├── pictures ├── README.md ├── app.png ├── workflow.png ├── workflow-k8s.png ├── infrastructure-aws.png ├── visitors-dashboard.png ├── infrastructure-vagrant.png └── infrastructure-k8s-simple.png ├── app ├── docker │ ├── visitors-service │ │ ├── visitors │ │ │ ├── __init__.py │ │ │ ├── service │ │ │ │ ├── __init__.py │ │ │ │ ├── migrations │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── 0001_initial.py │ │ │ │ ├── admin.py │ │ │ │ ├── tests.py │ │ │ │ ├── apps.py │ │ │ │ ├── serializers.py │ │ │ │ ├── models.py │ │ │ │ └── views.py │ │ │ ├── urls.py │ │ │ └── wsgi.py │ │ ├── .gitignore │ │ ├── requirements.txt │ │ ├── startup.sh │ │ ├── Dockerfile │ │ └── manage.py │ ├── visitors-webui │ │ ├── src │ │ │ ├── index.css │ │ │ ├── index.js │ │ │ ├── App.test.js │ │ │ ├── App.css │ │ │ └── App.js │ │ ├── report.json │ │ ├── public │ │ │ ├── favicon.ico │ │ │ └── index.html │ │ ├── .gitignore │ │ ├── package.json │ │ └── Dockerfile │ ├── visitors-db │ │ └── Dockerfile │ ├── docker-compose.yml │ └── README.md └── README.md ├── infrastructure ├── k8s │ ├── aws-KOPS │ │ ├── pictures │ │ │ ├── README.md │ │ │ ├── k8-saas-LB.png │ │ │ ├── k8s-user-group.png │ │ │ ├── k8s-master-node.png │ │ │ ├── k8s-user-summary.png │ │ │ ├── k8s-saas-IAM-roles.png │ │ │ └── k8s-saas-sec-groups.png │ │ └── manifests │ │ │ ├── frontend.yaml │ │ │ ├── backend.yaml │ │ │ └── database.yaml │ └── minikube │ │ ├── setup-environment.sh │ │ ├── manifests │ │ ├── frontend.yaml │ │ ├── backend.yaml │ │ └── database.yaml │ │ └── README.md ├── aws │ ├── terraform │ │ └── Jenkins-EC2 │ │ │ ├── versions.tf │ │ │ ├── output.tf │ │ │ ├── variables.tf │ │ │ ├── main.tf │ │ │ ├── main.tf.Route53 │ │ │ └── user-data.tpl │ └── ansible │ │ └── README.md ├── vagrant │ ├── scripts │ │ ├── cleanup.sh │ │ ├── jenkins-install.sh │ │ ├── jenkins-ssh.sh │ │ ├── clean.sh │ │ ├── vagrant.sh │ │ ├── virtualbox.sh │ │ ├── jenkins-master-ssh.sh │ │ ├── base.sh │ │ ├── jenkins-master-install.sh │ │ └── docker-install.sh │ ├── ansible-vagrant │ │ └── README.md │ ├── Vagrantfile.DevSecOps-example2 │ ├── README.md │ └── http │ │ └── kickstart.ks └── README.md └── utils ├── 9-jenkins-pipeline-python-end-to-end ├── reports │ ├── README.md │ └── docker_lynis-report.dat ├── pictures │ ├── README.md │ ├── DevSecOps-ec2.png │ ├── DevSecOps-workspace.png │ ├── DevSecOps-pipeline-full.png │ └── DevSecOps-pipeline-steps-UI.png ├── jenkins_home │ ├── ansible_hosts │ ├── killec2.yml │ ├── configureWAF.yml │ ├── strategy.ini │ ├── configureTestEnv.yml │ ├── hostaudit.yml │ └── createAwsEc2.yml ├── jenkins │ ├── ansible.cfg │ ├── setupJenkins.groovy │ └── plugins.txt ├── docker-compose.yml ├── config.xml └── setup-ubuntu.sh ├── 8-jenkins-docker-utils ├── docker-owasp-depcheck │ ├── .gitignore │ └── owasp-check.sh ├── docker-bandit │ ├── Dockerfile │ ├── .travis.yml │ └── Jenkinsfile-SAST-Bandit-PYTHON_PROJECT-example └── docker-clair-scanner │ ├── .travis.yml │ ├── Dockerfile.GO-install.sh │ └── Dockerfile ├── 1-ansible-aws-infra ├── roles │ ├── scan-artefact │ │ ├── tests │ │ │ ├── inventory │ │ │ └── test.yml │ │ ├── vars │ │ │ └── main.yml │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── .travis.yml │ │ └── meta │ │ │ └── main.yml │ ├── deploy-application │ │ ├── tests │ │ │ ├── inventory │ │ │ └── test.yml │ │ ├── vars │ │ │ └── main.yml │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── .travis.yml │ │ └── meta │ │ │ └── main.yml │ ├── deploy-infrastructure │ │ ├── tests │ │ │ ├── inventory │ │ │ └── test.yml │ │ ├── vars │ │ │ └── main.yml │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── .travis.yml │ │ └── meta │ │ │ └── main.yml │ ├── geerlingguy.docker │ │ ├── .ansible-lint │ │ ├── .gitignore │ │ ├── meta │ │ │ ├── .galaxy_install_info │ │ │ └── main.yml │ │ ├── .yamllint │ │ ├── handlers │ │ │ └── main.yml │ │ ├── .github │ │ │ └── FUNDING.yml │ │ ├── tasks │ │ │ ├── docker-users.yml │ │ │ ├── docker-compose.yml │ │ │ ├── main.yml │ │ │ ├── setup-Debian.yml │ │ │ └── setup-RedHat.yml │ │ ├── molecule │ │ │ └── default │ │ │ │ ├── converge.yml │ │ │ │ └── molecule.yml │ │ ├── .travis.yml │ │ ├── LICENSE │ │ └── defaults │ │ │ └── main.yml │ ├── set-infrastructure-build │ │ ├── tests │ │ │ ├── inventory │ │ │ └── test.yml │ │ ├── vars │ │ │ └── main.yml │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ └── meta │ │ │ └── main.yml │ ├── geerlingguy.pip │ │ ├── .gitignore │ │ ├── meta │ │ │ ├── .galaxy_install_info │ │ │ └── main.yml │ │ ├── molecule │ │ │ └── default │ │ │ │ ├── yaml-lint.yml │ │ │ │ ├── tests │ │ │ │ └── test_default.py │ │ │ │ ├── playbook.yml │ │ │ │ └── molecule.yml │ │ ├── defaults │ │ │ └── main.yml │ │ ├── tasks │ │ │ └── main.yml │ │ ├── .travis.yml │ │ └── LICENSE │ └── requirements.yml ├── hosts ├── attack │ ├── simple_curl.attack.j2 │ ├── cookies.attack.j2 │ ├── xss.attack.j2 │ ├── xss.attack.j2.back │ └── verbs.attack.j2 └── group_vars │ └── all.yml ├── 4-ansible-devsecops-general-utils ├── DVSW │ └── dvsw-playbook │ │ ├── inventory │ │ └── site.yml ├── Lynis │ └── lynis │ │ ├── inventory │ │ └── main.yml ├── Nessus │ ├── autonessus │ │ ├── roles │ │ │ ├── pausescan │ │ │ │ ├── vars │ │ │ │ │ └── main.yml │ │ │ │ └── tasks │ │ │ │ │ └── main.yml │ │ │ ├── startscan │ │ │ │ ├── vars │ │ │ │ │ └── main.yml │ │ │ │ └── tasks │ │ │ │ │ └── main.yml │ │ │ ├── stopscan │ │ │ │ ├── vars │ │ │ │ │ └── main.yml │ │ │ │ └── tasks │ │ │ │ │ └── main.yml │ │ │ ├── resumescan │ │ │ │ ├── vars │ │ │ │ │ └── main.yml │ │ │ │ └── tasks │ │ │ │ │ └── main.yml │ │ │ ├── setup │ │ │ │ ├── vars │ │ │ │ │ └── main.yml │ │ │ │ └── tasks │ │ │ │ │ └── main.yml │ │ │ ├── listpolices │ │ │ │ └── tasks │ │ │ │ │ └── main.yml │ │ │ └── listscans │ │ │ │ └── tasks │ │ │ │ └── main.yml │ │ ├── inventory │ │ └── site.yml │ ├── nessus-setup │ │ ├── inventory │ │ ├── site.yml │ │ ├── group_vars │ │ │ └── nessus.yml │ │ └── roles │ │ │ └── setup │ │ │ └── tasks │ │ │ └── main.yml │ └── nessus-restapi │ │ └── main.yml ├── OWASP-ZAP │ ├── zap-full-scan │ │ ├── inventory │ │ └── site.yml │ ├── zap-baseline-scan │ │ ├── inventory │ │ └── site.yml │ └── zap-setup-playbook │ │ ├── inventory │ │ ├── zap-full-scan │ │ ├── inventory │ │ └── site.yml │ │ ├── zap-baseline-scan │ │ ├── inventory │ │ └── site.yml │ │ └── site.yml ├── OWASP-brakeman │ └── brakeman-scan │ │ ├── inventory │ │ └── main.yml ├── Nikto │ └── nikto-scan │ │ ├── inventory │ │ └── main.yml ├── OWASP-dependency-check │ ├── owasp-dependency-check │ │ ├── inventory │ │ └── main.yml │ └── owasp-scala-dependency-check │ │ ├── README.md │ │ └── Jenkinsfile-SCALA-PROJECT-example ├── Viper │ └── viper-setup │ │ ├── inventory │ │ ├── roles │ │ ├── dependencies │ │ │ ├── templates │ │ │ │ └── ssdeep.sh │ │ │ └── tasks │ │ │ │ └── main.yml │ │ └── setup │ │ │ └── tasks │ │ │ └── main.yml │ │ └── main.yml └── Nmap │ ├── nmap-nse │ └── main.yml │ └── nmap-basic-scan │ └── main.yml ├── 0-jenkins-shared-library ├── README.md └── vars │ ├── goCheck.groovy │ ├── clean.groovy │ ├── runJmeter.groovy │ ├── ansiblePlay.groovy │ ├── mailNotifier.groovy │ ├── bashCheck.groovy │ └── slackNotifier.groovy ├── 3-ansible-devops-utils ├── gitlab │ ├── .gitignore │ ├── .ansible-lint │ ├── .github │ │ ├── FUNDING.yml │ │ └── workflows │ │ │ ├── release.yml │ │ │ └── ci.yml │ ├── .yamllint │ ├── handlers │ │ └── main.yml │ ├── vars │ │ ├── Debian.yml │ │ └── RedHat.yml │ ├── molecule │ │ └── default │ │ │ ├── molecule.yml │ │ │ ├── converge.yml │ │ │ └── version.yml │ ├── meta │ │ └── main.yml │ └── LICENSE └── jenkins │ └── site.yml ├── 7-ansible-log-monitoring-elk-aws-serverless-utils ├── elastic-stack │ ├── inventory │ ├── roles │ │ ├── logstash │ │ │ ├── tasks │ │ │ │ ├── main.yml │ │ │ │ ├── configure-logstash.yml │ │ │ │ └── install-logstash.yml │ │ │ ├── handlers │ │ │ │ └── main.yml │ │ │ └── templates │ │ │ │ ├── 02-beats-input.conf.j2 │ │ │ │ ├── 30-elasticsearch-output.conf.j2 │ │ │ │ ├── 11-weblog-filter.conf.j2 │ │ │ │ └── 10-sshlog-filter.conf.j2 │ │ ├── elasticsearch │ │ │ ├── tasks │ │ │ │ ├── main.yml │ │ │ │ ├── configure-elasticsearch.yml │ │ │ │ └── install-elasticsearch.yml │ │ │ └── handlers │ │ │ │ └── main.yml │ │ ├── nginx-reverse-proxy │ │ │ ├── handlers │ │ │ │ └── main.yml │ │ │ ├── tasks │ │ │ │ └── main.yml │ │ │ └── templates │ │ │ │ └── nginxdefault.j2 │ │ ├── kibana │ │ │ ├── handlers │ │ │ │ └── main.yml │ │ │ └── tasks │ │ │ │ └── main.yml │ │ └── common │ │ │ └── tasks │ │ │ └── main.yml │ ├── main.yml │ └── group_vars │ │ └── elastic-stack.yml ├── beats-for-elastic-stack │ ├── inventory │ ├── roles │ │ ├── filebeat │ │ │ ├── tasks │ │ │ │ ├── main.yml │ │ │ │ ├── configure-filebeat.yml │ │ │ │ └── install-filebeat.yml │ │ │ ├── handlers │ │ │ │ └── main.yml │ │ │ └── templates │ │ │ │ └── filebeat.yml.j2 │ │ ├── metricbeat │ │ │ ├── tasks │ │ │ │ ├── main.yml │ │ │ │ ├── configure-metricbeat.yml │ │ │ │ └── install-metricbeat.yml │ │ │ └── handlers │ │ │ │ └── main.yml │ │ └── packetbeat │ │ │ ├── tasks │ │ │ ├── main.yml │ │ │ ├── configure-packetbeat.yml │ │ │ └── install-packetbeat.yml │ │ │ └── handlers │ │ │ └── main.yml │ └── main.yml └── elastalert │ ├── roles │ ├── aws-serverless │ │ ├── templates │ │ │ ├── aws-credentials.j2 │ │ │ ├── serverless.yml.j2 │ │ │ ├── config.js.j2 │ │ │ ├── iamRoleStatements.json.j2 │ │ │ └── initDb.js.j2 │ │ └── tasks │ │ │ └── main.yml │ └── setup │ │ ├── templates │ │ ├── elastalert-config.j2 │ │ ├── elastalert-service.j2 │ │ └── elastalert-sshrule.j2 │ │ └── tasks │ │ └── main.yml │ └── site.yml ├── 5-ansible-devsecops-docker-utils ├── vuls │ ├── inventory │ ├── main.yml │ ├── group_vars │ │ └── vuls.yml │ └── roles │ │ ├── vuls_containers_download │ │ └── tasks │ │ │ └── main.yml │ │ └── vuls_database_download │ │ └── tasks │ │ └── main.yml ├── vuls-scanning │ ├── inventory │ └── templates │ │ ├── config.toml │ │ └── 192-168-33-80 ├── anchore-server │ ├── inventory │ └── main.yml ├── anchore-cli-scan │ ├── inventory │ └── main.yml ├── clair-scanner-setup │ ├── inventory │ └── main.yaml ├── clair-scanning-images │ ├── inventory │ └── main.yaml ├── osquery-setup │ ├── inventory │ ├── templates │ │ ├── fim.conf │ │ └── osquery.conf │ └── main.yml └── docker-bench-security │ └── main.yml ├── 6-ansible-devsecops-aws-utils ├── log-collection │ ├── inventory │ └── main.yml ├── aws-security-benchmark │ ├── README.md │ ├── architecture │ │ ├── cis-benchmark-matrix.xlsx │ │ ├── assets │ │ │ └── cis-benchmark-architecture.jpg │ │ └── README.md │ └── aws_cis_foundation_framework │ │ ├── CIS_Amazon_Web_Services_Foundations_Benchmark_v1.1.0.pdf │ │ └── README.md ├── s3-backup │ ├── templates │ │ └── s3cmd.j2 │ └── main.yml ├── Scout2 │ ├── scout2-setup │ │ └── main.yml │ └── scout2-scan │ │ └── main.yml └── aws-cis-benchmarks │ └── main.yml └── 2-ansible-vagrant-infra └── README.md /pictures/README.md: -------------------------------------------------------------------------------- 1 | TBD 2 | -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/README.md: -------------------------------------------------------------------------------- 1 | TBD 2 | -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/migrations/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/reports/README.md: -------------------------------------------------------------------------------- 1 | TBD 2 | -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-owasp-depcheck/.gitignore: -------------------------------------------------------------------------------- 1 | *ORIG 2 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/pictures/README.md: -------------------------------------------------------------------------------- 1 | TBD 2 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/tests/inventory: -------------------------------------------------------------------------------- 1 | localhost 2 | 3 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/tests/inventory: -------------------------------------------------------------------------------- 1 | localhost 2 | 3 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/tests/inventory: -------------------------------------------------------------------------------- 1 | localhost 2 | 3 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/.ansible-lint: -------------------------------------------------------------------------------- 1 | skip_list: 2 | - '306' 3 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/set-infrastructure-build/tests/inventory: -------------------------------------------------------------------------------- 1 | localhost 2 | 3 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/DVSW/dvsw-playbook/inventory: -------------------------------------------------------------------------------- 1 | [dvsw] 2 | 192.168.33.111 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Lynis/lynis/inventory: -------------------------------------------------------------------------------- 1 | [lynis] 2 | 192.168.1.5 3 | -------------------------------------------------------------------------------- /utils/0-jenkins-shared-library/README.md: -------------------------------------------------------------------------------- 1 | ### Description 2 | 3 | Shared-libray for Jenkins 4 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/.gitignore: -------------------------------------------------------------------------------- 1 | *.retry 2 | */__pycache__ 3 | *.pyc 4 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/vars/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # vars file for scan-artefact -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/pausescan/vars/main.yml: -------------------------------------------------------------------------------- 1 | scan_id: 17 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/startscan/vars/main.yml: -------------------------------------------------------------------------------- 1 | scan_id: 17 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/stopscan/vars/main.yml: -------------------------------------------------------------------------------- 1 | scan_id: 17 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/nessus-setup/inventory: -------------------------------------------------------------------------------- 1 | [nessus] 2 | 192.168.56.101 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-full-scan/inventory: -------------------------------------------------------------------------------- 1 | [zap] 2 | 192.168.56.100 -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/vars/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # vars file for deploy-infra -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/.gitignore: -------------------------------------------------------------------------------- 1 | *.retry 2 | */__pycache__ 3 | *.pyc 4 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/.gitignore: -------------------------------------------------------------------------------- 1 | *.retry 2 | */__pycache__ 3 | *.pyc 4 | .cache 5 | 6 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/inventory: -------------------------------------------------------------------------------- 1 | [nessus] 2 | 192.168.33.109 3 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/resumescan/vars/main.yml: -------------------------------------------------------------------------------- 1 | scan_id: 17 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-baseline-scan/inventory: -------------------------------------------------------------------------------- 1 | [zap] 2 | 192.168.56.100 -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-setup-playbook/inventory: -------------------------------------------------------------------------------- 1 | [zap] 2 | 192.168.56.100 -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/vars/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # vars file for deploy-application -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # defaults file for scan-artefact -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # handlers file for scan-artefact -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-brakeman/brakeman-scan/inventory: -------------------------------------------------------------------------------- 1 | [scanner] 2 | 192.168.1.5 3 | -------------------------------------------------------------------------------- /pictures/app.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/app.png -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # defaults file for deploy-infra -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # handlers file for deploy-infra -------------------------------------------------------------------------------- /infrastructure/aws/terraform/Jenkins-EC2/versions.tf: -------------------------------------------------------------------------------- 1 | 2 | terraform { 3 | required_version = ">= 0.12" 4 | } 5 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # defaults file for deploy-application -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # handlers file for deploy-application -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/set-infrastructure-build/vars/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # vars file for roles/set-infra-build -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-setup-playbook/zap-full-scan/inventory: -------------------------------------------------------------------------------- 1 | [zap] 2 | 192.168.56.100 -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/inventory: -------------------------------------------------------------------------------- 1 | [elastic-stack] 2 | 192.168.33.222 3 | -------------------------------------------------------------------------------- /app/docker/visitors-webui/src/index.css: -------------------------------------------------------------------------------- 1 | body { 2 | margin: 0; 3 | padding: 0; 4 | font-family: sans-serif; 5 | } 6 | -------------------------------------------------------------------------------- /pictures/workflow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/workflow.png -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/set-infrastructure-build/defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # defaults file for roles/set-infra-build -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/set-infrastructure-build/handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # handlers file for roles/set-infra-build -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-setup-playbook/zap-baseline-scan/inventory: -------------------------------------------------------------------------------- 1 | [zap] 2 | 192.168.56.100 -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/inventory: -------------------------------------------------------------------------------- 1 | [monitor] 2 | 192.168.56.200 3 | -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/admin.py: -------------------------------------------------------------------------------- 1 | from django.contrib import admin 2 | 3 | # Register your models here. 4 | -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/tests.py: -------------------------------------------------------------------------------- 1 | from django.test import TestCase 2 | 3 | # Create your tests here. 4 | -------------------------------------------------------------------------------- /pictures/workflow-k8s.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/workflow-k8s.png -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/.ansible-lint: -------------------------------------------------------------------------------- 1 | skip_list: 2 | - 'yaml' 3 | - 'role-name' 4 | - 'package-latest' 5 | -------------------------------------------------------------------------------- /app/docker/visitors-service/.gitignore: -------------------------------------------------------------------------------- 1 | db.sqlite3 2 | 3 | .DS_Store 4 | .vscode 5 | 6 | **__pycache__ 7 | *.pyc 8 | *.egg-info 9 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/meta/.galaxy_install_info: -------------------------------------------------------------------------------- 1 | {install_date: 'Sun Apr 26 20:37:35 2020', version: 1.3.0} 2 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nikto/nikto-scan/inventory: -------------------------------------------------------------------------------- 1 | [scanner] 2 | 192.168.1.10 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /pictures/infrastructure-aws.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/infrastructure-aws.png -------------------------------------------------------------------------------- /pictures/visitors-dashboard.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/visitors-dashboard.png -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/meta/.galaxy_install_info: -------------------------------------------------------------------------------- 1 | {install_date: 'Sun Apr 26 20:37:37 2020', version: 2.7.0} 2 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins_home/ansible_hosts: -------------------------------------------------------------------------------- 1 | [local] 2 | localhost ansible_connection=local 3 | 4 | [tstlaunched] 5 | -------------------------------------------------------------------------------- /pictures/infrastructure-vagrant.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/infrastructure-vagrant.png -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/tests/test.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: localhost 3 | remote_user: root 4 | roles: 5 | - scan-artefact -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins/ansible.cfg: -------------------------------------------------------------------------------- 1 | [defaults] 2 | host_key_checking = False 3 | private_key_file = ~/.ssh/devsecops 4 | -------------------------------------------------------------------------------- /app/docker/visitors-webui/report.json: -------------------------------------------------------------------------------- 1 | { 2 | "image": "davarski/visitors-webui:1.0.0", 3 | "unapproved": [], 4 | "vulnerabilities": [] 5 | } -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls/inventory: -------------------------------------------------------------------------------- 1 | [vuls] 2 | 192.168.33.60 ansible_host=192.168.33.60 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /pictures/infrastructure-k8s-simple.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/pictures/infrastructure-k8s-simple.png -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/tests/test.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: localhost 3 | remote_user: root 4 | roles: 5 | - deploy-application -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/tests/test.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: localhost 3 | remote_user: root 4 | roles: 5 | - deploy-infra -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls-scanning/inventory: -------------------------------------------------------------------------------- 1 | [vuls] 2 | 192.168.33.60 ansible_host=192.168.33.60 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/apps.py: -------------------------------------------------------------------------------- 1 | from django.apps import AppConfig 2 | 3 | 4 | class ServiceConfig(AppConfig): 5 | name = 'service' 6 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/.yamllint: -------------------------------------------------------------------------------- 1 | --- 2 | extends: default 3 | rules: 4 | line-length: 5 | max: 200 6 | level: warning 7 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # These are supported funding model platforms 2 | --- 3 | github: geerlingguy 4 | patreon: geerlingguy 5 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/anchore-server/inventory: -------------------------------------------------------------------------------- 1 | [anchore] 2 | 192.168.33.60 ansible_host=192.168.33.60 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /app/docker/visitors-webui/public/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/app/docker/visitors-webui/public/favicon.ico -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/set-infrastructure-build/tests/test.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: localhost 3 | remote_user: root 4 | roles: 5 | - roles/set-infra-build -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-dependency-check/owasp-dependency-check/inventory: -------------------------------------------------------------------------------- 1 | [scanner] 2 | 192.168.1.10 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/anchore-cli-scan/inventory: -------------------------------------------------------------------------------- 1 | [anchore] 2 | 192.168.33.60 ansible_host=192.168.33.60 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/clair-scanner-setup/inventory: -------------------------------------------------------------------------------- 1 | [docker] 2 | 192.168.1.10 ansible_host=192.168.1.10 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/clair-scanning-images/inventory: -------------------------------------------------------------------------------- 1 | [docker] 2 | 192.168.1.10 ansible_host=192.168.1.10 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/osquery-setup/inventory: -------------------------------------------------------------------------------- 1 | [linuxservers] 2 | 192.168.33.60 ansible_host=192.168.33.60 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: restart docker 3 | service: "name=docker state={{ docker_restart_handler_state }}" 4 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Viper/viper-setup/inventory: -------------------------------------------------------------------------------- 1 | [viper] 2 | 192.168.33.22 ansible_host=192.168.33.22 ansible_user=ubuntu ansible_password=vagrant 3 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/logstash/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - include: install-logstash.yml 2 | - include: configure-logstash.yml 3 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # These are supported funding model platforms 2 | --- 3 | github: geerlingguy 4 | patreon: geerlingguy 5 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/molecule/default/yaml-lint.yml: -------------------------------------------------------------------------------- 1 | --- 2 | extends: default 3 | rules: 4 | line-length: 5 | max: 120 6 | level: warning 7 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/filebeat/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - include: install-filebeat.yml 2 | - include: configure-filebeat.yml -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/k8-saas-LB.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/infrastructure/k8s/aws-KOPS/pictures/k8-saas-LB.png -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/requirements.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # Install a role for pip 3 | - src: geerlingguy.pip 4 | 5 | # Install a role for docker 6 | - src: geerlingguy.docker 7 | -------------------------------------------------------------------------------- /app/docker/visitors-service/requirements.txt: -------------------------------------------------------------------------------- 1 | Django==2.2.2 2 | djangorestframework==3.9.4 3 | django-cors-headers==2.4.0 4 | mysqlclient==1.3.13 5 | pytz==2019.1 6 | sqlparse==0.3.0 7 | -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/k8s-user-group.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/infrastructure/k8s/aws-KOPS/pictures/k8s-user-group.png -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/metricbeat/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - include: install-metricbeat.yml 2 | - include: configure-metricbeat.yml -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/packetbeat/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - include: install-packetbeat.yml 2 | - include: configure-packetbeat.yml -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/elasticsearch/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - include: install-elasticsearch.yml 2 | - include: configure-elasticsearch.yml 3 | -------------------------------------------------------------------------------- /app/docker/visitors-db/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM mysql:5.7 2 | 3 | ENV MYSQL_DATABASE visitors_db 4 | ENV MYSQL_USER visitors 5 | ENV MYSQL_PASSWORD password 6 | ENV MYSQL_RANDOM_ROOT_PASSWORD yes 7 | -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/k8s-master-node.