   => Package['debian.org']
+	}
+	mailalias { 'root':
+		ensure    => present,
+		recipient => $root_mail_alias,
 		require   => Package['debian.org']
 	}
 
@@ -250,6 +278,10 @@ class debian_org {
 		owner  => root,
 		group  => root,
 	}
+	file { '/usr/local/bin/dsa-is-shutdown-scheduled':
+		source	=> 'puppet:///modules/debian_org/dsa-is-shutdown-scheduled',
+		mode	=> '0555',
+	}
 
 	exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
 		path        => '/usr/bin:/usr/sbin:/bin:/sbin',
@@ -301,4 +333,48 @@ class debian_org {
 	file { '/root/.vimrc':
 		source => 'puppet:///modules/debian_org/root-dotfiles/vimrc',
 	}
+
+	if versioncmp($::lsbmajdistrelease, '9') >= 0 { # older puppets do facts as strings.
+		if $::processorcount > 1 {
+			package { 'irqbalance': ensure => installed }
+		}
+	}
+
+
+	# https://www.decadent.org.uk/ben/blog/bpf-security-issues-in-debian.html
+	site::sysctl { 'unprivileged_bpf_disabled':
+		key   => 'kernel.unprivileged_bpf_disabled',
+		value => '1',
+	}
+
+	# Disable kpartx udev rules
+	file { '/etc/udev/rules.d/60-kpartx.rules':
+		ensure => $has_lib_udev_rules_d_60_kpartx_rules ? { true  => 'present', default => 'absent' },
+		content => "",
+		mode => '0444',
+	}
+
+	# this is only to avoid warnings, else puppet will complain that we
+	# have a symlink there, even if we're not replacing it anyhow.
+	if ! $has_etc_ssh_ssh_known_hosts {
+		file { '/etc/ssh/ssh_known_hosts':
+			ensure  => 'present',
+			replace => 'no',
+			content => inline_template('<%= open("/etc/ssh/ssh_known_hosts").read() %>'),
+			notify  => Exec['ud-replicate'],
+		}
+	}
+
+	exec { 'ud-replicate':
+		path => '/usr/bin:/usr/sbin:/bin:/sbin',
+		command => '/usr/bin/ud-replicate',
+		refreshonly => true,
+		require => Package['userdir-ldap']
+	}
+
+	# some changes require rebuilding the initramfs.  Have the common exec here.
+	exec { 'update-initramfs -u':
+		path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
+		refreshonly => true;
+	}
 }