def create_accounts(users=None, default_password=None,
groups=None, admin=False):
"""
Create accounts with same settings
Default section: accounts, admin
:param users: List of users
:type users: str, list
:param default_password: Their default password ( in ``admin`` )
:type default_password: str
:param groups: List or string of comma separated groups
:type groups: list, str
:param admin: Should be users admins or not
:type admin: bool
"""
opts = dict(
users=users
or get_envvar('usernames',section='accounts')
or err("Users must be set"),
default_password=default_password
or get_envvar('default_password',section='accounts,admin')
or err("Default_password must be set"),
groups=groups
or get_envvar('groups',section='accounts'),
admin=admin or get_envvar('admin',section='accounts')
)
for username in opts["users"]:
create_account(username, default_password=opts["default_password"], admin=opts["admin"])
def testGetFromPriorityGroup(self):
env.settings={"email":"a", "admin":{"email":"b"}, "info":{"email":"c"}}
self.assertEqual(get_envvar("email", "admin,info"), "b")
env.settings={"email":"a", "admin":{}, "info":{"email":"c"}}
self.assertEqual(get_envvar("email", "admin,info"), "c")
env.settings={"email":"a", "admin":{}, "info":{}}
self.assertEqual(get_envvar("email", "admin,info"), "a")
def testGetFromSubgroupPriorityGroup(self):
env.settings = {
"email": "a",
"group1": {
"admin": {
"email": "b"
}
},
"group2": {
"info": {
"email": "c"
}
}
}
self.assertEqual(get_envvar("email", "group1.admin,group2.info"), "b")
env.settings = {
"email": "a",
"group1": {
"admin": {}
},
"group2": {
"info": {
"email": "c"
}
}
}
self.assertEqual(get_envvar("email", "group1.admin,group2.info"), "c")
env.settings = {"email": "a", "group1": {"admin": {}}}
self.assertEqual(get_envvar("email", "group1.admin,group2.info"), "a")
def configure_mysql_backups(password=None, time=None):
"""Example task for mysql backups"""
opts = dict(
password=password
or get_envvar('password',section='mysql',envdefault='default_password')
or err("No password for mysql set"),
time=time
or get_envvar('time',section='mysql')
or err("No backup time for mysql set")
)
# configure daily dumps of all databases
sudo('mkdir /var/backups/mysql')
sudo("echo %(time)s mysqldump -u root -p%(password)s --all-databases | gzip > /var/backups/mysql/mysqldump_$(date +%%Y-%%m-%%d).sql.gz' > /etc/cron.d/mysqldump" % opts)
def testGetFromDomain(self):
env.settings = {
"root": {
"admin": {
"email": "a"
}
},
"offlinehacker": {
"admin": {
"email": "b"
}
}
}
self.assertEqual(get_envvar("email", "admin", domain="root"), "a")
self.assertEqual(
get_envvar("email", "admin", domain="offlinehacker"), "b")
def install_rkhunter(email=None):
"""
Install and configure RootKit Hunter
Default section: admin
:param email: Email to send reports
:type email: str
"""
opts = dict(
email=email
or get_envvar('email',section='admin')
or err('Email must be set'),
)
# install RKHunter
apt_get('rkhunter')
# send emails on warnings
uncomment('/etc/rkhunter.conf', '#MAIL-ON-WARNING=me@mydomain root@mydomain', use_sudo=True)
sed('/etc/rkhunter.conf', 'me@mydomain root@mydomain', opts['email'], use_sudo=True)
# ignore some Ubuntu specific files
uncomment('/etc/rkhunter.conf', '#ALLOWHIDDENDIR=\/dev\/.udev', use_sudo=True)
uncomment('/etc/rkhunter.conf', '#ALLOWHIDDENDIR=\/dev\/.static', use_sudo=True)
uncomment('/etc/rkhunter.conf', '#ALLOWHIDDENDIR=\/dev\/.initramfs', use_sudo=True)
def install_unattended_upgrades(email=None):
"""
Configure Ubuntu to automatically install security updates.
Default section: admin
:param email: email where you want to receive info about updates
:type email: str
"""
opts = dict(
email=email or get_envvar("email", section="admin")
or err('env.email must be set'),
)
apt_get('unattended-upgrades')
sed('/etc/apt/apt.conf.d/50unattended-upgrades',
'//Unattended-Upgrade::Mail "root@localhost";',
'Unattended-Upgrade::Mail "%(email)s";' % opts,
use_sudo=True)
sed('/etc/apt/apt.conf.d/10periodic',
'APT::Periodic::Download-Upgradeable-Packages "0";',
'APT::Periodic::Download-Upgradeable-Packages "1";',
use_sudo=True)
sed('/etc/apt/apt.conf.d/10periodic',
'APT::Periodic::AutocleanInterval "0";',
'APT::Periodic::AutocleanInterval "7";',
use_sudo=True)
append('/etc/apt/apt.conf.d/10periodic',
'APT::Periodic::Unattended-Upgrade "1";',
use_sudo=True)
def testOverrideDomain(self):
with settings(domain="offlinehacker"):
env.settings = {
"root": {
"email": "b"
},
"offlinehacker": {
"email": "c"
}
}
self.assertEqual(get_envvar("email", domain="root"), "c")
def testOverrideGroup(self):
with settings(group="info"):
env.settings = {
"email": "a",
"admin": {
"email": "b"
},
"info": {
"email": "c"
}
}
self.assertEqual(get_envvar("email", "admin"), "c")
def set_hostname(ip=None, hostname=None):
"""
Set server's hostname
Default section: network
:param ip: ip
:type ip: str
:param hostname: hostname
:type hostname: str
"""
opts = dict(
ip=ip or get_envvar("ip",section="network")
or err("env.server_ip must be set"),
hostname=hostname or get_envvar("hostname",section="network")
or err("env.hostname must be set"),
)
sudo('echo "\n%(server_ip)s %(hostname)s" >> /etc/hosts' % opts)
sudo('echo "%(hostname)s" > /etc/hostname' % opts)
sudo('hostname %(hostname)s' % opts)
def generate_selfsigned_ssl(hostname=None):
"""Generate self-signed SSL certificates and provide them to Nginx."""
