Skip to content

Commit ceee75a

Browse files
TalkingQuicklyTalkingQuickly
authored
Merge pull request #66 from TalkingQuickly/feature/2021-upgrade
fixes: sshd configuration not being applied by default
2 parents e452bc7 + cb603cc commit ceee75a

15 files changed

+288
-30
lines changed

‎Berksfile

+4-11
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,26 @@
11
source "https://api.berkshelf.com"
22

3-
# cookbook 'apt', github: 'opscode-cookbooks/apt'
4-
cookbook 'apt-chef', '~> 1.0.0'
3+
cookbook 'apt', '~> 7.4.0'
54

6-
# cookbook 'fail2ban', github: 'opscode-cookbooks/fail2ban'
7-
cookbook 'fail2ban', '~> 2.3.0'
5+
cookbook 'fail2ban', '~> 6.3.2'
86

9-
# cookbook 'hostnames', github: 'nathantsoi/chef-cookbook-hostname'
107
cookbook 'hostnames', '= 0.3.1'
118

129
cookbook 'locale', '~> 1.1.0'
1310

1411
cookbook 'memcached', '~> 6.1.0'
1512

16-
#cookbook 'mysql', github: 'opscode-cookbooks/mysql'
1713
cookbook 'mysql', '~> 5.6.3'
1814

1915
cookbook 'ntp', '~> 3.7.0'
2016

21-
#cookbook 'openssh', github: 'opscode-cookbooks/openssh'
22-
cookbook 'openssh', '= 1.2.2'
17+
cookbook 'openssh', '~> 2.9.0'
2318

2419
cookbook 'postgresql', '~> 8.2.1'
2520

26-
# cookbook 'sudo', github: 'opscode-cookbooks/sudo'
27-
cookbook 'sudo', '~> 2.9.0'
21+
cookbook 'sudo', '~> 5.4.6'
2822

2923
cookbook 'ufw', '~> 3.2.1'
30-
cookbook 'firewall', '~> 2.7.0'
3124

3225
cookbook 'nginx', '~> 11.4.0'
3326

‎Berksfile.lock

+10-13
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
DEPENDENCIES
2-
apt-chef (~> 1.0.0)
3-
fail2ban (~> 2.3.0)
4-
firewall (~> 2.7.0)
2+
apt (~> 7.4.0)
3+
fail2ban (~> 6.3.2)
54
hostnames (= 0.3.1)
65
locale (~> 1.1.0)
76
memcached (~> 6.1.0)
@@ -16,7 +15,7 @@ DEPENDENCIES
1615
mysql (~> 5.6.3)
1716
nginx (~> 11.4.0)
1817
ntp (~> 3.7.0)
19-
openssh (= 1.2.2)
18+
openssh (~> 2.9.0)
2019
postgresql (~> 8.2.1)
2120
rails_gem_dependencies-tlq
2221
git: https://github.com/TalkingQuickly/rails_gem_dependencies-tlq.git
@@ -27,24 +26,22 @@ DEPENDENCIES
2726
ruby_rbenv
2827
git: https://github.com/sous-chefs/ruby_rbenv.git
2928
revision: 35c775e5e0371cb798f5049a56dc8330bd196f15
30-
sudo (~> 2.9.0)
29+
sudo (~> 5.4.6)
3130
ufw (~> 3.2.1)
3231
users (~> 5.5.0)
3332

3433
GRAPH
35-
apt (2.9.2)
36-
apt-chef (1.0.0)
37-
apt (>= 0.0.0)
34+
apt (7.4.0)
3835
chef-sugar (5.1.12)
39-
fail2ban (2.3.0)
36+
fail2ban (6.3.2)
4037
yum-epel (>= 0.0.0)
4138
firewall (2.7.0)
4239
chef-sugar (>= 0.0.0)
4340
homebrew (5.1.0)
4441
hostnames (0.3.1)
4542
hostsfile (>= 0.0.0)
4643
hostsfile (2.4.5)
47-
iptables (2.2.0)
44+
iptables (7.1.0)
4845
locale (1.1.0)
4946
memcached (6.1.0)
5047
monit-tlq (0.5.0)
@@ -55,8 +52,8 @@ GRAPH
5552
ohai (~> 5.2)
5653
ntp (3.7.0)
5754
ohai (5.3.0)
58-
openssh (1.2.2)
59-
iptables (>= 0.0.0)
55+
openssh (2.9.0)
56+
iptables (>= 7.0)
6057
postgresql (8.2.1)
6158
apt (>= 0.0.0)
6259
yum-epel (>= 0.0.0)
@@ -71,7 +68,7 @@ GRAPH
7168
yum-epel (>= 0.0.0)
7269
ruby_rbenv (2.6.0)
7370
selinux_policy (2.4.3)
74-
sudo (2.9.0)
71+
sudo (5.4.6)
7572
ufw (3.2.1)
7673
firewall (>= 2.0)
7774
ulimit (1.1.1)

