Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use safer default values #405

Merged
merged 23 commits into from
Jan 12, 2017
Merged

Use safer default values #405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
7191fda
Update install scripts to configure MongoDB to listen on localhost only
Kami Jan 9, 2017
fd5d744
Update debian bootstrap script to enable RBAC for MongoDB and create new
Kami Jan 9, 2017
f574eb9
Also set password for mistral postgresql user.
Kami Jan 9, 2017
f6d5a28
Installer crudini early on.
Kami Jan 9, 2017
1eb2bd1
Generate random password inline, no need to pass it to the script.
Kami Jan 9, 2017
d68be3b
Make the same changes in the EL6 and EL7 installer script.
Kami Jan 9, 2017
2765d6b
MongoDB needs to be running before we can add users.
Kami Jan 9, 2017
98d7cd6
Configure PostgreSQL to listen on localhost only.
Kami Jan 9, 2017
0a4ecda
Configure RabbitMQ to listen on localhost only.
Kami Jan 9, 2017
6461a9f
Make sure we set st2.conf values before starting st2 services.
Kami Jan 9, 2017
3ce0dcf
Abort if password is empty.
Kami Jan 9, 2017
ff83c05
Make sure password is not empty.
Kami Jan 9, 2017
2238498
Don't use static path since different distros use different version of
Kami Jan 9, 2017
59439c0
Fix typo, make sure values are quoted.
Kami Jan 9, 2017
6b6bcdc
Use correct config path.
Kami Jan 9, 2017
f80bb70
Fix typo.
Kami Jan 9, 2017
d21214b
Need to use echo -e on RHEL.
Kami Jan 9, 2017
097de90
Use correct postgresql.conf path on RHEL.
Kami Jan 9, 2017
e591891
Can't use crudini on RHEL.
Kami Jan 9, 2017
dfc9ec8
Use correct postgres config path on RHEL 6.
Kami Jan 9, 2017
26b7a4c
Use 127.0.0.1 instead of localhost.
Kami Jan 11, 2017
03e81c8
Use consistent order.
Kami Jan 12, 2017
bbc9b9e
Use restart on ubuntu 14.04.
Kami Jan 12, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 86 additions & 4 deletions scripts/st2bootstrap-deb.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,11 @@ setup_args() {
echo "Press \"ENTER\" to continue or \"CTRL+C\" to exit/abort"
read -e -p "Admin username: " -i "st2admin" USERNAME
read -e -s -p "Password: " PASSWORD

if [ "${PASSWORD}" = '' ]; then
echo "Password cannot be empty."
exit 1
fi
fi
}

Expand Down Expand Up @@ -173,14 +178,33 @@ check_st2_host_dependencies() {
fi
}

generate_random_passwords() {
# Generate random password used for MongoDB and PostgreSQL user authentication
ST2_MONGODB_PASSWORD=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 24 ; echo '')
ST2_POSTGRESQL_PASSWORD=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 24 ; echo '')
}

install_st2_dependencies() {
sudo apt-get update

# Note: gnupg-curl is needed to be able to use https transport when fetching keys
sudo apt-get install -y gnupg-curl
sudo apt-get install -y curl
sudo apt-get install -y rabbitmq-server

# Configure RabbitMQ to listen on localhost only
sudo sh -c 'echo "RABBITMQ_NODE_IP_ADDRESS=127.0.0.1" >> /etc/rabbitmq/rabbitmq-env.conf'

if [[ "$SUBTYPE" == 'xenial' ]]; then
sudo systemctl restart rabbitmq-server
else
sudo service rabbitmq-server restart
fi

# Various other dependencies needed by st2 and installer script
sudo apt-get install -y crudini
}

install_mongodb() {
# Add key and repo for the latest stable MongoDB (3.2)
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv EA312927
Expand All @@ -189,11 +213,55 @@ install_mongodb() {
sudo apt-get update
sudo apt-get install -y mongodb-org

# Configure MongoDB to listen on localhost only
sudo sed -i -e "s#bindIp:.*#bindIp: 127.0.0.1#g" /etc/mongod.conf

if [[ "$SUBTYPE" == 'xenial' ]]; then
sudo systemctl enable mongod
sudo systemctl start mongod
else
sudo service mongod restart
fi

sleep 5

# Create admin user and user used by StackStorm (MongoDB needs to be running)
mongo <<EOF
use admin;
db.createUser({
user: "admin",
pwd: "${ST2_MONGODB_PASSWORD}",
roles: [
{ role: "userAdminAnyDatabase", db: "admin" }
]
});
quit();
EOF

mongo <<EOF
use st2;
db.createUser({
user: "stackstorm",
pwd: "${ST2_MONGODB_PASSWORD}",
roles: [
{ role: "readWrite", db: "st2" }
]
});
quit();
EOF

