Add support for Security World client v13.4.4

This patch adds support for installing the latest Security World client
software.  The installation media format for that version is a zipped
file containing an ISO.

The mechanism for installing the source media was changed to expect this
new format.  The file is still downloaded to the target host and now
unzip is used instead of tar to unarchive the ISO.

The client software is now installed on the target host using the RPM files
found in the ISO image.

Change-Id: If00a8612cd50f492da833033a2ed3256585617bd
This commit is contained in:
Douglas Mendizábal 2023-09-21 14:15:10 -04:00
parent 87793418c7
commit b39d08608f
8 changed files with 69 additions and 80 deletions

View File

@ -32,32 +32,23 @@ Role Variables
- false - false
- Whether the role should execute the RFS configuration tasks. - Whether the role should execute the RFS configuration tasks.
* - thales_client_working_dir * - thales_client_working_dir
- /tmp/thales_client_install - /tmp/security_world_install
- Working directory in the target host. - Working directory in the target host.
* - thales_client_gid * - thales_client_gid
- 42481 - 42481
- Group ID for the thales group. - Group ID for the nfast group.
* - thales_client_uid * - thales_client_uid
- 42481 - 42481
- User ID for the thales user. - User ID for the nfast user.
* - thales_client_tarball_name * - security_world_iso_zip_url
- None - None
- Filename for the Thales client software tarball. - URL location of the Security World ISO ZIP file.
* - thales_client_tarball_location * - thales_client_tarball_location
- None - None
- Full URL where a copy of the client software tarball can be downloaded. - DEPRECATED: Use security_world_iso_zip_url instead.
* - thales_client_path
- linux/libc6_11/amd64/nfast
- Path to the client software directory inside the tarball
* - thales_km_data_tarball_name
- None
- Filename for the KM Data tarball
* - thales_km_data_location
- None
- Full URL where a copy of the KM Data tarball can be downloaded.
* - thales_rfs_ip_address * - thales_rfs_ip_address
- None - None
- IPv4 address for the Thales RFS host. - IPv4 address for the RFS host.
* - thales_client_ips * - thales_client_ips
- None - None
- Whitespace separated list of IP addresses to be added to RFS config. - Whitespace separated list of IP addresses to be added to RFS config.
@ -74,3 +65,6 @@ Requirements
------------ ------------
- ansible >= 2.4 - ansible >= 2.4
- Security World Software v13.4.4 ISO ZIP file - The ISO file in ZIP format as
provided by Entrust. This should be hosted in an HTTPS server that can be
accessed from the target host.

View File

@ -1,7 +1,6 @@
--- ---
thales_install_client: false thales_install_client: false
thales_configure_rfs: false thales_configure_rfs: false
thales_client_working_dir: /tmp/thales_client_install thales_client_working_dir: /tmp/security_world_install
thales_client_gid: 42481 thales_client_gid: 42481
thales_client_uid: 42481 thales_client_uid: 42481
thales_client_path: linux/libc6_11/amd64/nfast

View File

@ -2,4 +2,5 @@
- name: Legacy vars warning - name: Legacy vars warning
ansible.builtin.debug: ansible.builtin.debug:
msg: "WARNING: Using legacy thales_hsm_ip_address and msg: "WARNING: Using legacy thales_hsm_ip_address and
thales_hsm_config_location variables. Please udpate your vars file." thales_client_tarball_location variables. Please udpate your
vars file."

View File

@ -0,0 +1,9 @@
---
features:
- |
This version adds support for the latest Security World client software
(v13.4.4). Older security world versions are not supported.
deprecations:
- |
The variable `thales_client_tarball_location` has been deprecated. Use
`security_world_iso_zip_url` instead.

View File

@ -1,14 +1,14 @@
[metadata] [metadata]
name = ansible-role-thales-hsm name = ansible-role-thales-hsm
summary = ansible-role-thales-hsm - Ansible role to configure Thales HSM clients. summary = ansible-role-thales-hsm - Ansible role to configure nShileld Connect HSM clients.
description-file = description-file =
README.rst README.rst
author = TripleO Team author = TripleO Team
author-email = alee@redhat.com author-email = alee@redhat.com
home-page = https://github.com/dmend/ansible-role-thales-hsm home-page = https://opendev.org/openstack/ansible-role-thales-hsm
classifier = classifier =
License :: OSI Approved :: Apache Software License License :: OSI Approved :: Apache Software License
Development Status :: 4 - Beta Development Status :: 5 - Production/Stable
Intended Audience :: Developers Intended Audience :: Developers
Intended Audience :: System Administrators Intended Audience :: System Administrators
Intended Audience :: Information Technology Intended Audience :: Information Technology