‎Changelog.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## 5.0.1 (22nd March 2021)
2+
* Upgrades sudo, ufw, apt and fail2ban cookbooks to latest versions
3+
* Fixes issue where sshd configuration wasn't in the default server role run list
4+
* Adds a wrapper cookbook for the current community sudo cookbook
5+
*
6+
17
## 5.0.0 (March 2021)
28

39
* Updates to support latest Chef Workstation instead of legacy ChefDK

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5.0.0
1+
5.0.1

‎roles/server.json

+6-5
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@
1212
"${distro_id} stable",
1313
"${distro_id} ${distro_codename}-security"
1414
],
15-
"automatic_reboot" : true
15+
"automatic_reboot" : true,
16+
"auto_fix_interrupted_dpkg" : true
1617
}
1718
},
1819
"authorization": {
@@ -51,14 +52,14 @@
5152
"json_class": "Chef::Role",
5253
"run_list": [
5354
"recipe[apt::default]",
54-
"recipe[rdr_users_wrapper::default]",
55-
"recipe[firewall::default]",
5655
"recipe[ufw::default]",
56+
"recipe[openssh::default]",
57+
"recipe[fail2ban::default]",
58+
"recipe[rdr_sudo_wrapper::default]",
59+
"recipe[rdr_users_wrapper::default]",
5760
"recipe[apt::unattended-upgrades]",
5861
"recipe[ntp::default]",
59-
"recipe[sudo::default]",
6062
"recipe[locale::default]",
61-
"recipe[fail2ban::default]",
6263
"recipe[monit-tlq::default]",
6364
"recipe[monit_configs-tlq::system]"
6465
],

‎site-cookbooks/rdr_sudo_wrapper/.delivery/project.toml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Delivery for Local Phases Execution
2+
#
3+
# This file allows you to execute test phases locally on a workstation or
4+
# in a CI pipeline. The delivery-cli will read this file and execute the
5+
# command(s) that are configured for each phase. You can customize them
6+
# by just modifying the phase key on this file.
7+
#
8+
# By default these phases are configured for Cookbook Workflow only
9+
#
10+
11+
[local_phases]
12+
unit = "chef exec rspec spec/"
13+
lint = "chef exec cookstyle"
14+
# foodcritic has been deprecated in favor of cookstyle so we skip the syntax
15+
# phase now.
16+
syntax = "echo skipping syntax phase. Use lint phase instead."
17+
provision = "chef exec kitchen create"
18+
deploy = "chef exec kitchen converge"
19+
smoke = "chef exec kitchen verify"
20+
# The functional phase is optional, you can define it by uncommenting
21+
# the line below and running the command: `delivery local functional`
22+
# functional = ""
23+
cleanup = "chef exec kitchen destroy"
24+
25+
# Remote project.toml file
26+
#
27+
# Instead of the local phases above, you may specify a remote URI location for
28+
# the `project.toml` file. This is useful for teams that wish to centrally
29+
# manage the behavior of the `delivery local` command across many different
30+
# projects.
31+
#
32+
# remote_file = "https://url/project.toml"

‎site-cookbooks/rdr_sudo_wrapper/.gitignore

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
.vagrant
2+
*~
3+
*#
4+
.#*
5+
\#*#
6+
.*.sw[a-z]
7+
*.un~
8+
9+
# Bundler
10+
Gemfile.lock
11+
gems.locked
12+
bin/*
13+
.bundle/*
14+
15+
# test kitchen
16+
.kitchen/
17+
kitchen.local.yml
18+
19+
# Chef Infra
20+
Berksfile.lock
21+
.zero-knife.rb
22+
Policyfile.lock.json
23+
24+
.idea/
25+

‎site-cookbooks/rdr_sudo_wrapper/CHANGELOG.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# rdr_sudo_wrapper CHANGELOG
2+
3+
This file is used to list changes made in each version of the rdr_sudo_wrapper cookbook.
4+
5+
## 0.1.0
6+
7+
Initial release.
8+
9+
- change 0
10+
- change 1

‎site-cookbooks/rdr_sudo_wrapper/LICENSE

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Copyright 2021 The Authors
2+
3+
All rights reserved, do not redistribute.