# Require authentication to be able to acccess the database
sudo sh -c 'echo "security:\n authorization: enabled" >> /etc/mongod.conf'

# MongoDB needs to be restarted after enabling auth
if [[ "$SUBTYPE" == 'xenial' ]]; then
sudo systemctl restart mongod
else
sudo service mongod restart
fi

}

get_full_pkg_versions() {
if [ "$VERSION" != '' ];
then
Expand Down Expand Up @@ -255,7 +323,11 @@ install_st2() {
sudo apt-get install -yf
rm ${PACKAGE_FILENAME}
fi


# Configure [database] section in st2.conf (username password for MongoDB access)
sudo crudini --set /etc/st2/st2.conf database username "stackstorm"
sudo crudini --set /etc/st2/st2.conf database password "${ST2_MONGODB_PASSWORD}"

sudo st2ctl start
sleep 5
sudo st2ctl reload --register-all
Expand Down Expand Up @@ -290,8 +362,8 @@ configure_st2_user () {
}

configure_st2_authentication() {
# Install htpasswd and tool for editing ini files
sudo apt-get install -y apache2-utils crudini
# Install htpasswd tool for editing ini files
sudo apt-get install -y apache2-utils

# Create a user record in a password file.
sudo echo "${PASSWORD}" | sudo htpasswd -i /etc/st2/htpasswd $USERNAME
Expand Down Expand Up @@ -371,8 +443,13 @@ generate_symmetric_crypto_key_for_datastore() {
install_st2mistral_depdendencies() {
sudo apt-get install -y postgresql

# Configure service only listens on localhost
sudo crudini --set /etc/postgresql/*/main/postgresql.conf '' listen_addresses "'127.0.0.1'"

sudo service postgresql restart

cat << EHD | sudo -u postgres psql
CREATE ROLE mistral WITH CREATEDB LOGIN ENCRYPTED PASSWORD 'StackStorm';
CREATE ROLE mistral WITH CREATEDB LOGIN ENCRYPTED PASSWORD '${ST2_POSTGRESQL_PASSWORD}';
CREATE DATABASE mistral OWNER mistral;
EHD
}
Expand All @@ -391,8 +468,12 @@ install_st2mistral() {
rm ${PACKAGE_FILENAME}
fi

# Configure database settings
sudo crudini --set /etc/mistral/mistral.conf database connection "postgresql://mistral:${ST2_POSTGRESQL_PASSWORD}@127.0.0.1/mistral"

# Setup Mistral DB tables, etc.
/opt/stackstorm/mistral/bin/mistral-db-manage --config-file /etc/mistral/mistral.conf upgrade head

# Register mistral actions
/opt/stackstorm/mistral/bin/mistral-db-manage --config-file /etc/mistral/mistral.conf populate

Expand Down Expand Up @@ -527,6 +608,7 @@ ok_message() {
trap 'fail' EXIT
STEP="Setup args" && setup_args $@
STEP="Check TCP ports and MongoDB storage requirements" && check_st2_host_dependencies
STEP="Generate random password" && generate_random_passwords
STEP="Install st2 dependencies" && install_st2_dependencies
STEP="Install st2 dependencies (MongoDB)" && install_mongodb
STEP="Install st2" && install_st2
Expand Down
73 changes: 70 additions & 3 deletions scripts/st2bootstrap-el6.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,11 @@ setup_args() {
echo "Press \"ENTER\" to continue or \"CTRL+C\" to exit/abort"
read -e -p "Admin username: " -i "st2admin" USERNAME
read -e -s -p "Password: " PASSWORD

if [ "${PASSWORD}" = '' ]; then
echo "Password cannot be empty."
exit 1
fi
fi
}

Expand Down Expand Up @@ -258,14 +263,27 @@ check_st2_host_dependencies() {
fi
}

generate_random_passwords() {
# Generate random password used for MongoDB and PostgreSQL user authentication
ST2_MONGODB_PASSWORD=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 24 ; echo '')
ST2_POSTGRESQL_PASSWORD=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 24 ; echo '')
}

install_st2_dependencies() {
is_epel_installed=$(rpm -qa | grep epel-release || true)
if [[ -z "$is_epel_installed" ]]; then
sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
fi
sudo yum -y install curl rabbitmq-server

