first commit

README.md

@@ -1 +1,41 @@
-# Network-Vault
+# Network Vault
+
+Ansible playbook for network vault.
+
+This creates a share vault on the target server which is writeable.
+
+A second share is read only and keeps snapshots of the data from the rw-share.
+
+Everey 4 hours, rsnapshot creates cheap copies of the data on the ro-share.
+How long the data will be kept depends on settings in rsnapshot.conf
+
+
+Use-Case:
+Create a immutable, WORM-Like Network-Share that holds REALLY!!! sensitive data like desaster-recovery-plans, password databases, network-plans, all the data you need in worst case and that should not be encrypted by any ransomware.
+
+When ransomware locks down your systems, this is your machine to go, plug in a console and start recovery.
+
+When sealing the vault, you can not access it over ssh any more so no ransomware can access the system.
+
+You should NOT NOT NOT NOT have a KVM-Console connected because this can be used to access the system over the network
+
+Place this stuff on something like an Intel NUC, paint it red and put it into a safe place.
+
+Create any job to copy your DR-plans there every night.
+
+It uses cron-apt to update the system and reboots at 6 in the morning to keep kernel up to date
+
+
+
+
+Varialbes:
+* networkvault_vault_password -> password for user to access shares
+* networkvault_seal_vault -> when set to "true" it will uninstall ssh-server to prevent any access via network
+
+ToDo:
+* Quota to ensure, space*backup-copies can not be exceed disk space and break backups by abusing share
+* Check diff-size and do some kind of alter
+* Add monitoring-agent/SNMP-support to be able to monitor system (alive? disk OK?)
+* Add more interfaces like WebDAV, FTP
+* Only reboot if required
+* check no unneeded ports open/block with firewall

tasks/main.yml

@@ -0,0 +1,45 @@
+---
+- name: install stuff
+  apt:
+    name: 
+      - samba
+      - rsnapshot
+    update_cache: yes
+
+- name: include common role
+  include_role:
+    name: common
+
+- name: install cron-apt
+  include_role:
+    name: cronapt
+
+- name: create user for vault
+  user:
+    name: vault
+    state: present
+    shell: /bin/false
+    system: yes
+    createhome: yes
+    home: /var/vault
+
+- name: create smb user vault
+  expect:
+    command: smbpasswd -a vault
+    responses:
+      New SMB password: "{{ networkvault_vault_password }}"
+      Retype new SMB password: "{{ networkvault_vault_password }}"
+
+- name: reboot at 6 in the morning to activate kernel-updates
+  cron:
+    name: "reboot"
+    minute: "0"
+    hour: "6"
+    job: "/usr/sbin/reboot"
+
+- name: uninstall ssh service to seal vault
+  apt:
+    name: 
+      - openssh-server
+    state: absent
+  when: networkvault_seal_vault is defined and networkvault_seal_vault == True

templates/rsnapshot.conf.j2

@@ -0,0 +1,254 @@
+#################################################
+# rsnapshot.conf - rsnapshot configuration file #
+#################################################
+#                                               #
+# PLEASE BE AWARE OF THE FOLLOWING RULE:        #
+#                                               #
+# This file requires tabs between elements      #
+#                                               #
+#################################################
+
+#######################
+# CONFIG FILE VERSION #
+#######################
+
+config_version  1.2
+
+###########################
+# SNAPSHOT ROOT DIRECTORY #
+###########################
+
+# All snapshots will be stored under this root directory.
+#
+snapshot_root   /var/cache/rsnapshot/
+
+# If no_create_root is enabled, rsnapshot will not automatically create the
+# snapshot_root directory. This is particularly useful if you are backing
+# up to removable media, such as a FireWire or USB drive.
+#
+#no_create_root 1
+
+#################################
+# EXTERNAL PROGRAM DEPENDENCIES #
+#################################
+
+# LINUX USERS:   Be sure to uncomment "cmd_cp". This gives you extra features.
+# EVERYONE ELSE: Leave "cmd_cp" commented out for compatibility.
+#
+# See the README file or the man page for more details.