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/infrastructure/k8s/aws-KOPS/pictures/k8s-master-node.png -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/k8s-user-summary.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/infrastructure/k8s/aws-KOPS/pictures/k8s-user-summary.png -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/k8s-saas-IAM-roles.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/infrastructure/k8s/aws-KOPS/pictures/k8s-saas-IAM-roles.png -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/pictures/k8s-saas-sec-groups.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/infrastructure/k8s/aws-KOPS/pictures/k8s-saas-sec-groups.png -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Viper/viper-setup/roles/dependencies/templates/ssdeep.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | cd /tmp/ssdeep-2.14.1 4 | ./configure 5 | ./bootstrap 6 | make 7 | make install -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/.yamllint: -------------------------------------------------------------------------------- 1 | --- 2 | extends: default 3 | 4 | rules: 5 | line-length: 6 | max: 180 7 | level: warning 8 | 9 | ignore: | 10 | .github/stale.yml 11 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/nginx-reverse-proxy/handlers/main.yml: -------------------------------------------------------------------------------- 1 | - name: restart nginx 2 | service: 3 | name: nginx 4 | state: restarted 5 | -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/cleanup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | echo "debug: Executing scripts/cleanup.sh" 4 | 5 | dd if=/dev/zero of=/EMPTY bs=1M 6 | rm -f /EMPTY 7 | sync 8 | yum clean all 9 | rm -rf /var/cache/yum -------------------------------------------------------------------------------- /utils/0-jenkins-shared-library/vars/goCheck.groovy: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env groovy 2 | 3 | def call() { 4 | sh 'golint \${WORKSPACE}/fake-backend/config.go' 5 | sh 'golint \${WORKSPACE}/fake-backend/main.go' 6 | } 7 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: restart gitlab 3 | command: gitlab-ctl reconfigure 4 | register: gitlab_restart 5 | failed_when: gitlab_restart_handler_failed_when | bool 6 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/aws-serverless/templates/aws-credentials.j2: -------------------------------------------------------------------------------- 1 | [default] 2 | aws_access_key_id=YOUR_ACCESS_KEY_ID 3 | aws_secret_access_key=YOUR_SECRET_ACCESS_KEY -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-ec2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-ec2.png -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls/main.yml: -------------------------------------------------------------------------------- 1 | - name: setting up vuls using docker containers 2 | hosts: vuls 3 | become: yes 4 | 5 | roles: 6 | - vuls_containers_download 7 | - vuls_database_download -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-workspace.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-workspace.png -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls/group_vars/vuls.yml: -------------------------------------------------------------------------------- 1 | vuls_data_directory: "/vuls_data" 2 | nvd_database_years: 2017 3 | redhat_oval_versions: 4 | - 6 5 | - 7 6 | ubuntu_oval_versions: 7 | - 12 8 | - 14 9 | - 16 -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/hosts: -------------------------------------------------------------------------------- 1 | [all:vars] 2 | ansible_ssh_common_args='-o StrictHostKeyChecking=no -o userknownhostsfile=/dev/null' 3 | 4 | [local] 5 | 127.0.0.1 ansible_connection=local ansible_python_interpreter=/usr/bin/python 6 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-pipeline-full.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-pipeline-full.png -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/vars/Debian.yml: -------------------------------------------------------------------------------- 1 | --- 2 | gitlab_package_version_separator: '=' 3 | gitlab_repository_installation_script_url: "https://packages.gitlab.com/install/repositories/gitlab/{{ gitlab_edition }}/script.deb.sh" 4 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/vars/RedHat.yml: -------------------------------------------------------------------------------- 1 | --- 2 | gitlab_package_version_separator: '-' 3 | gitlab_repository_installation_script_url: "https://packages.gitlab.com/install/repositories/gitlab/{{ gitlab_edition }}/script.rpm.sh" 4 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/nessus-setup/site.yml: -------------------------------------------------------------------------------- 1 | - name: installing nessus server 2 | hosts: nessus 3 | remote_user: "{{ remote_user_name }}" 4 | gather_facts: no 5 | become: yes 6 | 7 | roles: 8 | - setup -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/setup/vars/main.yml: -------------------------------------------------------------------------------- 1 | nessus_user_token: "" 2 | nessus_user_name: "bbbbbbb" # Must required 3 | nessus_user_password: "ccccccc" # Must required 4 | nessus_url: "https://localhost:8834" -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-pipeline-steps-UI.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/9-jenkins-pipeline-python-end-to-end/pictures/DevSecOps-pipeline-steps-UI.png -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Viper/viper-setup/main.yml: -------------------------------------------------------------------------------- 1 | - name: Setting up Viper - binary management and analysis framework 2 | hosts: viper 3 | remote_user: ubuntu 4 | become: yes 5 | 6 | roles: 7 | - dependencies 8 | - setup -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/log-collection/inventory: -------------------------------------------------------------------------------- 1 | [servers] 2 | 192.168.100.10 ansible_host=192.168.100.10 ansible_user=ubuntu ansible_password=vagrant 3 | 192.168.100.20 ansible_host=192.168.100.20 ansible_user=ubuntu ansible_password=vagrant -------------------------------------------------------------------------------- /app/docker/visitors-webui/src/index.js: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import ReactDOM from 'react-dom'; 3 | import App from './App'; 4 | import './index.css'; 5 | 6 | ReactDOM.render( 7 | , 8 | document.getElementById('root') 9 | ); 10 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # For Python 3, use python3-pip. 3 | pip_package: python-pip 4 | pip_executable: "{{ 'pip3' if pip_package.startswith('python3') else 'pip' }}" 5 | 6 | pip_install_packages: [] 7 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/README.md: -------------------------------------------------------------------------------- 1 | # aws-security-benchmark 2 | Collection of resources related to security benchmark frameworks. 3 | Currently covered frameworks: 4 | - CIS Amazon Web Services Foundations Benchmark 1.1 5 | -------------------------------------------------------------------------------- /utils/0-jenkins-shared-library/vars/clean.groovy: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env groovy 2 | 3 | def call() { 4 | cleanWs(cleanWhenAborted: true, cleanWhenFailure: true, cleanWhenNotBuilt: true, cleanWhenSuccess: true, cleanWhenUnstable: true, deleteDirs: true) 5 | 6 | } 7 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/tasks/docker-users.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Ensure docker users are added to the docker group. 3 | user: 4 | name: "{{ item }}" 5 | groups: docker 6 | append: true 7 | with_items: "{{ docker_users }}" 8 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/nessus-setup/group_vars/nessus.yml: -------------------------------------------------------------------------------- 1 | remote_user_name: ubuntu 2 | nessus_download_url: "http://downloads.nessus.org/nessus3dl.php?file=Nessus-6.11.2-ubuntu1110_amd64.deb&licence_accept=yes&t=84ed6ee87f926f3d17a218b2e52b61f0" -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/architecture/cis-benchmark-matrix.xlsx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/architecture/cis-benchmark-matrix.xlsx -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/listpolices/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: list current policies using autoNessus 2 | command: "autoNessus -p" 3 | register: list_policies_output 4 | 5 | - debug: 6 | msg: "{{ list_policies_output.stdout_lines }}" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/listscans/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: list current scans and IDs using autoNessus 2 | command: "autoNessus -l" 3 | register: list_scans_output 4 | 5 | - debug: 6 | msg: "{{ list_scans_output.stdout_lines }}" -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-bandit/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM alpine 2 | 3 | MAINTAINER A.Davarski 4 | 5 | RUN mkdir -p /app 6 | WORKDIR /app 7 | 8 | RUN apk add --no-cache py2-pip python2 bash && pip install --no-cache-dir -U pip && pip install --no-cache-dir -U bandit 9 | -------------------------------------------------------------------------------- /app/docker/visitors-webui/src/App.test.js: -------------------------------------------------------------------------------- 1 | import React from 'react'; 2 | import ReactDOM from 'react-dom'; 3 | import App from './App'; 4 | 5 | it('renders without crashing', () => { 6 | const div = document.createElement('div'); 7 | ReactDOM.render(, div); 8 | }); 9 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/site.yml: -------------------------------------------------------------------------------- 1 | - name: setting up elastalert & automated defence in aws 2 | hosts: elastic-stack 3 | remote_user: ubuntu 4 | become: yes 5 | gather_facts: no 6 | 7 | roles: 8 | - setup 9 | - aws-serverless -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/kibana/handlers/main.yml: -------------------------------------------------------------------------------- 1 | - name: start kibana 2 | service: 3 | name: kibana 4 | state: started 5 | 6 | - name: restart kibana 7 | service: 8 | name: kibana 9 | state: restarted 10 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/filebeat/handlers/main.yml: -------------------------------------------------------------------------------- 1 | - name: start filebeat 2 | service: 3 | name: filebeat 4 | state: started 5 | 6 | - name: restart filebeat 7 | service: 8 | name: filebeat 9 | state: restarted -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/urls.py: -------------------------------------------------------------------------------- 1 | from django.contrib import admin 2 | from django.urls import path 3 | 4 | from visitors.service import views 5 | 6 | urlpatterns = [ 7 | path('admin/', admin.site.urls), 8 | path('visitors/', views.VisitorAPI.as_view()), 9 | ] 10 | -------------------------------------------------------------------------------- /infrastructure/aws/terraform/Jenkins-EC2/output.tf: -------------------------------------------------------------------------------- 1 | output "instance_ips" { 2 | value = [aws_instance.jenkins-tf.*.public_ip] 3 | } 4 | 5 | output "ip" { 6 | value = aws_instance.jenkins-tf.public_dns 7 | description = "The URL of the server instance." 8 | } 9 | 10 | 11 | -------------------------------------------------------------------------------- /utils/2-ansible-vagrant-infra/README.md: -------------------------------------------------------------------------------- 1 | ### ansible roles & playbooks for Vagrant environment 2 | - Deployment Infrastructure 3 | - Install Prerequiest 4 | - Set Environment Build 5 | - Scan and Push atrtifact 6 | - Deploy Application in preproduction 7 | - Deploy Application in production 8 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/pausescan/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: pausing nessus scan "{{ scan_id }}" using autoNessus 2 | command: "autoNessus -pS {{ scan_id }}" 3 | register: pause_scan_output 4 | 5 | - debug: 6 | msg: "{{ pause_scan_output.stdout_lines }}" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/stopscan/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: stopping nessus scan "{{ scan_id }}" using autoNessus 2 | command: "autoNessus -sP {{ scan_id }}" 3 | register: stop_scan_output 4 | 5 | - debug: 6 | msg: "{{ stop_scan_output.stdout_lines }}" -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls/roles/vuls_containers_download/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: pulling containers locally 2 | docker_image: 3 | name: "{{ item }}" 4 | pull: yes 5 | 6 | with_items: 7 | - vuls/go-cve-dictionary 8 | - vuls/goval-dictionary 9 | - vuls/vuls -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/architecture/assets/cis-benchmark-architecture.