From 0daba28196acc5fdded5cd26c1968aebcfad693e Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 11 Jun 2024 13:33:50 +0100 Subject: [PATCH 01/10] Only target windows VMs --- ansible/playbooks/checkmk.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index 8915719..baab0e2 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -1,6 +1,6 @@ --- - name: CheckMK Agent - hosts: "meta-win_project_{{ win_project }}" + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" collections: - checkmk.general vars_files: @@ -16,7 +16,7 @@ - checkmk_agent - name: CheckMK Hosts - hosts: "meta-win_project_{{ win_project }}" + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" gather_facts: false vars_files: - ../vars/checkmk.yml From 09184e7f80b2a430269a1ae76025302bfac36e1a Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 11 Jun 2024 13:37:45 +0100 Subject: [PATCH 02/10] fix proxy VM name --- ansible/playbooks/openstack-vms.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/playbooks/openstack-vms.yml b/ansible/playbooks/openstack-vms.yml index d3ce689..7cdc108 100644 --- a/ansible/playbooks/openstack-vms.yml +++ b/ansible/playbooks/openstack-vms.yml @@ -325,7 +325,7 @@ - name: Create proxy tags: teardown os_server: - name: "{{ os_project }}-proxy" + name: "{{ os_project }}-{{ win_project }}-proxy" state: "{{ state }}" image: "{{ proxy_image }}" flavor: 3661211f-673a-4777-8857-fd243d6c407d From a70771a609fdc2b5845667e5ba4d79d6d150cea2 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 12 Jun 2024 13:39:50 +0100 Subject: [PATCH 03/10] only try to create share on fs01 --- ansible/roles/win_fileserver/tasks/share.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ansible/roles/win_fileserver/tasks/share.yml b/ansible/roles/win_fileserver/tasks/share.yml index c1ac6ae..d9c18a6 100644 --- a/ansible/roles/win_fileserver/tasks/share.yml +++ b/ansible/roles/win_fileserver/tasks/share.yml @@ -3,19 +3,21 @@ tags: create_shares block: - name: "Create study data share" + tags: studydata_share win_share: name: "{{ studydata_volume_label }}" description: "{{ studydata_volume_label }} Drive" path: "{{ studydata_drive_letter }}:\\" list: no full: Administrators,Administrator,Everyone - tags: studydata_share - name: "Create File Transfer share" + tags: filetransfer_share win_share: name: "{{ filetransfer_volume_label }}" description: "File Transfer Script shared drive" path: "{{ filetransfer_drive_letter }}:\\" list: no full: Administrator@{{ win_project }}.loc,file-transfer - tags: filetransfer_share \ No newline at end of file + when: inventory_hostname in groups['meta-name_fs01'] + \ No newline at end of file From 5f4a9cb2ebcff299a2ab70ef3bfffcb7c8a4cabc Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 12 Jun 2024 16:13:20 +0100 Subject: [PATCH 04/10] enable access based enumeration for DFS --- ansible/roles/win_dfs/tasks/configure.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/roles/win_dfs/tasks/configure.yml b/ansible/roles/win_dfs/tasks/configure.yml index eea843e..f71b919 100644 --- a/ansible/roles/win_dfs/tasks/configure.yml +++ b/ansible/roles/win_dfs/tasks/configure.yml @@ -6,6 +6,7 @@ win_dsc: resource_name: xDFSNamespaceRoot Ensure: Present + EnableAccessBasedEnumeration: True Path: \\{{ win_project }}.loc\Study_Data TargetPath: \\{{ win_project }}-fs01\Study_Data_DFS Type: DomainV2 From 9b3a26ad6101d9487c7d1fddd1497a458c95fe5e Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 14 Jun 2024 11:24:39 +0100 Subject: [PATCH 05/10] Create all common VMs in 1 loop --- ansible/playbooks/openstack-vms.yml | 51 ++--------------------------- ansible/vars/common.yml | 3 +- 2 files changed, 4 insertions(+), 50 deletions(-) diff --git a/ansible/playbooks/openstack-vms.yml b/ansible/playbooks/openstack-vms.yml index 7cdc108..c02e9e6 100644 --- a/ansible/playbooks/openstack-vms.yml +++ b/ansible/playbooks/openstack-vms.yml @@ -234,7 +234,7 @@ - name: Common VMs block: - - name: Create Common VMs (DCs, Fileservers, WSUS, Chocolatey) + - name: Create Common VMs tags: teardown os_server: name: "{{ item.name }}" @@ -261,7 +261,7 @@ $admin = [adsi]("WinNT://./Administrator, user") $admin.PSBase.Invoke("SetPassword", "{{ vm_initial_password }}") Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible-documentation/devel/examples/scripts/ConfigureRemotingForAnsible.ps1')) - loop: "{{ standard_vms1 }}" + loop: "{{ standard_vms }}" async: 900 poll: 0 @@ -273,52 +273,7 @@ type: server vm_state: active register: common_status - until: 'common_status.servers|length == 3' - retries: 100 - delay: 60 - - - name: Common VMs - block: - - name: Create Common VMs (DCs, Fileservers, WSUS, Chocolatey) - tags: teardown - os_server: - name: "{{ item.name }}" - state: "{{ state }}" - image: "{{ vm_image }}" - flavor: 3661211f-673a-4777-8857-fd243d6c407d - timeout: 3600 - boot_from_volume: true - volume_size: 40 - terminate_volume: yes - security_groups: - - domain_member - - "{{ item.security_group }}" - network: "{{ os_network }}" - metadata: - name: "{{ item.meta_name }}" - win_project: "{{ win_project }}" - type: server - variant: "{{ item.security_group }}" # just happens to match maybe change??? - os: windows - userdata: | - #ps1 - Rename-Computer "{{ win_project }}-{{ item.meta_name }}" - $admin = [adsi]("WinNT://./Administrator, user") - $admin.PSBase.Invoke("SetPassword", "{{ vm_initial_password }}") - Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible-documentation/devel/examples/scripts/ConfigureRemotingForAnsible.ps1')) - loop: "{{ standard_vms2 }}" - async: 900 - poll: 0 - - - name: Wait for common VMs to build - os_server_info: - name: "{{ os_project }}-{{ win_project }}-*" - filters: - metadata: - type: server - vm_state: active - register: common_status2 - until: 'common_status2.servers|length == 6' + until: 'common_status.servers|length == 6' retries: 100 delay: 60 diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml index d1314ce..b988f9b 100644 --- a/ansible/vars/common.yml +++ b/ansible/vars/common.yml @@ -17,11 +17,10 @@ gpu_flavor: 3661211f-673a-4777-8857-fd243d6c407d # CHANGE THIS filetransfer_user: file-transfer -standard_vms1: +standard_vms: - { name: "{{ os_project }}-{{ win_project }}-dc01", security_group: "domain_controller", meta_name: dc01 } - { name: "{{ os_project }}-{{ win_project }}-dc02", security_group: "domain_controller", meta_name: dc02 } - { name: "{{ os_project }}-{{ win_project }}-fs01", security_group: "file_server", meta_name: fs01 } -standard_vms2: - { name: "{{ os_project }}-{{ win_project }}-fs02", security_group: "file_server", meta_name: fs02 } - { name: "{{ os_project }}-{{ win_project }}-wsus", security_group: "wsus_server", meta_name: wsus } - { name: "{{ os_project }}-{{ win_project }}-choc", security_group: "chocolatey_server", meta_name: choc } From 9fc4d3d16eac4f7b56515b539da454ca1c4cdda7 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 18 Jun 2024 10:13:51 +0100 Subject: [PATCH 06/10] setup proxy VM --- ansible/playbooks/win_proxy.yml | 13 +++ ansible/roles/win_proxy/defaults/main.yml | 11 +++ ansible/roles/win_proxy/handlers/main.yml | 6 ++ ansible/roles/win_proxy/tasks/assert.yml | 93 +++++++++++++++++++ ansible/roles/win_proxy/tasks/main.yml | 60 ++++++++++++ .../roles/win_proxy/templates/squid.conf.j2 | 49 ++++++++++ ansible/roles/win_proxy/vars/main.yml | 22 +++++ ansible/roles/win_proxy/vars/rules.yml | 14 +++ 8 files changed, 268 insertions(+) create mode 100644 ansible/playbooks/win_proxy.yml create mode 100644 ansible/roles/win_proxy/defaults/main.yml create mode 100644 ansible/roles/win_proxy/handlers/main.yml create mode 100644 ansible/roles/win_proxy/tasks/assert.yml create mode 100644 ansible/roles/win_proxy/tasks/main.yml create mode 100644 ansible/roles/win_proxy/templates/squid.conf.j2 create mode 100644 ansible/roles/win_proxy/vars/main.yml create mode 100644 ansible/roles/win_proxy/vars/rules.yml