+#
+cmd_cp          /bin/cp
+
+# uncomment this to use the rm program instead of the built-in perl routine.
+#
+cmd_rm          /bin/rm
+
+# rsync must be enabled for anything to work. This is the only command that
+# must be enabled.
+#
+cmd_rsync       /usr/bin/rsync
+
+# Uncomment this to enable remote ssh backups over rsync.
+#
+#cmd_ssh        /usr/bin/ssh
+
+# Comment this out to disable syslog support.
+#
+cmd_logger      /usr/bin/logger
+
+# Uncomment this to specify the path to "du" for disk usage checks.
+# If you have an older version of "du", you may also want to check the
+# "du_args" parameter below.
+#
+#cmd_du         /usr/bin/du
+
+# Uncomment this to specify the path to rsnapshot-diff.
+#
+#cmd_rsnapshot_diff     /usr/bin/rsnapshot-diff
+
+# Specify the path to a script (and any optional arguments) to run right
+# before rsnapshot syncs files
+#
+#cmd_preexec    /path/to/preexec/script
+
+# Specify the path to a script (and any optional arguments) to run right
+# after rsnapshot syncs files
+#
+#cmd_postexec   /path/to/postexec/script
+
+# Paths to lvcreate, lvremove, mount and umount commands, for use with
+# Linux LVMs.
+#
+#linux_lvm_cmd_lvcreate /sbin/lvcreate
+#linux_lvm_cmd_lvremove /sbin/lvremove
+#linux_lvm_cmd_mount    /bin/mount
+#linux_lvm_cmd_umount   /bin/umount
+
+#########################################
+#     BACKUP LEVELS / INTERVALS         #
+# Must be unique and in ascending order #
+# e.g. alpha, beta, gamma, etc.         #
+#########################################
+
+retain  alpha   6
+retain  beta    7
+retain  gamma   4
+retain delta   12
+
+############################################
+#              GLOBAL OPTIONS              #
+# All are optional, with sensible defaults #
+############################################
+
+# Verbose level, 1 through 5.
+# 1     Quiet           Print fatal errors only
+# 2     Default         Print errors and warnings only
+# 3     Verbose         Show equivalent shell commands being executed
+# 4     Extra Verbose   Show extra verbose information
+# 5     Debug mode      Everything
+#
+verbose         2
+
+# Same as "verbose" above, but controls the amount of data sent to the
+# logfile, if one is being used. The default is 3.
+# If you want the rsync output, you have to set it to 4
+#
+loglevel        3
+
+# If you enable this, data will be written to the file you specify. The
+# amount of data written is controlled by the "loglevel" parameter.
+#
+#logfile        /var/log/rsnapshot.log
+
+# If enabled, rsnapshot will write a lockfile to prevent two instances
+# from running simultaneously (and messing up the snapshot_root).
+# If you enable this, make sure the lockfile directory is not world
+# writable. Otherwise anyone can prevent the program from running.
+#
+lockfile        /var/run/rsnapshot.pid
+
+# By default, rsnapshot check lockfile, check if PID is running
+# and if not, consider lockfile as stale, then start
+# Enabling this stop rsnapshot if PID in lockfile is not running
+#
+#stop_on_stale_lockfile         0
+
+# Default rsync args. All rsync commands have at least these options set.
+#
+#rsync_short_args       -a
+#rsync_long_args        --delete --numeric-ids --relative --delete-excluded
+
+# ssh has no args passed by default, but you can specify some here.
+#
+#ssh_args       -p 22
+
+# Default arguments for the "du" program (for disk space reporting).
+# The GNU version of "du" is preferred. See the man page for more details.
+# If your version of "du" doesn't support the -h flag, try -k flag instead.
+#
+#du_args        -csh
+
+# If this is enabled, rsync won't span filesystem partitions within a
+# backup point. This essentially passes the -x option to rsync.
+# The default is 0 (off).
+#
+#one_fs         0
+
+# The include and exclude parameters, if enabled, simply get passed directly
+# to rsync. If you have multiple include/exclude patterns, put each one on a
+# separate line. Please look up the --include and --exclude options in the
+# rsync man page for more details on how to specify file name patterns.
