Hack The Sec-Leading Resource Of Linux Tutorial: puppet

<div dir="ltr" style="text-align: left;" trbidi="on">
Puppet Nodes to Foreman – CentOS 7 / Ubuntu 14.04 
Puppet is an open-source configuration management tool. It runs on many Unix-like systems as well as on Microsoft Windows, and includes its own declarative language to describe system configuration. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfyaHydR2dsd1VxEV8holOMAFNMnvGjL0OPYRu4Efz8smXMdvWTT47kx5zHrkRK31WTfrDo31tMb9m9lXyI8M_YdP0XRDUzVJloYX5BMP4xGU5saG4qdA5LiIHAl5mUf7BtaCvBhE2yn5s/s1600/puppet-labs-hackthesec.co.in.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="315" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfyaHydR2dsd1VxEV8holOMAFNMnvGjL0OPYRu4Efz8smXMdvWTT47kx5zHrkRK31WTfrDo31tMb9m9lXyI8M_YdP0XRDUzVJloYX5BMP4xGU5saG4qdA5LiIHAl5mUf7BtaCvBhE2yn5s/s320/puppet-labs-hackthesec.co.in.png" width="320" /></a></div>
 
Puppet is produced by Puppet Labs, founded by Luke Kanies in 2005. It is written in Ruby and released as free software under the GNU General Public License (GPL) until version 2.7.0 and the Apache License 2.0 after that. 
 
Foreman (also known as The Foreman) is an open source complete life cycle systems management tool for provisioning, configuring and monitoring of physical and virtual servers. Foreman has deep integration to configuration management software, with Puppet, Chef, Salt and other solutions through plugins, which allows you to automate repetitive tasks, deploy applications and manage change to deployed servers. 
 
 
Foreman provides provisioning on bare-metal (through managed DHCP, DNS, TFTP, and PXE-based unattended installations), virtualization and cloud. Foreman provides comprehensive, auditable interaction facilities including a web frontend, a command line interface, and a robust REST API. 
 
 
<ul style="text-align: left;">
<li><a href="http://www.hackthesec.co.in/2016/06/how-to-install-foreman-on-centos-7-rhel.html" style="font-family: verdana, geneva, sans-serif; font-size: x-large; line-height: 26px;" target="_blank">How To Install Foreman on CentOS 7 / RHEL 7 / Ubuntu 14.04</a></li>
</ul>
 
 
INSTALLATION :- 
 
Make sure your system (both puppet server and client) is able to resolve the hostname each other, either use /etc/hosts file or DNS server. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">vi /etc/hosts</pre>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">192.168.2.10 server.hackthesec.local server # Foreman
192.168.2.20 centos.hackthesec.local centos # CentOS 7 Agent
192.168.2.30 ubuntu.hackthesec.local ubuntu # Ubuntu 14.04 Agent</pre>
 
Install Puppet Agent on CentOS 7: 
Puppetlabs repository in order to get a puppet agent packages from official source. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">rpm -ivh https://yum.puppetlabs.com/puppetlabs-release-el-7.noarch.rpm

yum -y install puppet
</pre>
Install Puppet Agent on Ubuntu 14.04: 
Puppet agent, we have to configure Puppetlabs repository on Ubuntu 14.04. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">wget https://apt.puppetlabs.com/puppetlabs-release-trusty.deb
sudo dpkg -i puppetlabs-release-trusty.deb

sudo apt-get update

sudo apt-get install puppet
</pre>
Configure puppet agent on CentOS 7 / Ubuntu 14.04: 
Once the installation is done, we will need to update the "/etc/puppet/puppet.conf" file. 
 
