Skip to content

Commit 3422d34

Browse files
rockpapergoatrockpapergoat
authored
adding basic Windows agent support (#38)
* created auditd test branch * don't reassign that variable * move that down a bit in the case statements * fix amazon linux repo url and auditd disabling * updated spec for yum/amazon test * use old style os fact * ensure facts are in specs * wow, okay. missed another spot. * disable auditd on rhel like oses * don't set param twice * updated readme and changelog * updated metadata * updated gitignore * adding windows support * added windows specific paths we shall see * don't reassign variables * missing a comma * make sure vars are defined clean this up later. we don't need to define some of those for windows, like gpg key and friends. * define another thing we don't need here. just want to test basic functionality. * fix missing brace * allow upgrades * ensure installed only for now * skip configure hile testing but get back to it * wrong function there man, i'm rusty. * use lwf/remote_file to download * missing comma * more typos * add bin paths for windows see if config works * trying another thing here * added more params made config do less on windows * diff default ruleset for windows * pass deploy key from top level * append the deploy key to the windows install opts * apparently order is important here * ensure the package resource is named correctly on windows * use the name reported by add/remove programs/registry * updated docs a little will have to go back to add new params, etc. * add windows data yaml will also need to flesh this out some
1 parent 08962c5 commit 3422d34

11 files changed

Lines changed: 179 additions & 36 deletions

File tree

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,17 @@
1+
.DS_Store
12
.kitchen/
23
.bundle
34
.kitchen.local.yml
45
.librarian/
6+
*.swp
7+
*.orig
8+
*.log
9+
*.rpm
10+
*.deb
511
.ruby-version
612
.tmp/
13+
config.sh
14+
test.pp
715
modules/
816
pkg
917
Gemfile.lock

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
We'll track changes here starting with details about the 2.0 release and reference to earlier releases.
44

5+
## 2.0.3
6+
### Added
7+
- added basic support for downloading, configuring, installing, running windows agent
8+
59
## 2.0.2
610
### Fixed
711
- fixed amazon linux 1 support and tests

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,18 @@ Platforms
2121
* Debian
2222
* RedHat
2323
* Ubuntu
24+
* Windows
2425

2526
Classes
2627
=======
2728

2829
* `threatstack` - Main class
2930
* `threatstack::apt` (private) - Setup apt repository configuration and package install
3031
* `threatstack::yum` (private) - Setup yum repository configuration and package install
32+
* `threatstack::msi` (private) - Dummy repo class for Windows installs
3133
* `threatstack::configure` (private) - Register and configure the agent with the Threat Stack service
32-
* `threatstack::package` (private) - Install the Threat stack agent
34+
* `threatstack::package` (private) - Install the Threat Stack agent
35+
* `threatstack::service` (private) - Manage the Threat Stack service
3336
* `threatstack::params` (private) - Default setup values
3437
* `threatstack::site` (private) - Used by Puppet test-kitchen
3538

‎data/os/Windows.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
threatstack::params:
3+
repo_class: '::threatstack::msi'
4+
gpg_key: undef
5+
disable_auditd: false

‎manifests/configure.pp‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
# Copyright 2019 Threat Stack, Inc.
1919
#
2020
class threatstack::configure {
21-
2221
$rulesets = $::threatstack::rulesets
2322
$ruleset_args = $rulesets.map | $rule | {
2423
"--ruleset='${rule}'"
@@ -61,12 +60,18 @@
6160
} else {
6261
$config_args_content = ''
6362
}
64-
65-
exec { 'threatstack-agent-setup':
66-
command => "${cloudsight_bin} setup --deploy-key='${::threatstack::deploy_key}' --hostname='${::threatstack::ts_hostname}' ${full_setup_args}",
67-
subscribe => Package[$threatstack::ts_package],
68-
creates => "${confdir}/.audit",
69-
path => ['/bin', '/usr/bin'],
70-
unless => 'ps auwwwx| grep [t]sagentd'
63+
case $facts['os']['family'] {
64+
'Windows': {
65+
notice("Windows agent setup should be done at install time.")
66+
}
67+
default: {
68+
exec { 'threatstack-agent-setup':
69+
command => "${cloudsight_bin} setup --deploy-key='${::threatstack::deploy_key}' --hostname='${::threatstack::ts_hostname}' ${full_setup_args}",
70+
subscribe => Package[$threatstack::ts_package],
71+
creates => "${confdir}/.audit",
72+
path => $::threatstack::binpath,
73+
unless => $::threatstack::setup_unless
74+
}
75+
}
7176
}
7277
}

