From 41c8ecdddcc684ec94016788f433bf2fd065a743 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 4 Dec 2024 15:50:33 +0000 Subject: [PATCH] WIP changes for adding hosts to checkmk --- ansible/playbooks/checkmk.yml | 26 +++++++++++++---- ansible/roles/win_proxy/handlers/main.yml | 13 ++++++++- ansible/roles/win_proxy/tasks/checkmk.yml | 35 +++++++++++++++++++++++ ansible/roles/win_proxy/tasks/main.yml | 7 ++++- ansible/vars/protected.yml | 4 +++ 5 files changed, 77 insertions(+), 8 deletions(-) create mode 100644 ansible/roles/win_proxy/tasks/checkmk.yml diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index 8d4bb18..a8b914d 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -21,7 +21,7 @@ - checkmk_host - checkmk_all - - name: Add Windows host into check + - name: Add Windows host into checkMK checkmk.general.host: server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" site: "{{ checkmk_agent_site }}" @@ -92,11 +92,25 @@ - checkmk_all - checkmk_agent - - name: register for TLS - win_shell: | - sl 'C:\Program Files (x86)\checkmk\service' - .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + - name: TLS registrtion + block: + - name: register for TLS + win_shell: | + sl 'C:\Program Files (x86)\checkmk\service' + .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + #when: project_zone == 'standard' or + # inventory_hostname in groups['meta-type_server'] + + #- name: register TLS on client (Protected) + # vars: + # ansible_connection: local + # shell: | + # sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + # delegate_to: localhost + # when: project_zone == 'protected' and + # inventory_hostname in groups['meta-type_client'] tags: - checkmk_host - checkmk_tls - - checkmk_all \ No newline at end of file + - checkmk_all + \ No newline at end of file diff --git a/ansible/roles/win_proxy/handlers/main.yml b/ansible/roles/win_proxy/handlers/main.yml index 4cc7bbe..8b0f3fb 100644 --- a/ansible/roles/win_proxy/handlers/main.yml +++ b/ansible/roles/win_proxy/handlers/main.yml @@ -3,4 +3,15 @@ - name: Restart squid ansible.builtin.service: name: "{{ squid_service }}" - state: restarted \ No newline at end of file + state: restarted + +- name: "Activate Changes" + listen: activate changes + checkmk.general.activation: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + force_foreign_changes: "false" + validate_certs: "false" + run_once: true \ No newline at end of file diff --git a/ansible/roles/win_proxy/tasks/checkmk.yml b/ansible/roles/win_proxy/tasks/checkmk.yml new file mode 100644 index 0000000..6acaaf7 --- /dev/null +++ b/ansible/roles/win_proxy/tasks/checkmk.yml @@ -0,0 +1,35 @@ +--- + +- name: Gather the package facts + ansible.builtin.package_facts: + manager: apt + +- name: Setup CheckMK agent + block: + - name: Include CheckMK variables + ansible.builtin.include_vars: + file: ../vars/checkmk.yml + + - name: Add proxy host into checkMK + checkmk.general.host: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + validate_certs: "true" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + folder: "/" + name: "{{ inventory_hostname }}" + attributes: + ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}" + state: "present" + notify: "activate changes" + + - name: Install CheckMK Agent + import_role: + name: checkmk.general.agent + when: ansible_facts.packages['check-mk-agent'] | default('Missing') == 'Missing' + + - name: register agent for TLS + shell: | + cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + \ No newline at end of file diff --git a/ansible/roles/win_proxy/tasks/main.yml b/ansible/roles/win_proxy/tasks/main.yml index 2cc1aa4..4474f14 100644 --- a/ansible/roles/win_proxy/tasks/main.yml +++ b/ansible/roles/win_proxy/tasks/main.yml @@ -69,4 +69,9 @@ state: started enabled: true when: - - not ansible_check_mode \ No newline at end of file + - not ansible_check_mode + +- name: Import checkmk.yml + import_tasks: + file: checkmk.yml + tags: proxy_cmk \ No newline at end of file diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 092b892..63bf494 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -80,7 +80,11 @@ remote_ip_rules: - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"} + - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"} # Proxy - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"} - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"} - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"} + - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"} + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"} +