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/architecture/assets/cis-benchmark-architecture.jpg -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/logstash/handlers/main.yml: -------------------------------------------------------------------------------- 1 | - name: start logstash 2 | service: 3 | name: logstash 4 | state: started 5 | 6 | - name: restart logstash 7 | service: 8 | name: logstash 9 | state: restarted 10 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/resumescan/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: resume nessus scan "{{ scan_id }}" using autoNessus 2 | command: "autoNessus -sR {{ scan_id }}" 3 | register: resume_scan_output 4 | 5 | - debug: 6 | msg: "{{ resume_scan_output.stdout_lines }}" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/startscan/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: starting nessus scan "{{ scan_id }}" using autoNessus 2 | command: "autoNessus -sS {{ scan_id }}" 3 | register: start_scan_output 4 | 5 | - debug: 6 | msg: "{{ start_scan_output.stdout_lines }}" -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/metricbeat/handlers/main.yml: -------------------------------------------------------------------------------- 1 | - name: start metricbeat 2 | service: 3 | name: metricbeat 4 | state: started 5 | 6 | - name: restart metricbeat 7 | service: 8 | name: metricbeat 9 | state: restarted -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/packetbeat/handlers/main.yml: -------------------------------------------------------------------------------- 1 | - name: start packetbeat 2 | service: 3 | name: packetbeat 4 | state: started 5 | 6 | - name: restart packetbeat 7 | service: 8 | name: packetbeat 9 | state: restarted -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/jenkins-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | yum install java-1.8.0-openjdk-devel -y 3 | systemctl enable docker 4 | useradd -s /bin/bash -m -d /var/lib/jenkins jenkins 5 | usermod -a -G docker jenkins 6 | cat >> /etc/sudoers < 5044 4 | #ssl => true 5 | #ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" 6 | #ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" 7 | } 8 | } -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/setup/templates/elastalert-config.j2: -------------------------------------------------------------------------------- 1 | rules_folder: "/opt/elastalert/rules" 2 | run_every: 3 | seconds: 30 4 | buffer_time: 5 | minutes: 5 6 | es_host: localhost 7 | es_port: 9200 8 | writeback_index: elastalert_status 9 | alert_time_limit: 10 | days: 2 -------------------------------------------------------------------------------- /app/docker/visitors-webui/.gitignore: -------------------------------------------------------------------------------- 1 | # See https://help.github.com/ignore-files/ for more about ignoring files. 2 | 3 | # dependencies 4 | /node_modules 5 | 6 | # testing 7 | /coverage 8 | 9 | # production 10 | /build 11 | 12 | # misc 13 | .DS_Store 14 | .env 15 | npm-debug.log* 16 | yarn-debug.log* 17 | yarn-error.log* 18 | 19 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/site.yml: -------------------------------------------------------------------------------- 1 | - name: installing autonessus 2 | hosts: nessus 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | 7 | roles: 8 | - setup 9 | - listpolices 10 | - listscans 11 | - startscan 12 | - pausescan 13 | - resumescan 14 | - stopscan -------------------------------------------------------------------------------- /app/docker/visitors-service/startup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | for i in {1..10} 4 | do 5 | echo "Migrating Database..." 6 | python manage.py migrate 7 | 8 | if [ $? == "0" ]; then 9 | echo "Migration Complete" 10 | break 11 | fi 12 | 13 | sleep 3 14 | done 15 | 16 | python manage.py runserver 0.0.0.0:8000 17 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/s3-backup/templates/s3cmd.j2: -------------------------------------------------------------------------------- 1 | [default] 2 | access_key = {{ s3_access_key }} 3 | secret_key = {{ s3_access_secret }} 4 | host_base = s3.amazonaws.com 5 | host_bucket = %(bucket)s.s3.amazonaws.com 6 | website_endpoint = http://%(bucket)s.s3-website-%(location)s.amazonaws.com/ 7 | use_https = True 8 | signature_v2 = True -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/main.yml: -------------------------------------------------------------------------------- 1 | - name: setting up elastic beats on ubuntu 16.04 2 | hosts: monitor 3 | remote_user: ubuntu 4 | become: yes 5 | vars: 6 | logstash_server_ip: "192.168.56.102" 7 | 8 | roles: 9 | - filebeat 10 | - packetbeat 11 | - metricbeat 12 | -------------------------------------------------------------------------------- /app/README.md: -------------------------------------------------------------------------------- 1 | ### Application Overview (simple app example) 2 | 3 | • A web frontend, implemented in React 4 | 5 | • A REST API, implemented in Python using the Django framework 6 | 7 | • A database, using MySQL 8 | 9 | 10 | -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/serializers.py: -------------------------------------------------------------------------------- 1 | from rest_framework.serializers import ModelSerializer 2 | 3 | from visitors.service.models import Visitor 4 | 5 | 6 | class VisitorSerializer(ModelSerializer): 7 | 8 | class Meta: 9 | model = Visitor 10 | fields = ('id', 'client_ip', 'service_ip', 'timestamp') 11 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/molecule/default/converge.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Converge 3 | hosts: all 4 | become: true 5 | 6 | pre_tasks: 7 | - name: Update apt cache. 8 | apt: update_cache=yes cache_valid_time=600 9 | when: ansible_os_family == 'Debian' 10 | 11 | roles: 12 | - role: geerlingguy.docker 13 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/aws_cis_foundation_framework/CIS_Amazon_Web_Services_Foundations_Benchmark_v1.1.0.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/adavarski/DevSecOps-full-integration-chain/HEAD/utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/aws_cis_foundation_framework/CIS_Amazon_Web_Services_Foundations_Benchmark_v1.1.0.pdf -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/logstash/templates/30-elasticsearch-output.conf.j2: -------------------------------------------------------------------------------- 1 | output { 2 | elasticsearch { 3 | hosts => ["localhost:9200"] 4 | #sniffing => true 5 | manage_template => false 6 | index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" 7 | document_type => "%{[@metadata][type]}" 8 | } 9 | } -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/jenkins-ssh.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | mkdir -p /var/lib/jenkins/.ssh 4 | chmod 700 /var/lib/jenkins/.ssh 5 | touch /var/lib/jenkins/.ssh/authorized_keys 6 | chmod 600 /var/lib/jenkins/.ssh/authorized_keys 7 | 8 | cat >> /var/lib/jenkins/.ssh/authorized_keys <>/etc/environment 10 | LANG=en_US.utf-8 11 | LC_ALL=en_US.utf-8 12 | EOT 13 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/nessus-setup/roles/setup/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: install python 2 2 | raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) 3 | 4 | - name: downloading the package and installing 5 | apt: 6 | deb: "{{ nessus_download_url }}" 7 | 8 | - name: start the nessus daemon 9 | service: 10 | name: "nessusd" 11 | enabled: yes 12 | state: started -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/models.py: -------------------------------------------------------------------------------- 1 | from django.db import models 2 | 3 | 4 | class Visitor(models.Model): 5 | 6 | service_ip = models.CharField(max_length=16) 7 | client_ip = models.CharField(max_length=16) 8 | timestamp = models.DateTimeField(auto_now_add=True) 9 | 10 | def __str__(self): 11 | return 'Client IP [%s] Timestamp [%s]' % ( 12 | self.client_ip, self.timestamp) 13 | -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/vagrant.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | echo "debug: Executing scripts/vagrant.sh" 4 | 5 | # Install vagrant key 6 | mkdir /home/vagrant/.ssh 7 | chmod 700 /home/vagrant/.ssh 8 | wget --no-check-certificate 'https://raw.githubusercontent.com/mitchellh/vagrant/master/keys/vagrant.pub' -O /home/vagrant/.ssh/authorized_keys 9 | chmod 600 /home/vagrant/.ssh/authorized_keys 10 | chown -R vagrant /home/vagrant/.ssh -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-bandit/.travis.yml: -------------------------------------------------------------------------------- 1 | sudo: 'required' 2 | 3 | services: 4 | - 'docker' 5 | 6 | script: 7 | - docker build . -t bandit:$TRAVIS_COMMIT 8 | 9 | after_success: 10 | - if [[ "$TRAVIS_BRANCH" == "master" ]]; then 11 | docker login -u $DOCKER_HUB_USER -p $DOCKER_HUB_PASSWORD ; 12 | docker tag bandit:$TRAVIS_COMMIT davarski/bandit:latest ; 13 | docker push davarski/bandit:latest ; 14 | fi 15 | -------------------------------------------------------------------------------- /utils/0-jenkins-shared-library/vars/mailNotifier.groovy: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env groovy 2 | 3 | def call() { 4 | 5 | mail bcc: '', 6 | body: "${currentBuild.result}: Job ${env.JOB_NAME} build ${env.BUILD_NUMBER}\n More info at: ${env.BUILD_URL}", 7 | cc: '', 8 | from: 'Jenkins', 9 | replyTo: '', 10 | subject: "Jenkins Build ${currentBuild.result}: Job ${env.JOB_NAME}, on branch ${env.BRANCH_NAME}", 11 | to: 'davar@gmail.com' 12 | } 13 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/molecule/default/tests/test_default.py: -------------------------------------------------------------------------------- 1 | import os 2 | 3 | import testinfra.utils.ansible_runner 4 | 5 | testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( 6 | os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') 7 | 8 | 9 | def test_hosts_file(host): 10 | f = host.file('/etc/hosts') 11 | 12 | assert f.exists 13 | assert f.user == 'root' 14 | assert f.group == 'root' 15 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nmap/nmap-nse/main.yml: -------------------------------------------------------------------------------- 1 | - name: Advanced NMAP Scan using NSE 2 | hosts: localhost 3 | vars: 4 | ports: 5 | - 80 6 | - 443 7 | scan_host: scanme.nmap.org 8 | 9 | tasks: 10 | - name: Running Nmap NSE scan 11 | shell: "nmap -Pn -p {{ ports|join(',') }} --script {{ item }} -oA nmap-{{ item }}-results-%Y-%m-%d {{ scan_host }}" 12 | 13 | with_items: 14 | - http-methods 15 | - http-enum -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/Scout2/scout2-setup/main.yml: -------------------------------------------------------------------------------- 1 | - name: AWS Security Audit using Scout2 2 | hosts: localhost 3 | become: yes 4 | 5 | tasks: 6 | - name: installing python and pip 7 | apt: 8 | name: "{{ item }}" 9 | state: present 10 | update_cache: yes 11 | 12 | with_items: 13 | - python 14 | - python-pip 15 | 16 | - name: install aws scout2 17 | pip: 18 | name: awsscout2 -------------------------------------------------------------------------------- /app/docker/visitors-webui/package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "visitors-webui", 3 | "version": "0.1.0", 4 | "private": true, 5 | "dependencies": { 6 | "react": "^16.8.6", 7 | "react-dom": "^16.8.6", 8 | "react-scripts": "0.9.5" 9 | }, 10 | "devDependencies": {}, 11 | "scripts": { 12 | "start": "react-scripts start", 13 | "build": "react-scripts build", 14 | "test": "react-scripts test --env=jsdom", 15 | "eject": "react-scripts eject" 16 | } 17 | } -------------------------------------------------------------------------------- /app/docker/visitors-webui/src/App.css: -------------------------------------------------------------------------------- 1 | .App { 2 | text-align: center; 3 | } 4 | 5 | .App-logo { 6 | animation: App-logo-spin infinite 20s linear; 7 | height: 80px; 8 | } 9 | 10 | .App-header { 11 | background-color: #222; 12 | height: 150px; 13 | padding: 20px; 14 | color: white; 15 | } 16 | 17 | .App-intro { 18 | font-size: large; 19 | } 20 | 21 | @keyframes App-logo-spin { 22 | from { transform: rotate(0deg); } 23 | to { transform: rotate(360deg); } 24 | } 25 | -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/virtualbox.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash -x 2 | 3 | echo "debug: Executing scripts/virtualbox.sh" 4 | 5 | mount -o loop /home/vagrant/VBoxGuestAdditions.iso /mnt 6 | sh /mnt/VBoxLinuxAdditions.run 7 | rc=$? 8 | 9 | umount /mnt 10 | rm -rf /home/vagrant/VBoxGuestAdditions.iso 11 | 12 | if [ $rc -ne 0 ] 13 | then 14 | cat /var/log/VBoxGuestAdditions.log 15 | exit $rc 16 | else 17 | echo "Virtualbox guest addons have been installed successfully" 18 | exit 0 19 | fi -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/wsgi.py: -------------------------------------------------------------------------------- 1 | """ 2 | WSGI config for visitors project. 3 | 4 | It exposes the WSGI callable as a module-level variable named ``application``. 5 | 6 | For more information on this file, see 7 | https://docs.djangoproject.com/en/2.2/howto/deployment/wsgi/ 8 | """ 9 | 10 | import os 11 | 12 | from django.core.wsgi import get_wsgi_application 13 | 14 | os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'visitors.settings') 15 | 16 | application = get_wsgi_application() 17 | -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-clair-scanner/.travis.yml: -------------------------------------------------------------------------------- 1 | sudo: 'required' 2 | 3 | services: 4 | - 'docker' 5 | 6 | script: 7 | - docker build . -t docker-clair-scanner:$TRAVIS_COMMIT 8 | 9 | after_success: 10 | - if [[ "$TRAVIS_BRANCH" == "master" ]]; then 11 | docker login -u $DOCKER_HUB_USER -p $DOCKER_HUB_PASSWORD ; 12 | docker tag docker-clair-scanner:$TRAVIS_COMMIT davarski/docker-clair-scanner:latest ; 13 | docker push davarski/docker-clair-scanner:latest ; 14 | fi 15 | -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/jenkins-master-ssh.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | mkdir -p /var/lib/jenkins/.ssh 4 | chmod 700 /var/lib/jenkins/.ssh 5 | touch /var/lib/jenkins/.ssh/authorized_keys 6 | chmod 600 /var/lib/jenkins/.ssh/authorized_keys 7 | cat >> /var/lib/jenkins/.ssh/id_rsa <> /var/lib/jenkins/.ssh/id_rsa.pub <> /var/lib/jenkins/.ssh/authorized_keys <> /etc/sudoers < 13 | """ 14 | # check for 302 or 301 response code 15 | Then the output should match /30\d+/ 16 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/tasks/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Ensure Pip is installed. 