Learning Puppet for Windows Server

I will use puppetmaster as the hostname. You can use either vim or nano for text editing. If you have never used vim before, it will be easier for you to use nano.

$ sudonano /etc/hostname

Use CTRL + X and Y to save.

I will use puppetmaster.example.com.. Use the following command to edit the /etc/hosts file:

 $ sudonano /etc/hosts

Change the contents as follows. Use your own IP according to your network.

127.0.0.1       localhost
127.0.1.1       puppetmaster.example.com
10.10.10.10      puppetmaster.example.com puppetmaster

To verify that the changes are effective, use the hostname and hostname -f commands.

For your server, give a static IP and define your gateway and nameserver IPs.

First, define your IP gateway and subnet mask. For this, we will edit the /etc/network/interfaces file. Following is the sample detail I have added for my Puppet Master:

$ sudonano /etc/network/interfaces

As you can see, the details are self-explanatory:

Now, let's set the nameserver IPs. To set NS records, we need to edit /etc/resolvconf/resolv.conf.d/base, as follows:

$ nano /etc/resolvconf/resolv.conf.d/base

The sample contents of this file are shown in the following screenshot. In our example, we are using the Google DNS IPs. Here, you can use your company's DNS IPs.

After saving the file, reboot the server. After rebooting, you can check using the following command whether you have the correct IP, netmask, and broadcast:

$ ifconfig

Check whether the gateway is correct using the following command:

$ route -n

Lastly, check whether nameserver works correctly. Run the nslookup command and enter any address, as follows:

$ nslookup

As you can see in the preceding screenshot, it checks from 8.8.8.8. Now we can say that our network settings are correct. To exit nslookup, you can use the exit command.

We will first add the Puppet repositories for installation. Secondly, we will update the repositories. Lastly, we will update our server before installing Puppet.

Here are the details to add the Puppet repositories:

$ sudowget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
$ sudodpkg -ipuppetlabs-release-trusty.deb

Now, update the repository info, as follows:

$ sudo apt-get update

Lastly, install the updates, as follows:

$ sudo apt-get upgrade -y

Now, it is time to install Puppet Master and its agent on your server. We will also do some configurations. The command to install Puppet is as follows:

$ sudo apt-get install -y puppetmaster puppet

Now, let's make sure that Puppet Master starts automatically. For this purpose, we need to edit /etc/default/puppetmaster. You need to change the START=no value to START=yes. If it is already yes, you can leave this as it is and continue. You also need to enable puppet agent on the server. We will edit the /etc/default/puppet file. Again, we need to make sure that START=yes exists. We also need to change the server details for the puppet agent. Change the /etc/puppet/puppet.conf file and enter the server details. Just after [main], add the line server=puppetmaster.example.com.

After making the changes, we will restart the services as shown here:

$ sudo service puppetmaster restart
$ sudo service puppet restart

Check whether they are running using the following commands:

$ sudo service puppetmaster status
$ sudo service puppet status

As you can see in the preceding screenshot, the services are running without any problem. So we completed the installation of Puppet Master and Puppet agent on our server.

To limit the old passwords that can be used, we need to edit the /etc/pam.d/common-password file. PAM is Pluggable Authentication Modules. PAM enables us to change the authentication process of Linux.

$ sudonano /etc/pam.d/common-password
password     [success=1 default=ignore]    pam_unix.so obscure sha512 remember=5

To set more complex passwords, we will install the libpam-cracklib library, as follows:

$ sudo apt-get install libpam-cracklib

After this, we again edit the /etc/pam.d/common-password file as follows:

$ sudonano/etc/pam.d/common-password
password  requisite  pam_cracklib.so retry=3 minlen=10 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

Here are the /etc/pam.d/common-password details after the changes:

The password expiration details are in the /etc/login.defs file. Change the value of PASS_MAX_DAYS to 90 and it will be forced to update the password every 90 days, as follows:

$ sudonano/etc/login.defs
PASS_MAX_DAYS   90

This policy makes sure that any brute force attempt will fail, or need too much time to complete. We will lock the user account for 10 minutes, if five times there are consecutive login failures. For this purpose, we need to modify the /etc/pam.d/common-auth file. After the lock and wait time, if the user successfully logs in with the correct password, the failed attempts counter will be reset to zero. Otherwise, each failed attempt after the lock will cause another 10 minutes of lock. So, I suggest here that you keep a backup user with the sudo rights, as follows:

$ sudonano/etc/pam.d/common-auth
auth    required    pam_tally2.so deny=5 onerr=fail unlock_time=600

After completing all the changes, restart your server with the reboot command for all the changes to be applied. This is done as follows:

$ sudo reboot

You can check a user's login attempts with the following command:

$ sudo pam_tally2 -u username

Here is an example output after two unsuccessful login attempts:

If you want to reset the counter and unlock the user, you can use the following command. -r switch is used to reset the failures counter.

