1508 lines
81 KiB
Python
Executable File
1508 lines
81 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
# This script will use the libcloud api
|
|
# to manage vps instances from
|
|
# 1) Google Cloud Platform (GCE)
|
|
# 2) Microsoft Azure (AZURE_ARM)
|
|
# 3) Amazon Web Services (EC2)
|
|
# A user will be able to
|
|
# 1) create an instance
|
|
# 2) delete an instance or all of them across all or one cloud provider
|
|
# 3) list all instances across all cloud providers or a specific one
|
|
# 4) start a stopped instance or all of them across all or one cloud provider
|
|
# 5) stop a running instance or all of them across all or one cloud provider
|
|
# 6) reboot a running instance or all of them across all or one cloud provider
|
|
# 7) list images available for a provider
|
|
# 8) list sizes available for a provider
|
|
# 9) list locations available for a provider
|
|
# 10) run a script during the creation of a new instance to deploy docker services
|
|
# 11) ssh to an instance with a choice across all or one cloud provider
|
|
# all from the command line using flags
|
|
|
|
import os
|
|
import sys
|
|
import argparse
|
|
import time
|
|
import paramiko
|
|
import socket
|
|
from dotenv import load_dotenv
|
|
from libcloud.compute.types import Provider
|
|
from libcloud.compute.providers import get_driver
|
|
from libcloud.compute.base import NodeAuthSSHKey
|
|
from libcloud.compute.deployment import ScriptDeployment, MultiStepDeployment, ScriptFileDeployment
|
|
from azure.identity import ClientSecretCredential
|
|
from azure.mgmt.resource import ResourceManagementClient
|
|
from azure.mgmt.network import NetworkManagementClient
|
|
from azure.mgmt.network.v2022_07_01.models import SecurityRule
|
|
|
|
# Declare the ENV_FILE variable as such to always reside in the same directory as the script
|
|
# We use os.path.join to make sure the path is correct for every OS
|
|
# Also do the same for the ssh keys and the script to be used during deployment
|
|
ENV_FILE = os.path.join(os.path.dirname(__file__), ".env")
|
|
SECDEP_SSH_PUBLIC_KEY = os.path.join(os.path.dirname(__file__), "secdep.pub")
|
|
SECDEP_SSH_PRIVATE_KEY = os.path.join(os.path.dirname(__file__), "secdep")
|
|
SECDEP_DEPLOY_SCRIPT = os.path.join(os.path.dirname(__file__), "harden")
|
|
|
|
# Available choices when the action flag is used
|
|
action_choices = ["delete","start","stop","reboot","deleteall","startall","stopall","rebootall"]
|
|
|
|
# If no arguements were given let the user know this is not how to use this program
|
|
if not len(sys.argv) > 1:
|
|
print("No arguments passed. Use -h or --help for help")
|
|
exit(0)
|
|
# Define the command line arguments
|
|
parser = argparse.ArgumentParser(
|
|
prog='secdep.py',
|
|
description='Manage cloud instances',
|
|
)
|
|
parser.add_argument('-l', '--list', help='List all instances or with -P PROVIDER list a provider\'s instances', action='store_true')
|
|
parser.add_argument('-e', '--edit', help='Change credential values', action='store_true')
|
|
parser.add_argument('-v', '--version', help='Show secdep\'s version', action='store_true')
|
|
parser.add_argument('-P', '--provider', help='Cloud provider', choices=['gce', 'azure', 'aws'])
|
|
parser.add_argument('-a', '--action', help='Action to perform on a single provider with -P PROVIDER or all instances. Valid options are delete[all] start[all] stop[all] reboot[all]', choices=action_choices, metavar='ACTION')
|
|
parser.add_argument('-c', '--create', help='Create an instance', action='store_true')
|
|
parser.add_argument('-dep', '--deploy', help='Docker images to deploy', type=str, nargs='*', default=None, required=False)
|
|
parser.add_argument('-I', '--listimages', help='List images', action='store_true')
|
|
parser.add_argument('-S', '--listsizes', help='List sizes', action='store_true')
|
|
parser.add_argument('-G', '--listlocations', help='List locations', action='store_true')
|
|
parser.add_argument('-i', '--image', help='Image to use')
|
|
parser.add_argument('-s', '--size', help='Size of instance')
|
|
parser.add_argument('-n', '--name', help='Name of instance')
|
|
parser.add_argument('-g', '--region', help='Region to use')
|
|
parser.add_argument('-y', '--yes', help='Do not ask for confirmation during creation', action='store_true')
|
|
parser.add_argument('-p', '--print', help='Also print node, image, location or size', action='store_true')
|
|
parser.add_argument('-port', '--port', help='Port to connect to when using ssh')
|
|
parser.add_argument('-awsregion', '--awsregion', help='Specify aws region to not have to go through all of them')
|
|
parser.add_argument('-ssh', '--ssh', help='Connect to an instance using ssh with the option to use -P PROVIDER to choose node from a specific provider', action='store_true')
|
|
parser.add_argument('-init', '--init', help='Initialize a specific provider\'s values' , choices=['gce', 'azure', 'aws'])
|
|
args = parser.parse_args()
|
|
|
|
def show_version():
|
|
print("SecDep - Automated secure docker services deployment\nVersion: v1.0.0\nRepo: https://git.konsthol.eu/konsthol/SecDep")
|
|
|
|
if args.version:
|
|
show_version()
|
|
exit(0)
|
|
|
|
# If one or both keys don't exist we create them
|
|
if not os.path.exists(SECDEP_SSH_PUBLIC_KEY) or not os.path.exists(SECDEP_SSH_PRIVATE_KEY):
|
|
# Generate a new SSH key pair
|
|
# The key is stored in the current directory and named secdep
|
|
# The public key is stored in the current directory and named secdep.pub
|
|
# The passphrase is an empty string
|
|
# The key is a 4096 bit RSA key
|
|
# The key's comment is secdep@hostname
|
|
key = paramiko.RSAKey.generate(4096)
|
|
key.write_private_key_file(SECDEP_SSH_PRIVATE_KEY)
|
|
with open(SECDEP_SSH_PUBLIC_KEY, 'w') as f:
|
|
f.write("%s %s secdep@%s" % (key.get_name(), key.get_base64(), socket.gethostname()))
|
|
|
|
# We check if the env file it exists already in order to avoid overwriting it
|
|
# and if it doesn't exist, we create it by inserting an empty string
|
|
|
|
# When using the with statement, the file is automatically
|
|
# closed at the end of the indented block
|
|
if not os.path.exists(ENV_FILE):
|
|
with open(ENV_FILE, 'w') as f:
|
|
f.write('')
|
|
|
|
# The required values for authentication are stored in the .env file in the form of KEY=VALUE
|
|
# These are
|
|
# 1) SECDEP_GCE_CLIENT_ID (the service account Email found in project's IAM & Admin section/Service Accounts)
|
|
# 2) SECDEP_GCE_CLIENT_SECRET (the service account's private Key ID found in project's IAM & Admin section/Service Accounts)
|
|
# 3) SECDEP_GCE_PROJECT_ID (the project ID found in project's dashboard)
|
|
# 4) SECDEP_AZURE_TENANT_ID (the tenant id found when viewing the azure subscription)
|
|
# 5) SECDEP_AZURE_SUB_ID (documented in the README)
|
|
# 6) SECDEP_AZURE_APP_ID (documented in the README)
|
|
# 7) SECDEP_AZURE_PASSWORD (documented in the README)
|
|
# 8) SECDEP_AWS_ACCESS_KEY (that we created in the aws IAM section)
|
|
# 9) SECDEP_AWS_SECRET_KEY (that we viewed only once when we created the key)
|
|
|
|
# For GCE we need to create a service account (with Owner Role from the IAM section) and download the json file (from
|
|
# the Service Account's manage keys section) in the same directory as the script
|
|
|
|
# We then check if the .env file is empty to determine if it's the first run of the script
|
|
if os.stat(ENV_FILE).st_size == 0:
|
|
if args.init:
|
|
match args.init:
|
|
case "gce":
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AZURE_TENANT_ID=\n')
|
|
f.write('SECDEP_AZURE_SUB_ID=\n')
|
|
f.write('SECDEP_AZURE_APP_ID=\n')
|
|
f.write('SECDEP_AZURE_PASSWORD=\n')
|
|
f.write('SECDEP_AWS_ACCESS_KEY=\n')
|
|
f.write('SECDEP_AWS_SECRET_KEY=\n')
|
|
case "azure":
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_GCE_CLIENT_ID=\n')
|
|
f.write('SECDEP_GCE_CLIENT_SECRET=\n')
|
|
f.write('SECDEP_GCE_PROJECT_ID=\n')
|
|
f.write('SECDEP_AWS_ACCESS_KEY=\n')
|
|
f.write('SECDEP_AWS_SECRET_KEY=\n')
|
|
case "aws":
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_GCE_CLIENT_ID=\n')
|
|
f.write('SECDEP_GCE_CLIENT_SECRET=\n')
|
|
f.write('SECDEP_GCE_PROJECT_ID=\n')
|
|
f.write('SECDEP_AZURE_TENANT_ID=\n')
|
|
f.write('SECDEP_AZURE_SUB_ID=\n')
|
|
f.write('SECDEP_AZURE_APP_ID=\n')
|
|
f.write('SECDEP_AZURE_PASSWORD=\n')
|
|
case _:
|
|
print("Invalid provider")
|
|
else:
|
|
print('You will be asked for each needed value\nIf you want to skip a provider press enter on each of their values because they are all needed for authentication\nIf at some point you delete the provider\'s value entry you will once again be asked to enter it\nIf you pressed enter by mistake or inserted an incorrect value just edit the file directly or delete the corresponding line\nThere is also the choice of using the -e option to have that done interactively')
|
|
|
|
if os.stat(ENV_FILE).st_size != 0 and args.init:
|
|
print("The init flag was only meant to be optionally run once and only in the first run if you knew you were going to be using only one provider. If you need to change or populate a provider\'s needed values use the --edit or -e flag instead")
|
|
exit(0)
|
|
|
|
# We search for these values in the ENV_FILE and for each not found, we prompt the user to enter it
|
|
# We then write the values to the ENV_FILE
|
|
# An empty string is allowed in case the user does not want to use a particular cloud provider
|
|
# but he will be prompted for all values
|
|
with open(ENV_FILE, 'r') as f:
|
|
env_file_content = f.read()
|
|
if 'SECDEP_GCE_CLIENT_ID' not in env_file_content:
|
|
SECDEP_GCE_CLIENT_ID = input("Enter your GCE_CLIENT_ID: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_GCE_CLIENT_ID={}\n'.format(SECDEP_GCE_CLIENT_ID))
|
|
if 'SECDEP_GCE_CLIENT_SECRET' not in env_file_content:
|
|
SECDEP_GCE_CLIENT_SECRET = input("Enter your GCE_CLIENT_SECRET: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_GCE_CLIENT_SECRET={}\n'.format(SECDEP_GCE_CLIENT_SECRET))
|
|
if 'SECDEP_GCE_PROJECT_ID' not in env_file_content:
|
|
SECDEP_GCE_PROJECT_ID = input("Enter your GCE_PROJECT_ID: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_GCE_PROJECT_ID={}\n'.format(SECDEP_GCE_PROJECT_ID))
|
|
if 'SECDEP_AZURE_TENANT_ID' not in env_file_content:
|
|
SECDEP_AZURE_TENANT_ID = input("Enter your AZURE_TENANT_ID: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AZURE_TENANT_ID={}\n'.format(SECDEP_AZURE_TENANT_ID))
|
|
if 'SECDEP_AZURE_SUB_ID' not in env_file_content:
|
|
SECDEP_AZURE_SUB_ID = input("Enter your AZURE_SUB_ID: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AZURE_SUB_ID={}\n'.format(SECDEP_AZURE_SUB_ID))
|
|
if 'SECDEP_AZURE_APP_ID' not in env_file_content:
|
|
SECDEP_AZURE_APP_ID = input("Enter your AZURE_APP_ID: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AZURE_APP_ID={}\n'.format(SECDEP_AZURE_APP_ID))
|
|
if 'SECDEP_AZURE_PASSWORD' not in env_file_content:
|
|
SECDEP_AZURE_PASSWORD = input("Enter your AZURE_PASSWORD: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AZURE_PASSWORD={}\n'.format(SECDEP_AZURE_PASSWORD))
|
|
if 'SECDEP_AWS_ACCESS_KEY' not in env_file_content:
|
|
SECDEP_AWS_ACCESS_KEY = input("Enter your AWS_ACCESS_KEY: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AWS_ACCESS_KEY={}\n'.format(SECDEP_AWS_ACCESS_KEY))
|
|
if 'SECDEP_AWS_SECRET_KEY' not in env_file_content:
|
|
SECDEP_AWS_SECRET_KEY = input("Enter your AWS_SECRET_KEY: ")
|
|
with open(ENV_FILE, 'a') as f:
|
|
f.write('SECDEP_AWS_SECRET_KEY={}\n'.format(SECDEP_AWS_SECRET_KEY))
