Steve Shipway University of Auckland s.shipway@auckland.ac.nz Version 2.0: Dec 2011 Tested with RHEL(5.3,6.2), Ubuntu(Lucid), SecretServer(7.8)

Requires Savon Ruby Gem to be installed on Puppet Master: 'gem install savon' This probably means you need RHEL6 since RHEL6 Ruby did not support gems.

Also requires the secretserver.rb module file to be installed in /usr/lib/ruby/site_ruby/1.8/secretserver.rb

PARAMETERS

Set these in the init.pp file

$ss_hostname = 'secretserver.auckland.ac.nz' $ss_username = 'puppet' $ss_password = 'mypassword' $ss_folder = 'Drop-box'

PASSWORD CLASS

Change password if older than 30 days, updating secret server (thycotic.com) database to reflect changes.

Allows you to have regularly rotating passwords, stored centrally and audited, but with noone actually knowing what they are.

This will also change and update if password is not yet defined on SecretSvr It will NOT verify that SS record contains the correct password though as this is not necessarily possible with various backends

Only users with UID<500 are checked; to change this, edit the facter module to set facts for ALL users. (see comments at start of lib/facter/password.rb ) Note that ubuntu/debian people may wish to make this threshold <1000 instead.

Facter should set facts: pwage_(.*) for all accounts <500

To use: ss::password { 'root': } ss::password { 'oracle': maxage=>60, folder=>'Oracle Passwords' }

Attributes: maxage: number of days old a password must be before it gets auto changed default is 30 folder: which SecretServer folder to place the secret into, if not the default username: (namevar) username to set password for minchange: minimum number of days before password can be changed by user default is 0 (may not be supported by your unix)

SecretServer: The new password secure is of type 'Unix Account (SSH)' The secret name is $username@$fqdn

Assumptions:

1. The specified user exists as a Local user with no 2FA rules
2. The specified folder exists, is writeable, and defaults to appropriate sharing rules
3. All passwords for servers are shared with the puppet user
4. All newly created passwords will be with 'Unix Account (SSH)' template
5. Passwords can be changed via /usr/sbin/chpasswd (install this if it is not present). This works for ubuntu, debian, redhat, centos, fedora, and solaris (if chpasswd is installed from sunfreeware)
6. Password ages are in /etc/shadow in standard format (OK for redhat, centos, fedora, ubuntu, debian, solaris)
7. Secretserver v7.x API available

Bugs:

1. No way to detect noop mode from functions, so secretserver will be updated even though the password is not changed on the client.

SSL CERTIFICATE CLASS

This will synchronise certificate/key files on the client with the certificate and key data held in SecretServer.

It will optionally restart Apache after making changes.

Allows you to have certificates stored centrally, and multiple servers using the same certificate automatically updated together by puppet.

Should also work with Windows if you have service=>false and specify a windows file location with key=> and crt=>, though this is not tested.

To use: ss::cert { 'www.auckland.ac.nz': } ss::cert { $fqdn: service=>false; }

Attributes: key, crt: Specify alternate locations for the files. Default is to put them into /etc/httpd/conf/$name.crt and /etc/httpd/conf/$name.key service: set to false if you dont want it to restart httpd if cert changes ss: set to false if you want it to pull from a file instead of secretserver

SecretServer: The certificates MUST be stored in an object with a Certificate template. The secret name MUST correspond exactly to the namevar.

Assumptions:

1. The puppet master must have read access to the certificate secret
2. The files are stored in the correct format. No conversion or validation is performed.
3. SecretServer API 7.6 or later available

Bugs:

1. If you have service=>true (the default) then the definition of the httpd service may conflict with something you subsequently define elsewhere.