From cb28448e242a34f6f58874f0ed1d6039fbd30699 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 24 Oct 2024 10:39:23 +0100 Subject: [PATCH 1/4] change to allow switch to new os-transfer VM if needed --- ansible/roles/win_study/tasks/os-transfer.yml | 1 + ansible/vars/protected.yml | 1 + ansible/vars/standard.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/ansible/roles/win_study/tasks/os-transfer.yml b/ansible/roles/win_study/tasks/os-transfer.yml index da57297..4edbd35 100644 --- a/ansible/roles/win_study/tasks/os-transfer.yml +++ b/ansible/roles/win_study/tasks/os-transfer.yml @@ -3,6 +3,7 @@ file: path: "{{ item }}" state: directory + mode: '0750' loop: "{{ mft_directories }}" when: study_action == 'create' diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 83ea0a0..6aad896 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -69,6 +69,7 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"} # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"} + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"} # All Winwdows VMs - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"} diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index 2cf4a68..1427b88 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -42,6 +42,7 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"} # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"} + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"} # All Winwdows VMs - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"} From 695cb909e1871e09ca6214da99c790e3701bdf10 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 7 Nov 2024 15:17:30 +0000 Subject: [PATCH 2/4] enable user job --- ansible/roles/win_user/tasks/assert.yml | 12 ++++++++++++ ansible/roles/win_user/tasks/enable.yml | 9 +++++++++ ansible/roles/win_user/vars/main.yml | 2 +- 3 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 ansible/roles/win_user/tasks/enable.yml diff --git a/ansible/roles/win_user/tasks/assert.yml b/ansible/roles/win_user/tasks/assert.yml index 82dc4d7..e749368 100644 --- a/ansible/roles/win_user/tasks/assert.yml +++ b/ansible/roles/win_user/tasks/assert.yml @@ -49,6 +49,15 @@ quiet: true when: user_action == 'disable' + - name: Check User Info [ENABLE] + ansible.builtin.assert: + that: + # - username checked already + - study_code is defined # so can be removed from group (WIP) + - user_role is defined # so can be removed from group (WIP) + quiet: true + when: user_action == 'disable' + - name: Check User Info [MODIFY] ansible.builtin.assert: that: @@ -77,6 +86,9 @@ register: folder delegate_to: "{{ os_project }}-{{ win_project }}-fs01" failed_when: folder.stat.exists == false + when: | + user_action == 'create' or + user_action == 'modify' - name: Verify User block: diff --git a/ansible/roles/win_user/tasks/enable.yml b/ansible/roles/win_user/tasks/enable.yml new file mode 100644 index 0000000..5b33cd5 --- /dev/null +++ b/ansible/roles/win_user/tasks/enable.yml @@ -0,0 +1,9 @@ +--- +- name: Enable AD user + block: + - name: Enable user in AD + microsoft.ad.user: + name: "{{ username }}" + path: ou=Project Users,dc={{ win_project }},dc=loc + state: present + enabled: yes \ No newline at end of file diff --git a/ansible/roles/win_user/vars/main.yml b/ansible/roles/win_user/vars/main.yml index 7241096..06b8e38 100644 --- a/ansible/roles/win_user/vars/main.yml +++ b/ansible/roles/win_user/vars/main.yml @@ -1,4 +1,4 @@ study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }} exporter_group: "{{ study_code }}-exporter" -valid_actions: ["create", "reset", "disable", "modify"] \ No newline at end of file +valid_actions: ["create", "reset", "disable", "enable", "modify"] \ No newline at end of file From 94a8849a3c859de946647fd8a1cd599ff3b33ccd Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 22 Nov 2024 16:22:17 +0000 Subject: [PATCH 3/4] use wait for connection to replace rundeck 10min sleep step --- ansible/roles/win_initial/tasks/initial.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ansible/roles/win_initial/tasks/initial.yml b/ansible/roles/win_initial/tasks/initial.yml index a604314..e9beea7 100644 --- a/ansible/roles/win_initial/tasks/initial.yml +++ b/ansible/roles/win_initial/tasks/initial.yml @@ -17,9 +17,11 @@ ansible_password: "{{ vm_password }}" run_once: true when: password_status == 'finished' - - - name: Test password - win_ping: + + - name: wait for connention to VM + ansible.builtin.wait_for_connection: + delay: 10 + timeout: 600 any_errors_fatal: true - name: Set WinRM to delayed startup From 22945023f297193a78adf73b6632347af4ce5fe7 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 22 Nov 2024 16:22:48 +0000 Subject: [PATCH 4/4] Allow ICMP and TLS registration for checkmk --- ansible/vars/protected.yml | 2 ++ ansible/vars/standard.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 6aad896..829b901 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -72,8 +72,10 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"} # All Winwdows VMs + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"} - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"} + - { direction: "engress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"} - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"} - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index 1427b88..598c411 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -45,6 +45,7 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"} # All Winwdows VMs + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.172/32", comment: "WinRM rundeck 2"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}