From fe0db51c8c2c6287e9e32a1a9cf71ef7ebbd2021 Mon Sep 17 00:00:00 2001 From: Kevin O'Gorman Date: Thu, 25 Mar 2021 15:59:18 -0400 Subject: [PATCH 01/11] Added mokutil check to detect SecureBoot if enabled. (cherry picked from commit a24e2bccaf32f257ecf736a208a0b90692e2d916) --- .../roles/prepare-servers/tasks/main.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml index d9a765611a..517afe253c 100644 --- a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml +++ b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml @@ -21,6 +21,21 @@ SecureDrop cannot be installed. For details, see https://github.com/freedomofpress/securedrop/issues/4058 +- name: Check SecureBoot status + raw: 'mokutil --sb-state' + ignore_errors: yes + register: _mokutil_results + +- name: Verify that SecureBoot is not enabled + assert: + that: + - "'SecureBoot enabled' not in _mokutil_results.stdout" + - "'SecureBoot enabled' not in _mokutil_results.stderr" + fail_msg: >- + SecureBoot is enabled. SecureDrop cannot be installed, as it uses a + custom kernel that is not signed. Please disable SecureBoot on the + target servers and try again. + - name: Install python and packages required by installer raw: apt install -y python3 apt-transport-https dnsutils ubuntu-release-upgrader-core register: _apt_install_prereqs_results From 699aacf326e3c83871af53a6939f7fc5cf0a5d40 Mon Sep 17 00:00:00 2001 From: Conor Schaefer Date: Tue, 30 Mar 2021 08:13:13 -0700 Subject: [PATCH 02/11] Make sure mokutil is installed for SB check On Ubuntu Focal installed from ISO, the "mokutil" package wasn't installed by default. Let's add it early in the prepare-servers role, so we can use it to check for SecureBoot status before proceeding with installation. (cherry picked from commit 9ec39d87d9a70f8bb53741fce85cdfdc50464beb) --- .../roles/prepare-servers/tasks/main.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml index 517afe253c..e693ae3c4c 100644 --- a/install_files/ansible-base/roles/prepare-servers/tasks/main.yml +++ b/install_files/ansible-base/roles/prepare-servers/tasks/main.yml @@ -21,9 +21,15 @@ SecureDrop cannot be installed. For details, see https://github.com/freedomofpress/securedrop/issues/4058 +- name: Install python and packages required by installer + raw: apt install -y python3 apt-transport-https dnsutils ubuntu-release-upgrader-core mokutil + register: _apt_install_prereqs_results + changed_when: "'0 upgraded, 0 newly installed, 0 to remove' not in _apt_install_prereqs_results.stdout" + - name: Check SecureBoot status - raw: 'mokutil --sb-state' - ignore_errors: yes + command: mokutil --sb-state + changed_when: false + failed_when: false # results inspected below register: _mokutil_results - name: Verify that SecureBoot is not enabled @@ -36,11 +42,6 @@ custom kernel that is not signed. Please disable SecureBoot on the target servers and try again. -- name: Install python and packages required by installer - raw: apt install -y python3 apt-transport-https dnsutils ubuntu-release-upgrader-core - register: _apt_install_prereqs_results - changed_when: "'0 upgraded, 0 newly installed, 0 to remove' not in _apt_install_prereqs_results.stdout" - - name: Remove cloud-init apt: name: cloud-init From 4279687e2e3bfa63d4eaa52a0461dfb3c995dbe6 Mon Sep 17 00:00:00 2001 From: Erik Moeller Date: Thu, 25 Mar 2021 16:29:25 -0700 Subject: [PATCH 03/11] Correct backup location of custom logo; update docstring (cherry picked from commit 0441a1d41493d9286434b1bc78b4e9f7ec427035) --- .../ansible-base/roles/backup/files/backup.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/install_files/ansible-base/roles/backup/files/backup.py b/install_files/ansible-base/roles/backup/files/backup.py index cb25a3f3d2..9df91697b7 100755 --- a/install_files/ansible-base/roles/backup/files/backup.py +++ b/install_files/ansible-base/roles/backup/files/backup.py @@ -1,8 +1,11 @@ #!/opt/venvs/securedrop-app-code/bin/python """ -This script is copied to the App server and run by the Ansible playbook. When -run (as root), it collects all of the necessary information to backup the 0.3 -system and stores it in /tmp/sd-backup-0.3-TIME_STAMP.tar.gz. +This script is copied to the App server (to /tmp) and run by the Ansible playbook, +typically via `securedrop-admin`. + +The backup file in the format sd-backup-$TIMESTAMP.tar.gz is then copied to the +Admin Workstation by the playbook, and removed on the server. For further +information and limitations, see https://docs.securedrop.org/en/stable/backup_and_restore.html """ from datetime import datetime @@ -19,14 +22,17 @@ def main(): sd_code = '/var/www/securedrop' sd_config = os.path.join(sd_code, "config.py") - sd_custom_logo = os.path.join(sd_code, "static/i/logo.png") + sd_custom_logo = os.path.join(sd_code, "static/i/custom_logo.png") tor_hidden_services = "/var/lib/tor/services" torrc = "/etc/tor/torrc" with tarfile.open(backup_filename, 'w:gz') as backup: backup.add(sd_config) - backup.add(sd_custom_logo) + + # If no custom logo has been configured, the file will not exist + if os.path.exists(sd_custom_logo): + backup.add(sd_custom_logo) backup.add(sd_data) backup.add(tor_hidden_services) backup.add(torrc) From 94cd97712ff68c6cf7c055ba1f99a858f468e1da Mon Sep 17 00:00:00 2001 From: Kevin O'Gorman Date: Mon, 29 Mar 2021 13:40:34 -0400 Subject: [PATCH 04/11] Updated restore playbook to preserve server-side SSH configuration (cherry picked from commit 94e3f989c1aabbee67d3f1d5a0e638164487161b) --- .../roles/restore/tasks/cleanup_v2.yml | 40 +++++ .../ansible-base/roles/restore/tasks/main.yml | 162 +----------------- .../roles/restore/tasks/perform_restore.yml | 102 +++++++++++ .../roles/restore/tasks/update_tor.yml | 16 ++ 4 files changed, 165 insertions(+), 155 deletions(-) create mode 100644 install_files/ansible-base/roles/restore/tasks/cleanup_v2.yml create mode 100644 install_files/ansible-base/roles/restore/tasks/perform_restore.yml create mode 100644 install_files/ansible-base/roles/restore/tasks/update_tor.yml diff --git a/install_files/ansible-base/roles/restore/tasks/cleanup_v2.yml b/install_files/ansible-base/roles/restore/tasks/cleanup_v2.yml new file mode 100644 index 0000000000..cd90f5d0e2 --- /dev/null +++ b/install_files/ansible-base/roles/restore/tasks/cleanup_v2.yml @@ -0,0 +1,40 @@ +--- +- name: Copy disable_v2.py script + copy: + src: "{{ role_path }}/files/disable_v2.py" + dest: /opt/disable_v2.py + when: ("V3 services only" in compare_result.stdout) + +- name: Execute disable_v2 script + command: python3 /opt/disable_v2.py /etc/tor/torrc /etc/tor/torrc + when: ("V3 services only" in compare_result.stdout) + +- name: Remove v2 tor source directory + file: + state: absent + path: /var/lib/tor/services/source + when: ("V3 services only" in compare_result.stdout) + +- name: Remove v2 tor journalist directory + file: + state: absent + path: /var/lib/tor/services/journalist + when: ("V3 services only" in compare_result.stdout) + +- name: Remove v2 tor ssh directory + file: + state: absent + path: /var/lib/tor/services/ssh + when: ("V3 services only" in compare_result.stdout) + +- name: Remove v2 source_url application file + file: + state: absent + path: /var/lib/securedrop/source_v2_url + when: ("V3 services only" in compare_result.stdout) + +- name: Remove disable_v2.py script + file: + state: absent + path: /opt/disable_v2.py + when: ("V3 services only" in compare_result.stdout) diff --git a/install_files/ansible-base/roles/restore/tasks/main.yml b/install_files/ansible-base/roles/restore/tasks/main.yml index 3cd847b6de..a6e3eb89fe 100644 --- a/install_files/ansible-base/roles/restore/tasks/main.yml +++ b/install_files/ansible-base/roles/restore/tasks/main.yml @@ -1,159 +1,11 @@ --- -- name: Create temporary directory for Tor configuration check - connection: local - become: no - tempfile: - state: directory - register: torrc_check_dir +- name: Apply backup to Application Server + include: perform_restore.yml -- name: Fetch current Tor configuration from app server - become: no - fetch: - src: /etc/tor/torrc - dest: "{{ torrc_check_dir.path }}" - -- name: Create directory to hold the Tor configuration from the backup - connection: local - become: no - file: - path: "{{ torrc_check_dir.path }}/backup" - state: directory - -- name: Extract Tor configuration from backup - connection: local - become: no - unarchive: - dest: "{{ torrc_check_dir.path }}/backup/" - src: "{{ restore_file }}" - extra_opts: - - "etc/tor/torrc" - -- name: Check for Tor configuration differences between the backup and server - connection: local - become: no - command: "python {{ role_path }}/files/compare_torrc.py {{ torrc_check_dir.path }}" - ignore_errors: yes - register: compare_result - -- name: Remove temporary directory for Tor configuration check - connection: local - become: no - file: - path: "{{ torrc_check_dir.path }}" - state: absent - when: torrc_check_dir.path is defined - -- name: Verify that the backup Tor config is compatible with the server Tor config - assert: - that: - - "'Valid configuration' in compare_result.stdout" - fail_msg: - - "This backup's tor configuration cannot be applied on this server." - - "A data-only restore can be applied using the --preserve-tor-config argument" - - "More info: {{ compare_result.stdout }}" +- name: Remove deprecated v2 onion service configuration + include: cleanup_v2.yml when: not restore_skip_tor -- name: Copy backup to application server - synchronize: - src: "{{ restore_file }}" - dest: /tmp/{{ restore_file }} - partial: yes - -- name: Extract backup - unarchive: - dest: / - remote_src: yes - src: "/tmp/{{ restore_file}}" - when: (not restore_skip_tor) and - ("V3 services only" not in compare_result.stdout) - -- name: Extract backup, using v3 services only - unarchive: - dest: / - remote_src: yes - src: "/tmp/{{ restore_file}}" - exclude: "var/lib/tor/services/source,var/lib/tor/services/journalist,var/lib/tor/services/ssh" - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Extract backup, skipping tor service configuration - unarchive: - dest: / - remote_src: yes - src: "/tmp/{{ restore_file}}" - exclude: "var/lib/tor,etc/tor/torrc" - when: restore_skip_tor - -- name: Reconfigure securedrop-app-code - command: dpkg-reconfigure securedrop-app-code - -- name: Reconfigure securedrop-config - command: dpkg-reconfigure securedrop-config - -- name: Reload Apache service - service: - name: apache2 - state: reloaded - -- name: Copy disable_v2.py script - copy: - src: "{{ role_path }}/files/disable_v2.py" - dest: /opt/disable_v2.py - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Execute disable_v2 script - command: python3 /opt/disable_v2.py /etc/tor/torrc /etc/tor/torrc - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Remove v2 tor source directory - file: - state: absent - path: /var/lib/tor/services/source - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Remove v2 tor journalist directory - file: - state: absent - path: /var/lib/tor/services/journalist - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Remove v2 tor ssh directory - file: - state: absent - path: /var/lib/tor/services/ssh - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Remove v2 source_url application file - file: - state: absent - path: /var/lib/securedrop/source_v2_url - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Remove disable_v2.py script - file: - state: absent - path: /opt/disable_v2.py - when: (not restore_skip_tor) and - ("V3 services only" in compare_result.stdout) - -- name: Reload Tor service - service: - name: tor - state: reloaded - async: 60 - poll: 0 - register: tor_reload_job - -- name: Wait for Tor reload - async_status: - jid: "{{ tor_reload_job.ansible_job_id }}" - register: tor_reload - until: tor_reload.finished - retries: 6 - delay: 10 +- name: Restart Tor + include: update_tor.yml + when: not restore_skip_tor diff --git a/install_files/ansible-base/roles/restore/tasks/perform_restore.yml b/install_files/ansible-base/roles/restore/tasks/perform_restore.yml new file mode 100644 index 0000000000..2da23dca7d --- /dev/null +++ b/install_files/ansible-base/roles/restore/tasks/perform_restore.yml @@ -0,0 +1,102 @@ +--- +- name: Create temporary directory for Tor configuration check + connection: local + become: no + tempfile: + state: directory + register: torrc_check_dir + +- name: Fetch current Tor configuration from app server + become: no + fetch: + src: /etc/tor/torrc + dest: "{{ torrc_check_dir.path }}" + +- name: Create directory to hold the