[PATCH aeolus-configure] BZ 806001 aeolus-configure will always create an admin user, need to key of a uuid not name

This patch series moves us away from using admin/password for web requests, and instead we create/destroy a temporary aeolus user with administrative privileges for each puppet run. We also make a separate, optional profile, admin_configure, which can be used to create an aeolus user with administrative privileges. Note that this makes the default profile now set up no 'admin' user by default, addressing the re-creation of un/pw admin/password which was the root of the bug in BZ806001. --- conf/admin_configure | 10 ++++ .../lib/puppet/parser/functions/secure_random.rb | 15 +++++ recipes/aeolus/manifests/conductor.pp | 55 +++++++++++++++----- recipes/aeolus/manifests/profiles/default.pp | 25 ++++++--- recipes/aeolus/manifests/profiles/ec2.pp | 47 +++++++++++------ recipes/aeolus/manifests/profiles/mock.pp | 36 +++++++++---- recipes/aeolus/manifests/profiles/rhevm.pp | 29 +++++++---- .../aeolus/manifests/profiles/rhevm/instance.pp | 3 +- recipes/aeolus/manifests/profiles/vsphere.pp | 28 ++++++---- .../aeolus/manifests/profiles/vsphere/instance.pp | 3 +- 10 files changed, 178 insertions(+), 73 deletions(-) create mode 100644 conf/admin_configure create mode 100644 recipes/aeolus/lib/puppet/parser/functions/secure_random.rb diff --git a/conf/admin_configure b/conf/admin_configure new file mode 100644 index 0000000..00182c7 --- /dev/null +++ b/conf/admin_configure @@ -0,0 +1,10 @@ +parameters: + enable_https: true + admin_login: admin + admin_password: password + admin_email: root(a)localhost.localdomain + admin_first_name: Administrator + admin_last_name: "" +classes: +- aeolus::conductor +- aeolus::conductor::default_admin diff --git a/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb new file mode 100644 index 0000000..9ea7ce2 --- /dev/null +++ b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb @@ -0,0 +1,15 @@ +require 'securerandom' + +Puppet::Parser::Functions::newfunction(:secure_random, + :type => :rvalue, + :doc => <<ENDDOC +Return SecureRandom.hex using the first parameter as the +number of bytes desired, or 24 bytes by default. +ENDDOC +) do |args| + if !args[0].nil? && (args[0].responds_to to_i) + SecureRandom.hex(args[0]) + else + SecureRandom.hex(24) + end +end diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp index 786c658..670eb58 100644 --- a/recipes/aeolus/manifests/conductor.pp +++ b/recipes/aeolus/manifests/conductor.pp @@ -180,23 +180,50 @@ class aeolus::conductor::disabled { } # Create a new site admin conductor web user -define aeolus::conductor::site_admin($email="", $password="", $first_name="", $last_name=""){ +class aeolus::conductor::default_admin { exec{"create_site_admin_user": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production", - command => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]", + command => "/usr/bin/rake dc:create_user[${admin_login},${admin_password},${admin_email},${admin_first_name},${admin_last_name}]", logoutput => true, - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"", + unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from roles, permissions, users where roles.id = permissions.role_id and users.id = permissions.user_id and roles.name = 'base.admin' and users.login = '${admin_login}'\"` = \"1\"", require => Rails::Seed::Db["seed_aeolus_database"]} exec{"grant_site_admin_privs": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production", - command => "/usr/bin/rake dc:site_admin[${name}]", + command => "/usr/bin/rake dc:site_admin[${admin_login}]", logoutput => true, - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';\"` = \"1\"", + unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${admin_login}';\"` = \"1\"", require => Exec[create_site_admin_user]} } +define aeolus::conductor::temp_admin($password=""){ + exec{"create_temp_admin": + cwd => '/usr/share/aeolus-conductor', + environment => "RAILS_ENV=production", + command => "/usr/bin/rake dc:create_user[${name},${password},'temp-admin@localhost.localdomain','temp','admin']", + logoutput => true, + require => Rails::Seed::Db["seed_aeolus_database"]} + exec{"grant_temp_admin_privs": + cwd => '/usr/share/aeolus-conductor', + environment => "RAILS_ENV=production", + command => "/usr/bin/rake dc:site_admin[${name}]", + logoutput => true, + require => Exec[create_temp_admin]} + } + + +define aeolus::conductor::destroy_temp_admin{ + exec{"destroy_temp_admin": + cwd => '/usr/share/aeolus-conductor', + environment => "RAILS_ENV=production", + command => "/usr/bin/rake dc:destroy_user[${name}]", + logoutput => true, + require => Rails::Seed::Db["seed_aeolus_database"] + } +} + + # login to the aeolus conductor define aeolus::conductor::login($password){ web_request{ "$name-conductor-login": @@ -231,7 +258,7 @@ define aeolus::conductor::logout(){ } # Create a new provider via the conductor -define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider=""){ +define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider="", $admin_login=""){ web_request{ "provider-$name": post => "https://localhost/conductor/providers", parameters => { 'provider[name]' => $name, 'provider[url]' => $url, @@ -240,17 +267,17 @@ define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_pr returns => '200', follow => true, contains => "//img[@alt='Notices']", # in the case of an error, @alt='Warnings' - use_cookies_at => '/tmp/aeolus-admin', + use_cookies_at => "/tmp/aeolus-${admin_login}", log_to => '/tmp/configure-provider-request.log', only_log_errors => true, unless => { 'get' => 'https://localhost/conductor/providers', 'contains' => "//html/body//a[text() = '$name']" }, - require => [Service['aeolus-conductor'], Exec['grant_site_admin_privs'], Exec['deltacloud-core-startup-wait']] + require => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs'], Exec['deltacloud-core-startup-wait']] } } # Create a new provider account via the conductor -define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public=""){ +define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public="", $admin_login=""){ if $type != "ec2" { web_request{ "provider-account-$name": post => "https://localhost/conductor/providers/0/provider_accounts", @@ -264,7 +291,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" returns => '200', #contains => "//table/thead/tr/th[text() = 'Properties for $name']", follow => true, - use_cookies_at => '/tmp/aeolus-admin', + use_cookies_at => "/tmp/aeolus-${admin_login}", unless => { 'get' => 'https://localhost/conductor/provider_accounts', 'contains' => "//html/body//a[text() = '$name']" }, require => Service['aeolus-conductor']} @@ -285,7 +312,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" returns => '200', #contains => "//table/thead/tr/th[text() = 'Properties for $name']", follow => true, - use_cookies_at => '/tmp/aeolus-admin', + use_cookies_at => "/tmp/aeolus-${admin_login}", unless => { 'get' => 'https://localhost/conductor/provider_accounts', 'contains' => "//html/body//a[text() = '$name']" }, require => Service['aeolus-conductor'] @@ -293,7 +320,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" } } -define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''){ +define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='', $admin_login=''){ web_request{ "hwp-$name": post => "https://localhost/conductor/hardware_profiles", parameters => {'hardware_profile[name]' => $name, @@ -313,7 +340,7 @@ define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='' returns => '200', #verify => '.*Hardware profile added.*', follow => true, - use_cookies_at => '/tmp/aeolus-admin', - require => [Service['aeolus-conductor'], Exec['grant_site_admin_privs']] + use_cookies_at => "/tmp/aeolus-${admin_login}", + require => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs']] } } diff --git a/recipes/aeolus/manifests/profiles/default.pp b/recipes/aeolus/manifests/profiles/default.pp index 5bb3119..47e640d 100644 --- a/recipes/aeolus/manifests/profiles/default.pp +++ b/recipes/aeolus/manifests/profiles/default.pp @@ -14,25 +14,32 @@ class aeolus::profiles::default { + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + aeolus::create_bucket{"aeolus":} - aeolus::conductor::site_admin{"admin": - email => &#39;root(a)localhost.localdomain&#39;, - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password } - aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]} aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } - aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64']} + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} + } diff --git a/recipes/aeolus/manifests/profiles/ec2.pp b/recipes/aeolus/manifests/profiles/ec2.pp index 3f63f70..165a32b 100644 --- a/recipes/aeolus/manifests/profiles/ec2.pp +++ b/recipes/aeolus/manifests/profiles/ec2.pp @@ -15,68 +15,83 @@ class aeolus::profiles::ec2 { include aeolus::deltacloud::ec2 + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + aeolus::create_bucket{"aeolus":} - aeolus::conductor::site_admin{"admin": - email => &#39;root(a)localhost.localdomain&#39;, - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password } - aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]} aeolus::conductor::provider{"ec2-us-east-1": deltacloud_driver => 'ec2', deltacloud_provider => 'us-east-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::provider{"ec2-us-west-1": deltacloud_driver => 'ec2', deltacloud_provider => 'us-west-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::provider{"ec2-us-west-2": deltacloud_driver => 'ec2', deltacloud_provider => 'us-west-2', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::provider{"ec2-eu-west-1": deltacloud_driver => 'ec2', deltacloud_provider => 'eu-west-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::provider{"ec2-ap-southeast-1": deltacloud_driver => 'ec2', deltacloud_provider => 'ap-southeast-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::provider{"ec2-ap-northeast-1": deltacloud_driver => 'ec2', deltacloud_provider => 'ap-northeast-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::provider{"ec2-sa-east-1": deltacloud_driver => 'ec2', deltacloud_provider => 'sa-east-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } Aeolus::Conductor::Provider <| |> -> Aeolus::Conductor::Logout <| |> - aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64'] } + + aeolus::conductor::destroy_temp_admin{$temp_admin_login: + require => Aeolus::Conductor::Logout[$temp_admin_login]} + } diff --git a/recipes/aeolus/manifests/profiles/mock.pp b/recipes/aeolus/manifests/profiles/mock.pp index c68829c..b82a6d4 100644 --- a/recipes/aeolus/manifests/profiles/mock.pp +++ b/recipes/aeolus/manifests/profiles/mock.pp @@ -14,38 +14,50 @@ class aeolus::profiles::mock { + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + aeolus::create_bucket{"aeolus":} - aeolus::conductor::site_admin{"admin": - email => &#39;root(a)localhost.localdomain&#39;, - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password } - aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]} aeolus::conductor::provider{"mock": deltacloud_driver => 'mock', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } + aeolus::conductor::provider::account{"mock": provider => 'mock', type => 'mock', username => 'mockuser', password => 'mockpassword', - require => Aeolus::Conductor::Provider["mock"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Provider["mock"] } aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } - aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login : require => [Aeolus::Conductor::Provider['mock'], Aeolus::Conductor::Provider::Account['mock'], - Aeolus::Conductor::Hwp['small-x86_64']] } + Aeolus::Conductor::Hwp['small-x86_64']] + } + + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} + } diff --git a/recipes/aeolus/manifests/profiles/rhevm.pp b/recipes/aeolus/manifests/profiles/rhevm.pp index 547d7a9..8586944 100644 --- a/recipes/aeolus/manifests/profiles/rhevm.pp +++ b/recipes/aeolus/manifests/profiles/rhevm.pp @@ -13,6 +13,13 @@ # limitations under the License. class aeolus::profiles::rhevm ($instances) { + + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + create_resources2('aeolus::profiles::rhevm::instance', $instances) file {"/etc/imagefactory/rhevm.json": @@ -24,26 +31,28 @@ class aeolus::profiles::rhevm ($instances) { aeolus::create_bucket{"aeolus":} - aeolus::conductor::site_admin{"admin": - email => &#39;root(a)localhost.localdomain&#39;, - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password } - aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]} aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } - aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64']} - Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"] + Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login] + + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} + # TODO: create a realm and mappings } diff --git a/recipes/aeolus/manifests/profiles/rhevm/instance.pp b/recipes/aeolus/manifests/profiles/rhevm/instance.pp index 26ba3e9..195909d 100644 --- a/recipes/aeolus/manifests/profiles/rhevm/instance.pp +++ b/recipes/aeolus/manifests/profiles/rhevm/instance.pp @@ -43,5 +43,6 @@ define aeolus::profiles::rhevm::instance ( $nfs_server, deltacloud_driver => "rhevm", url => "http://localhost:3002/api", deltacloud_provider => "${deltacloud_api};${deltacloud_data_center}", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } } diff --git a/recipes/aeolus/manifests/profiles/vsphere.pp b/recipes/aeolus/manifests/profiles/vsphere.pp index dcca15b..db9955e 100644 --- a/recipes/aeolus/manifests/profiles/vsphere.pp +++ b/recipes/aeolus/manifests/profiles/vsphere.pp @@ -13,6 +13,13 @@ # limitations under the License. class aeolus::profiles::vsphere ($instances) { + + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + create_resources2('aeolus::profiles::vsphere::instance', $instances) aeolus::create_bucket{"aeolus":} @@ -24,24 +31,25 @@ class aeolus::profiles::vsphere ($instances) { mode => 640, require => Package['aeolus-conductor-daemons'] } - aeolus::conductor::site_admin{"admin": - email => &#39;root(a)localhost.localdomain&#39;, - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password } - aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]} aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } - aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64'] } - Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"] + Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login] + + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} } diff --git a/recipes/aeolus/manifests/profiles/vsphere/instance.pp b/recipes/aeolus/manifests/profiles/vsphere/instance.pp index 55ac95f..39a3321 100644 --- a/recipes/aeolus/manifests/profiles/vsphere/instance.pp +++ b/recipes/aeolus/manifests/profiles/vsphere/instance.pp @@ -22,6 +22,7 @@ define aeolus::profiles::vsphere::instance ($deltacloud_provider, deltacloud_driver => "vsphere", url => "http://localhost:3002/api", deltacloud_provider => "$deltacloud_provider", - require => Aeolus::Conductor::Login["admin"], + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login], } } -- 1.7.6.5