Add version 0.1.o of sysadmins: a way to add sudo users #116

berkes · 2014-09-26T22:20:14Z

This is a first go at #79

It introduces a small cookbook "sysadmins" that takes sysadmins from the node json file and creates these on the server.

Please have a look and tell me what you think. If you like, I will add a commit that adds this cookbook to the base role and bump the version.

I could not find any tests in the main repo, but maybe I am looking wrong? Am I supposed to run/add tests? And if so, where?

houndci-bot · 2014-09-26T22:20:17Z

vendor/cookbooks/sysadmins/metadata.rb

@@ -0,0 +1,7 @@
+name             'sysadmins'


Put one space between the method name and the first argument.
Prefer double-quoted strings unless you need single quotes to avoid extra backslashes for escaping.

Give users a bash-shell by default: else they have no shell at all.

houndci-bot · 2014-09-28T17:54:16Z

roles/base.rb

@@ -1,6 +1,6 @@
 name 'base'
 description 'Base bootstrap for every box'
-run_list "recipe[sudo]", "recipe[apt]", "recipe[build-essential]"
+run_list "recipe[sysadmins]", "recipe[sudo]", "recipe[apt]", "recipe[build-essential]"


Line is too long. [86/80]

berkes · 2014-09-28T18:05:40Z

One important issue to discuss is the default sudo-behaviour.

As this PR piggybacks the sudo-file managed by the included sudo cookbook, it gets the behaviour for the "sysadmin group" from there.

This means all sysadmins can sudo without using their passwords.

I -personally- don't like that very much. But I cannot really think of an actual reason why it makes me uncomfortable. What do you think?

jvanbaarsen · 2014-09-29T07:19:49Z

@berkes Thanks for working on this! Are there ways to prevent the using sudo without password? Or would it be super hard? I have the same as you, don't really like it, but cant think of a reason why. @michiels What do you think?

michiels · 2014-09-29T09:23:16Z

Let me think on this a little bit. My first thought would be to double down on security and require a password. But since we're using SSH keys to connect this would seem a bit weird AND I don't want to put user's passwords in the Chef attributes.

An alternative would be to require password, and have the user add a password when they log in with their SSH key for the first time. So until they choose a password, they can't sudo. This way we do have double-security for this.

I'm not sure what the "best practice" is for this. Maybe we can find some pointers. I'll ask around too :)

berkes · 2014-09-29T09:55:09Z

My gut-feeling says to go with what Ubuntu does by default, rather than what the "sudo" cookbook does by default.

Ubuntu's (server) default sudo behaviour is:

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

The first user on the system automatically gets "admin" group. Any new users can get admin group.
Users belonging to admin group need to provide their password when using sudo.

Here's what I -personally- would prefer for my servers:
I provide a list of users that get "admin" in my node.json file. I provide the password hash in that list; and optionally, provide one or more ssh-key's that allow even easier access for that user.
Any user in that list has access and sudo-access in the "default" Ubuntu-way:

You log in (over SSH) using either the provided keys, or the password.
You then have sudo-access, which asks for your password again.

I don't know all the ins- and outs, and I cannot oversee all the security-impacts of all alternatives. It might be more secure, but might also open some unintended security-hole: scio me nescire.
As such, I rather simply trust that others, in this case the Ubuntu architects, have made the right desisions. And follow their system.

In that case: please don't yet apply his PR. I will refactor and make sure that the sudo-cookbook behaves in the normal Ubuntu-way; I will assign the default "admin" group as used in Ubuntu, rather than a new "sysadmin" group.

michiels · 2014-09-29T10:18:51Z

@berkes 100% agree with your comment about using Ubuntu's defaults and setting those things accordingly with our Chef recipes. Would be great if you can change this PR to make that work. Thanks!

* Use a group called "admin" * Require a password for sudo. Requiring a password breaks Vagrant's provision and setup and as such, we don't require a password in Vagrant.

houndci-bot · 2014-09-29T19:41:36Z

roles/base.rb

      "include_sudoers_d" => true,
      "sudoers_default" => [
        'env_reset',
+        'mail_badpass',


Prefer double-quoted strings unless you need single quotes to avoid extra backslashes for escaping.

berkes · 2014-09-29T19:43:26Z

This should bring it in line with Ubuntu's default behaviour.