|
|
|
|
# Load environment variables from ENV_FILE and temporarily store them
|
|
# along the other system environment variables
|
|
# If an environment variable is already set, it will not be overwritten
|
|
# but since the existence of the .env file is mandatory it is best if
|
|
# they are not already set.
|
|
# That is because some of them may be named something slightly different
|
|
# by the user and this program works with these exact value names
|
|
# That is also the reason they are prefixed with the SECDEP_ string
|
|
load_dotenv(ENV_FILE)
|
|
|
|
# We also store them in variables for ease of use inside the program
|
|
# We take for granted that these values exist either empty or not
|
|
|
|
def get_env_vars():
|
|
# Make them global so we can use them in other functions
|
|
global SECDEP_GCE_CLIENT_ID
|
|
global SECDEP_GCE_CLIENT_SECRET
|
|
global SECDEP_GCE_PROJECT_ID
|
|
global SECDEP_AZURE_TENANT_ID
|
|
global SECDEP_AZURE_SUB_ID
|
|
global SECDEP_AZURE_APP_ID
|
|
global SECDEP_AZURE_PASSWORD
|
|
global SECDEP_AWS_ACCESS_KEY
|
|
global SECDEP_AWS_SECRET_KEY
|
|
# GCE
|
|
SECDEP_GCE_CLIENT_ID = os.getenv('SECDEP_GCE_CLIENT_ID')
|
|
SECDEP_GCE_CLIENT_SECRET = os.getenv('SECDEP_GCE_CLIENT_SECRET')
|
|
SECDEP_GCE_PROJECT_ID = os.getenv('SECDEP_GCE_PROJECT_ID')
|
|
if SECDEP_GCE_CLIENT_SECRET !="" and SECDEP_GCE_PROJECT_ID !="":
|
|
SECDEP_GCE_CLIENT_SECRET = os.path.join(os.path.dirname(os.path.abspath(__file__)), SECDEP_GCE_PROJECT_ID+'-'+SECDEP_GCE_CLIENT_SECRET[:12]+'.json')
|
|
# Never mind the error after converting is not None to !="" because only then
|
|
# this variable doesnt end up as /home/konsthol/MyGitea/SecDep/-.json
|
|
# Azure
|
|
SECDEP_AZURE_TENANT_ID = os.getenv('SECDEP_AZURE_TENANT_ID')
|
|
SECDEP_AZURE_SUB_ID = os.getenv('SECDEP_AZURE_SUB_ID')
|
|
SECDEP_AZURE_APP_ID = os.getenv('SECDEP_AZURE_APP_ID')
|
|
SECDEP_AZURE_PASSWORD = os.getenv('SECDEP_AZURE_PASSWORD')
|
|
# AWS
|
|
SECDEP_AWS_ACCESS_KEY = os.getenv('SECDEP_AWS_ACCESS_KEY')
|
|
SECDEP_AWS_SECRET_KEY = os.getenv('SECDEP_AWS_SECRET_KEY')
|
|
|
|
get_env_vars()
|
|
|
|
# List all the entries in the .env file and ask the user which one he wants to update
|
|
# If the user enters an invalid value, the program will ask again
|
|
# If the user enters 0 the program will exit
|
|
def update_env_file():
|
|
with open(ENV_FILE, 'r') as f:
|
|
env_file_content = f.read()
|
|
# find all lines staring with SECDEP_
|
|
file_entries = list(filter(lambda x: x.startswith('SECDEP_'), env_file_content.split('\n')))
|
|
count = 0
|
|
for line in file_entries:
|
|
count += 1
|
|
print("{}) {}".format(count, line))
|
|
print("Choosing 0 will exit the function")
|
|
print("You will be asked to enter the new value until it is valid or you enter 0")
|
|
choice = input("Choose the entry you want to update: ")
|
|
try:
|
|
choice = int(choice)
|
|
if choice > count or choice < 0:
|
|
raise ValueError
|
|
elif choice == 0:
|
|
return
|
|
except ValueError:
|
|
print("Invalid choice")
|
|
update_env_file()
|
|
else:
|
|
entry = file_entries[choice - 1]
|
|
entry_name = entry.split('=')[0]
|
|
entry_value = entry.split('=')[1]
|
|
if entry_value == '':
|
|
entry_value = 'None'
|
|
print("The current value for {} is {}".format(entry_name, entry_value))
|
|
new_value = input("Enter the new value: ")
|
|
with open(ENV_FILE, 'w') as f:
|
|
f.write(env_file_content.replace(entry, "{}={}".format(entry_name, new_value)))
|
|
print("The value for {} was updated successfully".format(entry_name))
|
|
update_env_file()
|
|
# Reload the environment variables
|
|
# That was setup this way because the initial thought was exiting manually but it will stay that way just in case we do end up making it like so
|
|
load_dotenv(ENV_FILE)
|
|
get_env_vars()
|
|
|
|
# If -e or --edit is passed, call the update_env_file function
|
|
if args.edit:
|
|
update_env_file()
|
|
exit(0)
|
|
|
|
# AWS and AZURE have thousands of image choice so we hardcode the ones we want in order to not wait forever during the input validation
|
|
AWS_ubuntu22_04_images = {
|
|
"ap-northeast-1": "ami-0cd7ad8676931d727",
|
|
"ap-south-1": "ami-06984ea821ac0a879",
|
|
"ca-central-1": "ami-0dae3a932d090b3de",
|
|
"eu-central-1": "ami-03e08697c325f02ab",
|
|
"eu-north-1": "ami-00c70b245f5354c0a",
|
|
"eu-west-1": "ami-0333305f9719618c7",
|
|
"sa-east-1": "ami-015e30624fffff117",
|
|
"us-east-1": "ami-00874d747dde814fa",
|
|
"us-west-1": "ami-09b2a1e33ce552e68",
|
|
"ap-northeast-2": "ami-09eba584c30b7299f",
|
|
"ap-southeast-2": "ami-0c18f3cdeea1c220d",
|
|
"eu-west-2": "ami-0d09654d0a20d3ae2",
|
|
"us-east-2": "ami-0ab0629dba5ae551d",
|
|
"us-west-2": "ami-095413544ce52437d",
|
|
"ap-northeast-3": "ami-0ead712799090892e",
|
|
"eu-west-3": "ami-0afd55c0c8a52973a"
|
|
}
|
|
AWS_ubuntu22_10_images = {
|
|
"ap-northeast-1": "ami-04e096919731466e4",
|
|
"ap-south-1": "ami-01b60efb0632e8b18",
|
|
"ap-southeast-1": "ami-085ecfe4d567e153a",
|
|
"ca-central-1": "ami-010346a896f698f7d",
|
|
"eu-central-1": "ami-0f1cf34dcb4057a5f",
|
|
"eu-north-1": "ami-0e942149c97ff88bd",
|
|
"eu-west-1": "ami-015423a987dafce81",
|
|
"sa-east-1": "ami-06edb0fb80530aa8b",
|
|
"us-east-1": "ami-074f5b0bdbdc43210",
|
|
"us-west-1": "ami-0eb5f373317fb0ae4",
|
|
"ap-northeast-2": "ami-05493e234687bd083",
|
|
"ap-southeast-2": "ami-0bd29331dcb023a43",
|
|
"eu-west-2": "ami-0ae7948375d66d902",
|
|
"us-east-2": "ami-0de381f43eb6dbe39",
|
|
"us-west-2": "ami-0534f435d9dd0ece4",
|
|
"ap-northeast-3": "ami-05ede9a3a46934154",
|
|
"eu-west-3": "ami-0545575c963ed1276"
|
|
}
|
|
AWS_debian_10_images = {
|
|
"ap-northeast-1": "ami-041e370f47f9b619e",
|
|
"ap-northeast-2": "ami-0243bb2bec2d9707b",
|
|
"ap-northeast-3": "ami-0c1c0379b3534e7d8",
|
|
"ap-south-1": "ami-0eb2c4104acb437b2",
|
|
"ap-southeast-1": "ami-0ee39036464b9a87e",
|
|
"ap-southeast-2": "ami-0bb99834ae8c7471e",
|
|
"ca-central-1": "ami-0125327537ef16282",
|
|
"eu-central-1": "ami-0c984d7a384cafb51",
|
|
"eu-north-1": "ami-013fff3fbe1b44cd7",
|
|
"eu-west-1": "ami-00aa3f69e07141166",
|
|
"eu-west-2": "ami-073e61682f2137943",
|
|
"eu-west-3": "ami-0fa84148519465f59",
|
|
"sa-east-1": "ami-03405dcb7a98e974b",
|
|
"us-east-1": "ami-03d6e2aceefaa35b0",
|
|
"us-east-2": "ami-0246e87085c5c98e3",
|
|
"us-west-1": "ami-0809b44a732f37188",
|
|
"us-west-2": "ami-0164ab05efc075cbc"
|
|
}
|
|
AWS_debian_11_images = {
|
|
"ap-northeast-1": "ami-043fed2cdcba4027e",
|
|
"ap-northeast-2": "ami-0bb0231c184073ac1",
|
|
"ap-northeast-3": "ami-09968ae34a843a6cb",
|
|
"ap-south-1": "ami-079b117c1800d30f8",
|
|
"ap-southeast-1": "ami-07ac0a74d21a3174c",
|
|
"ap-southeast-2": "ami-0c7a13e86ce7afc80",
|
|
"ca-central-1": "ami-09b3e61273dd34f3b",
|
|
"eu-central-1": "ami-0c75b861029de4030",
|
|
"eu-north-1": "ami-08869bacfa1188ec9",
|
|
"eu-west-1": "ami-0591c8c8aa7d9b217",
|
|
"eu-west-2": "ami-0e789c3dd24faa0be",