opts = dict(
hostname=hostname
or get_envvar('hostname',section='nginx')
or err("Hostname must be set"),
)
if not exists('mkdir /etc/nginx/certs'):
sudo('mkdir /etc/nginx/certs')
sudo('openssl genrsa -des3 -out server.key 2048')
sudo('openssl req -new -key server.key -out server.csr')
sudo('cp server.key server.key.password')
sudo('openssl rsa -in server.key.password -out server.key')
sudo('openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt')
sudo('cp server.crt /etc/nginx/certs/%(hostname)s.crt' % opts)
sudo('cp server.key /etc/nginx/certs/%(hostname)s.key' % opts)
def testGetFromSubgroupGroup(self):
env.settings = {
"group1": {
"group11": {
"val": "a"
},
"group12": {
"val": "b"
}
},
"group2": {
"group21": {
"val": "c"
},
"group22": {
"val": "d"
}
}
}
self.assertEqual(get_envvar("val", "group2.group21"), "c")
def set_system_time(timezone=None):
"""
Sets system timezone and installs ntp
Default section: admin
:param timezone: Timezone, for example ``/usr/share/zoneinfo/UTC``
:type timezone: str
"""
opts = dict(
timezone=timezone or get_envvar("timezone", section="admin")
or '/usr/share/zoneinfo/UTC',
)
# set timezone
sudo('cp %(timezone)s /etc/localtime' % opts)
# install NTP
apt_get('ntp')
def configure_ufw(rules=None):
"""
Configures Uncomplicated Firewall.
Default section: ufw,network
:param rules: list of firewall rules
:type rules: list, str
"""
# reset rules so we start from scratch
sudo('ufw --force reset')
rules = rules or get_envvar("rules", section="ufw,network") \
or err("env.rules must be set")
for rule in rules:
sudo(rule)
# re-enable firewall and print rules
sudo('ufw --force enable')
sudo('ufw status verbose')
def install_sendmail(email=None):
"""
Prepare a localhost SMTP server for sending out system notifications
to admins
Default section: admin
:param email: Email to send reports
:type email: str
"""
opts = dict(
email=email
or get_envvar('email',section='admin')
or err('Email must be set'),
)
# install sendmail
apt_get('sendmail')
# all email should be sent to maintenance email
append('/etc/aliases', 'root: %(email)s' % opts, use_sudo=True)
def raid_monitoring(email=None):
"""
Configure monitoring of our RAID-1 field. If anything goes wrong,
send an email!
Default section: admin
:param email: Email to send reports
:type email: str
"""
opts = dict(
email=email
or get_envvar('email',section='admin')
or err('Email must be set'),
)
# enable email notifications from mdadm raid monitor
append('/etc/mdadm/mdadm.conf', 'MAILADDR %(email)s' % opts, use_sudo=True)
# enable email notification for SMART disk monitoring
apt_get('smartmontools')
uncomment('/etc/default/smartmontools', '#start_smartd=yes', use_sudo=True)
def install_mysql(password=None):
"""
Install MySQL database server
Default section: mysql
:param password: Root mysql password ( ``envdefault="default_password"`` )
:type password: str
"""
opts = dict(
password=password
or get_envvar('password',section='mysql',envdefault='default_password')
or err("No password for mysql set")
)
# first set root password in advance so we don't get the package
# configuration dialog
sudo('echo "mysql-server-5.0 mysql-server/root_password password %(password)s" | debconf-set-selections' % opts)
sudo('echo "mysql-server-5.0 mysql-server/root_password_again password %(password)s" | debconf-set-selections' % opts)
# install MySQL along with php drivers for it
apt_get('mysql-server mysql-client')
def testGetFromGroup(self):
env.settings={"email":"a", "admin":{"email":"b"}}
self.assertEqual(get_envvar("email", "admin"), "b")
env.settings={"email":"a", "admin":{}}
self.assertEqual(get_envvar("email", "admin"), "a")
def testGetFromRoot(self):
env.settings={"email":"a", "admin":{}}
self.assertEqual(get_envvar("email", "admin"), "a")