View File

@ -5,12 +5,12 @@
state: directory state: directory
mode: '755' mode: '755'
- name: Create thales group - name: Create nfast group
ansible.builtin.group: ansible.builtin.group:
name: nfast name: nfast
gid: "{{ thales_client_gid }}" gid: "{{ thales_client_gid }}"
- name: Create thales user - name: Create nfast user
ansible.builtin.user: ansible.builtin.user:
name: nfast name: nfast
uid: "{{ thales_client_uid }}" uid: "{{ thales_client_uid }}"
@ -25,61 +25,47 @@
persistent: true persistent: true
when: ansible_os_family | lower == 'redhat' when: ansible_os_family | lower == 'redhat'
- name: Download Thales client tarball - name: Ensure unzip is avaliable to unzip ISO file
ansible.builtin.get_url: ansible.builtin.yum:
url: "{{ thales_client_tarball_location }}" name: unzip
dest: "{{ thales_client_working_dir }}/{{ thales_client_tarball_name }}" state: present
mode: '644'
force: false
- name: Unpack tarball to working directory - name: Download and unzip Security World ISO file from given url
ansible.builtin.unarchive: ansible.builtin.unarchive:
src: "{{ thales_client_working_dir }}/{{ thales_client_tarball_name }}" src: "{{ security_world_iso_zip_url }}"
dest: "{{ thales_client_working_dir }}" dest: "{{ thales_client_working_dir }}"
creates: "{{ thales_client_working_dir }}/{{ thales_client_path }}"
remote_src: true remote_src: true
- name: Unpack tarball to /opt/nfast - name: Set Security World ISO file path
ansible.builtin.shell: | ansible.builtin.set_fact:
for i in `find "{{ thales_client_working_dir }}/{{ thales_client_path }}" -name *.tar` ; do security_world_iso: "{{ thales_client_working_dir }}/{{ security_world_iso_zip_url | basename | splitext | first }}"
tar -C / -xvf $i ;
done
args:
creates: /opt/nfast/sbin/install
- name: Check for libnsl dependency - name: Extract RPMs and key from Security World ISO
ansible.builtin.stat: community.general.iso_extract:
path: /lib64/libnsl.so.1 image: "{{ security_world_iso }}"
register: st dest: "{{ thales_client_working_dir }}"
files:
- linux-rpms/amd64/nShield-hwsp.rpm
- linux-rpms/amd64/nShield-ctls.rpm
- linux-rpms/amd64/nShield-ncsnmp.rpm
- linux-rpms/amd64/pubkey.asc
- name: Ensure libnsl dependency is installed - name: Import Security World RPM key
ansible.builtin.package: ansible.builtin.rpm_key:
name: libnsl
state: present state: present
when: not st.stat.exists key: "{{ thales_client_working_dir }}/pubkey.asc"
- name: Install Security World RPMs
ansible.builtin.yum:
name: "{{ packages }}"
vars:
packages:
- "{{ thales_client_working_dir }}/nShield-hwsp.rpm"
- "{{ thales_client_working_dir }}/nShield-ctls.rpm"
- "{{ thales_client_working_dir }}/nShield-ncsnmp.rpm"
- name: Run installer - name: Run installer
ansible.builtin.shell: set -o pipefail && echo "1" | /opt/nfast/sbin/install ansible.builtin.shell: set -o pipefail && echo "1" | /opt/nfast/sbin/install
args:
creates: /opt/nfast/kmdata
- name: Get the security world data
ansible.builtin.get_url:
url: "{{ thales_km_data_location }}"
dest: "/root/{{ thales_km_data_tarball_name }}"
mode: '644'
force: false
- name: Remove the old km_data
ansible.builtin.file:
path: /opt/nfast/kmdata
state: absent
- name: Replace kmdata
ansible.builtin.unarchive:
src: "/root/{{ thales_km_data_tarball_name }}"
dest: /opt/nfast
remote_src: true
- name: Create cknfastrc - name: Create cknfastrc
ansible.builtin.template: ansible.builtin.template:
@ -114,7 +100,7 @@
var: enquiry var: enquiry
- name: Set up rfs_sync - name: Set up rfs_sync
ansible.builtin.command: /opt/nfast/bin/rfs-sync --setup --no-authenticate {{ thales_rfs_server_ip_address }} ansible.builtin.command: set -o pipefail && echo "yes" | /opt/nfast/bin/rfs-sync --setup {{ thales_rfs_server_ip_address }}
- name: Get keys from rfs server - name: Get keys from rfs server
ansible.builtin.command: /opt/nfast/bin/rfs-sync --update ansible.builtin.command: /opt/nfast/bin/rfs-sync --update

View File

@ -7,6 +7,12 @@
when: nshield_hsms is not defined and thales_hsm_ip_address is defined when: nshield_hsms is not defined and thales_hsm_ip_address is defined
notify: Legacy vars warning notify: Legacy vars warning
- name: Allow deprecated tarball URL variable
ansible.builtin.set_fact:
security_world_iso_zip_url: "{{ thales_client_tarball_location }}"
when: security_world_iso_zip_url is not defined and thales_client_tarball_location is defined
notify: legacy vars warning
- name: Include RFS tasks - name: Include RFS tasks
ansible.builtin.include_tasks: rfs.yaml ansible.builtin.include_tasks: rfs.yaml
when: thales_configure_rfs when: thales_configure_rfs

View File

@ -1,17 +1,11 @@
--- ---
thales_client_working_dir: /tmp/thales_client_install thales_install_client: true
thales_client_tarball_location: http://myserver.example.com/CipherTools-linux64-dev-12.40.2.tgz security_world_iso_zip_url: https://myhost.example.com/SecWorld_Lin64-13.4.4.iso.zip
thales_client_tarball_name: CipherTools-linux64-dev-12.40.2.tgz
thales_client_path: linux/libc6_11/amd64/nfast
thales_client_uid: 42481
thales_client_gid: 42481
thales_km_data_location: http://myserver.example.com/kmdata.tar.gz
thales_km_data_tarball_name: kmdata.tar.gz
thales_rfs_server_ip_address: 192.168.5.20
nshield_hsms: nshield_hsms:
- name: "My HSM 1" - name: "My HSM 1"
ip: 192.168.1.1 ip: 192.168.1.1
- name: "My HSM 2" - name: "My HSM 2"
ip: 192.168.1.1 ip: 192.168.1.1
thales_rfs_user: admin thales_rfs_server_ip_address: 192.168.1.10
thales_rfs_key: RSA Private key in PEM format used to log into RFS server. thales_bootstrap_client: 192.168.100.1
thales_client_ips: 192.168.100.1 192.168.100.2 192.168.100.3