diff --git a/ansible/playbooks/win_proxy.yml b/ansible/playbooks/win_proxy.yml new file mode 100644 index 0000000..55e5967 --- /dev/null +++ b/ansible/playbooks/win_proxy.yml @@ -0,0 +1,13 @@ +--- + +- hosts: "meta-variant_web_proxy" + vars: + ansible_ssh_private_key_file: /etc/ansible/keys/proxy.key + ansible_user: ubuntu + vars_files: + - ../vars/common.yml + roles: + - role: win_proxy + become: yes + tags: win_proxy + when: project_zone == 'protected' \ No newline at end of file diff --git a/ansible/roles/win_proxy/defaults/main.yml b/ansible/roles/win_proxy/defaults/main.yml new file mode 100644 index 0000000..8b45208 --- /dev/null +++ b/ansible/roles/win_proxy/defaults/main.yml @@ -0,0 +1,11 @@ +--- +# defaults file for squid + +# The port squid is listening on. +squid_port: 3128 + +# The directory where (and how) to cache. +squid_cache_dir: ufs /var/spool/squid 100 16 256 + +# Location of squid's log file +squid_access_log: /var/log/squid/access.log \ No newline at end of file diff --git a/ansible/roles/win_proxy/handlers/main.yml b/ansible/roles/win_proxy/handlers/main.yml new file mode 100644 index 0000000..4cc7bbe --- /dev/null +++ b/ansible/roles/win_proxy/handlers/main.yml @@ -0,0 +1,6 @@ +--- + +- name: Restart squid + ansible.builtin.service: + name: "{{ squid_service }}" + state: restarted \ No newline at end of file diff --git a/ansible/roles/win_proxy/tasks/assert.yml b/ansible/roles/win_proxy/tasks/assert.yml new file mode 100644 index 0000000..e02a4b7 --- /dev/null +++ b/ansible/roles/win_proxy/tasks/assert.yml @@ -0,0 +1,93 @@ +--- + +- name: assert | Test squid_port + ansible.builtin.assert: + that: + - squid_port is defined + - squid_port is number + - squid_port > 0 + - squid_port < 65536 + quiet: true + +- name: assert | Test squid_cache_dir + ansible.builtin.assert: + that: + - squid_cache_dir is defined + - squid_cache_dir is string + - squid_cache_dir.split(" ")[0] in [ "ufs", "aufs", "diskd", "rock", "null" ] + quiet: true + +- name: assert | Test squid_acls + ansible.builtin.assert: + that: + - squid_acls is iterable + quiet: true + when: + - squid_acls is defined + +- name: assert | Test item in squid_acls + ansible.builtin.assert: + that: + - item.name is defined + - item.name is string + - item.name is not none + - item.classifier is defined + - item.classifier is string + - item.classifier is not none + - item.value is defined + - item.value is string + - item.value is not none + quiet: true + loop: "{{ squid_acls }}" + loop_control: + label: "{{ item.name }}" + when: + - squid_acls is defined + +- name: assert | Test item in squid_http_access + ansible.builtin.assert: + that: + - item.state is defined + - item.state is string + - item.state is not none + - item.acls is defined + - item.acls is iterable + quiet: true + loop: "{{ squid_http_access }}" + loop_control: + label: "{{ item.state }}" + when: + - squid_http_access is defined + +- name: assert | Test squid_rules + ansible.builtin.assert: + that: + - squid_rules is iterable + quiet: true + when: + - squid_rules is defined + +- name: assert | Test item in squid_rules + ansible.builtin.assert: + that: + - item.acl is defined + - item.acl is string + - item.acl is not none + - item.decision is defined + - item.decision is string + - item.decision in [ "allow", "deny" ] + quiet: true + loop: "{{ squid_rules }}" + loop_control: + label: "{{ item.acl }}" + when: + - squid_rules is defined + +- name: assert | Test squid_logformat + ansible.builtin.assert: + that: + - squid_logformat is string + - squid_logformat.split(" ") | length > 1 + quiet: true + when: + - squid_logformat is defined diff --git a/ansible/roles/win_proxy/tasks/main.yml b/ansible/roles/win_proxy/tasks/main.yml new file mode 100644 index 0000000..010fc17 --- /dev/null +++ b/ansible/roles/win_proxy/tasks/main.yml @@ -0,0 +1,60 @@ +--- + +- name: Import assert.yml + import_tasks: + file: assert.yml + run_once: true + delegate_to: localhost + +- name: Create group + ansible.builtin.group: + name: "{{ squid_group }}" + system: true + state: present + +- name: Create user + ansible.builtin.user: + name: "{{ squid_user }}" + group: "{{ squid_group }}" + create_home: false + state: present + home: /var/spool/squid + shell: /sbin/nologin + system: true + +- name: Install squid + ansible.builtin.package: + name: "{{ squid_packages }}" + state: present + update_cache: true + +- name: Include variables + include_vars: rules.yml + +- name: Configure squid + ansible.builtin.template: + src: "{{ squid_config_file }}.j2" + dest: "{{ squid_config_directory }}/{{ squid_config_file }}" + mode: "0644" + validate: squid -k parse -f %s + notify: + - Restart squid + +- name: Create cache directory + ansible.builtin.file: + path: /var/spool/squid + state: directory + owner: "{{ squid_user }}" + group: "{{ squid_group }}" + mode: "0750" + +- name: Flush_handlers + ansible.builtin.meta: flush_handlers + +- name: Start and enable squid + ansible.builtin.service: + name: "{{ squid_service }}" + state: started + enabled: true + when: + - not ansible_check_mode \ No newline at end of file diff --git a/ansible/roles/win_proxy/templates/squid.conf.j2 b/ansible/roles/win_proxy/templates/squid.conf.j2 new file mode 100644 index 0000000..28a0083 --- /dev/null +++ b/ansible/roles/win_proxy/templates/squid.conf.j2 @@ -0,0 +1,49 @@ +{{ ansible_managed | comment }} + +http_port {{ squid_port }} + +cache_effective_user {{ squid_user }} +cache_effective_group {{ squid_group }} + +{% if squid_acls is defined %} +{% for acl in squid_acls %} +acl {{ acl.name }} {{ acl.classifier }} {{ acl.value }} +{% endfor %} +{% endif %} + +{% if squid_rules is defined %} +{% for rule in squid_rules %} +http_access {{ rule.decision }} {{ rule.acl }} +{% endfor %} +{% endif %} + +{% if squid_http_access is defined %} +{% for http_access in squid_http_access %} +http_access {{ http_access.state }} {{ http_access.acls | join(' ') }} +{% endfor %} +{% endif %} + +cache_dir {{ squid_cache_dir }} + +coredump_dir /var/spool/squid + +refresh_pattern ^ftp: 1440 20% 10080 +refresh_pattern ^gopher: 1440 0% 1440 +refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 +refresh_pattern . 0 20% 4320 + +{% if squid_cache_replacement_policy is defined %} +cache_replacement_policy {{ squid_cache_replacement_policy }} +{% endif %} + +{% if squid_maximum_object_size_mb is defined %} +maximum_object_size {{ squid_maximum_object_size_mb }} MB +{% endif %} + +{% if squid_logformat is defined %} +logformat {{ squid_logformat }} +{% endif %} + +{% if squid_access_log is defined %} +access_log {{ squid_access_log }} +{% endif %} \ No newline at end of file diff --git a/ansible/roles/win_proxy/vars/main.yml b/ansible/roles/win_proxy/vars/main.yml new file mode 100644 index 0000000..1162790 --- /dev/null +++ b/ansible/roles/win_proxy/vars/main.yml @@ -0,0 +1,22 @@ +--- + +squid_packages: + - squid + +_squid_user: + default: squid + Debian: proxy + +squid_user: "{{ _squid_user[ansible_os_family] | default(_squid_user['default']) }}" + +_squid_group: + default: squid + Debian: proxy + +squid_group: "{{ _squid_group[ansible_os_family] | default(_squid_group['default']) }}" + +squid_config_directory: /etc/squid + +squid_config_file: squid.conf + +squid_service: squid \ No newline at end of file diff --git a/ansible/roles/win_proxy/vars/rules.yml b/ansible/roles/win_proxy/vars/rules.yml new file mode 100644 index 0000000..751c1fd --- /dev/null +++ b/ansible/roles/win_proxy/vars/rules.yml @@ -0,0 +1,14 @@ +squid_acls: + - name: os_external + classifier: src + value: "10.24.0.0/16" + +squid_rules: + - acl: to_localhost + decision: deny + - acl: os_external + decision: allow + - acl: localhost + decision: allow + - acl: all + decision: deny \ No newline at end of file From 5618a7fecd633d1be53b0869248f7040d2f97a4b Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 18 Jun 2024 10:14:21 +0100 Subject: [PATCH 07/10] remove fail condition --- ansible/roles/win_transfer/tasks/unmount.