|
|
"eu-west-3": "ami-040dc155c278da35a",
|
|
"sa-east-1": "ami-0cb45622734c55ed6",
|
|
"us-east-1": "ami-052465340e6b59fc0",
|
|
"us-east-2": "ami-06a7641d5bd7bdc65",
|
|
"us-west-1": "ami-0097d5326aebc68e0",
|
|
"us-west-2": "ami-05063446e767da4ff"
|
|
}
|
|
AWS_centos7_images = {
|
|
"eu-north-1": "ami-0e5125a0f19c52a2b",
|
|
"eu-west-2": "ami-0de2f45684e59282c",
|
|
"us-west-1": "ami-0bcd12d19d926f8e9",
|
|
"eu-central-1": "ami-0afcbcee3dfbce929",
|
|
"us-east-1": "ami-0aedf6b1cb669b4c7",
|
|
"ap-south-1": "ami-09f129ee53d3523c0",
|
|
"ap-northeast-1": "ami-06e6d2122baa563c4",
|
|
"ap-northeast-2": "ami-061f5322ab2662c82",
|
|
"eu-west-3": "ami-051806c39fa542e22",
|
|
"us-west-2": "ami-04f798ca92cc13f74",
|
|
"ap-southeast-1": "ami-03bfba2e75432064e",
|
|
"us-east-2": "ami-033adaf0b583374d4",
|
|
"ap-southeast-2": "ami-0264ead5294ad1773",
|
|
"ca-central-1": "ami-01ebef6e00efb2c20",
|
|
"sa-east-1": "ami-015f6bf0657816a2d",
|
|
"eu-west-1": "ami-00d464afa64e1fc69"
|
|
}
|
|
AWS_centos8_images = {
|
|
"sa-east-1": "ami-0ec17e5479978d435",
|
|
"ap-southeast-2": "ami-0cd15beeae86bd0b5",
|
|
"us-east-1": "ami-0c07df890a618c98a",
|
|
"eu-central-1": "ami-0b79da023fb461a12",
|
|
"us-west-2": "ami-09195cb76ab892888",
|
|
"eu-west-1": "ami-0819edf1cd94e83e8",
|
|
"ap-southeast-1": "ami-07ab649c51b1c14e7",
|
|
"eu-north-1": "ami-05eaebdafff627949",
|
|
"us-east-2": "ami-05cefb3ebaddc75f6",
|
|
"eu-west-3": "ami-05a3b9ccef6b9a4f4",
|
|
"ap-south-1": "ami-04ebf66b7be0500f6",
|
|
"eu-west-2": "ami-0495083a5dc6bc6a3",
|
|
"us-west-1": "ami-033e1fe6304139f4c",
|
|
"ap-northeast-2": "ami-014911a31aba94953",
|
|
"ap-northeast-1": "ami-0117f2fc9c6939327",
|
|
"ca-central-1": "ami-00723d0970fc53863"
|
|
}
|
|
AWS_centos9_images = {
|
|
"us-west-2": "ami-0e27c3746a0d5ecbf",
|
|
"sa-east-1": "ami-0c70afd15bcb126a9",
|
|
"eu-north-1": "ami-0a942e3eea51f9810",
|
|
"ap-southeast-2": "ami-09825374904820651",
|
|
"us-west-1": "ami-08e31531a8310da78",
|
|
"eu-west-1": "ami-08be94d0e177189de",
|
|
"eu-west-3": "ami-082f57b7c23b057df",
|
|
"ap-northeast-1": "ami-074800b0d58e64b24",
|
|
"ap-southeast-1": "ami-05a6e3d785f747c7d",
|
|
"eu-west-2": "ami-056117c19265dad25",
|
|
"ca-central-1": "ami-03f6ca47d93885ab9",
|
|
"ap-south-1": "ami-0383b9760ad3de192",
|
|
"us-east-1": "ami-027a785419f41ea0f",
|
|
"ap-northeast-2": "ami-025fab85b691896e8",
|
|
"us-east-2": "ami-0127d4ce241322a8e",
|
|
"eu-central-1": "ami-00cdc2b0769957e1c"
|
|
}
|
|
AWS_fedora37_images = {
|
|
"us-east-1": "ami-023fb534213ca41da",
|
|
"us-east-2": "ami-0d9ef71e892f861c6",
|
|
"us-west-2": "ami-019b893191a9ac44a",
|
|
"us-west-1": "ami-04e37334d4e907fab",
|
|
"eu-west-1": "ami-0f242738c5379ffc1",
|
|
"eu-central-1": "ami-0965c162c412da7ca",
|
|
"eu-west-2": "ami-0257e646e0a4b4987",
|
|
"ap-southeast-1": "ami-002185f8a7d5528e2",
|
|
"ap-northeast-1": "ami-0e010569d0798fa05",
|
|
"ap-southeast-2": "ami-028fb965bf530cd3e",
|
|
"sa-east-1": "ami-0390b84962fd284f8",
|
|
"ap-northeast-2": "ami-0902b5ee3ed4ebe17",
|
|
"ap-south-1": "ami-04e6a16b463b1dbe0",
|
|
"ca-central-1": "ami-057f927818ad393c5"
|
|
}
|
|
AWS_redhat9_images = {
|
|
"eu-north-1": "ami-0cd776c8201793f81",
|
|
"ap-south-1": "ami-063d0d3250553f017",
|
|
"eu-west-3": "ami-0b6b7402cc4708282",
|
|
"eu-west-2": "ami-03628db51da52eeaa",
|
|
"eu-west-1": "ami-028f9616b17ba1d53",
|
|
"ap-northeast-3": "ami-088c289c3f07fa115",
|
|
"ap-northeast-2": "ami-000847072b0b35502",
|
|
"ap-northeast-1": "ami-0b74caa65e36e4b38",
|
|
"sa-east-1": "ami-03f8004d2ba700e6c",
|
|
"ca-central-1": "ami-0c23a35603e3d8ba4",
|
|
"ap-southeast-1": "ami-07a79552200256856",
|
|
"ap-southeast-2": "ami-0fe791c0ace58322c",
|
|
"eu-central-1": "ami-025d24108be0a614c",
|
|
"us-east-1": "ami-0c41531b8d18cc72b",
|
|
"us-east-2": "ami-078cbc4c2d057c244",
|
|
"us-west-1": "ami-0fa0ed170a59f4917",
|
|
"us-west-2": "ami-04a616933df665b44"
|
|
}
|
|
AWS_redhat8_6_images = {
|
|
"eu-north-1": "ami-06a2a41d455060f8b",
|
|
"ap-south-1": "ami-05c8ca4485f8b138a",
|
|
"eu-west-3": "ami-0460bf124812bebfa",
|
|
"eu-west-2": "ami-035c5dc086849b5de",
|
|
"eu-west-1": "ami-0f0f1c02e5e4d9d9f",
|
|
"ap-northeast-3": "ami-044921b7897a7e0da",
|
|
"ap-northeast-2": "ami-06c568b08b5a431d5",
|
|
"ap-northeast-1": "ami-0f903fb156f24adbf",
|
|
"sa-east-1": "ami-0c1b8b886626f940c",
|
|
"ca-central-1": "ami-0c3d3a230b9668c02",
|
|
"ap-southeast-1": "ami-051f0947e420652a9",
|
|
"ap-southeast-2": "ami-0808460885ff81045",
|
|
"eu-central-1": "ami-0e7e134863fac4946",
|
|
"us-east-1": "ami-06640050dc3f556bb",
|
|
"us-east-2": "ami-092b43193629811af",
|
|
"us-west-1": "ami-0186e3fec9b0283ee",
|
|
"us-west-2": "ami-08970fb2e5767e3b8"
|
|
}
|
|
AWS_redhat7_9_images = {
|
|
"eu-north-1": "ami-003fb5b0ea327060c",
|
|
"ap-south-1": "ami-0b6d1128312a13b2a",
|
|
"eu-west-3": "ami-0f4643887b8afe9e2",
|
|
"eu-west-2": "ami-0e6c172f77df9f9c3",
|
|
"eu-west-1": "ami-020e14de09d1866b4",
|
|
"ap-northeast-3": "ami-00718a107dacde79f",
|
|
"ap-northeast-2": "ami-0c851e892c33af909",
|
|
"ap-northeast-1": "ami-0155fdd0956a0c7a0",
|
|
"sa-east-1": "ami-07eca9d9caaced495",
|
|
"ca-central-1": "ami-0de9a412a63b8f99d",
|
|
"ap-southeast-1": "ami-0f24fbd3cc8531844",
|
|
"ap-southeast-2": "ami-0fb87e863747a1610",
|
|
"eu-central-1": "ami-0f58468b80db2db66",
|
|
"us-east-1": "ami-005b7876121b7244d",
|
|
"us-east-2": "ami-0d2bf41df19c4aac7",
|
|
"us-west-1": "ami-015474e24281c803d",
|
|
"us-west-2": "ami-02d40d11bb3aaf3e5"
|
|
}
|
|
AWS_opensuseLeap15_3_images = {
|
|
"ap-south-1": "ami-0ade60d62f2a2e05c",
|
|
"eu-north-1": "ami-0ae983da6ffb9b1e7",
|
|
"eu-west-3": "ami-025ea6b220205eeda",
|
|
"eu-west-2": "ami-0c912bbb879286143",
|
|
"eu-west-1": "ami-0397bb96c927b3747",
|
|
"ap-northeast-3": "ami-073fffb8542446f02",
|
|
"ap-northeast-2": "ami-0a4130f336deb5d7d",
|
|
"ap-northeast-1": "ami-093be1d241fe4f400",
|
|
"ca-central-1": "ami-07b73495c9189e14c",
|
|
"sa-east-1": "ami-02f22e7a3a61b9ad4",
|
|
"ap-southeast-1": "ami-0e2676834fdb2722d",
|
|
"ap-southeast-2": "ami-0d75289309da084dd",
|
|
"eu-central-1": "ami-0ca8f0b74d5fe4b0c",
|
|
"us-east-1": "ami-0a21376f8d02ffa2d",
|
|
"us-east-2": "ami-0a3fdbf842659345d",
|
|
"us-west-1": "ami-0feb167c171099332",
|
|
"us-west-2": "ami-0eb50cf5b36982ab5",
|
|
}
|
|
AWS_opensuseLeap15_4_images = {
|
|
"ap-south-1": "ami-0c936741ae62acefd",
|
|
"eu-north-1": "ami-06f677915bcf57a3f",
|
|
"eu-west-3": "ami-0fcb2baaff359470d",
|
|
"eu-west-2": "ami-0d75aefcfe115e1b1",
|
|
"eu-west-1": "ami-04c349804a22e1a81",
|
|
"ap-northeast-3": "ami-0ce8958d99aded398",
|
|
"ap-northeast-2": "ami-0d6202fde5a0672cb",
|
|
"ap-northeast-1": "ami-0ad77d12fa9be7d26",
|
|
"ca-central-1": "ami-08d3a675ff259e79b",
|
|
"sa-east-1": "ami-05c679febf019e22b",
|
|
"ap-southeast-1": "ami-0eff8b51447b310c8",
|
|
"ap-southeast-2": "ami-0050fc1b597e7e5c7",
|
|
"eu-central-1": "ami-04050bb7554762bec",
|
|