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

houndci-bot · 2014-10-08T21:28:24Z

vendor/cookbooks/backups/metadata.rb

@@ -0,0 +1,7 @@
+name             "backups"


Put one space between the method name and the first argument.

berkes · 2014-10-08T21:29:38Z

Github is completely borking my rebase. Will re-open a proper PR in a sec.

Add version 0.1.o of sysadmins: a way to add sudo users

d656efa

houndci-bot reviewed Sep 26, 2014
View reviewed changes

berkes added 4 commits September 28, 2014 19:12

Implement all HoundCI-s suggestions

5cf0bad

Cheffile lockfile must contain the new sysadmins too.

6a98cca

Bash-shell for sysadmins and use sysadmins group.

4ec2914

Give users a bash-shell by default: else they have no shell at all.

Actually run the sysadmins cookbook on base

5f12ff2

houndci-bot reviewed Sep 28, 2014
View reviewed changes

berkes added 2 commits September 29, 2014 21:35

Make sudo work like Ubuntu's defaults.

f6e47d8

* Use a group called "admin" * Require a password for sudo. Requiring a password breaks Vagrant's provision and setup and as such, we don't require a password in Vagrant.

Add the current changes to the changelog

1348557

houndci-bot reviewed Sep 29, 2014
View reviewed changes

Make it clear that you need to librarian install

73e2d0c

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

jvanbaarsen and others added 18 commits October 8, 2014 23:24

Add info about needed vagrant version

4172a74

Basic backup functionality

3e5b49b

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Ignore certificates dir as it contains the certificates

6fd2259

Make sure the backup directory is present

c77ac77

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Added support for database backups

961fb20

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Fixed Hound warnings

e92e98a

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

last hound warnign

3b34584

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Cleaned up a bit

1be80ac

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Preparation for feature launch

3b36e30

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Removed the sudo recipe

d036c95

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Mention s3

4be35e3

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Fix in the backups recipe

a71018a

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Install more dependencies

ca745b8

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

ruby1.9.1-dev

5bca4a9

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Enable compression for backups

76095a9

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Fixed a bug in the compression enabled flag

911dba0

Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>

Rake should be part of the gems.

f4d2f84

Add the current changes to the changelog

00df230

houndci-bot reviewed Oct 8, 2014
View reviewed changes

vendor/cookbooks/backups/metadata.rb

@@ -0,0 +1,7 @@

name "backups"

Copy link

houndci-bot Oct 8, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Put one space between the method name and the first argument.

berkes closed this Oct 8, 2014

berkes deleted the feature/79-sudo-users branch October 8, 2014 21:29

berkes mentioned this pull request Oct 20, 2014

Feature #79 sudo users #125

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add version 0.1.o of sysadmins: a way to add sudo users #116

Add version 0.1.o of sysadmins: a way to add sudo users #116

berkes commented Sep 26, 2014

houndci-bot Sep 26, 2014

houndci-bot Sep 28, 2014

berkes commented Sep 28, 2014

jvanbaarsen commented Sep 29, 2014

michiels commented Sep 29, 2014

berkes commented Sep 29, 2014

michiels commented Sep 29, 2014

houndci-bot Sep 29, 2014

berkes commented Sep 29, 2014

houndci-bot Oct 8, 2014

berkes commented Oct 8, 2014

Add version 0.1.o of sysadmins: a way to add sudo users #116

Add version 0.1.o of sysadmins: a way to add sudo users #116

Conversation

berkes commented Sep 26, 2014

houndci-bot Sep 26, 2014

Choose a reason for hiding this comment

houndci-bot Sep 28, 2014

Choose a reason for hiding this comment

berkes commented Sep 28, 2014

jvanbaarsen commented Sep 29, 2014

michiels commented Sep 29, 2014

berkes commented Sep 29, 2014

michiels commented Sep 29, 2014

houndci-bot Sep 29, 2014

Choose a reason for hiding this comment

berkes commented Sep 29, 2014

houndci-bot Oct 8, 2014

Choose a reason for hiding this comment

berkes commented Oct 8, 2014