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/ansible/roles/win_transfer/tasks/unmount.yml b/ansible/roles/win_transfer/tasks/unmount.yml index 70c6e57..f98904f 100644 --- a/ansible/roles/win_transfer/tasks/unmount.yml +++ b/ansible/roles/win_transfer/tasks/unmount.yml @@ -9,8 +9,6 @@ opts: "credentials={{ credentials_path }},iocharset=utf8" state: absent fstype: cifs - register: mount_status - failed_when: mount_status.changed == false - name: Remove smb-credential template file: From 8b37bea13553e872ae5b2985e677c2f7eb876d23 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 18 Jun 2024 10:16:05 +0100 Subject: [PATCH 08/10] change target hosts --- ansible/playbooks/wazuh.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/playbooks/wazuh.yml b/ansible/playbooks/wazuh.yml index 2ae618e..abcf286 100644 --- a/ansible/playbooks/wazuh.yml +++ b/ansible/playbooks/wazuh.yml @@ -1,6 +1,6 @@ --- - name: Wazuh Agent - hosts: "meta-win_project_{{ win_project }}" # will need fixed when proxy is added (linux) + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" gather_facts: false vars_files: - ../vars/common.yml From 3a7fc1ddb53f612272cce738b871f662512bf8bd Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 18 Jun 2024 10:21:52 +0100 Subject: [PATCH 09/10] use proxy to download wazuh agent --- ansible/playbooks/wazuh.yml | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/ansible/playbooks/wazuh.yml b/ansible/playbooks/wazuh.yml index abcf286..08c3a03 100644 --- a/ansible/playbooks/wazuh.yml +++ b/ansible/playbooks/wazuh.yml @@ -17,12 +17,31 @@ - wazuh_agent block: - name: Download agent - win_shell: 'Invoke-WebRequest -Uri "{{ wazuh_url }}/{{ wazuh_msi }}" -OutFile "$env:temp\{{ wazuh_msi }}"' - register: download_result + win_get_url: + url: "{{ wazuh_url }}/{{ wazuh_msi }}" + dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + when: | + inventory_hostname not in groups['meta-type_client'] or + project_zone == 'standard' + + - name: Download agent using proxy + vars: + proxy_ip: "{{ os_project }}-{{ win_project }}-proxy" + win_get_url: + url: "{{ wazuh_url }}/{{ wazuh_msi }}" + dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + when: | + inventory_hostname in groups['meta-type_client'] and + project_zone == 'protected' - name: Install agent - win_shell: 'msiexec.exe /i $env:temp\{{ wazuh_msi }} /q WAZUH_MANAGER="{{ wazuh_server }}" WAZUH_REGISTRATION_SERVER="{{ wazuh_server }}"' - when: download_result.rc == 0 + win_package: + path: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + arguments: + - /q + - WAZUH_MANAGER={{ wazuh_server }} + - WAZUH_REGISTRATION_SERVER={{ wazuh_server }} + state: present - name: Start Service win_service: From 020c07315c11eeac109dc5c287b51922ab4f41cb Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 18 Jun 2024 10:24:48 +0100 Subject: [PATCH 10/10] set proxy on client --- ansible/roles/win_initial/tasks/initial.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/ansible/roles/win_initial/tasks/initial.yml b/ansible/roles/win_initial/tasks/initial.yml index 1da8feb..8720adb 100644 --- a/ansible/roles/win_initial/tasks/initial.yml +++ b/ansible/roles/win_initial/tasks/initial.yml @@ -9,7 +9,7 @@ set_fact: ansible_password: "{{ vm_initial_password }}" run_once: true - when: password_status == 'pending'or + when: password_status == 'pending' or password_status == 'change' - name: Check for finished or change password status @@ -27,6 +27,18 @@ start_mode: delayed tags: winrm_delayed +- name: Set a proxy + vars: + proxy_ip: "{{ os_project }}-{{ win_project }}-proxy" + tags: proxy + win_inet_proxy: + proxy: "{{ hostvars[proxy_ip].ansible_host }}:3128" + bypass: + - + when: | + inventory_hostname in groups['meta-type_client'] and + project_zone == 'protected' + - name: Remove Local Admin tags: remove_admin block: