From 60d0edd4b594b5842ca586c5aea88a48d9a58da0 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 20 Feb 2025 20:33:49 +0000 Subject: [PATCH] changes for admin proxy credentials --- ansible/playbooks/checkmk.yml | 60 +++++++++---------- ansible/playbooks/wazuh.yml | 3 + ansible/roles/win_proxy/tasks/main.yml | 20 +++++++ .../roles/win_proxy/templates/squid.conf.j2 | 2 + ansible/roles/win_proxy/vars/rules.yml | 8 +++ ansible/vars/common.yml | 6 +- ansible/vars/protected.yml | 2 +- 7 files changed, 66 insertions(+), 35 deletions(-) diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index f07baf5..1848e16 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -39,7 +39,9 @@ tag_project_zone: "{{ project_zone }}" state: "{{ state }}" delegate_to: "localhost" - notify: "activate changes" + notify: + - "activate changes" + - "schedule downtime" tags: - checkmk_host - checkmk_host_update @@ -57,36 +59,23 @@ state: "present" run_once: true delegate_to: "localhost" - notify: "activate changes" + notify: + - "activate changes" + - "schedule downtime" when: project_zone == 'protected' - tags: checkmk_proxy + tags: + - checkmk_proxy + - checkmk_all - name: Flush handlers meta: flush_handlers + tags: always - name: Pause for 30 seconds to allow changes to activate. ansible.builtin.pause: seconds: 30 run_once: true - - name: Create downtimes for new VMs - block: - - name: "Schedule downtime on Windows VMs to cover deployment" - checkmk.general.downtime: - server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" - site: "{{ checkmk_agent_site }}" - automation_user: "{{ checkmk_agent_user }}" - automation_secret: "{{ checkmk_password }}" - host_name: "{{ inventory_hostname }}" - state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after - start_after: - minutes: 0 - end_after: - days: 0 - hours: 3 - delegate_to: "localhost" - tags: checkmk_downtime - handlers: - name: "Activate Changes" listen: activate changes @@ -98,8 +87,26 @@ force_foreign_changes: "false" validate_certs: "true" delegate_to: "localhost" + tags: always run_once: true + - name: "Schedule downtime" + listen: schedule downtime + checkmk.general.downtime: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + host_name: "{{ inventory_hostname }}" + state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after + start_after: + minutes: 0 + end_after: + days: 0 + hours: 3 + tags: always + delegate_to: "localhost" + - name: CheckMK Agent hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" gather_facts: false @@ -131,17 +138,6 @@ win_shell: | sl 'C:\Program Files (x86)\checkmk\service' .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert - #when: project_zone == 'standard' or - # inventory_hostname in groups['meta-type_server'] - - #- name: register TLS on client (Protected) - # vars: - # ansible_connection: local - # shell: | - # sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert - # delegate_to: localhost - # when: project_zone == 'protected' and - # inventory_hostname in groups['meta-type_client'] tags: - checkmk_host - checkmk_tls diff --git a/ansible/playbooks/wazuh.yml b/ansible/playbooks/wazuh.yml index 39d8f5d..2cf35d6 100644 --- a/ansible/playbooks/wazuh.yml +++ b/ansible/playbooks/wazuh.yml @@ -29,6 +29,9 @@ win_get_url: url: "{{ wazuh_url }}/{{ wazuh_msi }}" dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}" + proxy_url: "http://{{ hostvars[proxy_ip].ansible_host }}:3128" + proxy_username: "{{ proxy_user }}" + proxy_password: "{{ proxy_user_password }}" when: | inventory_hostname in groups['meta-type_client']|default([]) and project_zone == 'protected' diff --git a/ansible/roles/win_proxy/tasks/main.yml b/ansible/roles/win_proxy/tasks/main.yml index a07bc1a..97b1ea8 100644 --- a/ansible/roles/win_proxy/tasks/main.yml +++ b/ansible/roles/win_proxy/tasks/main.yml @@ -32,6 +32,26 @@ state: present update_cache: true +- name: Create htpasswd file + block: + - name: install htpasswd dependancy + ansible.builtin.package: + name: python3-passlib + state: present + update_cache: true + + - name: Create htpasswd user + community.general.htpasswd: + path: /etc/squid/htpasswd + create: true + state: present + name: "{{ proxy_user }}" + password: "{{ proxy_user_password }}" + owner: "{{ squid_user }}" + group: "{{ squid_group }}" + mode: 0640 + hash_scheme: bcrypt + - name: Include variables include_vars: rules.yml diff --git a/ansible/roles/win_proxy/templates/squid.conf.j2 b/ansible/roles/win_proxy/templates/squid.conf.j2 index 28a0083..53d6449 100644 --- a/ansible/roles/win_proxy/templates/squid.conf.j2 +++ b/ansible/roles/win_proxy/templates/squid.conf.j2 @@ -2,6 +2,8 @@ http_port {{ squid_port }} +auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/htpasswd + cache_effective_user {{ squid_user }} cache_effective_group {{ squid_group }} diff --git a/ansible/roles/win_proxy/vars/rules.yml b/ansible/roles/win_proxy/vars/rules.yml index 0997cc4..418ed51 100644 --- a/ansible/roles/win_proxy/vars/rules.yml +++ b/ansible/roles/win_proxy/vars/rules.yml @@ -8,6 +8,9 @@ squid_acls: - name: SSL_ports classifier: port value: 443 + - name: local + classifier: src + value: "127.0.0.1/32" - name: os_external classifier: src value: "10.24.0.0/16" @@ -20,6 +23,9 @@ squid_acls: - name: allowed_domains classifier: dstdomain value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\"" + - name: authenticated_user + classifier: proxy_auth + value: "REQUIRED" squid_rules: - acl: "!Safe_ports" @@ -36,5 +42,7 @@ squid_rules: decision: allow - acl: localhost allowed_domains decision: allow + - acl: authenticated_user + decision: allow - acl: all decision: deny \ No newline at end of file diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml index 8941f6f..ba6c70c 100644 --- a/ansible/vars/common.yml +++ b/ansible/vars/common.yml @@ -15,8 +15,8 @@ vm_initial_password: %VM_INITIAL_PASSWORD% vm_image: 3f193ea7-321d-418b-a233-da64661b08b1 proxy_image: 62669efd-ee43-4148-848c-b82f49ca2f45 server_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d -#user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d -user_vm_flavor: a82596d8-175b-45d2-b7db-d1658b3dd643 +user_vm_flavor: 3661211f-673a-4777-8857-fd243d6c407d +#user_vm_flavor: a82596d8-175b-45d2-b7db-d1658b3dd643 gpu_flavor: b07fc115-e48e-4289-b220-baae18c8db8a filetransfer_user: file-transfer @@ -26,6 +26,8 @@ guacamole_user_group: "Guacamole Users" winrm_script_url: http://10.24.3.242/ConfigureRemotingForAnsible.ps1 +proxy_user: proxy-admin + standard_vms: - { name: "{{ os_project }}-{{ win_project }}-dc01", security_group: "domain_controller", meta_name: dc01 } - { name: "{{ os_project }}-{{ win_project }}-dc02", security_group: "domain_controller", meta_name: dc02 } diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 3ca4fa8..513c9f3 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -80,7 +80,7 @@ remote_ip_rules: - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"} - - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"} + - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent Download"} # Proxy - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"} - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"}