changes for admin proxy credentials

ansible/playbooks/checkmk.yml

@@ -39,7 +39,9 @@
           tag_project_zone: "{{ project_zone }}"
         state: "{{ state }}"
       delegate_to: "localhost"
-      notify: "activate changes"
+      notify: 
+        - "activate changes"
+        - "schedule downtime"
       tags: 
         - checkmk_host
         - checkmk_host_update
@@ -57,36 +59,23 @@
         state: "present"
       run_once: true
       delegate_to: "localhost"
-      notify: "activate changes"
+      notify: 
+        - "activate changes"
+        - "schedule downtime"
       when: project_zone == 'protected'
-      tags: checkmk_proxy
+      tags: 
+        - checkmk_proxy
+        - checkmk_all
 
     - name: Flush handlers
       meta: flush_handlers
+      tags: always
 
     - name: Pause for 30 seconds to allow changes to activate.
       ansible.builtin.pause:
         seconds: 30
       run_once: true
 
-    - name: Create downtimes for new VMs
-      block:
-        - name: "Schedule downtime on Windows VMs to cover deployment"
-          checkmk.general.downtime:
-            server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
-            site: "{{ checkmk_agent_site }}"
-            automation_user: "{{ checkmk_agent_user }}"
-            automation_secret: "{{ checkmk_password }}"
-            host_name: "{{ inventory_hostname }}"
-            state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after
-            start_after:
-              minutes: 0
-            end_after:
-              days: 0
-              hours: 3
-          delegate_to: "localhost"
-      tags: checkmk_downtime
-
   handlers:
     - name: "Activate Changes"
       listen: activate changes
@@ -98,8 +87,26 @@
         force_foreign_changes: "false"
         validate_certs: "true"
       delegate_to: "localhost"
+      tags: always
       run_once: true
 
+    - name: "Schedule downtime"
+      listen: schedule downtime
+      checkmk.general.downtime:
+        server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/"
+        site: "{{ checkmk_agent_site }}"
+        automation_user: "{{ checkmk_agent_user }}"
+        automation_secret: "{{ checkmk_password }}"
+        host_name: "{{ inventory_hostname }}"
+        state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after
+        start_after:
+          minutes: 0
+        end_after:
+          days: 0
+          hours: 3
+      tags: always
+      delegate_to: "localhost"
+
 - name: CheckMK Agent
   hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
   gather_facts: false
@@ -131,17 +138,6 @@
               win_shell: |
                 sl 'C:\Program Files (x86)\checkmk\service'
                 .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
-              #when: project_zone == 'standard' or
-              #      inventory_hostname in groups['meta-type_server']
-
-            #- name: register TLS on client (Protected)
-            #  vars:
-            #    ansible_connection: local
-            #  shell: |
-            #    sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert
-            #  delegate_to: localhost
-            #  when: project_zone == 'protected' and
-            #        inventory_hostname in groups['meta-type_client']
           tags: 
             - checkmk_host
             - checkmk_tls

ansible/playbooks/wazuh.yml

@@ -29,6 +29,9 @@
           win_get_url:
             url: "{{ wazuh_url }}/{{ wazuh_msi }}"
             dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}"
+            proxy_url: "http://{{ hostvars[proxy_ip].ansible_host }}:3128"
+            proxy_username: "{{ proxy_user }}"
+            proxy_password: "{{ proxy_user_password }}"
           when: |
             inventory_hostname in groups['meta-type_client']|default([]) and
             project_zone == 'protected'

ansible/roles/win_proxy/tasks/main.yml

@@ -32,6 +32,26 @@
     state: present
     update_cache: true
 
+- name: Create htpasswd file
+  block:
+    - name: install htpasswd dependancy
+      ansible.builtin.package:
+        name: python3-passlib
+        state: present
+        update_cache: true
+
+    - name: Create htpasswd user
+      community.general.htpasswd:
+        path: /etc/squid/htpasswd
+        create: true
+        state: present
+        name: "{{ proxy_user }}"
+        password: "{{ proxy_user_password }}"
+        owner: "{{ squid_user }}"
+        group: "{{ squid_group }}"
+        mode: 0640
+        hash_scheme: bcrypt
+
 - name: Include variables
   include_vars: rules.yml
 

ansible/roles/win_proxy/templates/squid.conf.j2

@@ -2,6 +2,8 @@
 
 http_port {{ squid_port }}
 
+auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/htpasswd
+
 cache_effective_user {{ squid_user }}
 cache_effective_group {{ squid_group }}
 

ansible/roles/win_proxy/vars/rules.yml

@@ -8,6 +8,9 @@ squid_acls:
   - name: SSL_ports
     classifier: port
     value: 443
+  - name: local
+    classifier: src
+    value: "127.0.0.1/32"
   - name: os_external
     classifier: src
     value: "10.24.0.0/16"
@@ -20,6 +23,9 @@ squid_acls:
   - name: allowed_domains
     classifier: dstdomain
     value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\""
+  - name: authenticated_user
+    classifier: proxy_auth
+    value: "REQUIRED"
 
 squid_rules:
   - acl: "!Safe_ports"
@@ -36,5 +42,7 @@ squid_rules:
     decision: allow
   - acl: localhost allowed_domains
     decision: allow
+  - acl: authenticated_user
+    decision: allow
   - acl: all
     decision: deny

ansible/vars/common.yml

@@ -15,8 +15,8 @@ vm_initial_password: %VM_INITIAL_PASSWORD%
 vm_image: 3f193ea7-321d-418b-a233-da64661b08b1
 proxy_image: 62669efd-ee43-4148-848c-b82f49ca2f45
 server_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d
-#user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d
-user_vm_flavor: a82596d8-175b-45d2-b7db-d1658b3dd643
+user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d
+#user_vm_flavor: a82596d8-175b-45d2-b7db-d1658b3dd643
 gpu_flavor: b07fc115-e48e-4289-b220-baae18c8db8a
 
 filetransfer_user: file-transfer
@@ -26,6 +26,8 @@ guacamole_user_group: "Guacamole Users"
 
 winrm_script_url: http://10.24.3.242/ConfigureRemotingForAnsible.ps1
 
+proxy_user: proxy-admin
+
 standard_vms:
   - { name: "{{ os_project }}-{{ win_project }}-dc01", security_group: "domain_controller", meta_name: dc01 }
   - { name: "{{ os_project }}-{{ win_project }}-dc02", security_group: "domain_controller", meta_name: dc02 }

ansible/vars/protected.yml

@@ -80,7 +80,7 @@ remote_ip_rules:
   - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"}
   - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"}
   - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"}
-  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"}
+  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent Download"}
 # Proxy
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"}
   - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"}