diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index ff0a9cd..0000000 --- a/Jenkinsfile +++ /dev/null @@ -1,129 +0,0 @@ -pipeline { - agent { - label 'puppet' - } - - post { - always { - deleteDir() /* clean up our workspace */ - } - success { - updateGitlabCommitStatus state: 'success' - } - failure { - updateGitlabCommitStatus state: 'failed' - step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: 'support@confdroid.com', sendToIndividuals: true]) - } - } - - options { - gitLabConnection('gitlab.confdroid.com') - } - - stages { - - stage('pull master') { - steps { - sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) { - sh ''' - git config user.name "Jenkins Server" - git config user.email jenkins@confdroid.com - # Ensure we're on the development branch (triggered by push) - git checkout development - # Create jenkins branch from development - git checkout -b jenkins-build-$BUILD_NUMBER - # Optionally merge master into jenkins to ensure compatibility - git merge origin/master --no-ff || { echo "Merge conflict detected"; exit 1; } - ''' - } - } - } - - stage('puppet parser') { - steps { - sh '''for file in $(find . -iname \'*.pp\'); do - /opt/puppetlabs/bin/puppet parser validate --color false --render-as s --modulepath=modules $file || exit 1; - done;''' - } - } - - stage('check templates') { - steps{ - sh '''for file in $(find . -iname \'*.erb\'); - do erb -P -x -T "-" $file | ruby -c || exit 1; - done;''' - } - } - - stage('puppet-lint') { - steps { - sh '''/usr/local/bin/puppet-lint . \\ - --no-variable_scope-check \\ - || { echo "Puppet lint failed"; exit 1; } - ''' - } - } - - stage('SonarScan') { - steps { - withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) { - sh ''' - /opt/sonar-scanner/bin/sonar-scanner \ - -Dsonar.projectKey=confdroid_ssh \ - -Dsonar.sources=. \ - -Dsonar.host.url=https://sonarqube.confdroid.com \ - -Dsonar.token=$SONAR_TOKEN - ''' - } - } - } - - stage('create Puppet documentation') { - steps { - sh '/opt/puppetlabs/bin/puppet strings' - } - } - - stage('update repo') { - steps { - sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) { - sh ''' - git config user.name "Jenkins Server" - git config user.email jenkins@confdroid.com - git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit" - git push -o merge_request.create \ - -o merge_request.target=master \ - -o merge_request.title="Auto-merge for build $BUILD_NUMBER" \ - -o merge_request.description="Automated changes from Jenkins build $BUILD_NUMBER" \ - -o merge_request.merge_when_pipeline_succeeds=true \ - origin jenkins-build-$BUILD_NUMBER - ''' - } - } - } - stage('Mirror to Gitea') { - steps { - withCredentials([usernamePassword( - credentialsId: 'Jenkins-gitea', - usernameVariable: 'GITEA_USER', - passwordVariable: 'GITEA_TOKEN')]) { - script { - // Checkout from GitLab (already done implicitly) - sh ''' - git checkout master - git pull origin master - git branch -D development - git branch -D jenkins-build-$BUILD_NUMBER - git rm -f Jenkinsfile - git rm -r --cached .vscode || echo "No .vscode to remove from git" - git commit --amend --no-edit --allow-empty - git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_ssh.git - git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \ - push master --mirror - ''' - } - } - } - } - } -} \ No newline at end of file diff --git a/README.md b/README.md index f43420c..8361fe3 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,7 @@ - install required binaries - manage local custom configuration based on parameters, overriding the defaults +- manage selinux rules - manage service - (optional) manage firewall diff --git a/manifests/main/files.pp b/manifests/main/files.pp index 5ba3bba..de10f4f 100644 --- a/manifests/main/files.pp +++ b/manifests/main/files.pp @@ -18,6 +18,7 @@ class confdroid_ssh::main::files ( seltype => etc_t, seluser => system_u, content => template($sshd_config_erb), + notify => Service[$sshd_service], } if $ssh_manage_config { @@ -32,6 +33,7 @@ class confdroid_ssh::main::files ( seltype => etc_t, seluser => system_u, content => template($sshd_custom_erb), + notify => Service[$sshd_service], } } } diff --git a/manifests/main/service.pp b/manifests/main/service.pp index 50c048f..7d1a318 100644 --- a/manifests/main/service.pp +++ b/manifests/main/service.pp @@ -6,6 +6,7 @@ class confdroid_ssh::main::service ( ) inherits confdroid_ssh::params { require confdroid_ssh::main::files + require confdroid_ssh::selinux::semanage if $ssh_use_firewall { require confdroid_ssh::firewall::iptables } diff --git a/manifests/params.pp b/manifests/params.pp index cf54a25..a616ae8 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -9,20 +9,24 @@ # @param [String] ssh_fw_order order of firewall rule # @param [String] ssh_source_range source range for firewall rule # @param [Boolean] ssh_manage_config whether to manage the configuration +# @param [String] ssh_address_family AddressFamily setting for sshd_config +# @param [String] ssh_listen_address ListenAddress setting for sshd_config ############################################################################## class confdroid_ssh::params ( - Array $ssh_reqpackages = ['openssh','openssh-clients','openssh-server'], - String $pkg_ensure = 'present', + Array $ssh_reqpackages = ['openssh','openssh-clients','openssh-server'], + String $pkg_ensure = 'present', # firewall settings - Boolean $ssh_use_firewall = true, - String $ssh_fw_port = '22', - String $ssh_fw_order = '50', - String $ssh_source_range = '0.0.0.0/0', + Boolean $ssh_use_firewall = true, + String $ssh_fw_port = '22', + String $ssh_fw_order = '50', + String $ssh_source_range = '0.0.0.0/0', # main configuration - Boolean $ssh_manage_config = true, + Boolean $ssh_manage_config = true, + String $ssh_address_family = 'any', + String $ssh_listen_address = '0.0.0.0', ) { # default facts @@ -38,8 +42,8 @@ class confdroid_ssh::params ( $sshd_config_path = "${ssh_etc_path}/sshd_config" $sshd_custom_path = "${ssh_etc_path}/sshd_config.d" $sshd_custom_conf = "${sshd_custom_path}/10-custom.conf" - $sshd_custom_erb = 'confdroid_ssh/ssh_custom_conf.erb' - $sshd_config_erb = 'confdroid_ssh/ssh_config.erb' + $sshd_custom_erb = 'confdroid_ssh/sshd_custom_conf.erb' + $sshd_config_erb = 'confdroid_ssh/sshd_config.erb' # includes must be last include confdroid_ssh::main::config diff --git a/manifests/selinux/semanage.pp b/manifests/selinux/semanage.pp new file mode 100644 index 0000000..68d69ef --- /dev/null +++ b/manifests/selinux/semanage.pp @@ -0,0 +1,13 @@ +## confdroid_ssh::selinux::semanage.pp +# Module name: confdroid_ssh +# Author: 12ww1160 (12ww1160@confdroid.com) +# @summary Class manages SELinux semanage settings +############################################################################## +class confdroid_ssh::selinux::semanage ( +) inherits confdroid_ssh::params { + exec { 'semanage_port_ssh': + command => "semanage port -a -t ssh_port_t -p tcp ${ssh_fw_port}", + unless => "semanage port -l | grep '^ssh_port_t' | grep 'tcp' | grep '${ssh_fw_port}'", + path => ['/usr/bin', '/usr/sbin'], + } +} diff --git a/templates/ssh_config.erb b/templates/sshd_config.erb similarity index 100% rename from templates/ssh_config.erb rename to templates/sshd_config.erb diff --git a/templates/ssh_custom_conf.erb b/templates/sshd_custom_conf.erb similarity index 81% rename from templates/ssh_custom_conf.erb rename to templates/sshd_custom_conf.erb index a6d7920..1f9e222 100644 --- a/templates/ssh_custom_conf.erb +++ b/templates/sshd_custom_conf.erb @@ -5,3 +5,6 @@ ##### be made in the Puppet manifest parameters. # ############################################################################### +Port <%= @ssh_fw_port %> +AddressFamily <%= @ssh_address_family %> +ListenAddress <%= @ssh_listen_address %> \ No newline at end of file