$ sudo pam_tally2 -u username -r

Use the ssh-keygen command to generate the keys, as follows:

$ ssh-keygen

ssh-keygen first asks for the folder to save the keys. Just push the Enter key and continue. The next question is the passphrase. Make sure that you enter a password. Using the password with your key makes sure that, when somebody gets your key, it will be unusable.

Now go to the .ssh folder, as follows:

$ cd .ssh

Under this folder, you will see these two files:

We need to add the details of the public key to a file called authorized_keys. This will make it possible to log in with the private key.

$ cat id_rsa.pub >authorized_keys

Here is an example screenshot:

Change the authorized_keys file permissions, otherwise the key will not work. This is done as follows:

$ chmod 600 authorized_keys

This command will allow only the user to edit and write the file; any group or other users will not be able to change it.

Now, we need to get the contents of id_rsa to our computer that we will use to connect to Puppet Master.

To do this, you can use FileZilla to connect and download the file. Or you can use any FTP client with SFTP support. Here is a screenshot for the SFTP connection definition:

You need to enter the following:

After you have filled the details, click the Connect button. When you connect, you will see your user folder and the .ssh folder, as follows:

Download the id_rsa file to your documents folder. After this, you need to convert the file with PuTTYgen.exe. Open PuTTYgen.exe and click the Load button. You also need to select the All Files (*.*) option, as shown here:

After you click it open, it will ask for the password. After this, click on Save private key and give a name to your key. I saved it as puppetmaster.ppk. Now, we are ready to use this key to connect to Puppet Master.

To do it, first fill in the details as follows:

Now go to SSH | Auth. Select the key file, as follows:

After this, go back to Session from the Category section and use the Save button. This will make sure that you can reuse the connection and do not have to define the same settings again.

Now you will be able to connect by double-clicking your saved session name. It will ask for the key file password and then you will be able to connect.

To connect from Linux systems, you do not need to convert the private key. You can just connect from the terminal with the ssh command, as follows:

$ sshusername@serverip -ikeyfile

When I change this command to my example, it will b

 sshpuppet@10.10.10.10 -iid_rsa

This is our last step for SSH. After disabling the password login option, there will be no possibility for an hacker to use brute force against an account. Also, there will be no possibility to log in, even if the hacker knows the password.

We need to change the /etc/ssh/sshd_config file to disable password, as follows:

$ sudonano /etc/ssh/sshd_config

Find the PasswordAuthentication text, uncomment it, and set the value to no.

After changing the value and saving the file, restart the ssh service, as shown here:

$ sudo service ssh restart

Now, here is the output when I try to log in without the key:

We will use netstat to check the listening ports and running services. Here, we already know that for administrative purposes, we need to keep the SSH port 22 open. But we also need to check other ports that Puppet and Foreman are using. The command to check the listening ports and services is as follows:

$ sudonetstat -nlput

Here are the ports that we need to keep open:

You can also remember that in the section Installing Foreman when the installation finishes, it gives the details about the 8443 and 8140 ports.

We will use iptables as the firewall. It comes preinstalled on the Ubuntu Server. First, let's check the rules that we have. If no rules are defined previously, all the policies will be in the ACCEPT state. The commands to check the iptables rules are as follows:

$ sudoiptables -L -v

$ sudoiptables -A INPUT -p tcp --dport 22 -j ACCEPT

$ sudoiptables -A INPUT -p tcp --dport 80 -j ACCEPT

$ sudoiptables -A INPUT -p tcp --dport 443 -j ACCEPT

$ sudoiptables -A INPUT -p tcp --dport 8443 -j ACCEPT

$ sudoiptables -A INPUT -p tcp --dport 8140 -j ACCEPT

$ sudoiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Denying all the incoming traffic

This time, we do not give any protocol or port number. So, this means that all the input traffic will be dropped.

$ sudoiptables -P INPUT DROP

After completing the rules, let's check the iptables rules again:

As you can see in the preceding screenshot, all the rules are defined in the order that we defined.

Note

IMPORTANT:

Define the "deny all" rule last. The order of the rules is important. The first rule will be applied first. So, if you first define the "deny all" rule, you will not be able to connect with SSH and your connection will drop.

The rules we defined are not persistent. So whenever you restart your server, the rules will be lost. To prevent this, we will install iptables-persistent. This software will keep our rules and will enable them at the startup. First install it using the following command:

$ sudoapt-get install iptables-persistent

While installing, it will ask you to save the current configuration to a file name such as /etc/iptables/rules.v4. Answer this with a yes. The second question will be about IPv6. We did not define any rules for it, so answer no for this.

After completing the setup, reboot your server and list the rules of iptables to see that they are still there.