‎manifests/init.pp‎

Lines changed: 49 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88
# Arguments to be passed to `tsagent setup`
99
# type: array
1010
#
11+
# [*binpath*]
12+
# Used to set bin path for exec in the config class
13+
# type: Array
14+
#
1115
# [*disable_auditd*]
1216
# Required to work around issues with auditd on some distros
1317
# type: bool
@@ -16,6 +20,10 @@
1620
# Systemd vs. SysV init, related to above
1721
# type: string
1822
#
23+
# [*enable_sysmon*]
24+
# Windows: optionally enable sysmon (not used yet)
25+
# type: bool
26+
#
1927
# [*extra_args*]
2028
# Extra arguments to pass on the command line during agent activation.
2129
# type: array of hashes
@@ -54,10 +62,30 @@
5462
# Ruleset(s) to apply to host.
5563
# type: array
5664
#
65+
# [*setup_unless*]
66+
# Used in the setup exec in the configure class
67+
# type: String
68+
#
69+
# [*tmpdir*]
70+
# Used to download Windows agent MSI
71+
# type: string
72+
#
5773
# [*ts_hostname*]
5874
# Hostname as reported to Threat Stack.
5975
# type: string
6076
#
77+
# [*windows_download_url*]
78+
# Windows MSI download url
79+
# type: string
80+
#
81+
# [*windows_install_options*]
82+
# Windows MSI install options
83+
# type: array
84+
#
85+
# [*windows_ts_package*]
86+
# Windows MSI package name
87+
# type: string
88+
#
6189
# === Examples
6290
#
6391
# Standard usage:
@@ -78,25 +106,32 @@
78106
#
79107
# Pete Cheslock <pete.cheslock@threatstack.com>
80108
# Tom McLaughlin <tom.mclaughlin@threatstack.com>
109+
# Nate St. Germain <nate.stgermain@threatstack.com>
81110
#
82111
# === Copyright
83112
#
84-
# Copyright 2016 Threat Stack, Inc.
113+
# Copyright 2019 Threat Stack, Inc.
85114
#
86115
class threatstack (
87-
$deploy_key = undef,
88-
$package_version = $::threatstack::params::package_version,
89-
$configure_agent = true,
90-
$extra_args = $::threatstack::params::extra_args,
91-
$agent_config_args = undef,
92-
$repo_class = $::threatstack::params::repo_class,
93-
$repo_url = $::threatstack::params::repo_url,
94-
$gpg_key = $::threatstack::params::gpg_key,
95-
$rulesets = $::threatstack::params::rulesets,
96-
$confdir = $::threatstack::params::confdir,
97-
$ts_hostname = $::fqdn,
98-
$disable_auditd = $::threatstack::params::disable_auditd,
99-
$disable_auditd_cmd = $::threatstack::params::disable_auditd_cmd
116+
$deploy_key = undef,
117+
$package_version = $::threatstack::params::package_version,
118+
$configure_agent = true,
119+
$extra_args = $::threatstack::params::extra_args,
120+
$agent_config_args = undef,
121+
$repo_class = $::threatstack::params::repo_class,
122+
$repo_url = $::threatstack::params::repo_url,
123+
$gpg_key = $::threatstack::params::gpg_key,
124+
$rulesets = $::threatstack::params::rulesets,
125+
$confdir = $::threatstack::params::confdir,
126+
$ts_hostname = $::fqdn,
127+
$disable_auditd = $::threatstack::params::disable_auditd,
128+
$disable_auditd_cmd = $::threatstack::params::disable_auditd_cmd,
129+
$binpath = $::threatstack::params::binpath,
130+
$setup_unless = $::threatstack::params::setup_unless,
131+
$windows_download_url = $::threatstack::params::download_url,
132+
$windows_tmp_path = $::threatstack::params::tmp_path,
133+
$windows_install_options = concat(["TSDEPLOYKEY=${deploy_key}"],$::threatstack::params::windows_install_options)
134+
100135
) inherits ::threatstack::params {
101136

102137
$ts_package = $::threatstack::params::ts_package

‎manifests/msi.pp‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# == Class: threatstack::msi
2+
#
3+
# Download Threat Stack msi
4+
#
5+
# === Examples
6+
#
7+
# This class is not meant to be directly realized outside of
8+
# Class['::threatstack'].
9+
#
10+
# This is sort of a dummy class but might be used at some point.
11+
#
12+
# === Authors
13+
#
14+
# Nate St. Germain <nate.stgermain@threatstack.com>
15+
#
16+
# === Copyright
17+
#
18+
# Copyright 2019 Threat Stack, Inc.
19+
#
20+
class threatstack::msi inherits ::threatstack::params {
21+
}