+#
+#include        ???
+#include        ???
+#exclude        ???
+#exclude        ???
+
+# The include_file and exclude_file parameters, if enabled, simply get
+# passed directly to rsync. Please look up the --include-from and
+# --exclude-from options in the rsync man page for more details.
+#
+#include_file   /path/to/include/file
+#exclude_file   /path/to/exclude/file
+
+# If your version of rsync supports --link-dest, consider enabling this.
+# This is the best way to support special files (FIFOs, etc) cross-platform.
+# The default is 0 (off).
+#
+#link_dest      0
+
+# When sync_first is enabled, it changes the default behaviour of rsnapshot.
+# Normally, when rsnapshot is called with its lowest interval
+# (i.e.: "rsnapshot alpha"), it will sync files AND rotate the lowest
+# intervals. With sync_first enabled, "rsnapshot sync" handles the file sync,
+# and all interval calls simply rotate files. See the man page for more
+# details. The default is 0 (off).
+#
+#sync_first     0
+
+# If enabled, rsnapshot will move the oldest directory for each interval
+# to [interval_name].delete, then it will remove the lockfile and delete
+# that directory just before it exits. The default is 0 (off).
+#
+#use_lazy_deletes       0
+
+# Number of rsync re-tries. If you experience any network problems or
+# network card issues that tend to cause ssh to fail with errors like
+# "Corrupted MAC on input", for example, set this to a non-zero value
+# to have the rsync operation re-tried.
+#
+#rsync_numtries 0
+
+# LVM parameters. Used to backup with creating lvm snapshot before backup
+# and removing it after. This should ensure consistency of data in some special
+# cases
+#
+# LVM snapshot(s) size (lvcreate --size option).
+#
+#linux_lvm_snapshotsize 100M
+
+# Name to be used when creating the LVM logical volume snapshot(s).
+#
+#linux_lvm_snapshotname rsnapshot
+
+# Path to the LVM Volume Groups.
+#
+#linux_lvm_vgpath       /dev
+
+# Mount point to use to temporarily mount the snapshot(s).
+#
+#linux_lvm_mountpath    /path/to/mount/lvm/snapshot/during/backup
+
+###############################
+### BACKUP POINTS / SCRIPTS ###
+###############################
+
+# LOCALHOST
+#backup /home/          localhost/
+#backup /etc/           localhost/
+#backup /usr/local/     localhost/
+
+#backup /var/log/rsnapshot              localhost/
+#backup /etc/passwd     localhost/
+#backup /home/foo/My Documents/         localhost/
+#backup /foo/bar/       localhost/      one_fs=1, rsync_short_args=-urltvpog
+#backup_script  /usr/local/bin/backup_pgsql.sh  localhost/postgres/
+# You must set linux_lvm_* parameters below before using lvm snapshots
+#backup lvm://vg0/xen-home/     lvm-vg0/xen-home/
+
+# EXAMPLE.COM
+#backup_exec    /bin/date "+ backup of example.com started at %c"
+#backup root@example.com:/home/ example.com/    +rsync_long_args=--bwlimit=16,exclude=core
+#backup root@example.com:/etc/  example.com/    exclude=mtab,exclude=core
+#backup_exec    ssh root@example.com "mysqldump -A > /var/db/dump/mysql.sql"
+#backup root@example.com:/var/db/dump/  example.com/
+#backup_exec    /bin/date "+ backup of example.com ended at %c"
+
+# CVS.SOURCEFORGE.NET
+#backup_script  /usr/local/bin/backup_rsnapshot_cvsroot.sh      rsnapshot.cvs.sourceforge.net/
+
+# RSYNC.SAMBA.ORG
+#backup rsync://rsync.samba.org/rsyncftp/       rsync.samba.org/rsyncftp/
+
+
+backup  /var/vault/     localhost/

templates/smb.conf.j2

@@ -0,0 +1,255 @@
+#
+# Sample configuration file for the Samba suite for Debian GNU/Linux.
