Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement certificate policy manager for machines #745

Merged
merged 13 commits into from
Jul 31, 2023
Merged

Implement certificate policy manager for machines #745

merged 13 commits into from
Jul 31, 2023

Commits on Jul 31, 2023

  1. Hack to allow propagation of Microsoft GPO entries 

    The certificate policy manager is configured via the Windows GPO
entries instead of our custom ADMX/ADML counterpart. We were already able
to parse these entries but we were excluding them as they didn't start
with our Ubuntu-specific prefix.

The easiest way to make this work is to add the Ubuntu prefix to the
keys that we want to use in our certificate policy manager.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    61d1100 View commit details
    Browse the repository at this point in the history

  2. Pass backend object to policies.NewManager 

    We will need to know both the domain and online status of the backend
for the certificate policy manager. Since the backend object contains
both of these, pass it along when creating the policy manager object.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    c5f50a6 View commit details
    Browse the repository at this point in the history

  3. Add certificate policy manager 

    This manager leverages the Samba implementation of certificate
autoenrollment. It contains a few patches and fixes on top of the
samba#master version of `gp_cert_auto_enroll_ext.py` file, that will
ultimately be upstreamed.

Autoenrollment is performed via a separate policy manager that runs a
helper Python script (`cert-autoenroll`) which communicates with the
Windows CEP/CES services through Samba. For better control and to avoid
unexpected behavior we vendor the required Samba files, which are
confirmed to work on all Ubuntu versions starting with (and including)
Jammy (22.04).

Samba has its own cache mechanism which stores information concerning
the applied GPOs which we are using in order to ensure idempotency.

By default, Samba would parse the .reg file itself (see the
process_group_policy method from the vendored code). However, it is
better to have this functionality entirely within adsys so we can
provide samba the pre-parsed list of GPO entries and override the entry
point of the extension. This ensures we don't operate on disk files
which can change at anytime (even during adsys policy application).
Doing this we also have better knowledge on the enabled/disabled state
of the GPO entry used to configure the policy.

The advanced configuration entries are passed via JSON to the external
script which then takes care to create the proper PReg entries that can
be used by Samba to apply additional logic when determining the policy
servers to use.

Fixes UDENG-1056
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    0f4d632 View commit details
    Browse the repository at this point in the history

  4. Hook up certificate policy manager to parent manager

    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    4ff12e1 View commit details
    Browse the repository at this point in the history

  5. Add CLI command to dump certificate enroll script 

    Similar to the adsys-gpolist, provide a way for users to dump the
certificate autoenrollment script for debugging purposes.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    170bcfd View commit details
    Browse the repository at this point in the history

  6. Match Samba permissions when creating directories 

    The Samba implementation creates the private directory with 0700
permissions and uses 0755 for the rest. We should honor that in our
implementation as well.

Additionally, create the global trust dir on the off chance it doesn't
already exist.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    af7aca4 View commit details
    Browse the repository at this point in the history

  7. Remove unused Python import

    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    2c1cfcc View commit details
    Browse the repository at this point in the history

  8. Write Samba cache file to a specific directory 

    And change the naming from stateDir to sambaCacheDir to better reflect
what the path is used for.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    b49fcd0 View commit details
    Browse the repository at this point in the history

  9. Unenroll machine if cert policy is not configured 

    Similar to our other policy manager behaviors, if the certificate policy
is either disabled or not configured, unenroll the machine if
applicable.

To avoid running the helper Python script on every policy apply,
determine if we actually need to unenroll by checking the existence of
the Samba cache directory. Additionally, update the Python script to
remove the directory after unenrollment is successful.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    7c810ff View commit details
    Browse the repository at this point in the history

  10. Mark certificate policy as Pro only and add tests

    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    7857337 View commit details
    Browse the repository at this point in the history

  11. Disable parallel testing for autoenroll script 

    Because Python coverage can't be parallelized, avoid running these tests
in parallel.
    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    3eb2769 View commit details
    Browse the repository at this point in the history

  12. Check error when typecasting GPO data

    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    9b0f22c View commit details
    Browse the repository at this point in the history

  13. Add GPO parsing test for certificate policy

    @GabrielNagy
    GabrielNagy committed Jul 31, 2023
    Configuration menu
    Copy the full SHA
    1a7be22 View commit details
    Browse the repository at this point in the history