‎manifests/package.pp‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,26 @@
3939
# NOTE: We do not signal the tsagent service to restart because the
4040
# package takes care of this. The workflow differs between fresh
4141
# installation and upgrades.
42-
package { $::threatstack::ts_package:
43-
ensure => $::threatstack::package_version,
44-
require => $required
42+
case $facts['os']['family'] {
43+
'Windows': {
44+
remote_file { 'agent msi download':
45+
ensure => present,
46+
path => $::threatstack::windows_tmp_path,
47+
source => $::threatstack::windows_download_url
48+
}
49+
50+
package { $::threatstack::ts_package:
51+
ensure => installed,
52+
source => $::threatstack::windows_tmp_path,
53+
install_options => $::threatstack::windows_install_options,
54+
require => Remote_file['agent msi download']
55+
}
56+
}
57+
default: {
58+
package { $::threatstack::ts_package:
59+
ensure => $::threatstack::package_version,
60+
require => $required
61+
}
4562
}
63+
}
4664
}

‎manifests/params.pp‎

Lines changed: 47 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,57 @@
1818
#
1919

2020
class threatstack::params {
21-
$ts_package = 'threatstack-agent'
22-
$ts_service = 'threatstack'
21+
$ts_package = $facts['os']['family'] ? {
22+
'Windows' => 'Threat Stack Cloud Security Platform',
23+
default => 'threatstack-agent'
24+
}
25+
26+
$ts_service = $facts['os']['family'] ? {
27+
'Windows' => 'Threat Stack Agent',
28+
default => 'threatstack'
29+
}
30+
31+
$cloudsight_bin = $facts['os']['family'] ? {
32+
'Windows' => "C:\\Program Files\\Threat Stack\\tsagent.exe",
33+
default => '/usr/bin/tsagent'
34+
}
35+
36+
$binpath = $facts['os']['family'] ? {
37+
'Windows' => ["C:\\Program Files\\Threat Stack\\"],
38+
default => ['/bin', '/usr/bin']
39+
}
40+
41+
$setup_unless = $facts['os']['family'] ? {
42+
'Windows' => 'tasklist.exe /fi "Imagename eq tsagent*"',
43+
default =>'ps auwwwx| grep [t]sagentd'
44+
}
45+
46+
$confdir = $facts['os']['family'] ? {
47+
'Windows' => "C:\\ProgramData\\Threat Stack\\config\\",
48+
default => '/opt/threatstack/etc'
49+
}
50+
51+
$rulesets = $facts['os']['family'] ? {
52+
'Windows' => ['Windows Rule Set'],
53+
default => ['Base Rule Set']
54+
}
55+
2356
$package_version = 'installed'
24-
$rulesets = ['Base Rule Set']
2557
$extra_args = undef
26-
$cloudsight_bin = '/usr/bin/tsagent'
27-
$confdir = '/opt/threatstack/etc'
58+
$windows_install_options = ["TSEVENTLOGLIST=Security,Microsoft-Windows-Sysmon/Operational"]
2859

2960
case $facts['os']['family'] {
61+
'Windows': {
62+
$repo_class = '::threatstack::msi'
63+
$repo_url = undef
64+
$gpg_key = undef
65+
$disable_auditd = false
66+
$disable_auditd_cmd = undef
67+
$windows_base_url = "https://pkg.threatstack.com/v2/Windows"
68+
$windows_pkg_name = 'Threat+Stack+Cloud+Security+Agent.latest.msi'
69+
$download_url = "${windows_base_url}/${windows_pkg_name}"
70+
$tmp_path = "C:\\Windows\\Temp\\${windows_pkg_name}"
71+
}
3072
'RedHat': {
3173
$repo_class = '::threatstack::yum'
3274
$gpg_key = 'https://app.threatstack.com/RPM-GPG-KEY-THREATSTACK'
@@ -66,6 +108,4 @@
66108
fail("Module ${module_name} does not support ${::operatingsystem}")
67109
}
68110
}
69-
70-
71111
}

‎manifests/service.pp‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,3 @@
2323
}
2424

2525
}
26-

0 commit comments

Comments
 (0)