-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
25 changed files
with
1,322 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| --- | ||
| # Create a named Credential OEM_HOST_SSH which may be used by the Central Agent | ||
| # for local authentication to the host where OMS is running. This uses an SSH | ||
| # key rather than a password. | ||
|
|
||
| # SSSD needs to be installed as OEM uses the pam_sss.so library provided. | ||
| # The daemon itself does not need to be enabled or started. | ||
| - name: Install SSSD | ||
| yum: | ||
| name: sssd | ||
| state: present | ||
| disable_gpg_check: true | ||
|
|
||
| # By default ssh-rsa is not an accepted authentication method in the OpenSSH | ||
| # server which is installed by default in OL/RH7.4 and above. | ||
| # Add it to the list of accepted methods. | ||
| - name: Allow ssh-rsa Authentication in OpenSSH | ||
| lineinfile: | ||
| path: /etc/crypto-policies/back-ends/opensshserver.config | ||
| regexp: "^(.*-oPubkeyAcceptedKeyTypes=)(?!ssh-rsa,)(.+)$" | ||
| line: '\1ssh-rsa,\2' | ||
| backrefs: true | ||
| register: add_ssh_rsa | ||
|
|
||
| # A restart if require to pick up the OpenSSH Config changes | ||
| - name: Restart SSHD service | ||
| ansible.builtin.service: | ||
| name: sshd | ||
| state: restarted | ||
| when: add_ssh_rsa.changed | ||
|
|
||
| - name: Create SSH Directory for Oracle | ||
| file: | ||
| path: "/home/{{ oracle_install_user }}/.ssh" | ||
| owner: "{{ oracle_install_user }}" | ||
| group: "{{ oracle_install_group }}" | ||
| state: directory | ||
| mode: "0700" | ||
|
|
||
| - name: Generate an RSA private key | ||
| community.crypto.openssh_keypair: | ||
| path: "/home/{{ oracle_install_user }}/.ssh/oem_ssh_key" | ||
| comment: For use by OEM Central Agent for local authentication | ||
| size: 4096 | ||
| type: rsa | ||
| become: true | ||
| become_user: oracle | ||
|
|
||
| - name: Read Public key | ||
| slurp: | ||
| src: "/home/{{ oracle_install_user }}/.ssh/oem_ssh_key.pub" | ||
| register: read_public_key | ||
|
|
||
| - name: Authorize the Public Key for Agent Connections | ||
| authorized_key: | ||
| user: "{{ oracle_install_user }}" | ||
| state: present | ||
| key: "{{ read_public_key.content | b64decode }}" | ||
|
|
||
| - name: Create HostSSHCreds | ||
| block: | ||
| # EMCLI Login script contains a password so ensure it is not readable by other users | ||
| - name: Copy EMCLI Login Script | ||
| ansible.builtin.template: | ||
| src: emcli_login.sh.j2 | ||
| dest: "{{ stage }}/emcli_login.sh" | ||
| mode: "0700" | ||
| owner: oracle | ||
| group: oinstall | ||
|
|
||
| # If the credential already exists then do not treat that as an error | ||
| - name: Run HostSSHCreds Creation | ||
| become_user: oracle | ||
| ansible.builtin.shell: | | ||
| echo "running emcli_login.sh" | ||
| {{ stage }}/emcli_login.sh | ||
| # Get Hostname as it is known to the Central Agent | ||
| HOST_TARGET=$({{ emctl }} config agent listtargets | grep -E "^.*, host]$" | cut -d, -f1 | tr -d ' []') | ||
| echo "Adding OEM_HOST_SSH CREDENTIALS for the ${HOST_TARGET} host" | ||
| function create_credential() | ||
| { | ||
| {{ emcli }} create_named_credential -cred_name=OEM_HOST_SSH -auth_target_type=host -cred_type=HostSSHCreds -attributes="USERNAME:{{ oracle_install_user }};SSH_PVT_KEY:pvtkey" -target_name="${HOST_TARGET}" -input_file="pvtkey:/home/{{ oracle_install_user }}/.ssh/oem_ssh_key" -target_type=host -cred_scope=instance | ||
| RC=$? | ||
| } | ||
| CREATE_CREDENTIAL=$(create_credential) | ||
| ALREADY_EXISTS_MESSAGE="Error occurred: Credential name OEM_HOST_SSH exists." | ||
| if [[ ${CREATE_CREDENTIAL} =~ ${ALREADY_EXISTS_MESSAGE} ]]; then | ||
| # If the credential already exists then drop and replace it since the key may have been changed | ||
| {{ emcli }} delete_named_credential -cred_owner=SYSMAN -cred_name=OEM_HOST_SSH | ||
| create_credential | ||
| fi | ||