# Configure RabbitMQ to listen on localhost only
sudo sh -c 'echo "RABBITMQ_NODE_IP_ADDRESS=127.0.0.1" >> /etc/rabbitmq/rabbitmq-env.conf'

sudo service rabbitmq-server start
sudo chkconfig rabbitmq-server on

# Various other dependencies needed by st2 and installer script
sudo yum -y install crudini
}

install_mongodb() {
Expand All @@ -281,8 +299,45 @@ gpgkey=https://www.mongodb.org/static/pgp/server-3.2.asc
EOT"

sudo yum -y install mongodb-org

# Configure MongoDB to listen on localhost only
sudo sed -i -e "s#bindIp:.*#bindIp: 127.0.0.1#g" /etc/mongod.conf

sudo service mongod start
sudo chkconfig mongod on

sleep 5

# Create admin user and user used by StackStorm (MongoDB needs to be running)
mongo <<EOF
use admin;
db.createUser({
user: "admin",
pwd: "${ST2_MONGODB_PASSWORD}",
roles: [
{ role: "userAdminAnyDatabase", db: "admin" }
]
});
quit();
EOF

mongo <<EOF
use st2;
db.createUser({
user: "stackstorm",
pwd: "${ST2_MONGODB_PASSWORD}",
roles: [
{ role: "readWrite", db: "st2" }
]
});
quit();
EOF

# Require authentication to be able to acccess the database
sudo sh -c 'echo -e "security:\n authorization: enabled" >> /etc/mongod.conf'

# MongoDB needs to be restarted after enabling auth
sudo service mongod restart
}

install_st2() {
Expand All @@ -297,6 +352,10 @@ install_st2() {
sudo yum -y install ${PACKAGE_URL}
fi

# Configure [database] section in st2.conf (username password for MongoDB access)
sudo crudini --set /etc/st2/st2.conf database username "stackstorm"
sudo crudini --set /etc/st2/st2.conf database password "${ST2_MONGODB_PASSWORD}"

sudo st2ctl start
sleep 5
sudo st2ctl reload --register-all
Expand Down Expand Up @@ -328,8 +387,8 @@ configure_st2_user() {
}

configure_st2_authentication() {
# Install htpasswd and tool for editing ini files
sudo yum -y install httpd-tools crudini
# Install htpasswd tool
sudo yum -y install httpd-tools

# Create a user record in a password file.
sudo htpasswd -bs /etc/st2/htpasswd $USERNAME $PASSWORD
Expand Down Expand Up @@ -444,6 +503,9 @@ install_st2mistral_depdendencies() {
# Setup postgresql at a first time
sudo service postgresql-9.4 initdb

# Configure service only listens on localhost
sudo sh -c "echo \"listen_addresses = '127.0.0.1'\" >> /var/lib/pgsql/9.4/data/postgresql.conf"

# Make localhost connections to use an MD5-encrypted password for authentication
sudo sed -i "s/\(host.*all.*all.*127.0.0.1\/32.*\)ident/\1md5/" /var/lib/pgsql/9.4/data/pg_hba.conf
sudo sed -i "s/\(host.*all.*all.*::1\/128.*\)ident/\1md5/" /var/lib/pgsql/9.4/data/pg_hba.conf
Expand All @@ -453,7 +515,7 @@ install_st2mistral_depdendencies() {
sudo chkconfig postgresql-9.4 on

cat << EHD | sudo -u postgres psql
CREATE ROLE mistral WITH CREATEDB LOGIN ENCRYPTED PASSWORD 'StackStorm';
CREATE ROLE mistral WITH CREATEDB LOGIN ENCRYPTED PASSWORD '${ST2_POSTGRESQL_PASSWORD}';
CREATE DATABASE mistral OWNER mistral;
EHD
}
Expand All @@ -468,8 +530,12 @@ install_st2mistral() {
sudo yum -y install ${PACKAGE_URL}
fi

# Configure database settings
sudo crudini --set /etc/mistral/mistral.conf database connection "postgresql://mistral:${ST2_POSTGRESQL_PASSWORD}@127.0.0.1/mistral"

# Setup Mistral DB tables, etc.
/opt/stackstorm/mistral/bin/mistral-db-manage --config-file /etc/mistral/mistral.conf upgrade head

# Register mistral actions
/opt/stackstorm/mistral/bin/mistral-db-manage --config-file /etc/mistral/mistral.conf populate

Expand Down Expand Up @@ -580,6 +646,7 @@ STEP="Check TCP ports and MongoDB storage requirements" && check_st2_host_depend
STEP='Check libffi-devel availability' && check_libffi_devel
STEP='Adjust SELinux policies' && adjust_selinux_policies
STEP='Install repoquery tool' && install_yum_utils
STEP="Generate random password" && generate_random_passwords

STEP="Install st2 dependencies" && install_st2_dependencies
STEP="Install st2 dependencies (MongoDB)" && install_mongodb
Expand Down
Loading