Menu

Chef Supermarket

Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

View our collection of guides, documentation, and articles

Cookbooks
Advanced Options

Select Badges

Select Supported Platforms

Select Status

RSS

common_auth (8) Versions 0.2.1

Resources to help manage Linux users, groups, sudo and openssh

Policyfile
Berkshelf
Knife 
cookbook 'common_auth', '~> 0.2.1', :supermarket
cookbook 'common_auth', '~> 0.2.1'
knife supermarket install common_auth
knife supermarket download common_auth
README
Dependencies
Changelog
Quality 17%

common_auth cookbook

A cookbook which will create users, group, sudoers and configure openssh with the design to be based on group policies.

Requiremetns

  • Chef 12.7.0 or later.

Platform

  • Ubuntu

Attributes / Data Bags

The goal of this cookbook is to manage authentication related resources through a mixture of node attributes and data_bag_item, with node attributes taking precedence over the contents of a data_bag_item.

common_auth.groups

This namespace contains directives which will manage groups on a system as well as optionally populate a list of users to manage.

{
  "id": "group1",
  "gid": 1234,
  "members": ["user1","user2"],
  "require_members": true,
  "include_members": true,
  "sudoer": {
    "runas": "root",
    "nopasswd": false
  },
  "action": "create"
}
common_auth.groups.data_bag

The data_bag from which to pull group definitions, which provide the bulk of a group's definitions.

Additionally, though functionally provided by common_attrs, these data_bag_items may contain optional namespaces.

{
  "id": "group1",
  "gid": 1234,
  "require_members": true,
  "include_members": true,
  "_production": {
    "members": ["superuser"]
  },
  "_staging": {
    "members": ["user1","user2"]
  }
}
common_auth.groups.config

A hash containing attribute level overrides for the data_bag_item contents. These can be useful when you wish to provide overrides from a Cookbook, PolicyFile, Role or Environment.

{
  "config": {
    "group1": {
      "action": "delete"
    }
  }
}
common_auth.groups.managed

A hash containing a list of groups which should be managed on this machine. Each hash value may be either True symbolizing that this item should be managed or False, symbolizing that the group is safe to be deleted.

During the Chef run, the common_group_account LWRPs will update this Hash at the node precedence level, to ensure that the system keeps track of groups which had previously been managed during a Chef run and have since been deleted form the data_bag.

{
  "managed": {
    "group1": true,
    "group2": false
  }
}

common_auth.users

This namespace contains directives which will manage users on a system.

{
  "id": "user1",
  "uid": 1234,
  "gid": 1234,
  "common": "Managed by Chef",
  "home": "/home/user1",
  "shell": "/bin/bash",
  "password": "$6...",
  "keys": {
    "public_keys": {
      "pubkey1": "SHA",
      "pubkey2": "SHA"
    },
    "private_keys": {
      "privkey1": "SHA"
    }
  },
  "action": "create"
}
common_auth.users.data_bag

The data_bag from which to pull user definitions, which provide the bulk of a user's definitions.

These items may be un-encrypted, encrypted or be partially encrypted with the secure_data_bag gem.

Additionally, though functionally provided by common_attrs, these data_bag_items may contain optional namespaces.

{
  "id": "user1",
  "_production": {
    "password": "$6prodpass"
  },
  "_staging": {
    "password": "$6stagpass"
  }
}
common_auth.users.config

A hash containing attribute level overrides for the data_bag_item contents. These can be useful when you wish to provide overrides from a Cookbook, PolicyFile, Role or Environment.

{
  "config": {
    "user1": {
      "action": "delete"
    }
  }
}
common_auth.users.managed

A hash containing a list of users which should be managed on this machine. Each hash value may be either True symbolizing that this item should be managed or False, symbolizing that the group is safe to be deleted.

During the Chef run, the common_user_account LWRPs will update this Hash at the node precedence level, to ensure that the system keeps track of users which had previously been managed during a Chef run and have since been deleted form the data_bag.

{
  "managed": {
    "user1": true,
    "user2": false
  }
}

common_auth.sudoers

A Hash containing sudoers definitions which will drive the creation of sudo LWRP entries.

This is empty by default, except when the cookbook detects that it is being run inside of Vagrant, where the Vagrant user will be granted access.

common_auth.openssh.allow_groups

Hash of OpenSSH AllowGroup directives that will override the standard OpenSSH cookbook attributes.