‎site-cookbooks/rdr_sudo_wrapper/Policyfile.rb

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Policyfile.rb - Describe how you want Chef Infra Client to build your system.
2+
#
3+
# For more information on the Policyfile feature, visit
4+
# https://docs.chef.io/policyfile/
5+
6+
# A name that describes what the system you're building with Chef does.
7+
name 'rdr_sudo_wrapper'
8+
9+
# Where to find external cookbooks:
10+
default_source :supermarket
11+
12+
# run_list: chef-client will run these recipes in the order specified.
13+
run_list 'rdr_sudo_wrapper::default'
14+
15+
# Specify a custom source for a single cookbook:
16+
cookbook 'rdr_sudo_wrapper', path: '.'

‎site-cookbooks/rdr_sudo_wrapper/README.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# rdr_sudo_wrapper
2+
3+
TODO: Enter the cookbook description here.
4+

‎site-cookbooks/rdr_sudo_wrapper/chefignore

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Put files/directories that should be ignored in this file when uploading
2+
# to a Chef Infra Server or Supermarket.
3+
# Lines that start with '# ' are comments.
4+
5+
# OS generated files #
6+
######################
7+
.DS_Store
8+
ehthumbs.db
9+
Icon?
10+
nohup.out
11+
Thumbs.db
12+
.envrc
13+
14+
# EDITORS #
15+
###########
16+
.#*
17+
.project
18+
.settings
19+
*_flymake
20+
*_flymake.*
21+
*.bak
22+
*.sw[a-z]
23+
*.tmproj
24+
*~
25+
\#*
26+
REVISION
27+
TAGS*
28+
tmtags
29+
.vscode
30+
.editorconfig
31+
32+
## COMPILED ##
33+
##############
34+
*.class
35+
*.com
36+
*.dll
37+
*.exe
38+
*.o
39+
*.pyc
40+
*.so
41+
*/rdoc/
42+
a.out
43+
mkmf.log
44+
45+
# Testing #
46+
###########
47+
.circleci/*
48+
.codeclimate.yml
49+
.delivery/*
50+
.foodcritic
51+
.kitchen*
52+
.mdlrc
53+
.overcommit.yml
54+
.rspec
55+
.rubocop.yml
56+
.travis.yml
57+
.watchr
58+
.yamllint
59+
azure-pipelines.yml
60+
Dangerfile
61+
examples/*
62+
features/*
63+
Guardfile
64+
kitchen.yml*
65+
mlc_config.json
66+
Procfile
67+
Rakefile
68+
spec/*
69+
test/*
70+
71+
# SCM #
72+
#######
73+
.git
74+
.gitattributes
75+
.gitconfig
76+
.github/*
77+
.gitignore
78+
.gitkeep
79+
.gitmodules
80+
.svn
81+
*/.bzr/*
82+
*/.git
83+
*/.hg/*
84+
*/.svn/*
85+
86+
# Berkshelf #
87+
#############
88+
Berksfile
89+
Berksfile.lock
90+
cookbooks/*
91+
tmp
92+
93+
# Bundler #
94+
###########
95+
vendor/*
96+
Gemfile
97+
Gemfile.lock
98+
99+
# Policyfile #
100+
##############
101+
Policyfile.rb
102+
Policyfile.lock.json
103+
104+
# Documentation #
105+
#############
106+
CODE_OF_CONDUCT*
107+
CONTRIBUTING*
108+
documentation/*
109+
TESTING*
110+
UPGRADING*
111+
112+
# Vagrant #
113+
###########
114+
.vagrant
115+
Vagrantfile

‎site-cookbooks/rdr_sudo_wrapper/kitchen.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
driver:
3+
name: vagrant
4+
5+
## The forwarded_port port feature lets you connect to ports on the VM guest via
6+
## localhost on the host.
7+
## see also: https://www.vagrantup.com/docs/networking/forwarded_ports
8+
9+
# network:
10+
# - ["forwarded_port", {guest: 80, host: 8080}]
11+
12+
provisioner:
13+
name: chef_zero
14+
15+
## product_name and product_version specifies a specific Chef product and version to install.
16+
## see the Chef documentation for more details: https://docs.chef.io/workstation/config_yml_kitchen/
17+
# product_name: chef
18+
# product_version: 16
19+
20+
verifier:
21+
name: inspec
22+
23+
platforms:
24+
- name: ubuntu-20.04
25+
- name: centos-8
26+
27+
suites:
28+
- name: default
29+
verifier:
30+
inspec_tests:
31+
- test/integration/default
32+
attributes:

0 commit comments

Comments
 (0)