"us-east-1": "ami-08159a7e0bbb30b75",
|
|
"us-east-2": "ami-028019dea1a954aa4",
|
|
"us-west-1": "ami-0685f2266425e1dec",
|
|
"us-west-2": "ami-02881e3769e7c9ab2"
|
|
}
|
|
|
|
AWS_images = {
|
|
"Ubuntu Server 22.04 LTS": AWS_ubuntu22_04_images,
|
|
"Ubuntu Server 22.10": AWS_ubuntu22_10_images,
|
|
"Debian 10": AWS_debian_10_images,
|
|
"Debian 11": AWS_debian_11_images,
|
|
"CentOS 7": AWS_centos7_images,
|
|
"CentOS 8": AWS_centos8_images,
|
|
"CentOS 9": AWS_centos9_images,
|
|
"Fedora 37": AWS_fedora37_images,
|
|
"Red Hat Enterprise Linux 7.9": AWS_redhat7_9_images,
|
|
"Red Hat Enterprise Linux 8.6": AWS_redhat8_6_images,
|
|
"Red Hat Enterprise Linux 9.0": AWS_redhat9_images,
|
|
"OpenSUSE Leap 15.3": AWS_opensuseLeap15_3_images,
|
|
"OpenSUSE Leap 15.4": AWS_opensuseLeap15_4_images
|
|
}
|
|
|
|
AZURE_images = {
|
|
"Ubuntu Server 22.04 LTS": "Canonical:0001-com-ubuntu-server-jammy:22_04-lts:22.04.202301050",
|
|
"Ubuntu Server 22.10": "Canonical:0001-com-ubuntu-server-kinetic:22_10:22.10.202301040",
|
|
"Debian 10": "Debian:debian-11:11:0.20221219.1234",
|
|
"Debian 11": "Debian:debian-10:10:0.20221205.1220",
|
|
"CentOS 8.4": "OpenLogic:CentOS:8_4:8.4.2021071900",
|
|
"CentOS 8.5": "OpenLogic:CentOS:8_5:8.5.2022101800",
|
|
"Fedora 36": "ntegralinc1586961136942:ntg_fedora_36:ntg_fedora_36:1.0.1",
|
|
"Fedora 37": "ntegralinc1586961136942:ntg_fedora_37:ntg_fedora_37:1.0.0",
|
|
"Red Hat Enterprise Linux 8.6": "RedHat:rhel-raw:8_6:8.6.2022052401",
|
|
"Red Hat Enterprise Linux 9.1": "RedHat:rhel-raw:9_1:9.1.2022112213",
|
|
"OpenSUSE Leap 15.3": "SUSE:opensuse-leap-15-3:gen1:2022.11.04",
|
|
"OpenSUSE Leap 15.4": "SUSE:opensuse-leap-15-4:gen1:2022.11.04"
|
|
}
|
|
|
|
# Declare the global variables for the drivers
|
|
global gce_driver
|
|
global azure_driver
|
|
global aws_driver
|
|
global providers_quantity
|
|
|
|
# Get GCE driver
|
|
def get_gce_driver():
|
|
if SECDEP_GCE_CLIENT_SECRET !="" and SECDEP_GCE_PROJECT_ID !="" and SECDEP_GCE_CLIENT_ID !="":
|
|
driver = get_driver(Provider.GCE)
|
|
print("Trying to authenticate with google...\n")
|
|
return driver(SECDEP_GCE_CLIENT_ID, SECDEP_GCE_CLIENT_SECRET, project=SECDEP_GCE_PROJECT_ID)
|
|
|
|
# Get Azure driver
|
|
def get_azure_driver():
|
|
if SECDEP_AZURE_TENANT_ID !="" and SECDEP_AZURE_SUB_ID !="" and SECDEP_AZURE_APP_ID !="" and SECDEP_AZURE_PASSWORD !="":
|
|
driver = get_driver(Provider.AZURE_ARM)
|
|
print("Trying to authenticate with azure...\n")
|
|
return driver(tenant_id=SECDEP_AZURE_TENANT_ID, subscription_id=SECDEP_AZURE_SUB_ID, key=SECDEP_AZURE_APP_ID, secret=SECDEP_AZURE_PASSWORD)
|
|
|
|
# Get AWS driver
|
|
def get_aws_driver():
|
|
if SECDEP_AWS_ACCESS_KEY !="" and SECDEP_AWS_SECRET_KEY !="":
|
|
driver = get_driver(Provider.EC2)
|
|
print("Trying to authenticate with amazon...\n")
|
|
return driver(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY)
|
|
|
|
# We need to know the quantity to print the loading percentage when getting the list of all the nodes
|
|
def get_providers_quantity():
|
|
providers_quantity = 0
|
|
if SECDEP_GCE_CLIENT_SECRET !="" and SECDEP_GCE_PROJECT_ID !="" and SECDEP_GCE_CLIENT_ID !="":
|
|
providers_quantity +=1
|
|
if SECDEP_AZURE_TENANT_ID !="" and SECDEP_AZURE_SUB_ID !="" and SECDEP_AZURE_APP_ID !="" and SECDEP_AZURE_PASSWORD !="":
|
|
providers_quantity +=1
|
|
if SECDEP_AWS_ACCESS_KEY !="" and SECDEP_AWS_SECRET_KEY !="":
|
|
providers_quantity +=1
|
|
return providers_quantity
|
|
|
|
providers_quantity = get_providers_quantity()
|
|
|
|
gce_driver = get_gce_driver()
|
|
azure_driver = get_azure_driver()
|
|
aws_driver = get_aws_driver()
|
|
|
|
# We call this function in almost every other function in order to not keep remaking the driver
|
|
def get_corresponding_driver(provider):
|
|
global driver
|
|
match provider:
|
|
case "gce":
|
|
driver = gce_driver
|
|
case "azure":
|
|
driver = azure_driver
|
|
case "aws":
|
|
driver = aws_driver
|
|
case _:
|
|
print("Invalid provider")
|
|
assert driver is not None, "You need to set all {} environment variables first".format(provider.upper())
|
|
return driver
|
|
|
|
# This function takes a provider arguement and lists all the available sizes
|
|
def list_provider_sizes(provider):
|
|
print("Getting "+provider+" sizes...")
|
|
driver = get_corresponding_driver(provider)
|
|
if provider == "aws" or provider == "gce":
|
|
sizes = driver.list_sizes(location=None)
|
|
sizes = [size for size in sizes if size.ram < 16384]
|
|
else:
|
|
azlocation = driver.list_locations()[0]
|
|
sizes = driver.list_sizes(location=azlocation)
|
|
sizes = [size for size in sizes if size.ram < 16384]
|
|
count = 0
|
|
print("Available "+provider+" sizes")
|
|
if provider == "aws":
|
|
for size in sizes:
|
|
count += 1
|
|
print("{}) {}\n\nRam: {}\nDisk: {}\nBandwidth: {}\nPrice: {}\n".format(count, size.name, size.ram, size.disk, size.bandwidth, size.price))
|
|
elif provider == "gce":
|
|
for size in sizes:
|
|
count += 1
|
|
print("{}) {}\n\n{}\nPrice: {}\n".format(count, size.name, size.extra['description'], size.price))
|
|
else:
|
|
for size in sizes:
|
|
count += 1
|
|
print("{}) {}\n\nRam: {}\nDisk: {}\nPrice: {}\n".format(count, size.name, size.ram, size.disk, size.price))
|
|
return sizes
|
|
|
|
# This function takes a provider arguement and lists all the available locations
|
|
def list_provider_locations(provider):
|
|
print("Getting "+provider+" locations...")
|
|
driver = get_corresponding_driver(provider)
|
|
locations = driver.list_locations()
|
|
count = 0
|
|
print("Available "+provider+" locations")
|
|
if provider == "aws":
|
|
print("Still loading...")
|
|
locations = []
|
|
awsLocations = ["ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-southeast-1", "ap-southeast-2", "ca-central-1", "eu-central-1", "eu-north-1", "eu-west-1", "eu-west-2", "eu-west-3", "sa-east-1", "us-east-1", "us-east-2", "us-west-1", "us-west-2"]
|
|
for region in awsLocations:
|
|
awsdr = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region)
|
|
specificAwsLocations = awsdr.list_locations()
|
|
for item in specificAwsLocations:
|
|
locations.append(item)
|
|
for location in locations:
|
|
count += 1
|
|
print("{}) {}\n\nRegion name: {}\nCountry: {}\n".format(count, location.name, location.availability_zone.region_name, location.country))
|
|
else:
|
|
for location in locations:
|
|
count += 1
|
|
print("{}) {}\n\nCountry: {}\n".format(count, location.name, location.country))
|
|
return locations
|
|
|
|
def listAWSregions(list):
|
|
count = 0
|
|
print("Available aws regions:")
|
|
for item in list:
|
|
count += 1
|
|
print("{}) {}".format(count, item))
|
|
return list
|
|
|
|
# This function lists all available images from the providers.
|
|
def list_provider_images(provider,images=None):
|
|
driver = get_corresponding_driver(provider)
|
|
print("Getting images from " +provider+"...")
|
|
if provider == "azure":
|
|
images = AZURE_images
|
|
elif provider == "aws":
|
|
images = AWS_images
|
|
else:
|
|
images = driver.list_images()
|
|
# We filter out the images we do not care about
|
|
images = list(filter(lambda x: 'windows' not in x.name.lower() and 'cos' not in x.name.lower() and 'arm64' not in x.name.lower() and 'byos' not in x.name.lower() and 'sap' not in x.name.lower(), images))
|
|
count = 0
|
|
print("Available "+provider+" images")
|
|
if provider == "azure" or provider == "aws":
|
|
for image in images:
|
|
count += 1
|
|
print("{}) {}".format(count, image))
|
|
else:
|
|
for image in images:
|
|
count += 1
|
|
print("{}) {}\n\n{}\n".format(count, image.name, image.extra['description']))
|
|
return images
|
|
|
|
# This function gets called in every get function to create a menu for selection
|
|
# It takes a list and a list name as arguements to differentiate how we print each one
|
|
# It also validates the user input and keeps asking for a valid one unless the user enters 0 to exit
|
|
def choose_from_list(listFromlistFunction,listName):
|
|
if len(listFromlistFunction) == 0:
|
|
print("No items")
|
|
exit(0)
|
|
if listName == "awsLocation":
|
|
printFormat = "{}) {}\n\nRegion name: {}\nCountry: {}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.availability_zone.region_name, item.country))"
|
|
elif listName == "azureLocation" or listName == "gceLocation":
|
|
printFormat = "{}) {}\n\nCountry: {}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.country))"
|
|
elif listName == "awsSize":
|
|
printFormat = "{}) {}\n\nRam: {}\nDisk: {}\nBandwidth: {}\nPrice: {}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.ram, item.disk, item.bandwidth, item.price))"
|
|
elif listName == "gceSize":
|
|
printFormat = "{}) {}\n\n{}\nPrice: {}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.extra['description'], item.price))"
|
|
elif listName == "azureSize":
|
|
printFormat = "{}) {}\n\nRam: {}\nDisk: {}\nPrice: {}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.ram, item.disk, item.price))"
|
|
elif listName == "awsImage" or listName == "azureImage" or listName == "awsRegion" or listName == "aws_region":
|
|
printFormat = "{}) {}"
|
|
printstring = "print(printFormat.format(count, item))"
|
|
elif listName == "gceImage":
|
|
printFormat = "{}) {}\n\n{}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.extra['description']))"
|
|
elif listName == "node":
|
|
printFormat = "{}) {}\n\nState: {}\nPublic IPs: {}\nPrivate IPs: {}\nDriver: {}\nSize: {}\nImage: {}\nCreation Date: {}\nExtra: {}\n"
|
|
printstring = "print(printFormat.format(count, item.name, item.state, item.public_ips, item.private_ips, item.driver, item.size, item.image, item.created_at, item.extra))"
|
|
|
|
compiled_code = compile(printstring,"<string>","exec")
|
|
print("Choosing 0 will exit")
|
|
choice = input("Choose the "+listName+" you want to use: ")
|
|
while True:
|
|
try:
|
|
choice = int(choice)
|
|
if choice > len(listFromlistFunction) or choice < 0:
|
|
raise ValueError
|
|
elif choice == 0:
|
|
return
|
|
elif choice == '':
|
|
raise ValueError
|
|
else:
|
|
if listName == "azureImage":
|
|
item = list(listFromlistFunction.values())[choice-1]
|
|
elif listName == "awsImage":
|
|
item = list(listFromlistFunction.values())[choice-1]
|
|
print(list(listFromlistFunction)[choice-1])
|
|
elif listName == "awsRegion":
|
|
item1 = list(listFromlistFunction)[choice-1]
|
|
item2 = list(listFromlistFunction.values())[choice-1]
|
|
return item1,item2
|
|
else:
|
|
item = listFromlistFunction[int(choice) - 1]
|
|
return item
|
|
except ValueError:
|
|
count = 0
|
|
for item in listFromlistFunction:
|
|
count += 1
|
|
exec(compiled_code)
|
|
print("Invalid choice")
|
|
print("Choosing 0 will exit")
|
|
choice = input("Choose the "+listName+" you want to use: ")
|
|
|
|
# This function gets a provider location and returns it
|
|
def get_provider_location(provider):
|
|
location = choose_from_list(list_provider_locations(provider),provider+"Location")
|
|
return location
|
|
|
|
# This function gets a provider size and returns it
|
|
def get_provider_size(provider):
|
|
size = choose_from_list(list_provider_sizes(provider),provider+"Size")
|
|
return size
|
|
|
|
# This function asks the user which image he wants to use and returns it
|
|
# If the user enters an invalid value, the program will ask again
|
|
# If the user enters 0 the program will exit
|
|
# For azure, after the user chooses one we take the value which is the image URN
|
|
# and use it to get the actual AzureImage
|
|
# For aws after we get the image we must select a region to get the ami because
|
|
# amis are region specific. Then we get the actual image
|
|
# Unlike GCE, the equivalent list_images() function requires NodeLocation as an argument so
|
|
# we choose the first available one.
|
|
# Without additional arguments like publisher, sku and version it takes rediculously
|
|
# long to execute because there are over 3000 images available and the code that retrieves them has about 3 nested for loops.
|
|
# That is why we use a dictionary to output the available images. The list does not get updated
|
|
# but since the options include very old releases as well it is safe to assume these will also
|
|
# be kept as available choices
|
|
# Same goes for aws
|
|
def get_provider_image(provider):
|
|
image = choose_from_list(list_provider_images(provider),provider+"Image")
|
|
if provider == "azure":
|
|
driver = get_corresponding_driver(provider)
|
|
azlocation = driver.list_locations()[0]
|
|
if image is not None:
|
|
image = driver.get_image(image,location=azlocation)
|
|
elif provider == "aws":
|
|
if image is not None:
|
|
region = choose_from_list(listAWSregions(image),provider+"Region")
|
|
if region is not None:
|
|
dr = get_driver(Provider.EC2)
|
|
correct_driver = dr(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region[0])
|
|
image = correct_driver.get_image(region[1])
|
|
else:
|
|
image = None
|
|
return image
|
|
|
|
# We need the blockPrint and enablePrint functions for when we use the list something ones during the input validation
|
|
# and don't actually need to see the lists
|
|
def blockPrint():
|
|
sys.stdout = open(os.devnull, 'w')
|
|
|
|
def enablePrint():
|
|
sys.stdout = sys.__stdout__
|
|
|
|
def getAWSRegionFromAmi(ami):
|
|
images = AWS_images.values()
|
|
for image in images:
|
|
if ami in image.values():
|
|
return list(image.keys())[list(image.values()).index(ami)]
|
|
|
|
# This is the most important function of all and uses all the previous ones to validate the input and get the actual objects
|
|
def create_node(provider, name=None, location=None, size=None, image=None, confirm=None, deploy=None):
|
|
# Get public ssh key value
|
|
with open(SECDEP_SSH_PUBLIC_KEY, 'r') as f:
|
|
pubkey = f.read()
|
|
if provider == "azure":
|
|
auth = NodeAuthSSHKey(pubkey)
|
|
# Check if name was given and if not prompt the user to give one
|
|
if name is None:
|
|
name = input("Enter the name of the node: ")
|
|
assert name != "", "Name is empty"
|
|
name = provider+"-"+name
|
|
else:
|
|
name = provider+"-"+name
|
|
# In the case of aws location has to be None because it is actually derived from the ami (image)
|
|
if provider == "aws":
|
|
location = None
|
|
# print("in aws you first have to choose an image before the location")
|
|
else:
|
|
# In other cases
|
|
# Check if location was given and if not prompt the user to choose
|
|
if location is None:
|
|
location = get_provider_location(provider)
|
|
assert location is not None, "Location is None"
|
|
# If it was given, get the list of valid values to compare the imput with
|
|
else:
|
|
blockPrint()
|
|
locations = list_provider_locations(provider)
|
|
enablePrint()
|
|
locationName = []
|
|
for loc in locations:
|
|
# gce and aws have the location name under the name tag and azure under the id.
|
|
if provider == "gce" or provider == "aws":
|
|
locationName.append(loc.name)
|
|
else:
|
|
locationName.append(loc.id)
|
|
# If it was not found prompt the user for selection
|
|
if location not in locationName:
|
|
print("Invalid Location")
|
|
location = get_provider_location(provider)
|
|
assert location is not None, "Location is None"
|
|
else:
|
|
location = locations[locationName.index(location)]
|
|
# Check if size was given and if not prompt the user to choose
|
|
if size is None:
|
|
size = get_provider_size(provider)
|
|
assert size is not None, "Size is None"
|
|
# If it was given, get the list of valid values to compare the input with
|
|
else:
|
|
blockPrint()
|
|
sizes = list_provider_sizes(provider)
|
|
enablePrint()
|
|
sizeName = []
|
|
for siz in sizes:
|
|
sizeName.append(siz.name)
|
|
if size not in sizeName:
|
|
print("Invalid Size")
|
|
size = get_provider_size(provider)
|
|
assert size is not None, "Size is None"
|
|
else:
|
|
size = sizes[sizeName.index(size)]
|
|
# Check if image was given and if not prompt the user to choose one
|
|
if image is None:
|
|
image = get_provider_image(provider)
|
|
assert image is not None, "Image is None"
|
|
if provider == "aws":
|
|
ami = image.id
|
|
region = getAWSRegionFromAmi(ami)
|
|
dr = get_corresponding_driver(provider)
|
|
assert dr is not None, "Driver is not set up correctly"
|
|
image = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region).get_image(ami)
|
|
else:
|
|
blockPrint()
|
|
# If provider was aws we must get the list of amis
|
|
if provider == "gce":
|
|
images = list_provider_images(provider)
|
|
elif provider == "azure":
|
|
images = AZURE_images.values()
|
|
else:
|
|
images = AWS_images.values()
|
|
enablePrint()
|
|
imageName = []
|
|
if provider == "gce":
|
|
for img in images:
|
|
imageName.append(img.name)
|
|
elif provider == "azure":
|
|
for img in images:
|
|
imageName.append(img)
|
|
else:
|
|
# In the case of aws this is how we get the list of amis
|
|
for img in images:
|
|
amis = img.values()
|
|
for ami in amis:
|
|
imageName.append(ami)
|
|
if image not in imageName:
|
|
print("Invalid Image")
|
|
image = get_provider_image(provider)
|
|
# If the image given was not in the list of valid values we must get the actual image and the region from the ami to get the correct driver
|
|
if provider == "aws":
|
|
ami = image.id
|
|
region = getAWSRegionFromAmi(ami)
|
|
dr = get_corresponding_driver(provider)
|
|
assert dr is not None, "Driver is not set up correctly"
|
|
image = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region).get_image(ami)
|
|
assert image is not None, "Image is None"
|
|
else:
|
|
# If image was indeed in the list we choose it
|
|
if provider == "gce":
|
|
image = images[imageName.index(image)]
|
|
elif provider == "azure":
|
|
driver = get_corresponding_driver(provider)
|
|
azlocation = driver.list_locations()[0]
|
|
image = driver.get_image(image,location=azlocation)
|
|
else:
|
|
# but in the case of aws we still need to get the region first
|
|
region = getAWSRegionFromAmi(image)
|
|
dr = get_corresponding_driver(provider)
|
|
assert dr is not None, "Driver is not set up correctly"
|
|
image = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region).get_image(image)
|
|
# In the case of gce we need to give the sa_scopes and the ex_metadata parameters
|
|
if provider == "gce":
|
|
sa_scopes = [{"email": "default","scopes": ["cloud-platform"]}]
|
|
ex_metadata = metadata = { "items": [{"key": "ssh-keys", "value": "secdep: %s" % (pubkey)}] }
|
|
# For any other provider we just get the driver as defined in the get_corresponding_driver function
|
|
if provider != "aws":
|
|
driver = get_corresponding_driver(provider)
|
|
else:
|
|
# But for aws we need to get the one matching our derived region from the image selection
|
|
dr = get_corresponding_driver(provider)
|
|
assert dr is not None, "Driver is not set up correctly"
|
|
driver = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region)
|
|
# If the user did not input the -y or --yes flag then we output the current choices for a second though
|
|
if confirm is False:
|
|
print("\nName: %s\n" % (name))
|
|
# There is a differentiation between aws and the other providers in region and location
|
|
if provider == "aws":
|
|
print("\nLocation: %s\n" % (region))
|
|
else:
|
|
print("\nLocation: %s\n" % (location))
|
|
print("\nSize: %s\n" % (size))
|
|
print("\nImage: %s\n" % (image))
|
|
print("Type yes if you want to confirm your choices")
|
|
confirm = input("Continue? ")
|
|
# Any input other than yes does not continue the node creation
|
|
assert confirm == "yes", "User did not confirm"
|
|
if provider == "gce":
|
|
gceNodes = driver.list_nodes()
|
|
for gceNode in gceNodes:
|
|
if gceNode.name == name:
|
|
print("A node with that name already exists under this project, please choose another one")
|
|
exit(0)
|
|
existIn = False
|
|
firewalls = driver.ex_list_firewalls()
|
|
for firewall in firewalls:
|
|
if firewall.name == "allow-all-inbound":
|
|
existIn = True
|
|
break
|
|
if existIn == False:
|
|
driver.ex_create_firewall(name="allow-all-inbound", allowed=[{"IPProtocol": "tcp", "ports": ["0-65534"]},{"IPProtocol": "udp", "ports": ["0-65534"]}], network='default', direction='INGRESS', priority=1000, source_service_accounts=sa_scopes, target_service_accounts=sa_scopes)
|
|
if args.deploy:
|
|
actualDeployScript = ScriptFileDeployment(script_file=SECDEP_DEPLOY_SCRIPT, args=args.deploy, name="harden", delete=True)
|
|
node = driver.deploy_node(name=name, image=image, size=size, location=location, ex_service_accounts=sa_scopes, ex_metadata=metadata, deploy=actualDeployScript, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_username="secdep")
|
|
print('harden stdout: %s' % (actualDeployScript.stdout))
|
|
print('harden stderr: %s' % (actualDeployScript.stderr))
|
|
print('harden exit_code: %s' % (actualDeployScript.exit_status))
|
|
else:
|
|
node = driver.create_node(name=name, image=image, size=size, location=location, ex_service_accounts=sa_scopes, ex_metadata=metadata)
|
|
elif provider == "azure":
|
|
print("Keep in mind azure node creation may take a while because we need to create all the needed resources first")
|
|
res_groups = driver.ex_list_resource_groups()
|
|
for res_group in res_groups:
|
|
if res_group.name == name+"-res_group":
|
|
print("A resource group with that name already exists, please try a different virtual machine name to differentiate the resource group name")
|
|
exit(0)
|
|
credential = ClientSecretCredential(client_id=SECDEP_AZURE_APP_ID, client_secret=SECDEP_AZURE_PASSWORD, tenant_id=SECDEP_AZURE_TENANT_ID)
|
|
subscription_id = SECDEP_AZURE_SUB_ID
|
|
resource_client = ResourceManagementClient(credential, subscription_id)
|
|
network_client = NetworkManagementClient(credential, subscription_id)
|
|
# Create Resource group using azure sdk since libcloud does not offer that functionality
|
|
res_group = resource_client.resource_groups.create_or_update(name+"-res_group", {"location": location.id})
|
|
# Create Virtual Network using azure sdk since libcloud does not offer that functionality
|
|
poller = network_client.virtual_networks.begin_create_or_update(res_group.name, name+"-vir_net", { "location": location.id, "address_space": {"address_prefixes": ["10.0.0.0/16"]},},)
|
|
vir_net = poller.result()
|
|
# Create the default subnet using azure sdk since libcloud does not offer that functionality
|
|
poller = network_client.subnets.begin_create_or_update(res_group.name, vir_net.name, name+"-subnet", { "address_prefix": "10.0.0.0/24"},)
|
|
subnet = poller.result()
|
|
# Create Network Security Group
|
|
driver.ex_create_network_security_group(name=name+"-sec_group", resource_group=res_group.name, location=location)
|
|
# Get the created Virtual Network
|
|
networks = driver.ex_list_networks()
|
|
for network in networks:
|
|
if network.name == vir_net.name:
|
|
ex_network = network
|
|
break
|
|
else:
|
|
print("Could not find the virtual network. Maybe it was not created correctly?")