Tor configuration from the backup + connection: local + become: no + file: + path: "{{ torrc_check_dir.path }}/backup" + state: directory + +- name: Extract Tor configuration from backup + connection: local + become: no + unarchive: + dest: "{{ torrc_check_dir.path }}/backup/" + src: "{{ restore_file }}" + extra_opts: + - "etc/tor/torrc" + +- name: Check for Tor configuration differences between the backup and server + connection: local + become: no + command: "python {{ role_path }}/files/compare_torrc.py {{ torrc_check_dir.path }}" + ignore_errors: yes + register: compare_result + +- name: Remove temporary directory for Tor configuration check + connection: local + become: no + file: + path: "{{ torrc_check_dir.path }}" + state: absent + when: torrc_check_dir.path is defined + +- name: Verify that the backup Tor config is compatible with the server Tor config + assert: + that: + - "'Valid configuration' in compare_result.stdout" + fail_msg: + - "This backup's tor configuration cannot be applied on this server." + - "A data-only restore can be applied using the --preserve-tor-config argument" + - "More info: {{ compare_result.stdout }}" + when: not restore_skip_tor + +- name: Copy backup to application server + synchronize: + src: "{{ restore_file }}" + dest: /tmp/{{ restore_file }} + partial: yes + +- name: Extract backup + unarchive: + dest: / + remote_src: yes + src: "/tmp/{{ restore_file}}" + exclude: + - "var/lib/tor/services/ssh" + - "var/lib/tor/services/sshv3" + when: (not restore_skip_tor) and + ("V3 services only" not in compare_result.stdout) + +- name: Extract backup, using v3 services only + unarchive: + dest: / + remote_src: yes + src: "/tmp/{{ restore_file}}" + exclude: + - "var/lib/tor/services/source,var/lib/tor/services/journalist" + - "var/lib/tor/services/ssh" + - "var/lib/tor/services/sshv3" + when: (not restore_skip_tor) and + ("V3 services only" in compare_result.stdout) + +- name: Extract backup, skipping tor service configuration + unarchive: + dest: / + remote_src: yes + src: "/tmp/{{ restore_file}}" + exclude: "var/lib/tor,etc/tor/torrc" + when: restore_skip_tor + +- name: Reconfigure securedrop-app-code + command: dpkg-reconfigure securedrop-app-code + +- name: Reconfigure securedrop-config + command: dpkg-reconfigure securedrop-config + +- name: Reload Apache service + service: + name: apache2 + state: reloaded diff --git a/install_files/ansible-base/roles/restore/tasks/update_tor.yml b/install_files/ansible-base/roles/restore/tasks/update_tor.yml new file mode 100644 index 0000000000..9d24c23363 --- /dev/null +++ b/install_files/ansible-base/roles/restore/tasks/update_tor.yml @@ -0,0 +1,16 @@ +--- +- name: Reload Tor service + service: + name: tor + state: reloaded + async: 60 + poll: 0 + register: tor_reload_job + +- name: Wait for Tor reload + async_status: + jid: "{{ tor_reload_job.ansible_job_id }}" + register: tor_reload + until: tor_reload.finished + retries: 6 + delay: 10 From 64bc4be9c6d96f384473859df72a33019cc216a0 Mon Sep 17 00:00:00 2001 From: Kushal Das Date: Mon, 29 Mar 2021 16:21:12 +0530 Subject: [PATCH 05/11] Fixes #5835 disables ossec mails for fwupd Adds a new rules group and also the related decoder. (cherry picked from commit d289c1af055c104d0de4770b217252dba20781cb) --- .../var/ossec/etc/local_decoder.xml | 7 +++++++ .../var/ossec/rules/local_rules.xml | 19 +++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml b/install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml index 50445d873e..63c4e3b707 100644 --- a/install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml +++ b/install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml @@ -47,3 +47,10 @@ dhclient + + + + fwupd + diff --git a/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml b/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml index eb3f5d4cb8..26eeab6958 100644 --- a/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml +++ b/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml @@ -73,6 +73,25 @@ + + + + + fwupd + Error opening directory + fwupd error + no_email_alert + + + fwupd + Failed to load SMBIOS + fwupd error for auto updates + no_email_alert + + +