{
  "allow_groups": {
    "group1": true,
    "group2": false
  }
}

This is empty by default, excpet when the cookbook detects that is is being run inside of Vagrant.

common_auth.openssh.match_groups

Hash of OpenSSH Match group statements which will override the standard OpenSSH cookbook attributes.

{
  "match_groups": {
    "group1": {
      "allow_tcp_forwarding": "yes"
    }
  }
}

todo : Ideally i'd like to move this into the group LWRP at some point.

Resources

common_user_account

Resource which will be responsible for creating a user resource and optionally a common_user_keys resource. Additionally, the creation or deletion of these attributes will be stored in node attributes to ensure that users are deleted if ommitted from configuration.

common_user_keys

Resource which will manage a user's ssh public authorized_keys, ssh private rsa keys and will automatically create an ssh_wrapper script for each private key.

common_group_account

Resource which will be responsible for creating a group resource and optinially a sudoers resource.

Recipes

common_auth::auth

This recipe will generate user and group resources based on attributes.

common_auth:openssh

This recipe will call the opeenssh cookbook to manage this service.

common_auth::sudoers

This recipe will generate sudo LWRP instances based on attributes.

Dependent cookbooks

common_attrs ~> 0.4.0
sudo ~> 2.9.0
openssh ~> 2.0.0

Contingent cookbooks

common_core Applicable Versions
common_core 0.1.3
common_core 0.2.0
common_core 0.2.1
common_core 0.2.2
common_core 0.3.0

common_auth

0.2.1

  • Resolve Chef 14 deprecation warning

0.2.0

  • metadata missing comma nothing errors why

0.1.9

  • Resolve error in creating of private id keys and ssh wrappers where all keys created with username rather than keyname

0.1.8

  • Remove common_group_account warning when passed include_members

0.1.7

  • Resolve a problem in the custom resources where soem values ( ex.: group memberships ) would never be populated.

0.1.6

  • Enhancement
    • Resolve Chef13 warning with secure_data_bag
  • Bugfix
    • Resolve bug in ssh_wrapper scripts

0.1.5

  • Add whyrun support to common_user_account
  • Add whyrun support to common_user_keys
  • Add whyrun support to common_group_account

0.1.4

  • Let's pretend it's the inital commit

Collaborator Number Metric 
            
0.2.1 failed this metric
Failure: Cookbook has 1 collaborators. A cookbook must have at least 2 collaborators to pass this metric.

Contributing File Metric 
            
0.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file

Foodcritic Metric 
            
0.2.1 failed this metric
FC046: Attribute assignment uses assign unless nil: common_auth/attributes/common_auth-openssh.rb:5
FC046: Attribute assignment uses assign unless nil: common_auth/attributes/common_auth-openssh.rb:15
FC046: Attribute assignment uses assign unless nil: common_auth/attributes/common_auth-sudoers.rb:4
FC067: Ensure at least one platform supported in metadata: common_auth/metadata.rb:1
FC069: Ensure standardized license defined in metadata: common_auth/metadata.rb:1
FC108: Resource should not define a property named 'name': common_auth/resources/common_group_account.rb:4
FC108: Resource should not define a property named 'name': common_auth/resources/common_user_account.rb:4
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_group_account.rb:4
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_group_account.rb:9
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_group_account.rb:13
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_group_account.rb:17
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_group_account.rb:21
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:4
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:9
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:14
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:19
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:23
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:30
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:35
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:40
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:44
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_account.rb:48
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_keys.rb:4
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_keys.rb:8
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_keys.rb:13
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_keys.rb:18
FC117: Do not use kind_of in custom resource properties: common_auth/resources/common_user_keys.rb:23
FC120: Do not set the name property directly on a resource: common_auth/recipes/auth.rb:115
Run with Foodcritic Version 16.3.0 with tags metadata,correctness ~FC031 ~FC045 and failure tags any

No Binaries Metric 
            
0.2.1 passed this metric

Testing File Metric 
            
0.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric 
            
0.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must include a tag that matches this cookbook version number

Jonathan Serafini Jonathan Serafini
Francois Lapierre-Messier

Details

View Source View Issues

Updated July 18, 2016 Created on

Supported Platforms

    None Specified

License

apachev2

Required Chef Infra Client

(>= 12.7)

Download Cookbook