| exit $RC | ||
| register: run_hostsshcreds_creation | ||
| changed_when: run_hostsshcreds_creation.stdout is search('.*Credential OEM_HOST_SSH created.*') | ||
|
|
||
| - name: Set Preferred Host Credentials for the OEM Database | ||
| become_user: oracle | ||
| ansible.builtin.shell: | | ||
| echo "running emcli_login.sh" | ||
| {{ stage }}/emcli_login.sh | ||
| {{ emcli }} set_preferred_credential -set_name=DBHostCreds -target_name=EMREP -target_type=oracle_database -credential_name=OEM_HOST_SSH | ||
| register: set_preferred_credentials | ||
|
|
||
| always: | ||
| - name: Remove EMCLI login scripts from Staging Area | ||
| ansible.builtin.file: | ||
| path: emcli_login.sh | ||
| state: absent |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| <# | ||
| .SYNOPSIS | ||
| Wrapper script for creating module manifest | ||
| .DESCRIPTION | ||
| Automatically detect files and exported functions and create | ||
| associated manifest file. | ||
| .PARAMETER ModuleName | ||
| String | ||
| .PARAMETER ModuleVersion | ||
| String | ||
| .PARAMETER Description | ||
| String | ||
| .EXAMPLE | ||
| Create-ModPlatformModuleManifest.ps1 "ModPlatformAD" | ||
| #> | ||
|
|
||
| param ( | ||
| [Parameter(Mandatory=$true)][string]$ModuleName, | ||
| $ModuleVersion, | ||
| $Description, | ||
| $PowerShellVersion | ||
| ) | ||
|
|
||
| $ManifestParameters = @{ | ||
| "GUID" = New-Guid | ||
| "ModuleVersion" = "1.0.0.0" | ||
| "Author" = "Ministry of Justice" | ||
| "CompanyName" = "Ministry of Justice" | ||
| "Copyright" = "(c) 2024 Crown Copyright (Ministry of Justice)" | ||
| "Description" = "Modernisation Platform ${ModuleName} module" | ||
| "PowerShellVersion" = $PSVersionTable.PSVersion.ToString() | ||
| } | ||
|
|
||
| $ErrorActionPreference = "Stop" | ||
|
|
||
| $ManifestPath = "${ModuleName}/${ModuleName}.psd1" | ||
|
|
||
| # Overwrite default manifest parameters with existing values with incremented version | ||
| if (Get-ChildItem $ManifestPath -ErrorAction SilentlyContinue) { | ||
| $ManifestParameters.Keys.Clone() | ForEach-Object { | ||
| $ExistingValue = (Select-String -Path $ManifestPath -Pattern "${_} = '" -Raw).Split("'")[1] | ||
| if ($ExistingValue) { | ||
| if ($_ -eq "ModuleVersion") { | ||
| # increment existing version number | ||
| $Version = [version]$ExistingValue | ||
| $Number = $Version.Major*1000+$Version.Minor*100+$Version.Build*10+$Version.Revision+1 | ||
| $Revision = $Number % 10 | ||
| $Build = (($Number-$Revision)/10)%10 | ||
| $Minor = (($Number-$Revision-$Build*10)/100)%10 | ||
| $Major = ($Number-$Revision-$Build*10-$Minor*100)/1000 | ||
| $ManifestParameters[$_] = "${Major}.${Minor}.${Build}.${Revision}" | ||
| } else { | ||
| $ManifestParameters[$_] = $ExistingValue | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if ($ModuleVersion) { | ||
| $Version = [version]$ModuleVersion | ||
| if ($Version.Revision -gt 9 -or $Version.Build -gt 9 -or $Version.Minor -gt 9) { | ||
| Write-Error "Invalid version - revision/build/minor must not exceed 9" | ||
| } | ||
| $ManifestParameters["ModuleVersion"] = $ModuleVersion | ||
| } | ||
| if ($Description) { | ||
| $ManifestParameters["Description"] = $Description | ||
| } | ||
| if ($PowerShellVersion) { | ||
| $ManifestParameters["PowerShellVersion"] = $PowerShellVersion | ||
| } | ||
|
|
||
| # Automatically detect functions to export | ||
| $ModuleFiles = Get-ChildItem "${ModuleName}/*.psm1" -Name | ||
| $FunctionsToExport = Select-String -Path "${ModuleName}/*.psm1" -Pattern 'Export-ModuleMember' | Select-String -Pattern "Function \w" -Raw | foreach { $_.Split(" ")[-1] } | ||
|
|
||
| $ManifestParameters["Path"] = $ManifestPath | ||
| $ManifestParameters["NestedModules"] = $ModuleFiles | ||
| $ManifestParameters["FunctionsToExport"] = $FunctionsToExport | ||
|
|
||
| Write-Output $ManifestParameters | ||
| New-ModuleManifest @ManifestParameters |
Oops, something went wrong.