There are two section on the agent node's puppet config file, a [main] and [master] section. Add the following settings to your [main] settings. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">vi /etc/puppet/puppet.conf</pre>
Comment or Delete "templatedir=$confdir/templates" line and enter your details Foreman (Puppet Master) in "server = hostname" line 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
#templatedir=$confdir/templates
### Add Below Lines ###
server = server.hackthesec.local
report = true
pluginsync = true</pre>
Edit /etc/default/puppet to enable puppet service. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">vi /etc/default/puppet</pre>
Setting this to "yes" allows the puppet agent service to run. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">START=yes</pre>
To enable and run puppet agent service. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">puppet resource service puppet ensure=running enable=true</pre>
Sign Puppet Agent certificate: 
Now, you will have to sign the certificates of puppet agents in order to work with Foreman, issue the following command to list down the unsigned certificates. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">[root@hackthesec server ~]# puppet cert list
"ubuntu.hackthesec.local" (SHA256) 35:D1:B5:67:52:1C:1C:BH:6H:DD:3C:2E:B0:28:D7:15:52:95:32:95:1F:37:29:2G:5F:D7:4C:F5:DB:94:A1:B2</pre>
In the above output, "ubuntu.hackthesec.local" is the puppet agent. To sign the certificate follow below command 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">[root@hackthesec server ~]# puppet cert sign ubuntu.hackthesec.local
Notice: Signed certificate request for ubuntu.hackthesec.local
Notice: Removing file Puppet::SSL::CertificateRequest ubuntu.hackthesec.local at '/var/lib/puppet/ssl/ca/requests/ubuntu.hackthesec.local.pem'</pre>
Console Mode: 
Open your Foreman web console, go to Infrastructure –> Smart proxies. Click Certificates button. 
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUGlMe2UjdXBn2DDmn2QcJbRjLwa8rQTCYQN4s6nXK5rQAzCeF3H_99APJ3smwjMYNTRuuG74KRirK3p63DATPuJ5lvaGGBPLEnmcMo1N2cbT01mZr1aaNoYwSM5Ex_P10qEGH5wsUGT45/s1600/Puppet-Nodes-to-Foreman-Smart-Proxies-hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUGlMe2UjdXBn2DDmn2QcJbRjLwa8rQTCYQN4s6nXK5rQAzCeF3H_99APJ3smwjMYNTRuuG74KRirK3p63DATPuJ5lvaGGBPLEnmcMo1N2cbT01mZr1aaNoYwSM5Ex_P10qEGH5wsUGT45/s1600/Puppet-Nodes-to-Foreman-Smart-Proxies-hackthesec.co.in.png" /></a></div>
You see  agent certificate (ubuntu.hackthesec.local) is pending to be signed. To sign, click Sign button. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEZDMnqfHwnNiEwh7QQY2UQALS34bO8_M6Sr26SbZlfVTDXBlnaKLD5l1Dwofy8UlTUgArDwGH_J2VauYMgSdznCEDdpWV4HuYDlZJPcgaX0nNLa1GinDis5lXfRNE-cmvymUeTno1aBxB/s1600/Puppet-Nodes-to-Foreman-Agent-Certificates-hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEZDMnqfHwnNiEwh7QQY2UQALS34bO8_M6Sr26SbZlfVTDXBlnaKLD5l1Dwofy8UlTUgArDwGH_J2VauYMgSdznCEDdpWV4HuYDlZJPcgaX0nNLa1GinDis5lXfRNE-cmvymUeTno1aBxB/s1600/Puppet-Nodes-to-Foreman-Agent-Certificates-hackthesec.co.in.png" /></a></div>
After that your agent (ubuntu.hackthesec.local) is signed successfully. 
To verify the node go to Hosts –> All Hosts. Verify that the new node (ubuntu.hackthesec.local) has been added to Foreman. 
Troubleshooting 
In case if you want to remove the puppet agent from the Puppet master, run. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">[root@hackthesec server ~]# puppet cert clean ubuntu.hackthesec.local
Notice: Revoked certificate with serial 3
Notice: Removing file Puppet::SSL::Certificate ubuntu.hackthesec.local at '/var/lib/puppet/ssl/ca/signed/ubuntu.hackthesec.local.pem'
Notice: Removing file Puppet::SSL::Certificate ubuntu.hackthesec.local at '/var/lib/puppet/ssl/certs/ubuntu.hackthesec.local.pem'</pre>
In case, if you want to re-register the puppet agent that you just deleted in previous step. Follow the below procedure. 
 
Stop the puppet service. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">service puppet stop</pre>
Delete the puppet agent ssl directory. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">rm -rf /var/lib/puppet/ssl/certs</pre>
Start the puppet service. 
<pre style="background: rgb(68, 67, 65); border-radius: 6px; border: 1px solid rgb(227, 227, 227); box-sizing: border-box; clear: none !important; color: white; font-family: monospace, serif; font-size: 14px; margin-bottom: 10px !important; margin-top: 10px !important; overflow: auto; padding: 10px !important; width: auto !important; word-break: break-all;">service puppet start</pre>
Now, you can go and run the "puppet cert list" command on Foreman (puppet master) server to see the signing request, approve it incase you required. 
 
 
<div style="text-align: center;">
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>
</div>