|
|
# Get Virtual Network's default subnet we created
|
|
subnet = driver.ex_list_subnets(network=ex_network)[0]
|
|
# Create public ip
|
|
public_ip = driver.ex_create_public_ip(name=name+"-ip", resource_group=res_group.name, location=location, public_ip_allocation_method="Static")
|
|
# Create a Virtual Network Interface
|
|
network_interface = driver.ex_create_network_interface(name=name+"-nic", subnet=subnet, resource_group=res_group.name, location=location, public_ip=public_ip)
|
|
# Get the created Virtual Network Interface
|
|
nic = driver.ex_list_nics(resource_group=res_group.name)[0]
|
|
# Get the created Network Security Group
|
|
sec_group = driver.ex_list_network_security_groups(res_group.name)[0]
|
|
# Parameters to associate the Network Security Group to the Virtual Network Interface
|
|
params = {"ipConfigurations":[{"name":"myip1","id":nic.id,"type":"Microsoft.Network/networkInterfaces/ipConfigurations","properties":{"provisioningState":"Succeeded","privateIPAddress":"10.0.0.4","privateIPAllocationMethod":"Dynamic","publicIPAddress":{"id":public_ip.id},"subnet":{"id":subnet.id},"primary":"true","privateIPAddressVersion":"IPv4"}}],"dnsSettings":{"dnsServers":[]},"enableAcceleratedNetworking":"false","enableIPForwarding":"false","disableTcpStateTracking":"false","networkSecurityGroup":{"id":sec_group.id},"nicType":"Standard"}
|
|
# New Virtual Network Interface associated with the Network Security Group
|
|
newnic = driver.ex_update_nic_properties(nic, res_group.name, params)
|
|
# Update the Network Security Group's rules to accept connections using azure sdk since libcloud does not offer that functionality
|
|
network_client.security_rules.begin_create_or_update(res_group.name, sec_group.name,"allowAllInbound", SecurityRule(protocol='*', source_address_prefix='*', destination_address_prefix='*', access='Allow', direction='Inbound', description='Allow all', source_port_range='*', destination_port_range='*', priority=4096, name="allowAll"))
|
|
network_client.security_rules.begin_create_or_update(res_group.name, sec_group.name,"allowAllOutbound", SecurityRule(protocol='*', source_address_prefix='*', destination_address_prefix='*', access='Allow', direction='Outbound', description='Allow all', source_port_range='*', destination_port_range='*', priority=4096, name="allowAll"))
|
|
# Create the node
|
|
if args.deploy:
|
|
actualDeployScript = ScriptFileDeployment(script_file=SECDEP_DEPLOY_SCRIPT, args=args.deploy, name="harden", delete=True)
|
|
node = driver.deploy_node(name=name, size=size, image=image, location=location, auth=auth, ex_user_name="secdep", ex_resource_group=res_group.name, ex_use_managed_disks=True, ex_nic=newnic, ex_os_disk_delete=True, deploy=actualDeployScript, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_username="secdep")
|
|
print('harden stdout: %s' % (actualDeployScript.stdout))
|
|
print('harden stderr: %s' % (actualDeployScript.stderr))
|
|
print('harden exit_code: %s' % (actualDeployScript.exit_status))
|
|
else:
|
|
node = driver.create_node(name=name, size=size, image=image, location=location, auth=auth, ex_user_name="secdep", ex_resource_group=res_group.name, ex_use_managed_disks=True, ex_nic=newnic, ex_os_disk_delete=True)
|
|
else:
|
|
# If provider was aws
|
|
# Delete all keys since we are just going to upload the same one for the creation
|
|
# This doesn't affect already existing nodes because as we said, it it the same one used for the others
|
|
keys = driver.list_key_pairs()
|
|
for key in keys:
|
|
driver.delete_key_pair(key)
|
|
keyname="secdep@"+socket.gethostname()
|
|
driver.import_key_pair_from_string(keyname, pubkey)
|
|
driver.ex_authorize_security_group_permissive('default')
|
|
# since each ami decides on a different admin user name we can't use the create node
|
|
# to end up with a secdep user but we have to use the deploy_node function
|
|
SCRIPT = '''#!/usr/bin/env bash
|
|
sudo useradd -G sudo -s /bin/bash -m secdep
|
|
sudo echo "secdep:secdeppass" | sudo chpasswd
|
|
sudo mkdir -p /home/secdep/.ssh
|
|
[[ -e /root/.ssh/authorized_keys ]] && sudo cp /root/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/admin/.ssh/authorized_keys ]] && sudo cp /home/admin/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/ec2-user/.ssh/authorized_keys ]] && sudo cp /home/ec2-user/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/centos/.ssh/authorized_keys ]] && sudo cp /home/centos/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/fedora/.ssh/authorized_keys ]] && sudo cp /home/fedora/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/ubuntu/.ssh/authorized_keys ]] && sudo cp /home/ubuntu/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
sudo chmod 755 /home
|
|
sudo chown secdep:secdep /home/secdep -R
|
|
sudo chmod 700 /home/secdep /home/secdep/.ssh
|
|
sudo chmod 600 /home/secdep/.ssh/authorized_keys'''
|
|
deploy = ScriptDeployment(script=SCRIPT, name="initialization.sh", delete=True)
|
|
if args.deploy:
|
|
actualDeployScript = ScriptFileDeployment(script_file=SECDEP_DEPLOY_SCRIPT, args=args.deploy, name="harden", delete=True)
|
|
msd = MultiStepDeployment([deploy, actualDeployScript])
|
|
node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=msd, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_alternate_usernames=["admin", "ec2-user", "centos", "fedora", "ubuntu"])
|
|
print('deploy stdout: %s' % (deploy.stdout))
|
|
print('deploy stderr: %s' % (deploy.stderr))
|
|
print('deploy exit_code: %s' % (deploy.exit_status))
|
|
print('harden stdout: %s' % (actualDeployScript.stdout))
|
|
print('harden stderr: %s' % (actualDeployScript.stderr))
|
|
print('harden exit_code: %s' % (actualDeployScript.exit_status))
|
|
else:
|
|
node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=deploy, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_alternate_usernames=["admin", "ec2-user", "centos", "fedora", "ubuntu"])
|
|
print('deploy stdout: %s' % (deploy.stdout))
|
|
print('deploy stderr: %s' % (deploy.stderr))
|
|
print('deploy exit_code: %s' % (deploy.exit_status))
|
|
else:
|
|
# When the -y or --yes parameter is passed we go straight to the node creation
|
|
if provider == "gce":
|
|
gceNodes = driver.list_nodes()
|
|
for gceNode in gceNodes:
|
|
if gceNode.name == name:
|
|
print("A node with that name already exists under this project, please choose another one")
|
|
exit(0)
|
|
existIn = False
|
|
firewalls = driver.ex_list_firewalls()
|
|
for firewall in firewalls:
|
|
if firewall.name == "allow-all-inbound":
|
|
existIn = True
|
|
break
|
|
if existIn == False:
|
|
driver.ex_create_firewall(name="allow-all-inbound", allowed=[{"IPProtocol": "tcp", "ports": ["0-65534"]},{"IPProtocol": "udp", "ports": ["0-65534"]}], network='default', direction='INGRESS', priority=1000, source_service_accounts=sa_scopes, target_service_accounts=sa_scopes)
|
|
if args.deploy:
|
|
actualDeployScript = ScriptFileDeployment(script_file=SECDEP_DEPLOY_SCRIPT, args=args.deploy, name="harden", delete=True)
|
|
node = driver.deploy_node(name=name, image=image, size=size, location=location, ex_service_accounts=sa_scopes, ex_metadata=metadata, deploy=actualDeployScript, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_username="secdep")
|
|
print('harden stdout: %s' % (actualDeployScript.stdout))
|
|
print('harden stderr: %s' % (actualDeployScript.stderr))
|
|
print('harden exit_code: %s' % (actualDeployScript.exit_status))
|
|
else:
|
|
node = driver.create_node(name=name, image=image, size=size, location=location, ex_service_accounts=sa_scopes, ex_metadata=metadata)
|
|
elif provider == "azure":
|
|
print("Keep in mind azure node creation may take a while because we need to create all the needed resources first")
|
|
res_groups = driver.ex_list_resource_groups()
|
|
for res_group in res_groups:
|
|
if res_group.name == name+"-res_group":
|
|
print("A resource group with that name already exists, please try a different virtual machine name to differentiate the resource group name")
|
|
exit(0)
|
|
credential = ClientSecretCredential(client_id=SECDEP_AZURE_APP_ID, client_secret=SECDEP_AZURE_PASSWORD, tenant_id=SECDEP_AZURE_TENANT_ID)
|
|
subscription_id = SECDEP_AZURE_SUB_ID
|
|
resource_client = ResourceManagementClient(credential, subscription_id)
|
|
network_client = NetworkManagementClient(credential, subscription_id)
|
|
# Create Resource group using azure sdk since libcloud does not offer that functionality
|
|
res_group = resource_client.resource_groups.create_or_update(name+"-res_group", {"location": location.id})
|
|
# Create Virtual Network using azure sdk since libcloud does not offer that functionality
|
|
poller = network_client.virtual_networks.begin_create_or_update(res_group.name, name+"-vir_net", { "location": location.id, "address_space": {"address_prefixes": ["10.0.0.0/16"]},},)
|
|
vir_net = poller.result()
|
|
# Create the default subnet using azure sdk since libcloud does not offer that functionality
|
|
poller = network_client.subnets.begin_create_or_update(res_group.name, vir_net.name, name+"-subnet", { "address_prefix": "10.0.0.0/24"},)
|
|
subnet = poller.result()
|
|
# Create Network Security Group
|
|
driver.ex_create_network_security_group(name=name+"-sec_group", resource_group=res_group.name, location=location)
|
|
# Get the created Virtual Network
|
|
networks = driver.ex_list_networks()
|
|
for network in networks:
|
|
if network.name == vir_net.name:
|
|
ex_network = network
|
|
break
|
|
else:
|
|
print("Could not find the virtual network. Maybe it was not created correctly?")