+#
+#
+# This is the main Samba configuration file. You should read the
+# smb.conf(5) manual page in order to understand the options listed
+# here. Samba has a huge number of configurable options most of which
+# are not shown in this example
+#
+# Some options that are often worth tuning have been included as
+# commented-out examples in this file.
+#  - When such options are commented with ";", the proposed setting
+#    differs from the default Samba behaviour
+#  - When commented with "#", the proposed setting is the default
+#    behaviour of Samba but the option is considered important
+#    enough to be mentioned here
+#
+# NOTE: Whenever you modify this file you should run the command
+# "testparm" to check that you have not made any basic syntactic
+# errors.
+
+#======================= Global Settings =======================
+
+[global]
+
+## Browsing/Identification ###
+
+# Change this to the workgroup/NT-domain name your Samba server will part of
+   workgroup = WORKGROUP
+
+#### Networking ####
+
+# The specific set of interfaces / networks to bind to
+# This can be either the interface name or an IP address/netmask;
+# interface names are normally preferred
+;   interfaces = 127.0.0.0/8 eth0
+
+# Only bind to the named interfaces and/or networks; you must use the
+# 'interfaces' option above to use this.
+# It is recommended that you enable this feature if your Samba machine is
+# not protected by a firewall or is a firewall itself.  However, this
+# option cannot handle dynamic or non-broadcast interfaces correctly.
+;   bind interfaces only = yes
+
+
+
+#### Debugging/Accounting ####
+
+# This tells Samba to use a separate log file for each machine
+# that connects
+   log file = /var/log/samba/log.%m
+
+# Cap the size of the individual log files (in KiB).
+   max log size = 1000
+
+# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
+# Append syslog@1 if you want important messages to be sent to syslog too.
+   logging = file
+
+# Do something sensible when Samba crashes: mail the admin a backtrace
+   panic action = /usr/share/samba/panic-action %d
+
+
+####### Authentication #######
+
+# Server role. Defines in which mode Samba will operate. Possible
+# values are "standalone server", "member server", "classic primary
+# domain controller", "classic backup domain controller", "active
+# directory domain controller".
+#
+# Most people will want "standalone server" or "member server".
+# Running as "active directory domain controller" will require first
+# running "samba-tool domain provision" to wipe databases and create a
+# new domain.
+   server role = standalone server
+
+   obey pam restrictions = yes
+
+# This boolean parameter controls whether Samba attempts to sync the Unix
+# password with the SMB password when the encrypted SMB password in the
+# passdb is changed.
+   unix password sync = yes
+
+# For Unix password sync to work on a Debian GNU/Linux system, the following
+# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
+# sending the correct chat script for the passwd program in Debian Sarge).
+   passwd program = /usr/bin/passwd %u
+   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
+
+# This boolean controls whether PAM will be used for password changes
+# when requested by an SMB client instead of the program listed in
+# 'passwd program'. The default is 'no'.
+   pam password change = yes
+
+# This option controls how unsuccessful authentication attempts are mapped
+# to anonymous connections
+   map to guest = bad user
+
+########## Domains ###########
+
+#
+# The following settings only takes effect if 'server role = primary
+# classic domain controller', 'server role = backup domain controller'
+# or 'domain logons' is set
+#
+
+# It specifies the location of the user's
+# profile directory from the client point of view) The following
+# required a [profiles] share to be setup on the samba server (see
+# below)
+;   logon path = \\%N\profiles\%U
+# Another common choice is storing the profile in the user's home directory
+# (this is Samba's default)
+#   logon path = \\%N\%U\profile
+
+# The following setting only takes effect if 'domain logons' is set
+# It specifies the location of a user's home directory (from the client
+# point of view)
+;   logon drive = H:
+#   logon home = \\%N\%U
+
+# The following setting only takes effect if 'domain logons' is set
+# It specifies the script to run during logon. The script must be stored
+# in the [netlogon] share
+# NOTE: Must be store in 'DOS' file format convention
+;   logon script = logon.cmd
+
+# This allows Unix users to be created on the domain controller via the SAMR
+# RPC pipe.  The example command creates a user account with a disabled Unix
+# password; please adapt to your needs
+; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u
+
+# This allows machine accounts to be created on the domain controller via the
+# SAMR RPC pipe.
