X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fdebian_org%2Fmanifests%2Finit.pp;h=be1fe71094005b90000dc5599970569cf62cbbda;hb=9728596ba8cf819fe5255eb2aee9b2c469b8359c;hp=6e0ea319353e1754317b129af64ab51b8efc330c;hpb=c61c409283de99571fbc366b114d29154c52b988;p=mirror%2Fdsa-puppet.git

diff --git a/modules/debian_org/manifests/init.pp b/modules/debian_org/manifests/init.pp
index 6e0ea3193..be1fe7109 100644
--- a/modules/debian_org/manifests/init.pp
+++ b/modules/debian_org/manifests/init.pp
@@ -12,12 +12,8 @@ class debian_org {
 		$servicefiles = 'absent'
 	}
 
-	# the virtual facter needs virt-what on jessie to work
-	if versioncmp($::lsbmajdistrelease, '9') < 0 {
-		package { 'virt-what': ensure => installed }
-	} else {
-		package { 'virt-what': ensure => purged }
-	}
+	# the virtual facter needs virt-what on jessie to work; clean up.
+	package { 'virt-what': ensure => purged }
 
 	$samhain_recipients = hiera('samhain_recipients')
 	$root_mail_alias = hiera('root_mail_alias')
@@ -76,13 +72,6 @@ class debian_org {
 		]:
 	}
 
-	if getfromhash($site::nodeinfo, 'broken-rtc') {
-		package { 'fake-hwclock':
-			ensure => installed,
-			tag    => extra_repo,
-		}
-	}
-
 	package { 'molly-guard':
 		ensure => installed,
 	}
@@ -125,12 +114,10 @@ class debian_org {
 		content => "Etc/UTC\n",
 		notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 	}
-	if versioncmp($::lsbmajdistrelease, '9') >= 0 { # jessie has a regular file there, for instance
-		file { '/etc/localtime':
-			ensure => 'link',
-			target => '/usr/share/zoneinfo/Etc/UTC',
-			notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
-		}
+	file { '/etc/localtime':
+		ensure => 'link',
+		target => '/usr/share/zoneinfo/Etc/UTC',
+		notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
 	}
 	file { '/etc/puppet/puppet.conf':
 		content => template('debian_org/puppet.conf.erb'),
@@ -171,9 +158,16 @@ class debian_org {
 		notify => Exec['systemctl daemon-reload'],
 	}
 
-	concat { '/etc/cron.d/dsa-puppet-stuff': }
-	concat::fragment { 'dsa-puppet-stuff---header':
-		target => '/etc/cron.d/dsa-puppet-stuff',
+	file { '/etc/cron.d/dsa-puppet-stuff':
+		ensure => 'absent',
+	}
+	file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
+		ensure => 'absent',
+	}
+
+	concat { '/etc/cron.d/puppet-crontab': }
+	concat::fragment { 'puppet-crontab---header':
+		target => '/etc/cron.d/puppet-crontab',
 		order  => '000',
 		content  => @(EOF)
 			## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
@@ -182,10 +176,10 @@ class debian_org {
 			PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/nagios/plugins
 			| EOF
 	}
-	concat::fragment { 'dsa-puppet-stuff---all':
-		target => '/etc/cron.d/dsa-puppet-stuff',
+	concat::fragment { 'puppet-crontab---all':
+		target => '/etc/cron.d/puppet-crontab',
 		order  => '010',
-		content => template('debian_org/dsa-puppet-stuff.cron.erb'),
+		content => template('debian_org/puppet-crontab.cron.erb'),
 		require => Package['debian.org'],
 	}
 	file { '/etc/ldap/ldap.conf':
@@ -209,8 +203,8 @@ class debian_org {
 		ensure => directory,
 		mode   => '0755',
 	}
-	file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
-		source  => 'puppet:///modules/debian_org/dsa-puppet-stuff.cron.ignore',
+	file { '/etc/dsa/cron.ignore.puppet-crontab':
+		source  => 'puppet:///modules/debian_org/puppet-crontab.cron.ignore',
 		require => Package['debian.org']
 	}
 	file { '/etc/nsswitch.conf':
@@ -240,21 +234,21 @@ class debian_org {
 
 	# set mmap_min_addr to 4096 to mitigate
 	# Linux NULL-pointer dereference exploits
-	site::sysctl { 'mmap_min_addr':
+	base::sysctl { 'mmap_min_addr':
 		ensure => absent
 	}
-	site::sysctl { 'perf_event_paranoid':
+	base::sysctl { 'perf_event_paranoid':
 		key   => 'kernel.perf_event_paranoid',
 		value => '2',
 	}
-	site::sysctl { 'puppet-vfs_cache_pressure':
+	base::sysctl { 'puppet-vfs_cache_pressure':
 		key   => 'vm.vfs_cache_pressure',
 		value => '10',
 	}
-	site::alternative { 'editor':
+	base::alternative { 'editor':
 		linkto => '/usr/bin/vim.basic',
 	}
-	site::alternative { 'view':
+	base::alternative { 'view':
 		linkto => '/usr/bin/vim.basic',
 	}
 	mailalias { 'samhain-reports':
@@ -275,8 +269,7 @@ class debian_org {
 		group  => root,
 	}
 	file { '/usr/local/bin/dsa-is-shutdown-scheduled':
-		source	=> 'puppet:///modules/debian_org/dsa-is-shutdown-scheduled',
-		mode	=> '0555',
+		ensure => 'absent',
 	}
 
 	exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
@@ -330,19 +323,32 @@ class debian_org {
 		source => 'puppet:///modules/debian_org/root-dotfiles/vimrc',
 	}
 
-	if versioncmp($::lsbmajdistrelease, '9') >= 0 { # older puppets do facts as strings.
+	if versioncmp($::lsbmajdistrelease, '9') == 0 { # older puppets do facts as strings.
 		if $::processorcount > 1 {
 			package { 'irqbalance': ensure => installed }
 		}
+	} else {
+		# 926967 drops the recommendation on irqbalance in Buster
+		package { 'irqbalance': ensure => purged }
 	}
 
 
 	# https://www.decadent.org.uk/ben/blog/bpf-security-issues-in-debian.html
-	site::sysctl { 'unprivileged_bpf_disabled':
+	base::sysctl { 'unprivileged_bpf_disabled':
 		key   => 'kernel.unprivileged_bpf_disabled',
 		value => '1',
 	}
 
+	# our ipv6 addresses and routes are statically configured.
+	base::sysctl { 'dsa-accept-ra-default':
+		key   => 'net.ipv6.conf.default.accept_ra',
+		value => 0,
+	}
+	base::sysctl { 'dsa-accept-ra-all':
+		key   => 'net.ipv6.conf.all.accept_ra',
+		value => 0,
+	}
+
 	# Disable kpartx udev rules
 	file { '/etc/udev/rules.d/60-kpartx.rules':
 		ensure => $has_lib_udev_rules_d_60_kpartx_rules ? { true  => 'present', default => 'absent' },