|
|
# Get Virtual Network's default subnet we created
|
|
subnet = driver.ex_list_subnets(network=ex_network)[0]
|
|
# Create public ip
|
|
public_ip = driver.ex_create_public_ip(name=name+"-ip", resource_group=res_group.name, location=location, public_ip_allocation_method="Static")
|
|
# Create a Virtual Network Interface
|
|
network_interface = driver.ex_create_network_interface(name=name+"-nic", subnet=subnet, resource_group=res_group.name, location=location, public_ip=public_ip)
|
|
# Get the created Virtual Network Interface
|
|
nic = driver.ex_list_nics(resource_group=res_group.name)[0]
|
|
# Get the created Network Security Group
|
|
sec_group = driver.ex_list_network_security_groups(res_group.name)[0]
|
|
# Parameters to associate the Network Security Group to the Virtual Network Interface
|
|
params = {"ipConfigurations":[{"name":"myip1","id":nic.id,"type":"Microsoft.Network/networkInterfaces/ipConfigurations","properties":{"provisioningState":"Succeeded","privateIPAddress":"10.0.0.4","privateIPAllocationMethod":"Dynamic","publicIPAddress":{"id":public_ip.id},"subnet":{"id":subnet.id},"primary":"true","privateIPAddressVersion":"IPv4"}}],"dnsSettings":{"dnsServers":[]},"enableAcceleratedNetworking":"false","enableIPForwarding":"false","disableTcpStateTracking":"false","networkSecurityGroup":{"id":sec_group.id},"nicType":"Standard"}
|
|
# New Virtual Network Interface associated with the Network Security Group
|
|
newnic = driver.ex_update_nic_properties(nic, res_group.name, params)
|
|
# Update the Network Security Group's rules to accept connections using azure sdk since libcloud does not offer that functionality
|
|
network_client.security_rules.begin_create_or_update(res_group.name, sec_group.name,"allowAllInbound", SecurityRule(protocol='*', source_address_prefix='*', destination_address_prefix='*', access='Allow', direction='Inbound', description='Allow all', source_port_range='*', destination_port_range='*', priority=4096, name="allowAll"))
|
|
network_client.security_rules.begin_create_or_update(res_group.name, sec_group.name,"allowAllOutbound", SecurityRule(protocol='*', source_address_prefix='*', destination_address_prefix='*', access='Allow', direction='Outbound', description='Allow all', source_port_range='*', destination_port_range='*', priority=4096, name="allowAll"))
|
|
# Create the node
|
|
if args.deploy:
|
|
actualDeployScript = ScriptFileDeployment(script_file=SECDEP_DEPLOY_SCRIPT, args=args.deploy, name="harden", delete=True)
|
|
node = driver.deploy_node(name=name, size=size, image=image, location=location, auth=auth, ex_user_name="secdep", ex_resource_group=res_group.name, ex_use_managed_disks=True, ex_nic=newnic, ex_os_disk_delete=True, deploy=actualDeployScript, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_username="secdep")
|
|
print('harden stdout: %s' % (actualDeployScript.stdout))
|
|
print('harden stderr: %s' % (actualDeployScript.stderr))
|
|
print('harden exit_code: %s' % (actualDeployScript.exit_status))
|
|
else:
|
|
node = driver.create_node(name=name, size=size, image=image, location=location, auth=auth, ex_user_name="secdep", ex_resource_group=res_group.name, ex_use_managed_disks=True, ex_nic=newnic, ex_os_disk_delete=True)
|
|
else:
|
|
# If provider was aws
|
|
# Delete all keys since we are just going to upload the same one for the creation
|
|
# This doesn't affect already existing nodes because as we said, it it the same one used for the others
|
|
keys = driver.list_key_pairs()
|
|
for key in keys:
|
|
driver.delete_key_pair(key)
|
|
keyname="secdep@"+socket.gethostname()
|
|
driver.import_key_pair_from_string(keyname, pubkey)
|
|
driver.ex_authorize_security_group_permissive('default')
|
|
# since each ami decides on a different admin user name we can't use the create node
|
|
# to end up with a secdep user but we have to use the deploy_node function
|
|
SCRIPT = '''#!/usr/bin/env bash
|
|
sudo useradd -G sudo -s /bin/bash -m secdep
|
|
sudo echo "secdep:secdeppass" | sudo chpasswd
|
|
sudo mkdir -p /home/secdep/.ssh
|
|
[[ -e /root/.ssh/authorized_keys ]] && sudo cp /root/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/admin/.ssh/authorized_keys ]] && sudo cp /home/admin/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/ec2-user/.ssh/authorized_keys ]] && sudo cp /home/ec2-user/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/centos/.ssh/authorized_keys ]] && sudo cp /home/centos/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/fedora/.ssh/authorized_keys ]] && sudo cp /home/fedora/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
[[ -e /home/ubuntu/.ssh/authorized_keys ]] && sudo cp /home/ubuntu/.ssh/authorized_keys /home/secdep/.ssh/authorized_keys
|
|
sudo chmod 755 /home
|
|
sudo chown secdep:secdep /home/secdep -R
|
|
sudo chmod 700 /home/secdep /home/secdep/.ssh
|
|
sudo chmod 600 /home/secdep/.ssh/authorized_keys'''
|
|
deploy = ScriptDeployment(script=SCRIPT, name="initialization.sh", delete=True)
|
|
if args.deploy:
|
|
actualDeployScript = ScriptFileDeployment(script_file=SECDEP_DEPLOY_SCRIPT, args=args.deploy, name="harden", delete=True)
|
|
msd = MultiStepDeployment([deploy, actualDeployScript])
|
|
node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=msd, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_alternate_usernames=["admin", "ec2-user", "centos", "fedora", "ubuntu"])
|
|
print('deploy stdout: %s' % (deploy.stdout))
|
|
print('deploy stderr: %s' % (deploy.stderr))
|
|
print('deploy exit_code: %s' % (deploy.exit_status))
|
|
print('harden stdout: %s' % (actualDeployScript.stdout))
|
|
print('harden stderr: %s' % (actualDeployScript.stderr))
|
|
print('harden exit_code: %s' % (actualDeployScript.exit_status))
|
|
else:
|
|
node = driver.deploy_node(name=name, image=image, size=size, ex_keyname=keyname, deploy=deploy, ssh_key=SECDEP_SSH_PRIVATE_KEY, ssh_alternate_usernames=["admin", "ec2-user", "centos", "fedora", "ubuntu"])
|
|
print('deploy stdout: %s' % (deploy.stdout))
|
|
print('deploy stderr: %s' % (deploy.stderr))
|
|
print('deploy exit_code: %s' % (deploy.exit_status))
|
|
print(node.name + " created successfully")
|
|
print("Node is initializing")
|
|
print("ip to connect to")
|
|
print("\nIP: %s" % (node.public_ips[0]))
|
|
print("\nssh command: ssh -i %s secdep@%s\n" % (SECDEP_SSH_PRIVATE_KEY, node.public_ips[0]))
|
|
print("If you ever change the port adjust the command accordingly")
|
|
return node
|
|
|
|
def list_all_nodes(provider, filterIn=None, awsRegion=None):
|
|
print("Getting all nodes...")
|
|
print("Loading 0%...")
|
|
nodes = []
|
|
if provider is None:
|
|
if SECDEP_GCE_CLIENT_ID != "":
|
|
print("Getting GCE nodes...")
|
|
driver = get_corresponding_driver("gce")
|
|
gceNodes = driver.list_nodes()
|
|
if len(gceNodes) > 0:
|
|
for node in gceNodes:
|
|
nodes.append(node)
|
|
print("Loading %s%%..." % (int((1/providers_quantity)*100)))
|
|
else:
|
|
print("Skipping gce")
|
|
if SECDEP_AZURE_APP_ID != "":
|
|
print("Getting AZURE nodes...")
|
|
driver2 = get_corresponding_driver("azure")
|
|
azureNodes = driver2.list_nodes()
|
|
if len(azureNodes) > 0:
|
|
for node in azureNodes:
|
|
nodes.append(node)
|
|
print("Loading %s%%..." % (int((2/providers_quantity)*100)))
|
|
else:
|
|
print("Skipping azure")
|
|
if SECDEP_AWS_ACCESS_KEY != "":
|
|
driver3 = get_corresponding_driver("aws")
|
|
print("Getting AWS nodes...")
|
|
awsLocations = ["ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-southeast-1", "ap-southeast-2", "ca-central-1", "eu-central-1", "eu-north-1", "eu-west-1", "eu-west-2", "eu-west-3", "sa-east-1", "us-east-1", "us-east-2", "us-west-1", "us-west-2"]
|
|
for region in awsLocations:
|
|
driver3 = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region)
|
|
# make it so it tries all drivers
|
|
awsNodes = driver3.list_nodes()
|
|
if len(awsNodes) > 0:
|
|
for node in awsNodes:
|
|
nodes.append(node)
|
|
print("Loading %s%%..." % (int((3/providers_quantity)*100)))
|
|
else:
|
|
print("Skipping aws")
|
|
elif provider == "gce":
|
|
if SECDEP_GCE_CLIENT_ID != "":
|
|
print("Getting GCE nodes...")
|
|
driver = get_corresponding_driver("gce")
|
|
gceNodes = driver.list_nodes()
|
|
if len(gceNodes) > 0:
|
|
for node in gceNodes:
|
|
nodes.append(node)
|
|
print("Loading %s%%..." % (int((1/providers_quantity)*100)))
|
|
else:
|
|
print("Skipping gce")
|
|
elif provider == "azure":
|
|
if SECDEP_AZURE_APP_ID != "":
|
|
print("Getting AZURE nodes...")
