diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index 8915719..baab0e2 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -1,6 +1,6 @@ --- - name: CheckMK Agent - hosts: "meta-win_project_{{ win_project }}" + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" collections: - checkmk.general vars_files: @@ -16,7 +16,7 @@ - checkmk_agent - name: CheckMK Hosts - hosts: "meta-win_project_{{ win_project }}" + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" gather_facts: false vars_files: - ../vars/checkmk.yml diff --git a/ansible/playbooks/openstack-vms.yml b/ansible/playbooks/openstack-vms.yml index 7a67140..c02e9e6 100644 --- a/ansible/playbooks/openstack-vms.yml +++ b/ansible/playbooks/openstack-vms.yml @@ -280,7 +280,7 @@ - name: Create proxy tags: teardown os_server: - name: "{{ os_project }}-proxy" + name: "{{ os_project }}-{{ win_project }}-proxy" state: "{{ state }}" image: "{{ proxy_image }}" flavor: 3661211f-673a-4777-8857-fd243d6c407d diff --git a/ansible/playbooks/wazuh.yml b/ansible/playbooks/wazuh.yml index 2ae618e..08c3a03 100644 --- a/ansible/playbooks/wazuh.yml +++ b/ansible/playbooks/wazuh.yml @@ -1,6 +1,6 @@ --- - name: Wazuh Agent - hosts: "meta-win_project_{{ win_project }}" # will need fixed when proxy is added (linux) + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" gather_facts: false vars_files: - ../vars/common.yml @@ -17,12 +17,31 @@ - wazuh_agent block: - name: Download agent - win_shell: 'Invoke-WebRequest -Uri "{{ wazuh_url }}/{{ wazuh_msi }}" -OutFile "$env:temp\{{ wazuh_msi }}"' - register: download_result + win_get_url: + url: "{{ wazuh_url }}/{{ wazuh_msi }}" + dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + when: | + inventory_hostname not in groups['meta-type_client'] or + project_zone == 'standard' + + - name: Download agent using proxy + vars: + proxy_ip: "{{ os_project }}-{{ win_project }}-proxy" + win_get_url: + url: "{{ wazuh_url }}/{{ wazuh_msi }}" + dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + when: | + inventory_hostname in groups['meta-type_client'] and + project_zone == 'protected' - name: Install agent - win_shell: 'msiexec.exe /i $env:temp\{{ wazuh_msi }} /q WAZUH_MANAGER="{{ wazuh_server }}" WAZUH_REGISTRATION_SERVER="{{ wazuh_server }}"' - when: download_result.rc == 0 + win_package: + path: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + arguments: + - /q + - WAZUH_MANAGER={{ wazuh_server }} + - WAZUH_REGISTRATION_SERVER={{ wazuh_server }} + state: present - name: Start Service win_service: diff --git a/ansible/playbooks/win_proxy.yml b/ansible/playbooks/win_proxy.yml new file mode 100644 index 0000000..55e5967 --- /dev/null +++ b/ansible/playbooks/win_proxy.yml @@ -0,0 +1,13 @@ +--- + +- hosts: "meta-variant_web_proxy" + vars: + ansible_ssh_private_key_file: /etc/ansible/keys/proxy.key + ansible_user: ubuntu + vars_files: + - ../vars/common.yml + roles: + - role: win_proxy + become: yes + tags: win_proxy + when: project_zone == 'protected' \ No newline at end of file diff --git a/ansible/roles/win_initial/tasks/initial.yml b/ansible/roles/win_initial/tasks/initial.yml index 1da8feb..8720adb 100644 --- a/ansible/roles/win_initial/tasks/initial.yml +++ b/ansible/roles/win_initial/tasks/initial.yml @@ -9,7 +9,7 @@ set_fact: ansible_password: "{{ vm_initial_password }}" run_once: true - when: password_status == 'pending'or + when: password_status == 'pending' or password_status == 'change' - name: Check for finished or change password status @@ -27,6 +27,18 @@ start_mode: delayed tags: winrm_delayed +- name: Set a proxy + vars: + proxy_ip: "{{ os_project }}-{{ win_project }}-proxy" + tags: proxy + win_inet_proxy: + proxy: "{{ hostvars[proxy_ip].ansible_host }}:3128" + bypass: + - + when: | + inventory_hostname in groups['meta-type_client'] and + project_zone == 'protected' + - name: Remove Local Admin tags: remove_admin