+# The following assumes a "machines" group exists on the system
+; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
+
+# This allows Unix groups to be created on the domain controller via the SAMR
+# RPC pipe.
+; add group script = /usr/sbin/addgroup --force-badname %g
+
+############ Misc ############
+
+# Using the following line enables you to customise your configuration
+# on a per machine basis. The %m gets replaced with the netbios name
+# of the machine that is connecting
+;   include = /home/samba/etc/smb.conf.%m
+
+# Some defaults for winbind (make sure you're not using the ranges
+# for something else.)
+;   idmap config * :              backend = tdb
+;   idmap config * :              range   = 3000-7999
+;   idmap config YOURDOMAINHERE : backend = tdb
+;   idmap config YOURDOMAINHERE : range   = 100000-999999
+;   template shell = /bin/bash
+
+# Setup usershare options to enable non-root users to share folders
+# with the net usershare command.
+
+# Maximum number of usershare. 0 means that usershare is disabled.
+#   usershare max shares = 100
+
+# Allow users who've been granted usershare privileges to create
+# public shares, not just authenticated ones
+   usershare allow guests = yes
+
+#======================= Share Definitions =======================
+
+#[homes]
+#   comment = Home Directories
+#   browseable = no
+#
+## By default, the home directories are exported read-only. Change the
+## next parameter to 'no' if you want to be able to write to them.
+#   read only = yes
+#
+## File creation mask is set to 0700 for security reasons. If you want to
+## create files with group=rw permissions, set next parameter to 0775.
+#   create mask = 0700
+#
+## Directory creation mask is set to 0700 for security reasons. If you want to
+## create dirs. with group=rw permissions, set next parameter to 0775.
+#   directory mask = 0700
+#
+## By default, \\server\username shares can be connected to by anyone
+## with access to the samba server.
+## The following parameter makes sure that only "username" can connect
+## to \\server\username
+## This might need tweaking when using external authentication schemes
+#   valid users = %S
+#
+## Un-comment the following and create the netlogon directory for Domain Logons
+## (you need to configure Samba to act as a domain controller too.)
+#;[netlogon]
+#;   comment = Network Logon Service
+#;   path = /home/samba/netlogon
+#;   guest ok = yes
+#;   read only = yes
+#
+## Un-comment the following and create the profiles directory to store
+## users profiles (see the "logon path" option above)
+## (you need to configure Samba to act as a domain controller too.)
+## The path below should be writable by all users so that their
+## profile directory may be created the first time they log on
+#;[profiles]
+#;   comment = Users profiles
+#;   path = /home/samba/profiles
+#;   guest ok = no
+#;   browseable = no
+#;   create mask = 0600
+#;   directory mask = 0700
+#
+#[printers]
+#   comment = All Printers
+#   browseable = no
+#   path = /var/spool/samba
+#   printable = yes
+#   guest ok = no
+#   read only = yes
+#   create mask = 0700
+
+## Windows clients look for this share name as a source of downloadable
+## printer drivers
+##[print$]
+##   comment = Printer Drivers
+##   path = /var/lib/samba/printers
+##   browseable = yes
+##   read only = yes
+##   guest ok = no
+## Uncomment to allow remote administration of Windows print drivers.
+## You may need to replace 'lpadmin' with the name of the group your
+## admin users are members of.
+## Please note that you also need to set appropriate Unix permissions
+## to the drivers directory for these users to have write rights in it
+#;   write list = root, @lpadmin
+
+[vault]
+comment = Vault
+path = /var/vault
+browsable = yes
+guest ok = no
+read only = no
+write list = vault
+create mask = 0755
+public = no
+
+[roshare]
+comment = Vault
+path = /var/cache/rsnapshot
+browsable = yes
+guest ok = no
+read only = yes
+read list = vault
+create mask = 0755
+public = no