|
|
driver2 = get_corresponding_driver("azure")
|
|
azureNodes = driver2.list_nodes()
|
|
if len(azureNodes) > 0:
|
|
for node in azureNodes:
|
|
nodes.append(node)
|
|
print("Loading %s%%..." % (int((2/providers_quantity)*100)))
|
|
else:
|
|
print("Skipping azure")
|
|
elif provider == "aws":
|
|
if SECDEP_AWS_ACCESS_KEY != "":
|
|
driver3 = get_corresponding_driver("aws")
|
|
print("Getting AWS nodes...")
|
|
awsLocations = ["ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-southeast-1", "ap-southeast-2", "ca-central-1", "eu-central-1", "eu-north-1", "eu-west-1", "eu-west-2", "eu-west-3", "sa-east-1", "us-east-1", "us-east-2", "us-west-1", "us-west-2"]
|
|
if awsRegion is None:
|
|
for region in awsLocations:
|
|
driver3 = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region)
|
|
# make it so it tries all drivers
|
|
awsNodes = driver3.list_nodes()
|
|
if len(awsNodes) > 0:
|
|
for node in awsNodes:
|
|
nodes.append(node)
|
|
else:
|
|
if awsRegion not in awsLocations:
|
|
print("Invalid region")
|
|
awsRegion = choose_from_list(listAWSregions(awsLocations),"aws_region")
|
|
assert awsRegion is not None, "You chose an invalid aws region so we can't continue unless you choose a corect one"
|
|
driver3 = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=awsRegion)
|
|
awsNodes = driver3.list_nodes()
|
|
if len(awsNodes) > 0:
|
|
for node in awsNodes:
|
|
nodes.append(node)
|
|
print("Loading %s%%..." % (int((3/providers_quantity)*100)))
|
|
else:
|
|
print("Skipping aws")
|
|
count = 0
|
|
if len(nodes) == 0:
|
|
print("No nodes")
|
|
exit(0)
|
|
# available states: running, rebooting, terminated, pending, stopped, suspended, paused, erro, unknown
|
|
# for delete
|
|
if filterIn == "delete":
|
|
nodes = list(filter(lambda x: 'running' in x.state.lower() or 'rebooting' in x.state.lower() or 'stopped' in x.state.lower() or 'suspended' in x.state.lower() or 'paused' in x.state.lower(), nodes))
|
|
# for start
|
|
if filterIn == "start":
|
|
nodes = list(filter(lambda x: 'stopped' in x.state.lower() or 'suspended' in x.state.lower() or 'paused' in x.state.lower(), nodes))
|
|
# for stop
|
|
if filterIn == "stop":
|
|
nodes = list(filter(lambda x: 'running' in x.state.lower() or 'rebooting' in x.state.lower(), nodes))
|
|
# for reboot
|
|
if filterIn == "reboot":
|
|
nodes = list(filter(lambda x: 'running' in x.state.lower() or 'suspended' in x.state.lower() or 'paused' in x.state.lower(), nodes))
|
|
for node in nodes:
|
|
count += 1
|
|
print("{}) {}\n\nState: {}\nPublic IPs: {}\nPrivate IPs: {}\nDriver: {}\nSize: {}\nImage: {}\nCreation Date: {}\nExtra: {}\n".format(count, node.name, node.state, node.public_ips, node.private_ips, node.driver, node.size, node.image, node.created_at, node.extra))
|
|
return nodes
|
|
|
|
def get_node(provider, awsRegion=None):
|
|
node = choose_from_list(list_all_nodes(provider, None, awsRegion), "node")
|
|
return node
|
|
|
|
def node_action(action, provider, awsRegion=None):
|
|
node = choose_from_list(list_all_nodes(provider, action, awsRegion), "node")
|
|
if node is None:
|
|
print("Nothing was chosen")
|
|
exit(0)
|
|
providerName = node.name.split("-")[0]
|
|
if providerName == "gce":
|
|
driver = get_corresponding_driver("gce")
|
|
elif providerName == "azure":
|
|
driver = get_corresponding_driver("azure")
|
|
node_name = node.name
|
|
credential = ClientSecretCredential(client_id=SECDEP_AZURE_APP_ID, client_secret=SECDEP_AZURE_PASSWORD, tenant_id=SECDEP_AZURE_TENANT_ID)
|
|
subscription_id = SECDEP_AZURE_SUB_ID
|
|
resource_client = ResourceManagementClient(credential, subscription_id)
|
|
network_client = NetworkManagementClient(credential, subscription_id)
|
|
elif providerName == "aws":
|
|
driver = get_corresponding_driver("aws")
|
|
assert driver is not None, "Driver is not set up correctly"
|
|
region = getAWSRegionFromAmi(node.extra['image_id'])
|
|
driver = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region)
|
|
match action:
|
|
case "reboot":
|
|
succeded = driver.reboot_node(node)
|
|
case "stop":
|
|
succeded = driver.stop_node(node)
|
|
case "start":
|
|
succeded = driver.start_node(node)
|
|
case "delete":
|
|
succeded = driver.destroy_node(node)
|
|
case _:
|
|
print("Invalid action command")
|
|
exit(0)
|
|
if(succeded):
|
|
print("%s node %s -> successful" % (providerName.upper(), action))
|
|
else:
|
|
print("%s node %s -> failed" % (providerName.upper(), action))
|
|
if providerName == "azure" and action == "delete":
|
|
print("Deleting the corresponding resource group may take a while")
|
|
poller = resource_client.resource_groups.begin_delete(node_name+"-res_group")
|
|
result = poller.result()
|
|
|
|
def node_action_all(action, provider, awsRegion=None):
|
|
string = action[:-3]
|
|
nodes = list_all_nodes(provider, string, awsRegion)
|
|
node_name = ""
|
|
for node in nodes:
|
|
providerName = node.name.split("-")[0]
|
|
if providerName == "gce":
|
|
driver = get_corresponding_driver("gce")
|
|
elif providerName == "azure":
|
|
driver = get_corresponding_driver("azure")
|
|
node_name = node.name
|
|
credential = ClientSecretCredential(client_id=SECDEP_AZURE_APP_ID, client_secret=SECDEP_AZURE_PASSWORD, tenant_id=SECDEP_AZURE_TENANT_ID)
|
|
subscription_id = SECDEP_AZURE_SUB_ID
|
|
resource_client = ResourceManagementClient(credential, subscription_id)
|
|
network_client = NetworkManagementClient(credential, subscription_id)
|
|
elif providerName == "aws":
|
|
driver = get_corresponding_driver("aws")
|
|
assert driver is not None, "Driver is not set up correctly"
|
|
region = getAWSRegionFromAmi(node.extra['image_id'])
|
|
driver = get_driver(Provider.EC2)(SECDEP_AWS_ACCESS_KEY, SECDEP_AWS_SECRET_KEY, region=region)
|
|
match action:
|
|
case "rebootall":
|
|
succeded = driver.reboot_node(node)
|
|
case "stopall":
|
|
succeded = driver.stop_node(node)
|
|
case "startall":
|
|
succeded = driver.start_node(node)
|
|
case "deleteall":
|
|
succeded = driver.destroy_node(node)
|
|
case _:
|
|
print("Invalid action command")
|
|
exit(0)
|
|
if(succeded):
|
|
print("%s node %s -> successful" % (node.name, string))
|
|
else:
|
|
print("%s node %s -> failed" % (node.name, string))
|
|
if providerName == "azure" and action == "delete":
|
|
print("Deleting the corresponding resource group may take a while")
|
|
poller = resource_client.resource_groups.begin_delete(node_name+"-res_group")
|
|
result = poller.result()
|
|
|
|
def ssh(provider, port=None, awsRegion=None):
|
|
node = choose_from_list(list_all_nodes(provider,"stop",awsRegion), "node")
|
|
ip = node.public_ips[0]
|
|
if port is None:
|
|
port = 22
|
|
else:
|
|
port = port
|
|
username = "secdep"
|
|
sshkey = SECDEP_SSH_PRIVATE_KEY
|
|
ssh = paramiko.SSHClient()
|
|
ssh.load_system_host_keys()
|
|
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
ssh.connect(ip, port=port, username=username, key_filename=sshkey)
|
|
channel = ssh.get_transport()
|
|
if channel is not None:
|
|
channel = channel.open_session()
|
|
channel.get_pty()
|
|
channel.invoke_shell()
|
|
while True:
|
|
command = input('$> ')
|
|
if command == 'exit': break
|
|
channel.send((command + "\n").encode())
|
|
while True:
|
|
if channel.recv_ready():
|
|
output = channel.recv(1024)
|
|
print(output.decode())
|
|
else:
|
|
time.sleep(0.5)
|
|
if not(channel.recv_ready()):
|
|
break
|
|
ssh.close()
|
|
|
|
if args.awsregion and args.provider != "aws":
|
|
print("AWS region flag as the name suggests only goes with the aws provider")
|
|
exit(0)
|
|
# If -I -S or -G is passed, provider must be passed as well
|
|
if args.listimages or args.listsizes or args.listlocations:
|
|
assert args.provider is not None, "Provider must be passed if listing images, sizes or locations"
|
|
if args.listimages and args.provider:
|
|
# If -I or --listimages is passed, call the list_provider_images function
|
|
if args.print:
|
|
print(get_provider_image(args.provider))
|
|
else:
|
|
list_provider_images(args.provider)
|
|
exit(0)
|
|
if args.listsizes and args.provider:
|
|
# If -S or --listsizes is passed, call the list_provider_sizes function
|
|
if args.print:
|
|
print(get_provider_size(args.provider))
|
|
else:
|
|
list_provider_sizes(args.provider)
|
|
exit(0)
|
|
if args.listlocations and args.provider:
|
|
# If -G or --listlocations is passed, call the list_provider_locations function
|
|
if args.print:
|
|
print(get_provider_location(args.provider))
|
|
else:
|
|
list_provider_locations(args.provider)
|
|
exit(0)
|
|
if args.create:
|
|
assert args.provider is not None, "Provider must be specified for node creation"
|
|
# If -c or --create is passed, call the create_node function
|
|
create_node(args.provider, args.name, args.region, args.size, args.image, args.yes, args.deploy)
|
|
exit(0)
|
|
if args.list:
|
|
if args.print:
|
|
print(get_node(args.provider, args.awsregion))
|
|
else:
|
|
list_all_nodes(args.provider, None, args.awsregion)
|
|
exit(0)
|
|
# If args.action contains the word all execute the node_action_all function, otherwise the node_action function
|
|
if args.action:
|
|
if(args.action.endswith("all")):
|
|
node_action_all(args.action, args.provider, args.awsregion)
|
|
else:
|
|
node_action(args.action, args.provider, args.awsregion)
|
|
exit(0)
|
|
if args.ssh:
|
|
ssh(args.provider, args.port, args.awsregion)
|
|
exit(0)
|
|
if args.image or args.size or args.name or args.region or args.yes or args.deploy and not args.create:
|
|
print("Image, size, name, region, yes and deploy parameters only go along with the create flag")
|
|
exit(0)
|
|
if args.print and not args.list or args.listimages or args.listsizes or args.listlocations:
|
|
print("The print flag only goes together with the list, list images, list sizes or list locations")
|
|
exit(0)
|
|
if args.port and not args.ssh:
|
|
print("The port flag only goes with the ssh flag")
|
|
exit(0)
|