block: diff --git a/ansible/roles/win_proxy/defaults/main.yml b/ansible/roles/win_proxy/defaults/main.yml new file mode 100644 index 0000000..8b45208 --- /dev/null +++ b/ansible/roles/win_proxy/defaults/main.yml @@ -0,0 +1,11 @@ +--- +# defaults file for squid + +# The port squid is listening on. +squid_port: 3128 + +# The directory where (and how) to cache. +squid_cache_dir: ufs /var/spool/squid 100 16 256 + +# Location of squid's log file +squid_access_log: /var/log/squid/access.log \ No newline at end of file diff --git a/ansible/roles/win_proxy/handlers/main.yml b/ansible/roles/win_proxy/handlers/main.yml new file mode 100644 index 0000000..4cc7bbe --- /dev/null +++ b/ansible/roles/win_proxy/handlers/main.yml @@ -0,0 +1,6 @@ +--- + +- name: Restart squid + ansible.builtin.service: + name: "{{ squid_service }}" + state: restarted \ No newline at end of file diff --git a/ansible/roles/win_proxy/tasks/assert.yml b/ansible/roles/win_proxy/tasks/assert.yml new file mode 100644 index 0000000..e02a4b7 --- /dev/null +++ b/ansible/roles/win_proxy/tasks/assert.yml @@ -0,0 +1,93 @@ +--- + +- name: assert | Test squid_port + ansible.builtin.assert: + that: + - squid_port is defined + - squid_port is number + - squid_port > 0 + - squid_port < 65536 + quiet: true + +- name: assert | Test squid_cache_dir + ansible.builtin.assert: + that: + - squid_cache_dir is defined + - squid_cache_dir is string + - squid_cache_dir.split(" ")[0] in [ "ufs", "aufs", "diskd", "rock", "null" ] + quiet: true + +- name: assert | Test squid_acls + ansible.builtin.assert: + that: + - squid_acls is iterable + quiet: true + when: + - squid_acls is defined + +- name: assert | Test item in squid_acls + ansible.builtin.assert: + that: + - item.name is defined + - item.name is string + - item.name is not none + - item.classifier is defined + - item.classifier is string + - item.classifier is not none + - item.value is defined + - item.value is string + - item.value is not none + quiet: true + loop: "{{ squid_acls }}" + loop_control: + label: "{{ item.name }}" + when: + - squid_acls is defined + +- name: assert | Test item in squid_http_access + ansible.builtin.assert: + that: + - item.state is defined + - item.state is string + - item.state is not none + - item.acls is defined + - item.acls is iterable + quiet: true + loop: "{{ squid_http_access }}" + loop_control: + label: "{{ item.state }}" + when: + - squid_http_access is defined + +- name: assert | Test squid_rules + ansible.builtin.assert: + that: + - squid_rules is iterable + quiet: true + when: + - squid_rules is defined + +- name: assert | Test item in squid_rules + ansible.builtin.assert: + that: + - item.acl is defined + - item.acl is string + - item.acl is not none + - item.decision is defined + - item.decision is string + - item.decision in [ "allow", "deny" ] + quiet: true + loop: "{{ squid_rules }}" + loop_control: + label: "{{ item.acl }}" + when: + - squid_rules is defined + +- name: assert | Test squid_logformat + ansible.builtin.assert: + that: + - squid_logformat is string + - squid_logformat.split(" ") | length > 1 + quiet: true + when: + - squid_logformat is defined diff --git a/ansible/roles/win_proxy/tasks/main.yml b/ansible/roles/win_proxy/tasks/main.yml new file mode 100644 index 0000000..010fc17 --- /dev/null +++ b/ansible/roles/win_proxy/tasks/main.yml @@ -0,0 +1,60 @@ +--- + +- name: Import assert.yml + import_tasks: + file: assert.yml + run_once: true + delegate_to: localhost + +- name: Create group + ansible.builtin.group: + name: "{{ squid_group }}" + system: true + state: present + +- name: Create user + ansible.builtin.user: + name: "{{ squid_user }}" + group: "{{ squid_group }}" + create_home: false + state: present + home: /var/spool/squid + shell: /sbin/nologin + system: true + +- name: Install squid + ansible.builtin.package: + name: "{{ squid_packages }}" + state: present + update_cache: true + +- name: Include variables + include_vars: rules.yml + +- name: Configure squid + ansible.builtin.template: + src: "{{ squid_config_file }}.j2" + dest: "{{ squid_config_directory }}/{{ squid_config_file }}" + mode: "0644" + validate: squid -k parse -f %s + notify: + - Restart squid + +- name: Create cache directory + ansible.builtin.file: + path: /var/spool/squid + state: directory + owner: "{{ squid_user }}" + group: "{{ squid_group }}" + mode: "0750" + +- name: Flush_handlers + ansible.builtin.meta: flush_handlers + +- name: Start and enable squid + ansible.builtin.service: + name: "{{ squid_service }}" + state: started + enabled: true + when: + - not ansible_check_mode \ No newline at end of file diff --git a/ansible/roles/win_proxy/templates/squid.conf.j2 b/ansible/roles/win_proxy/templates/squid.conf.j2 new file mode 100644 index 0000000..28a0083 --- /dev/null +++ b/ansible/roles/win_proxy/templates/squid.conf.j2 @@ -0,0 +1,49 @@ +{{ ansible_managed | comment }} + +http_port {{ squid_port }} + +cache_effective_user {{ squid_user }} +cache_effective_group {{ squid_group }} + +{% if squid_acls is defined %} +{% for acl in squid_acls %} +acl {{ acl.name }} {{ acl.classifier }} {{ acl.value }} +{% endfor %} +{% endif %} + +{% if squid_rules is defined %} +{% for rule in squid_rules %} +http_access {{ rule.decision }} {{ rule.acl }} +{% endfor %} +{% endif %} + +{% if squid_http_access is defined %} +{% for http_access in squid_http_access %} +http_access {{ http_access.state }} {{ http_access.acls | join(' ') }} +{% endfor %} +{% endif %} + +cache_dir {{ squid_cache_dir }} + +coredump_dir /var/spool/squid + +refresh_pattern ^ftp: 1440 20% 10080 +refresh_pattern ^gopher: 1440 0% 1440 +refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 +refresh_pattern . 0 20% 4320 + +{% if squid_cache_replacement_policy is defined %} +cache_replacement_policy {{ squid_cache_replacement_policy }} +{% endif %} + +{% if squid_maximum_object_size_mb is defined %} +maximum_object_size {{ squid_maximum_object_size_mb }} MB +{% endif %} + +{% if squid_logformat is defined %} +logformat {{ squid_logformat }} +{% endif %} + +{% if squid_access_log is defined %} +access_log {{ squid_access_log }} +{% endif %} \ No newline at end of file diff --git a/ansible/roles/win_proxy/vars/main.yml b/ansible/roles/win_proxy/vars/main.yml new file mode 100644 index 0000000..1162790 --- /dev/null +++ b/ansible/roles/win_proxy/vars/main.yml @@ -0,0 +1,22 @@ +--- + +squid_packages: + - squid + +_squid_user: + default: squid + Debian: proxy + +squid_user: "{{ _squid_user[ansible_os_family] | default(_squid_user['default']) }}" + +_squid_group: + default: squid + Debian: proxy + +squid_group: "{{ _squid_group[ansible_os_family] | default(_squid_group['default']) }}" + +squid_config_directory: /etc/squid + +squid_config_file: squid.conf + +squid_service: squid \ No newline at end of file diff --git a/ansible/roles/win_proxy/vars/rules.yml b/ansible/roles/win_proxy/vars/rules.yml new file mode 100644 index 0000000..751c1fd --- /dev/null +++ b/ansible/roles/win_proxy/vars/rules.yml @@ -0,0 +1,14 @@ +squid_acls: + - name: os_external + classifier: src + value: "10.24.0.0/16" + +squid_rules: + - acl: to_localhost + decision: deny + - acl: os_external + decision: allow + - acl: localhost + decision: allow + - acl: all + decision: deny \ No newline at end of file diff --git a/ansible/roles/win_transfer/tasks/unmount.yml b/ansible/roles/win_transfer/tasks/unmount.yml index 70c6e57..f98904f 100644 --- a/ansible/roles/win_transfer/tasks/unmount.yml +++ b/ansible/roles/win_transfer/tasks/unmount.yml @@ -9,8 +9,6 @@ opts: "credentials={{ credentials_path }},iocharset=utf8" state: absent fstype: cifs - register: mount_status - failed_when: mount_status.changed == false - name: Remove smb-credential template file: