konsthol/SecDep
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Trust me, it's not badly written. It's just way above your head.

Browse Source
This commit is contained in:
konsthol
2023-03-12 20:42:23 +02:00
parent 029407c1c6
commit f8de2cd9d7
1 changed files with 34 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
secdep.py
View File

@@ -944,19 +944,28 @@ def create_node(provider, name=None, location=None, size=None, image=None, confi
elif provider == "azure": elif provider == "azure":
node = driver.create_node(name, size, image, location, auth=auth) node = driver.create_node(name, size, image, location, auth=auth)
else: else:
driver.import_key_pair_from_string("secdep@"+socket.gethostname(), pubkey) keys = driver.ex_find_or_import_keypair_by_key_material(pubkey)
if len(keys) <= 2:
pass
else:
driver.import_key_pair_from_string("secdep@"+socket.gethostname(), pubkey)
driver.ex_authorize_security_group_permissive('default') driver.ex_authorize_security_group_permissive('default')
keyname="secdep@"+socket.gethostname() keyname="secdep@"+socket.gethostname()
SCRIPT = '''#!/usr/bin/env bash SCRIPT = '''#!/usr/bin/env bash
useradd -G sudo -m secdep sudo useradd -G sudo -m secdep
echo "secdep:secdeppass" | chpasswd sudo echo "secdep:secdeppass" | sudo chpasswd
echo "%sudo ALL=(ALL:ALL) ALL" >> /etc/sudoers sudo echo "%sudo ALL=(ALL:ALL) ALL" >> /etc/sudoers
mkdir -p /home/secdep/.ssh sudo mkdir -p /home/secdep/.ssh
cp /root/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys''' [[ -e /root/.ssh/authorized_keys ]] && sudo cp /root/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/admin/.ssh/authorized_keys ]] && sudo cp /home/admin/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/ec2-user/.ssh/authorized_keys ]] && sudo cp /home/ec2-user/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/centos/.ssh/authorized_keys ]] && sudo cp /home/centos/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/fedora/.ssh/authorized_keys ]] && sudo cp /home/fedora/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/ubuntu/.ssh/authorized_keys ]] && sudo cp /home/ubuntu/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys'''
step_1 = SSHKeyDeployment(pubkey) step_1 = SSHKeyDeployment(pubkey)
step_2 = ScriptDeployment(SCRIPT) step_2 = ScriptDeployment(SCRIPT)
msd = MultiStepDeployment([step_1, step_2]) msd = MultiStepDeployment([step_1, step_2])
node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=msd, ssh_key=SECDEP_SSH_PRIVATE_KEY) node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=msd, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_alternate_usernames=["admin", "ec2-user", "centos", "fedora", "ubuntu"])
print('stdout: %s' % (step_2.stdout)) print('stdout: %s' % (step_2.stdout))
print('stderr: %s' % (step_2.stderr)) print('stderr: %s' % (step_2.stderr))
print('exit_code: %s' % (step_2.exit_status)) print('exit_code: %s' % (step_2.exit_status))
@@ -967,19 +976,28 @@ def create_node(provider, name=None, location=None, size=None, image=None, confi
elif provider == "azure": elif provider == "azure":
node = driver.create_node(name, size, image, location, auth=auth) node = driver.create_node(name, size, image, location, auth=auth)
else: else:
driver.import_key_pair_from_string("secdep@"+socket.gethostname(), pubkey) keys = driver.ex_find_or_import_keypair_by_key_material(pubkey)
if len(keys) <= 2:
pass
else:
driver.import_key_pair_from_string("secdep@"+socket.gethostname(), pubkey)
driver.ex_authorize_security_group_permissive('default') driver.ex_authorize_security_group_permissive('default')
keyname="secdep@"+socket.gethostname() keyname="secdep@"+socket.gethostname()
SCRIPT = '''#!/usr/bin/env bash SCRIPT = '''#!/usr/bin/env bash
useradd -G sudo -m secdep sudo useradd -G sudo -m secdep
echo "secdep:secdeppass" | chpasswd sudo echo "secdep:secdeppass" | sudo chpasswd
echo "%sudo ALL=(ALL:ALL) ALL" >> /etc/sudoers sudo echo "%sudo ALL=(ALL:ALL) ALL" >> /etc/sudoers
mkdir -p /home/secdep/.ssh sudo mkdir -p /home/secdep/.ssh
cp /root/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys''' [[ -e /root/.ssh/authorized_keys ]] && sudo cp /root/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/admin/.ssh/authorized_keys ]] && sudo cp /home/admin/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/ec2-user/.ssh/authorized_keys ]] && sudo cp /home/ec2-user/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/centos/.ssh/authorized_keys ]] && sudo cp /home/centos/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/fedora/.ssh/authorized_keys ]] && sudo cp /home/fedora/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
[[ -e /home/ubuntu/.ssh/authorized_keys ]] && sudo cp /home/ubuntu/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys'''
step_1 = SSHKeyDeployment(pubkey) step_1 = SSHKeyDeployment(pubkey)
step_2 = ScriptDeployment(SCRIPT) step_2 = ScriptDeployment(SCRIPT)
msd = MultiStepDeployment([step_1, step_2]) msd = MultiStepDeployment([step_1, step_2])
node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=msd, ssh_key=SECDEP_SSH_PRIVATE_KEY) node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=msd, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_alternate_usernames=["admin", "ec2-user", "centos", "fedora", "ubuntu"])
print('stdout: %s' % (step_2.stdout)) print('stdout: %s' % (step_2.stdout))
print('stderr: %s' % (step_2.stderr)) print('stderr: %s' % (step_2.stderr))
print('exit_code: %s' % (step_2.exit_status)) print('exit_code: %s' % (step_2.exit_status))
@@ -1046,6 +1064,8 @@ def delete_node():
else: else:
print("%s node could not be deleted" % (providerName.upper())) print("%s node could not be deleted" % (providerName.upper()))
driver = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY,region="eu-west-1")
# If -p -q or -G is passed, provider must be passed as well # If -p -q or -G is passed, provider must be passed as well
if args.listimages or args.listsizes or args.listlocations: if args.listimages or args.listsizes or args.listlocations:
assert args.provider is not None, "Provider must be passed if listing images, sizes or locations" assert args.provider is not None, "Provider must be passed if listing images, sizes or locations"