3 | package: 4 | name: "{{ pip_package }}" 5 | state: present 6 | 7 | - name: Ensure pip_install_packages are installed. 8 | pip: 9 | name: "{{ item.name | default(item) }}" 10 | version: "{{ item.version | default(omit) }}" 11 | virtualenv: "{{ item.virtualenv | default(omit) }}" 12 | state: "{{ item.state | default(omit) }}" 13 | executable: "{{ pip_executable }}" 14 | with_items: "{{ pip_install_packages }}" 15 | -------------------------------------------------------------------------------- /app/docker/visitors-service/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM python:3 2 | 3 | EXPOSE 8000 4 | 5 | ENV HOME=/code 6 | RUN mkdir -p ${HOME} && \ 7 | useradd -u 1001 -r -g 0 -d ${HOME} -s /sbin/nologin \ 8 | -c "Visitors Application User" default 9 | WORKDIR ${HOME} 10 | 11 | ADD visitors ${HOME}/visitors 12 | ADD requirements.txt manage.py startup.sh ${HOME}/ 13 | 14 | RUN pip install -r requirements.txt 15 | 16 | RUN chown -R 1001:0 ${HOME} && \ 17 | find ${HOME} -type d -exec chmod g+ws {} \; 18 | 19 | USER 1001 20 | CMD ["bash", "startup.sh"] 21 | -------------------------------------------------------------------------------- /infrastructure/aws/terraform/Jenkins-EC2/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | description = "AWS region to host your infrastructure" 3 | default = "us-east-2" 4 | } 5 | 6 | variable "key_name" { 7 | description = "Private key name to use with instance" 8 | default = "demo" 9 | } 10 | 11 | variable "instance_type" { 12 | description = "AWS instance type" 13 | default = "t2.micro" 14 | } 15 | 16 | variable "ami" { 17 | description = "AWS AMI latest" 18 | 19 | # Ubuntu 20.04 20 | default = "ami-0a91cd140a1fc148a" 21 | } 22 | 23 | -------------------------------------------------------------------------------- /app/docker/visitors-webui/src/App.js: -------------------------------------------------------------------------------- 1 | import React, { Component } from 'react'; 2 | 3 | import VisitorsTable from './VisitorsTable.js'; 4 | 5 | class App extends Component { 6 | render() { 7 | 8 | let title = process.env.REACT_APP_TITLE || 'Visitors Dashboard' 9 | 10 | return ( 11 |
12 |
13 |

{title}

14 |
15 |
16 | 17 |
18 |
19 | ); 20 | } 21 | } 22 | 23 | export default App; 24 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/molecule/default/playbook.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Converge 3 | hosts: all 4 | become: true 5 | 6 | vars: 7 | pip_install_packages: 8 | # Test installing a specific version of a package. 9 | - name: ipaddress 10 | version: "1.0.18" 11 | # Test installing a package by name. 12 | - colorama 13 | 14 | pre_tasks: 15 | - name: Update apt cache. 16 | apt: update_cache=true cache_valid_time=600 17 | when: ansible_os_family == 'Debian' 18 | 19 | roles: 20 | - role: geerlingguy.pip 21 | -------------------------------------------------------------------------------- /infrastructure/k8s/minikube/setup-environment.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Install minikube and kubectl the same k8s minor version : v1.16.2 4 | curl -Lo minikube https://github.com/kubernetes/minikube/releases/download/v1.5.2/minikube-linux-amd64 && chmod +x minikube && sudo mv ./minikube /usr/local/bin/ 5 | curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.16.2/bin/linux/amd64/kubectl && chmod +x ./kubectl && sudo mv ./kubectl /usr/local/bin/ 6 | 7 | # Run minikube and wait 8 | minikube start --cpus 2 --memory 4096 9 | minikube addons enable ingress 10 | sleep 300 11 | 12 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/attack/cookies.attack.j2: -------------------------------------------------------------------------------- 1 | @slow 2 | Feature: Evaluate received cookies against expected. 3 | 4 | Background: 5 | Given "curl" is installed 6 | And the following profile: 7 | | name | value | 8 | | hostname | http://{{ public_ip_preprod }}:3000 | 9 | 10 | Scenario: Verify server is returning the cookies expected 11 | When I launch a "curl" attack with: 12 | """ 13 | curl --include --location --head --silent 14 | """ 15 | Then the following cookies should be received: 16 | | name | httponly | 17 | | NID | true | 18 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/molecule/default/converge.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Converge 3 | hosts: all 4 | become: true 5 | 6 | vars: 7 | gitlab_restart_handler_failed_when: false 8 | 9 | pre_tasks: 10 | - name: Update apt cache. 11 | apt: update_cache=true cache_valid_time=600 12 | when: ansible_os_family == 'Debian' 13 | changed_when: false 14 | 15 | - name: Remove the .dockerenv file so GitLab Omnibus doesn't get confused. 16 | file: 17 | path: /.dockerenv 18 | state: absent 19 | 20 | roles: 21 | - role: geerlingguy.gitlab 22 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Viper/viper-setup/roles/setup/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: downloading the release 2 | unarchive: 3 | src: https://github.com/viper-framework/viper/archive/v1.2.tar.gz 4 | dest: /opt/ 5 | remote_src: yes 6 | 7 | - name: installing pip dependencies 8 | pip: 9 | requirements: /opt/viper-1.2/requirements.txt 10 | 11 | - name: starting viper webinterface 12 | shell: nohup /usr/bin/python /opt/viper-1.2/web.py -H 0.0.0.0 & 13 | ignore_errors: yes 14 | 15 | - debug: 16 | msg: "Viper web interface is running at http://{{ inventory_hostname }}:9090" -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/nginx-reverse-proxy/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: htpasswd generation 2 | #command: htpasswd -c /etc/nginx/htpasswd.users 3 | htpasswd: 4 | path: "/etc/nginx/htpasswd.users" 5 | name: "{{ basic_auth_username }}" 6 | password: "{{ basic_auth_password }}" 7 | owner: root 8 | group: root 9 | mode: 0644 10 | 11 | - name: nginx virtualhost configuration 12 | template: 13 | src: "templates/nginxdefault.j2" 14 | dest: "/etc/nginx/sites-available/default" 15 | 16 | notify: 17 | - restart nginx 18 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/molecule/default/molecule.yml: -------------------------------------------------------------------------------- 1 | --- 2 | dependency: 3 | name: galaxy 4 | driver: 5 | name: docker 6 | lint: | 7 | set -e 8 | yamllint . 9 | ansible-lint 10 | platforms: 11 | - name: instance 12 | image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest" 13 | command: ${MOLECULE_DOCKER_COMMAND:-""} 14 | volumes: 15 | - /sys/fs/cgroup:/sys/fs/cgroup:ro 16 | privileged: true 17 | pre_build_image: true 18 | provisioner: 19 | name: ansible 20 | playbooks: 21 | converge: ${MOLECULE_PLAYBOOK:-converge.yml} 22 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/aws-serverless/templates/serverless.yml.j2: -------------------------------------------------------------------------------- 1 | service: automated-defence 2 | 3 | stage: dev 4 | region: us-east-1 5 | 6 | provider: 7 | name: aws 8 | runtime: nodejs6.10 9 | iamRoleStatements: 10 | $ref: ./iamRoleStatements.json 11 | 12 | functions: 13 | blacklist: 14 | handler: handler.blacklistip 15 | events: 16 | - http: 17 | path: blacklistip 18 | method: get 19 | 20 | handleexpiry: 21 | handler: handler.handleexpiry 22 | events: 23 | - schedule: rate(1 minute) 24 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/nginx-reverse-proxy/templates/nginxdefault.j2: -------------------------------------------------------------------------------- 1 | server { 2 | listen 80; 3 | 4 | server_name localhost; 5 | 6 | auth_basic "Restricted Access"; 7 | auth_basic_user_file /etc/nginx/htpasswd.users; 8 | 9 | location / { 10 | proxy_pass http://localhost:5601; 11 | proxy_http_version 1.1; 12 | proxy_set_header Upgrade $http_upgrade; 13 | proxy_set_header Connection 'upgrade'; 14 | proxy_set_header Host $host; 15 | proxy_cache_bypass $http_upgrade; 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/DVSW/dvsw-playbook/site.yml: -------------------------------------------------------------------------------- 1 | - name: setting up DVWS container 2 | hosts: dvsw 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | vars: 7 | dvws_image_name: cyrivs89/web-dvws 8 | 9 | tasks: 10 | - name: pulling {{ dvws_image_name }} container 11 | docker_image: 12 | name: "{{ dvws_image_name }}" 13 | 14 | - name: running dvws container 15 | docker_container: 16 | name: dvws 17 | image: "{{ dvws_image_name }}" 18 | interactive: yes 19 | state: started 20 | ports: 21 | - "80:80" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nmap/nmap-basic-scan/main.yml: -------------------------------------------------------------------------------- 1 | - name: Basic NMAP Scan Playbook 2 | hosts: localhost 3 | gather_facts: false 4 | vars: 5 | top_ports: 1000 6 | network_hosts: 7 | - 192.168.1.1 8 | - scanme.nmap.org 9 | - 127.0.0.1 10 | 11 | tasks: 12 | - name: check if nmap installed and install 13 | apt: 14 | name: nmap 15 | update_cache: yes 16 | state: present 17 | become: yes 18 | 19 | - name: top ports scan 20 | shell: "nmap --top-ports {{ top_ports }} -Pn -oA nmap-scan-%Y-%m-%d {{ network_hosts|join(' ') }}" -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/logstash/tasks/configure-logstash.yml: -------------------------------------------------------------------------------- 1 | - name: logstash configuration files 2 | template: 3 | src: "{{ item.src }}" 4 | dest: /etc/logstash/conf.d/"{{ item.dst }}" 5 | 6 | with_items: 7 | - { src: '02-beats-input.conf.j2', dst: '02-beats-input.conf' } 8 | - { src: '10-sshlog-filter.conf.j2', dst: '10-sshlog-filter.conf' } 9 | - { src: '11-weblog-filter.conf.j2', dst: '11-weblog-filter.conf' } 10 | - { src: '30-elasticsearch-output.conf.j2', dst: '10-elasticsearch-output.conf' } 11 | 12 | notify: 13 | - restart logstash 14 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/attack/xss.attack.j2: -------------------------------------------------------------------------------- 1 | @slow 2 | Feature: Look for cross site scripting (xss) using arachni against scanme.nmap.org 3 | 4 | Scenario: Using arachni, look for cross site scripting and verify no issues are found 5 | Given "arachni" is installed 6 | And the following profile: 7 | | name | value | 8 | | url | http://{{ public_ip_preprod }}:3000 | 9 | When I launch an "arachni" attack with: 10 | """ 11 | arachni --checks=xss --scope-directory-depth-limit=1 12 | """ 13 | Then the output should contain "0 issues were detected." 14 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/aws-serverless/templates/config.js.j2: -------------------------------------------------------------------------------- 1 | module.exports = { 2 | region: "us-east-1", // AWS Region to deploy in 3 | accessToken: "YOUR_R4NDOM_S3CR3T_ACCESS_TOKEN_GOES_HERE", // Accesstoken to make requests to blacklist 4 | aclLimit: 20, // Maximum number of acl rules 5 | ruleStartId: 10, // Starting id for acl entries 6 | aclId: "YOUR_ACL_ID", // AclId that you want to be managed 7 | tableName: "blacklist_ip", // DynamoDB table that will be created 8 | ruleValidity: 5 // Validity of Blacklist rule in minutes 9 | } -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/attack/xss.attack.j2.back: -------------------------------------------------------------------------------- 1 | @slow 2 | Feature: Look for cross site scripting (xss) using arachni against scanme.nmap.org 3 | 4 | Scenario: Using arachni, look for cross site scripting and verify no issues are found 5 | Given "arachni" is installed 6 | And the following profile: 7 | | name | value | 8 | | url | http://{{ public_ip_preprod }}:3000 | 9 | When I launch an "arachni" attack with: 10 | """ 11 | arachni --checks=xss --scope-directory-depth-limit=1 12 | """ 13 | Then the output should contain "1 issues were detected." 14 | -------------------------------------------------------------------------------- /infrastructure/README.md: -------------------------------------------------------------------------------- 1 | ### Ansible roles & playbooks for infrastructure: 2 | 3 | - [ansible roles & playbooks](https://github.com/adavarski/DevSecOps-full-integration-chain/tree/main/utils/1-ansible-aws-infra) for AWS environment 4 | - [ansible roles & playbooks](https://github.com/adavarski/DevSecOps-full-integration-chain/tree/main/utils/2-ansible-vagrant-infra) for Vagrant environment 5 | - [k8s development (minikube)](https://github.com/adavarski/DevSecOps-full-integration-chain/tree/main/infrastructure/k8s/minikube) 6 | - [k8s production (AWS:KOPS)](https://github.com/adavarski/DevSecOps-full-integration-chain/tree/main/infrastructure/k8s/aws-KOPS) 7 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/Scout2/scout2-scan/main.yml: -------------------------------------------------------------------------------- 1 | - name: AWS Security Audit using Scout2 2 | hosts: localhost 3 | vars: 4 | aws_access_key: XXXXXXXX 5 | aws_secret_key: XXXXXXXX 6 | 7 | tasks: 8 | - name: running scout2 scan 9 | # If you are performing from less memory system add --thread-config 1 to below command 10 | command: "Scout2" 11 | environment: 12 | AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" 13 | AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" 14 | 15 | - name: AWS Scout2 report downloaded 16 | debug: 17 | msg: "Report can be found at ./scout2-report/report.html" -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/meta/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | dependencies: [] 3 | 4 | galaxy_info: 5 | role_name: gitlab 6 | author: geerlingguy 7 | description: GitLab Git web interface 8 | company: "Midwestern Mac, LLC" 9 | license: "license (BSD, MIT)" 10 | min_ansible_version: 2.0 11 | platforms: 12 | - name: EL 13 | versions: 14 | - 7 15 | - 8 16 | - name: Debian 17 | versions: 18 | - all 19 | - name: Ubuntu 20 | versions: 21 | - all 22 | galaxy_tags: 23 | - development 24 | - web 25 | - gitlab 26 | - git 27 | - repository 28 | - ci 29 | - integration 30 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/aws-serverless/templates/iamRoleStatements.json.j2: -------------------------------------------------------------------------------- 1 | [ 2 | { 3 | "Action": "ec2:*", 4 | "Effect": "Allow", 5 | "Resource": "*" 6 | }, 7 | { 8 | "Effect": "Allow", 9 | "Action": "elasticloadbalancing:*", 10 | "Resource": "*" 11 | }, 12 | { 13 | "Effect": "Allow", 14 | "Action": "cloudwatch:*", 15 | "Resource": "*" 16 | }, 17 | { 18 | "Effect": "Allow", 19 | "Action": "autoscaling:*", 20 | "Resource": "*" 21 | }, 22 | { 23 | "Effect": "Allow", 24 | "Action": "dynamodb:*", 25 | "Resource": "*" 26 | } 27 | ] 28 | -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-clair-scanner/Dockerfile.GO-install.sh: -------------------------------------------------------------------------------- 1 | FROM alpine 2 | 3 | RUN apk update && apk add go git curl make musl-dev && rm -rf /var/cache/apk/* 4 | 5 | ENV GOROOT /usr/lib/go 6 | ENV GOPATH /gopath 7 | ENV GOBIN /usr/bin 8 | 9 | RUN git clone https://github.com/arminc/clair-scanner.git /gopath/src/clair 10 | 11 | WORKDIR /gopath/src/clair 12 | 13 | RUN curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh && \ 14 | make build 15 | 16 | 17 | FROM alpine 18 | 19 | COPY --from=0 /gopath/src/clair/clair-scanner /usr/local/bin/clair 20 | 21 | EXPOSE 9279 22 | 23 | ENTRYPOINT ["clair"] 24 | 25 | CMD [] 26 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins_home/configureWAF.yml: -------------------------------------------------------------------------------- 1 | # Configure launched instance for WAF 2 | - name: Configure instance(s) 3 | hosts: tstlaunched 4 | become: True 5 | remote_user: ubuntu 6 | gather_facts: True 7 | tasks: 8 | - name: Run the WAF on docker 9 | docker_container: 10 | name: modsecurity_waf 11 | image: owasp/modsecurity-crs 12 | state: started 13 | restart_policy: always 14 | ports: 15 | - "80:80" 16 | env: 17 | PARANOIA: "2" 18 | PROXY: "1" 19 | PROXYLOCATION: "http://{{ ansible_default_ipv4.address }}:10007/" 20 | -------------------------------------------------------------------------------- /infrastructure/vagrant/Vagrantfile.DevSecOps-example2: -------------------------------------------------------------------------------- 1 | # -*- mode: ruby -*- 2 | # vi: set ft=ruby : 3 | 4 | Vagrant.configure(2) do |config| 5 | 6 | config.vm.box = "jenkins-slave" 7 | config.vm.network "public_network", ip: "10.50.1.35" , bridge: "ens3f0" 8 | config.vm.network "public_network", ip: "10.50.1.36" , bridge: "ens3f0" 9 | config.vm.network "public_network", ip: "10.50.1.37" , bridge: "ens3f0" 10 | config.vm.network "public_network", ip: "10.50.1.38" , bridge: "ens3f0" 11 | 12 | config.vm.provider "virtualbox" do |vb| 13 | # vb.gui = true 14 | vb.memory = "8192" 15 | vb.cpus = 4 16 | vb.name = "jenkins-slave-1" 17 | end 18 | 19 | end 20 | 21 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/logstash/templates/11-weblog-filter.conf.j2: -------------------------------------------------------------------------------- 1 | filter { 2 | if [type] == "weblog" { 3 | grok { 4 | match => { 5 | "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}' 6 | } 7 | } 8 | 9 | date { 10 | match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ] 11 | locale => en 12 | } 13 | 14 | geoip { 15 | source => "clientip" 16 | } 17 | 18 | useragent { 19 | source => "agent" 20 | target => "useragent" 21 | } 22 | } 23 | } -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/clair-scanner-setup/main.yaml: -------------------------------------------------------------------------------- 1 | - name: Clair Scanner Server Setup 2 | hosts: docker 3 | remote_user: ubuntu 4 | become: yes 5 | 6 | tasks: 7 | - name: setting up clair-db 8 | docker_container: 9 | name: clair_db 10 | image: arminc/clair-db 11 | exposed_ports: 12 | - 5432 13 | 14 | - name: setting up clair-local-scan 15 | docker_container: 16 | name: clair 17 | image: arminc/clair-local-scan:v2.0.1 18 | ports: 19 | - "6060:6060" 20 | links: 21 | - "clair_db:postgres" 22 | 23 | - debug: 24 | msg: "It will take some time to update the CVE databasae" -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | language: python 3 | python: "2.7" 4 | 5 | # Use the new container infrastructure 6 | sudo: false 7 | 8 | # Install ansible 9 | addons: 10 | apt: 11 | packages: 12 | - python-pip 13 | 14 | install: 15 | # Install ansible 16 | - pip install ansible 17 | 18 | # Check ansible version 19 | - ansible --version 20 | 21 | # Create ansible.cfg with correct roles_path 22 | - printf '[defaults]\nroles_path=../' >ansible.cfg 23 | 24 | script: 25 | # Basic role syntax check 26 | - ansible-playbook tests/test.yml -i tests/inventory --syntax-check 27 | 28 | notifications: 29 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | language: python 3 | python: "2.7" 4 | 5 | # Use the new container infrastructure 6 | sudo: false 7 | 8 | # Install ansible 9 | addons: 10 | apt: 11 | packages: 12 | - python-pip 13 | 14 | install: 15 | # Install ansible 16 | - pip install ansible 17 | 18 | # Check ansible version 19 | - ansible --version 20 | 21 | # Create ansible.cfg with correct roles_path 22 | - printf '[defaults]\nroles_path=../' >ansible.cfg 23 | 24 | script: 25 | # Basic role syntax check 26 | - ansible-playbook tests/test.yml -i tests/inventory --syntax-check 27 | 28 | notifications: 29 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | language: python 3 | python: "2.7" 4 | 5 | # Use the new container infrastructure 6 | sudo: false 7 | 8 | # Install ansible 9 | addons: 10 | apt: 11 | packages: 12 | - python-pip 13 | 14 | install: 15 | # Install ansible 16 | - pip install ansible 17 | 18 | # Check ansible version 19 | - ansible --version 20 | 21 | # Create ansible.cfg with correct roles_path 22 | - printf '[defaults]\nroles_path=../' >ansible.cfg 23 | 24 | script: 25 | # Basic role syntax check 26 | - ansible-playbook tests/test.yml -i tests/inventory --syntax-check 27 | 28 | notifications: 29 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/elasticsearch/tasks/configure-elasticsearch.yml: -------------------------------------------------------------------------------- 1 | - name: creating elasticsearch backup repo directory at {{ elasticsearch_backups_repo_path }} 2 | file: 3 | path: "{{ elasticsearch_backups_repo_path }}" 4 | state: directory 5 | mode: 0755 6 | owner: elasticsearch 7 | group: elasticsearch 8 | 9 | - name: configuring elasticsearch.yml file 10 | template: 11 | src: "{{ item.src }}" 12 | dest: /etc/elasticsearch/"{{ item.dst }}" 13 | 14 | with_items: 15 | - { src: 'elasticsearch.yml.j2', dst: 'elasticsearch.yml' } 16 | - { src: 'jvm.options.j2', dst: 'jvm.options' } 17 | 18 | notify: 19 | - restart elasticsearch 20 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/kibana/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: adding elastic gpg key for kibana 2 | apt_key: 3 | url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch" 4 | state: present 5 | 6 | - name: adding the elastic repository 7 | apt_repository: 8 | repo: "deb https://artifacts.elastic.co/packages/5.x/apt stable main" 9 | state: present 10 | 11 | - name: installing kibana 12 | apt: 13 | name: "{{ item }}" 14 | state: present 15 | update_cache: yes 16 | 17 | with_items: 18 | - kibana 19 | 20 | - name: adding kibana to the startup programs 21 | service: 22 | name: kibana 23 | enabled: yes 24 | 25 | notify: 26 | - start kibana 27 | -------------------------------------------------------------------------------- /app/docker/visitors-service/manage.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | """Django's command-line utility for administrative tasks.""" 3 | import os 4 | import sys 5 | 6 | 7 | def main(): 8 | os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'visitors.settings') 9 | try: 10 | from django.core.management import execute_from_command_line 11 | except ImportError as exc: 12 | raise ImportError( 13 | "Couldn't import Django. Are you sure it's installed and " 14 | "available on your PYTHONPATH environment variable? Did you " 15 | "forget to activate a virtual environment?" 16 | ) from exc 17 | execute_from_command_line(sys.argv) 18 | 19 | 20 | if __name__ == '__main__': 21 | main() 22 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/meta/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | dependencies: [] 3 | 4 | galaxy_info: 5 | author: geerlingguy 6 | description: Docker for Linux. 7 | company: "Midwestern Mac, LLC" 8 | license: "license (BSD, MIT)" 9 | min_ansible_version: 2.4 10 | platforms: 11 | - name: EL 12 | versions: 13 | - 7 14 | - 8 15 | - name: Fedora 16 | versions: 17 | - all 18 | - name: Debian 19 | versions: 20 | - stretch 21 | - buster 22 | - name: Ubuntu 23 | versions: 24 | - xenial 25 | - bionic 26 | galaxy_tags: 27 | - web 28 | - system 29 | - containers 30 | - docker 31 | - orchestration 32 | - compose 33 | - server 34 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/beats-for-elastic-stack/roles/filebeat/templates/filebeat.yml.j2: -------------------------------------------------------------------------------- 1 | filebeat: 2 | prospectors: 3 | - 4 | paths: 5 | - /var/log/auth.log 6 | # - /var/log/syslog 7 | # - /var/log/*.log 8 | 9 | document_type: sshlog 10 | 11 | - 12 | paths: 13 | - /var/log/nginx/access.log 14 | 15 | document_type: weblog 16 | 17 | registry_file: /var/lib/filebeat/registry 18 | 19 | output: 20 | logstash: 21 | hosts: ["{{ logstash_server_ip }}:5044"] 22 | bulk_max_size: 1024 23 | 24 | #ssl: 25 | # certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] 26 | 27 | logging: 28 | files: 29 | rotateeverybytes: 10485760 # = 10MB -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins_home/strategy.ini: -------------------------------------------------------------------------------- 1 | # Authorized and unauthorized licenses in LOWER CASE 2 | [Licenses] 3 | authorized_licenses: 4 | bsd 5 | new bsd 6 | bsd license 7 | new bsd license 8 | simplified bsd 9 | apache 10 | apache 2.0 11 | apache software license 12 | gnu lgpl 13 | lgpl with exceptions or zpl 14 | isc license 15 | isc license (iscl) 16 | mit 17 | mit license 18 | python software foundation license 19 | zpl 2.1 20 | 21 | unauthorized_licenses: 22 | gpl v3 23 | 24 | [Authorized Packages] 25 | # Python software license (see http://zesty.ca/python/uuid.README.txt) 26 | uuid: 1.30 27 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | language: python 3 | services: docker 4 | 5 | env: 6 | global: 7 | - ROLE_NAME: pip 8 | matrix: 9 | - MOLECULE_DISTRO: centos7 10 | - MOLECULE_DISTRO: fedora29 11 | - MOLECULE_DISTRO: ubuntu1804 12 | - MOLECULE_DISTRO: debian9 13 | 14 | install: 15 | # Install test dependencies. 16 | - pip install molecule docker 17 | 18 | before_script: 19 | # Use actual Ansible Galaxy role name for the project directory. 20 | - cd ../ 21 | - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME 22 | - cd geerlingguy.$ROLE_NAME 23 | 24 | script: 25 | # Run tests. 26 | - molecule test 27 | 28 | notifications: 29 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ 30 | -------------------------------------------------------------------------------- /infrastructure/vagrant/scripts/docker-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | yum install -y yum-utils device-mapper-persistent-data lvm2 git 3 | yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo 4 | yum install -y docker-ce docker-ce-cli containerd.io 5 | systemctl start docker 6 | curl -L "https://github.com/docker/compose/releases/download/1.23.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose 7 | chmod +x /usr/local/bin/docker-compose 8 | ln -sf /usr/local/bin/docker-compose /usr/bin/docker-compose 9 | cat > /etc/docker/daemon.json < 14 | """ 15 | Then the output should contain "" 16 | Examples: 17 | | method | response | 18 | | delete | 405 Method Not Allowed | 19 | | patch | 405 Method Not Allowed | 20 | | trace | 405 Method Not Allowed| 21 | | track | 405 Method Not Allowed | 22 | | bogus | HTTP/1.0 405 METHOD NOT ALLOWED | 23 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/tasks/docker-compose.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Check current docker-compose version. 3 | command: docker-compose --version 4 | register: docker_compose_current_version 5 | changed_when: false 6 | failed_when: false 7 | 8 | - name: Delete existing docker-compose version if it's different. 9 | file: 10 | path: "{{ docker_compose_path }}" 11 | state: absent 12 | when: > 13 | docker_compose_current_version.stdout is defined 14 | and docker_compose_version not in docker_compose_current_version.stdout 15 | 16 | - name: Install Docker Compose (if configured). 17 | get_url: 18 | url: https://github.com/docker/compose/releases/download/{{ docker_compose_version }}/docker-compose-Linux-x86_64 19 | dest: "{{ docker_compose_path }}" 20 | mode: 0755 21 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-setup-playbook/site.yml: -------------------------------------------------------------------------------- 1 | - name: setting up owasp zap container 2 | hosts: zap 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | vars: 7 | owasp_zap_image_name: owasp/zap2docker-weekly 8 | 9 | tasks: 10 | - name: pulling {{ owasp_zap_image_name }} container 11 | docker_image: 12 | name: "{{ owasp_zap_image_name }}" 13 | 14 | - name: running owasp zap container 15 | docker_container: 16 | name: owasp-zap 17 | image: "{{ owasp_zap_image_name }}" 18 | interactive: yes 19 | state: started 20 | user: zap 21 | command: zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true 22 | ports: 23 | - "8080:8080" 24 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | language: python 3 | services: docker 4 | 5 | env: 6 | global: 7 | - ROLE_NAME: docker 8 | matrix: 9 | - MOLECULE_DISTRO: centos8 10 | - MOLECULE_DISTRO: centos7 11 | - MOLECULE_DISTRO: ubuntu1804 12 | - MOLECULE_DISTRO: ubuntu1604 13 | - MOLECULE_DISTRO: debian10 14 | - MOLECULE_DISTRO: debian9 15 | 16 | install: 17 | # Install test dependencies. 18 | - pip install molecule yamllint ansible-lint docker 19 | 20 | before_script: 21 | # Use actual Ansible Galaxy role name for the project directory. 22 | - cd ../ 23 | - mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME 24 | - cd geerlingguy.$ROLE_NAME 25 | 26 | script: 27 | # Run tests. 28 | - molecule test 29 | 30 | notifications: 31 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ 32 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/tasks/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - include_tasks: setup-RedHat.yml 3 | when: ansible_os_family == 'RedHat' 4 | 5 | - include_tasks: setup-Debian.yml 6 | when: ansible_os_family == 'Debian' 7 | 8 | - name: Install Docker. 9 | package: 10 | name: "{{ docker_package }}" 11 | state: "{{ docker_package_state }}" 12 | notify: restart docker 13 | 14 | - name: Ensure Docker is started and enabled at boot. 15 | service: 16 | name: docker 17 | state: "{{ docker_service_state }}" 18 | enabled: "{{ docker_service_enabled }}" 19 | 20 | - name: Ensure handlers are notified now to avoid firewall conflicts. 21 | meta: flush_handlers 22 | 23 | - include_tasks: docker-compose.yml 24 | when: docker_install_compose | bool 25 | 26 | - include_tasks: docker-users.yml 27 | when: docker_users | length > 0 28 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/group_vars/elastic-stack.yml: -------------------------------------------------------------------------------- 1 | #---------- ANSIBLE PLAYBOOK CONFIGURATION ------- 2 | 3 | remote_user_login_name: "ubuntu" 4 | 5 | 6 | #---------- NGINX REVERSE PROXY CONFIGURATION ---- 7 | 8 | basic_auth_username: "elkadmin" 9 | basic_auth_password: "elkadmin" 10 | 11 | 12 | #---------- ELASTICSEARCH CONFIGURATION ---------- 13 | 14 | elasticsearch_cluster_name: "elastic-stack" 15 | elasticsearch_node_name: "node1" 16 | elasticsearch_network_host_address: "127.0.0.1" 17 | elasticsearch_backups_repo_path: "/var/backups/elasticsearch" 18 | 19 | 20 | elasticsearch_jvm_heap_Xms: "Xms1g" 21 | elasticsearch_jvm_heap_Xmx: "Xmx1g" 22 | 23 | #---------- LOGSTASH CONFIGURATION --------------- 24 | logstash_server_domain_name: "example.com" 25 | 26 | 27 | #---------- KIBANA CONFIGURATION ----------------- 28 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/setup/templates/elastalert-sshrule.j2: -------------------------------------------------------------------------------- 1 | es_host: localhost 2 | es_port: 9200 3 | name: "SSH Bruteforce attack alert" 4 | type: frequency 5 | index: filebeat-* 6 | num_events: 20 7 | timeframe: 8 | minutes: 1 9 | 10 | # For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html 11 | 12 | filter: 13 | - query: 14 | query_string: 15 | query: '_type:sshlog AND login:failed AND (username: "ubuntu" OR username: "root")' 16 | 17 | alert: 18 | - slack: 19 | slack_webhook_url: "https://hooks.slack.com/services/xxxxx" 20 | slack_username_override: "attack-bot" 21 | slack_emoji_override: "robot_face" 22 | 23 | - command: ["/usr/bin/curl", "https://xxxxxxxxxxx.execute-api.us-east-1.amazonaws.com/dev/zzzzzzzzzzzzzz/ip/inframonitor/%(ip)s"] 24 | 25 | realert: 26 | minutes: 0 -------------------------------------------------------------------------------- /utils/0-jenkins-shared-library/vars/slackNotifier.groovy: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env groovy 2 | 3 | def call(String buildResult) { 4 | if ( buildResult == "SUCCESS" ) { 5 | slackSend color: "good", message: "CONGRATULATION: Job ${env.JOB_NAME} with buildnumber ${env.BUILD_NUMBER} was successful ! more info ${env.BUILD_URL}" 6 | } 7 | else if( buildResult == "FAILURE" ) { 8 | slackSend color: "danger", message: "BAD NEWS:Job ${env.JOB_NAME} with buildnumber ${env.BUILD_NUMBER} was failed ! more info ${env.BUILD_URL}" 9 | } 10 | else if( buildResult == "UNSTABLE" ) { 11 | slackSend color: "warning", message: "BAD NEWS:Job ${env.JOB_NAME} with buildnumber ${env.BUILD_NUMBER} was unstable ! more info ${env.BUILD_URL}" 12 | } 13 | else { 14 | slackSend color: "danger", message: "BAD NEWS:Job ${env.JOB_NAME} with buildnumber ${env.BUILD_NUMBER} its result was unclear ! more info ${env.BUILD_URL}" 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/common/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: install python 2 2 | raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) 3 | 4 | - name: accepting oracle java license agreement 5 | debconf: 6 | name: 'oracle-java8-installer' 7 | question: 'shared/accepted-oracle-license-v1-1' 8 | value: 'true' 9 | vtype: 'select' 10 | 11 | - name: adding ppa repo for oracle java by webupd8team 12 | apt_repository: 13 | repo: 'ppa:webupd8team/java' 14 | state: present 15 | update_cache: yes 16 | 17 | - name: installing java nginx apache2-utils and git 18 | apt: 19 | name: "{{ item }}" 20 | state: present 21 | update_cache: yes 22 | 23 | with_items: 24 | - python-software-properties 25 | - oracle-java8-installer 26 | - nginx 27 | - apache2-utils 28 | - python-pip 29 | - python-passlib 30 | -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-owasp-depcheck/owasp-check.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | OWASPDC_DIRECTORY="$(pwd)/owasp-dependency-check" 4 | DATA_DIRECTORY="$OWASPDC_DIRECTORY/data" 5 | REPORT_DIRECTORY="$OWASPDC_DIRECTORY/reports" 6 | 7 | if [ ! -d "$DATA_DIRECTORY" ]; then 8 | mkdir -p "$OWASPDC_DIRECTORY" 9 | fi 10 | 11 | if [ ! -d "$DATA_DIRECTORY" ]; then 12 | mkdir -p "$DATA_DIRECTORY" 13 | chmod -R 777 "$DATA_DIRECTORY" 14 | 15 | mkdir -p "$REPORT_DIRECTORY" 16 | chmod -R 777 "$REPORT_DIRECTORY" 17 | fi 18 | 19 | docker pull owasp/dependency-check 20 | 21 | docker run --rm \ 22 | --volume $(pwd):/src \ 23 | --volume "$DATA_DIRECTORY":/usr/share/dependency-check/data \ 24 | --volume "$REPORT_DIRECTORY":/report \ 25 | owasp/dependency-check \ 26 | --scan /src \ 27 | --log /report/dc.log \ 28 | --out /report/dc.html \ 29 | --format "HTML" \ 30 | --project "$PROJECT_NAME" 31 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/molecule/default/version.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Converge 3 | hosts: all 4 | become: true 5 | 6 | vars: 7 | gitlab_restart_handler_failed_when: false 8 | 9 | pre_tasks: 10 | - name: Update apt cache. 11 | apt: update_cache=true cache_valid_time=600 12 | when: ansible_os_family == 'Debian' 13 | changed_when: false 14 | 15 | - name: Remove the .dockerenv file so GitLab Omnibus doesn't get confused. 16 | file: 17 | path: /.dockerenv 18 | state: absent 19 | 20 | - name: Set the test GitLab version number for Debian. 21 | set_fact: 22 | gitlab_version: '11.4.0-ce.0' 23 | when: ansible_os_family == 'Debian' 24 | 25 | - name: Set the test GitLab version number for RedHat. 26 | set_fact: 27 | gitlab_version: '11.4.0-ce.0.el7' 28 | when: ansible_os_family == 'RedHat' 29 | 30 | roles: 31 | - role: geerlingguy.gitlab 32 | -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-clair-scanner/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM debian:jessie 2 | 3 | RUN apt-get update -y && apt-get install --no-install-recommends -y -q \ 4 | curl \ 5 | zip \ 6 | build-essential \ 7 | ca-certificates \ 8 | git mercurial bzr \ 9 | && rm -rf /var/lib/apt/lists/* 10 | 11 | ENV GOVERSION 1.14 12 | RUN mkdir /goroot && mkdir /gopath 13 | RUN curl https://storage.googleapis.com/golang/go${GOVERSION}.linux-amd64.tar.gz \ 14 | | tar xvzf - -C /goroot --strip-components=1 15 | 16 | ENV GOPATH /gopath 17 | ENV GOROOT /goroot 18 | ENV PATH $GOROOT/bin:$GOPATH/bin:$PATH 19 | 20 | RUN go get github.com/mitchellh/gox 21 | 22 | RUN git clone https://github.com/arminc/clair-scanner.git /gopath/src/clair 23 | 24 | WORKDIR /gopath/src/clair 25 | 26 | RUN make build 27 | 28 | FROM alpine 29 | 30 | COPY --from=0 /gopath/src/clair/clair-scanner /usr/local/bin/clair 31 | 32 | EXPOSE 9279 33 | 34 | ENTRYPOINT ["clair"] 35 | 36 | CMD [] 37 | 38 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Viper/viper-setup/roles/dependencies/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: installing required packages 2 | apt: 3 | name: "{{ item }}" 4 | state: present 5 | update_cache: yes 6 | 7 | with_items: 8 | - gcc 9 | - python-dev 10 | - python-pip 11 | - libssl-dev 12 | - swig 13 | 14 | - name: downloading ssdeep release 15 | unarchive: 16 | src: https://github.com/ssdeep-project/ssdeep/releases/download/release-2.14.1/ssdeep-2.14.1.tar.gz 17 | dest: /tmp/ 18 | remote_src: yes 19 | 20 | - name: copy ssdeep setup script 21 | template: 22 | src: ssdeep.sh 23 | dest: /tmp/ssdeep.sh 24 | mode: 0755 25 | 26 | - name: installing ssdeep 27 | shell: /tmp/ssdeep.sh 28 | ignore_errors: yes 29 | 30 | - name: installing core dependencies 31 | pip: 32 | name: "{{ item }}" 33 | state: present 34 | 35 | with_items: 36 | - SQLAlchemy 37 | - PrettyTable 38 | - python-magic 39 | - pydeep -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/autonessus/roles/setup/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: installing python-pip 2 | apt: 3 | name: python-pip 4 | update_cache: yes 5 | state: present 6 | 7 | - name: install python requests 8 | pip: 9 | name: requests 10 | 11 | - name: setting up autonessus 12 | get_url: 13 | url: "https://github.com/redteamsecurity/AutoNessus/raw/master/autoNessus.py" 14 | dest: /usr/bin/autoNessus 15 | mode: 0755 16 | 17 | - name: updating the credentials 18 | replace: 19 | path: /usr/bin/autoNessus 20 | regexp: "{{ item.src }}" 21 | replace: "{{ item.dst }}" 22 | backup: yes 23 | no_log: True 24 | 25 | with_items: 26 | - { src: "token = ''", dst: "token = '{{ nessus_user_token }}'" } 27 | - { src: "url = 'https://localhost:8834'", dst: "url = '{{ nessus_url }}'" } 28 | - { src: "username = 'xxxxx'", dst: "username = '{{ nessus_user_name }}'" } 29 | - { src: "password = 'xxxxx'", dst: "password = '{{ nessus_user_password }}'" } -------------------------------------------------------------------------------- /app/docker/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: '3.3' 2 | 3 | services: 4 | visitors-mysql: 5 | image: mysql:5.7 6 | hostname: visitors-mysql 7 | ports: 8 | - 3306:3306 9 | environment: 10 | - MYSQL_ROOT_PASSWORD=password 11 | - MYSQL_DATABASE=visitors_db 12 | - MYSQL_USER=visitors 13 | - MYSQL_PASSWORD=password 14 | 15 | visitors-service: 16 | image: davarski/visitors-service:1.0.0 17 | hostname: visitors-service 18 | ports: 19 | - 8000:30685 20 | environment: 21 | - MYSQL_DATABASE=visitors_db 22 | - MYSQL_SERVICE_HOST=visitors-mysql 23 | - MYSQL_USER=visitors 24 | - MYSQL_PASSWORD=password 25 | depends_on: 26 | - visitors-mysql 27 | 28 | visitors-webui: 29 | image: davarski/visitors-webui:1.0.0 30 | hostname: visitors-webui 31 | environment: 32 | - REACT_APP_BACKEND_HOST=visitors-service 33 | - REACT_APP_BACKEND_PORT=30685 34 | - REACT_APP_TITLE="Visitors DASHBOARD" 35 | ports: 36 | - 3000:3000 37 | depends_on: 38 | - visitors-mysql 39 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/docker-bench-security/main.yml: -------------------------------------------------------------------------------- 1 | - name: Docker bench security playbook 2 | hosts: docker 3 | remote_user: ubuntu 4 | become: yes 5 | 6 | tasks: 7 | - name: make sure git installed 8 | apt: 9 | name: git 10 | state: present 11 | 12 | - name: download the docker bench security 13 | git: 14 | repo: https://github.com/docker/docker-bench-security.git 15 | dest: /opt/docker-bench-security 16 | 17 | - name: running docker-bench-security scan 18 | command: docker-bench-security.sh -l /tmp/output.log 19 | args: 20 | chdir: /opt/docker-bench-security/ 21 | 22 | - name: downloading report locally 23 | fetch: 24 | src: /tmp/output.log 25 | dest: "{{ playbook_dir }}/{{ inventory_hostname }}-docker-report-{{ ansible_date_time.date }}.log" 26 | flat: yes 27 | 28 | - name: report location 29 | debug: 30 | msg: "Report can be found at {{ playbook_dir }}/{{ inventory_hostname }}-docker-report-{{ ansible_date_time.date }}.log" 31 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-cis-benchmarks/main.yml: -------------------------------------------------------------------------------- 1 | - name: AWS CIS Benchmarks playbook 2 | hosts: localhost 3 | become: yes 4 | vars: 5 | aws_access_key: XXXXXXXX 6 | aws_secret_key: XXXXXXXX 7 | 8 | tasks: 9 | - name: installing aws cli and ansi2html 10 | pip: 11 | name: "{{ item }}" 12 | 13 | with_items: 14 | - awscli 15 | - ansi2html 16 | 17 | - name: downloading and setting up prowler 18 | get_url: 19 | url: https://raw.githubusercontent.com/Alfresco/prowler/master/prowler 20 | dest: /usr/bin/prowler 21 | mode: 0755 22 | 23 | - name: running prowler full scan 24 | shell: "prowler | ansi2html -la > ./aws-cis-report-{{ ansible_date_time.epoch }}.html" 25 | environment: 26 | AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" 27 | AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" 28 | 29 | - name: AWS CIS Benchmarks report downloaded 30 | debug: 31 | msg: "Report can be found at ./aws-cis-report-{{ ansible_date_time.epoch }}.html" 32 | -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/manifests/frontend.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: apps/v1 3 | kind: Deployment 4 | metadata: 5 | name: visitors-frontend 6 | spec: 7 | replicas: 1 8 | selector: 9 | matchLabels: 10 | app: visitors 11 | tier: frontend 12 | template: 13 | metadata: 14 | labels: 15 | app: visitors 16 | tier: frontend 17 | spec: 18 | containers: 19 | - name: visitors-frontend 20 | image: "davarski/visitors-webui:1.0.0" 21 | imagePullPolicy: Always 22 | ports: 23 | - name: visitors 24 | containerPort: 3000 25 | env: 26 | - name: REACT_APP_TITLE 27 | value: "Visitors Dashboard" 28 | --- 29 | apiVersion: v1 30 | kind: Service 31 | metadata: 32 | name: visitors-frontend-service 33 | labels: 34 | app: visitors 35 | tier: frontend 36 | spec: 37 | type: NodePort 38 | ports: 39 | - port: 3000 40 | targetPort: 3000 41 | nodePort: 30686 42 | protocol: TCP 43 | selector: 44 | app: visitors 45 | tier: frontend 46 | -------------------------------------------------------------------------------- /infrastructure/k8s/minikube/manifests/frontend.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: apps/v1 3 | kind: Deployment 4 | metadata: 5 | name: visitors-frontend 6 | spec: 7 | replicas: 1 8 | selector: 9 | matchLabels: 10 | app: visitors 11 | tier: frontend 12 | template: 13 | metadata: 14 | labels: 15 | app: visitors 16 | tier: frontend 17 | spec: 18 | containers: 19 | - name: visitors-frontend 20 | image: "davarski/visitors-webui:1.0.0" 21 | imagePullPolicy: Always 22 | ports: 23 | - name: visitors 24 | containerPort: 3000 25 | env: 26 | - name: REACT_APP_TITLE 27 | value: "Visitors Dashboard" 28 | --- 29 | apiVersion: v1 30 | kind: Service 31 | metadata: 32 | name: visitors-frontend-service 33 | labels: 34 | app: visitors 35 | tier: frontend 36 | spec: 37 | type: NodePort 38 | ports: 39 | - port: 3000 40 | targetPort: 3000 41 | nodePort: 30686 42 | protocol: TCP 43 | selector: 44 | app: visitors 45 | tier: frontend 46 | -------------------------------------------------------------------------------- /infrastructure/aws/terraform/Jenkins-EC2/main.tf: -------------------------------------------------------------------------------- 1 | # Use AWS Terraform provider 2 | provider "aws" { 3 | region = "us-east-2" 4 | } 5 | 6 | 7 | data "template_file" "myuserdata" { 8 | template = "${file("${path.cwd}/user-data.tpl")}" 9 | } 10 | 11 | # Create EC2 instance 12 | resource "aws_instance" "jenkins-tf" { 13 | ami = var.ami 14 | key_name = var.key_name 15 | vpc_security_group_ids = [aws_security_group.jenkins-tf.id] 16 | source_dest_check = false 17 | instance_type = var.instance_type 18 | user_data = "${data.template_file.myuserdata.template}" 19 | tags = { 20 | Name = "Jenkins EC2 instance" 21 | } 22 | } 23 | 24 | 25 | # Create Security Group for EC2 26 | resource "aws_security_group" "jenkins-tf" { 27 | name = "terraform-jenkins-sg" 28 | 29 | ingress { 30 | from_port = 0 31 | to_port = 0 32 | protocol = "-1" 33 | cidr_blocks = ["0.0.0.0/0"] 34 | } 35 | 36 | 37 | egress { 38 | from_port = 0 39 | to_port = 0 40 | protocol = "-1" 41 | cidr_blocks = ["0.0.0.0/0"] 42 | } 43 | 44 | } 45 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/clair-scanning-images/main.yaml: -------------------------------------------------------------------------------- 1 | - name: Scanning containers using clair-scanner 2 | hosts: docker 3 | remote_user: ubuntu 4 | become: yes 5 | vars: 6 | image_to_scan: "debian:sid" #container to scan for vulnerabilities 7 | clair_server: "http://192.168.1.10:6060" #clair server api endpoint 8 | 9 | tasks: 10 | - name: downloading and setting up clair-scanner binary 11 | get_url: 12 | url: https://github.com/arminc/clair-scanner/releases/download/v6/clair-scanner_linux_amd64 13 | dest: /usr/local/bin/clair-scanner 14 | mode: 0755 15 | 16 | - name: scanning {{ image_to_scan }} container for vulnerabilities 17 | command: "clair-scanner -r /tmp/{{ image_to_scan }}-scan-report.json -c {{ clair_server }} --ip 0.0.0.0 {{ image_to_scan }}" 18 | register: scan_output 19 | ignore_errors: yes 20 | 21 | - name: downloading the report locally 22 | fetch: 23 | src: /tmp/{{ image_to_scan }}-scan-report.json 24 | dest: {{ playbook_dir }}/{{ image_to_scan }}-scan-report.json 25 | flat: yes 26 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # This workflow requires a GALAXY_API_KEY secret present in the GitHub 3 | # repository or organization. 4 | # 5 | # See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy 6 | # See: https://github.com/ansible/galaxy/issues/46 7 | 8 | name: Release 9 | 'on': 10 | push: 11 | tags: 12 | - '*' 13 | 14 | defaults: 15 | run: 16 | working-directory: 'geerlingguy.gitlab' 17 | 18 | jobs: 19 | 20 | release: 21 | name: Release 22 | runs-on: ubuntu-latest 23 | steps: 24 | - name: Check out the codebase. 25 | uses: actions/checkout@v2 26 | with: 27 | path: 'geerlingguy.gitlab' 28 | 29 | - name: Set up Python 3. 30 | uses: actions/setup-python@v2 31 | with: 32 | python-version: '3.x' 33 | 34 | - name: Install Ansible. 35 | run: pip3 install ansible-base 36 | 37 | - name: Trigger a new import on Galaxy. 38 | run: ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }} $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2) 39 | -------------------------------------------------------------------------------- /infrastructure/vagrant/README.md: -------------------------------------------------------------------------------- 1 | # Packer CentOS template 2 | Packer templates to bake VirtualBox image (vagrant) 3 | 4 | ### Purpose 5 | This repository store sample Packer templates required to create a Vagrant virtualbox base CentOS 7 x86_64 boxes using Packer for jenkins (master and slave) 6 | 7 | ### Requirements 8 | The following software must be installed/present on your local machine before you can use Packer to build the Vagrant box file: 9 | 10 | * Packer 11 | * VirtualBox (needed to build the VirtualBox box) 12 | 13 | ### CentOS Packer Template example (jenkins slave): 14 | 15 | * [template-jenkins-slave.json](https://github.com/adavarski/packer-vagrant-vbox-centos-7.6-jenkins-POC/blob/master/template-jenkins-slave.json) 16 | 17 | ### Usage 18 | Make sure all the required software is installed, then cd to the directory containing this repo files, and run: 19 | ``` 20 | $ packer build template-jenkins-master.json 21 | $ packer build template-jenkins-slave.json 22 | ``` 23 | After a few minutes, Packer should tell you the box was generated successfully 24 | 25 | ``` 26 | vagrant box add jenkins-slave builds/virtualbox-centos7-minimal.box --force 27 | vagrant up 28 | ``` 29 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2017 Jeff Geerling 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of 6 | this software and associated documentation files (the "Software"), to deal in 7 | the Software without restriction, including without limitation the rights to 8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 | the Software, and to permit persons to whom the Software is furnished to do so, 10 | subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.pip/LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2017 Jeff Geerling 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of 6 | this software and associated documentation files (the "Software"), to deal in 7 | the Software without restriction, including without limitation the rights to 8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 | the Software, and to permit persons to whom the Software is furnished to do so, 10 | subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2017 Jeff Geerling 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of 6 | this software and associated documentation files (the "Software"), to deal in 7 | the Software without restriction, including without limitation the rights to 8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 | the Software, and to permit persons to whom the Software is furnished to do so, 10 | subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls-scanning/templates/192-168-33-80: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 3 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 4 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 5 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 6 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 8 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 10 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 11 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 12 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 13 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 14 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 15 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 16 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 17 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 18 | -----END RSA PRIVATE KEY----- -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastic-stack/roles/logstash/templates/10-sshlog-filter.conf.j2: -------------------------------------------------------------------------------- 1 | filter { 2 | if [type] == "sshlog" { 3 | grok { 4 | match => [ 5 | "message", "%{SYSLOGTIMESTAMP:syslog_date} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}(?:\[%{POSINT}\])?: %{WORD:login} password for %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}", 6 | "message", "%{SYSLOGTIMESTAMP:syslog_date} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}(?:\[%{POSINT}\])?: message repeated 2 times: \[ %{WORD:login} password for %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}", 7 | "message", "%{SYSLOGTIMESTAMP:syslog_date} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}(?:\[%{POSINT}\])?: %{WORD:login} password for invalid user %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}", 8 | "message", "%{SYSLOGTIMESTAMP:syslog_date} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}(?:\[%{POSINT}\])?: %{WORD:login} %{WORD:auth_method} for %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}" 9 | ] 10 | } 11 | 12 | date { 13 | match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ] 14 | locale => en 15 | } 16 | 17 | geoip { 18 | source => "ip" 19 | } 20 | } 21 | } -------------------------------------------------------------------------------- /app/docker/visitors-service/visitors/service/views.py: -------------------------------------------------------------------------------- 1 | import socket 2 | 3 | from django.shortcuts import render 4 | from rest_framework.response import Response 5 | from rest_framework.views import APIView 6 | 7 | from visitors.service.models import Visitor 8 | from visitors.service.serializers import VisitorSerializer 9 | 10 | 11 | class VisitorAPI(APIView): 12 | 13 | def get(self, request): 14 | qs = Visitor.objects.order_by('-timestamp')[:10] 15 | s = VisitorSerializer(qs, many=True) 16 | return Response(s.data) 17 | 18 | def post(self, request): 19 | service_ip = socket.gethostbyname(socket.gethostname()) 20 | client_ip = self.get_client_ip(request) 21 | 22 | v = Visitor(service_ip=service_ip, 23 | client_ip=client_ip) 24 | v.save() 25 | 26 | s = VisitorSerializer(v) 27 | return Response(s.data) 28 | 29 | @staticmethod 30 | def get_client_ip(request): 31 | x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR') 32 | if x_forwarded_for: 33 | ip = x_forwarded_for.split(',')[0] 34 | else: 35 | ip = request.META.get('REMOTE_ADDR') 36 | return ip 37 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | false 5 | 6 | 7 | 8 | 2 9 | 10 | 11 | https://github.com/adavarski/DevSecOps-pipeline-python 12 | 13 | 14 | 15 | 16 | */main 17 | 18 | 19 | false 20 | 21 | 22 | 23 | Jenkinsfile 24 | true 25 | 26 | 27 | false 28 | 29 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/tasks/setup-Debian.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Ensure old versions of Docker are not installed. 3 | package: 4 | name: 5 | - docker 6 | - docker-engine 7 | state: absent 8 | 9 | - name: Ensure dependencies are installed. 10 | apt: 11 | name: 12 | - apt-transport-https 13 | - ca-certificates 14 | - gnupg2 15 | state: present 16 | 17 | - name: Add Docker apt key. 18 | apt_key: 19 | url: "{{ docker_apt_gpg_key }}" 20 | id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 21 | state: present 22 | register: add_repository_key 23 | ignore_errors: "{{ docker_apt_ignore_key_error }}" 24 | 25 | - name: Ensure curl is present (on older systems without SNI). 26 | package: name=curl state=present 27 | when: add_repository_key is failed 28 | 29 | - name: Add Docker apt key (alternative for older systems without SNI). 30 | shell: > 31 | curl -sSL {{ docker_apt_gpg_key }} | sudo apt-key add - 32 | args: 33 | warn: false 34 | when: add_repository_key is failed 35 | 36 | - name: Add Docker repository. 37 | apt_repository: 38 | repo: "{{ docker_apt_repository }}" 39 | state: present 40 | update_cache: true 41 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/s3-backup/main.yml: -------------------------------------------------------------------------------- 1 | - name: backing up the log data 2 | hosts: localhost 3 | gather_facts: false 4 | become: yes 5 | vars: 6 | s3_access_key: XXXXXXX # Use ansible-vault to encrypt 7 | s3_access_secret: XXXXXXX # Use ansible-vault to encrypt 8 | localfolder: /tmp/LOGS/ # Trailing slash is important 9 | remotebucket: secretforensicsdatausingansible # This should be unique in s3 10 | 11 | tasks: 12 | - name: installing s3cmd if not installed 13 | apt: 14 | name: "{{ item }}" 15 | state: present 16 | update_cache: yes 17 | 18 | with_items: 19 | - python-magic 20 | - python-dateutil 21 | - s3cmd 22 | 23 | - name: create s3cmd config file 24 | template: 25 | src: s3cmd.j2 26 | dest: /root/.s3cfg 27 | owner: root 28 | group: root 29 | mode: 0640 30 | 31 | - name: make sure "{{ remotebucket }}" is avilable 32 | command: "s3cmd mb s3://{{ remotebucket }}/ -c /root/.s3cfg" 33 | 34 | - name: running the s3 backup to "{{ remotebucket }}" 35 | command: "s3cmd sync {{ localfolder }} --preserve s3://{{ remotebucket }}/ -c /root/.s3cfg" -------------------------------------------------------------------------------- /infrastructure/vagrant/http/kickstart.ks: -------------------------------------------------------------------------------- 1 | install 2 | cdrom 3 | 4 | lang en_US.UTF-8 5 | keyboard us 6 | timezone Europe/Sofia 7 | 8 | network --onboot yes --bootproto=dhcp --device=eth0 --activate --noipv6 9 | 10 | rootpw vagrant 11 | authconfig --enableshadow --passalgo=sha512 12 | user --name=vagrant --groups=vagrant --password=vagrant 13 | 14 | firewall --disabled 15 | selinux --disabled 16 | firstboot --disabled 17 | 18 | bootloader --location=mbr 19 | text 20 | skipx 21 | 22 | logging --level=info 23 | zerombr 24 | clearpart --all --initlabel 25 | autopart 26 | 27 | reboot 28 | 29 | %packages --nobase 30 | @Core 31 | openssh-clients 32 | openssh-server 33 | %end 34 | 35 | %post --log=/root/post_install.log 36 | 37 | # Add vagrant to sudoers 38 | cat > /etc/sudoers.d/vagrant << EOF_sudoers_vagrant 39 | vagrant ALL=(ALL) NOPASSWD: ALL 40 | EOF_sudoers_vagrant 41 | 42 | /bin/chmod 0440 /etc/sudoers.d/vagrant 43 | /bin/sed -i "s/^.*requiretty/#Defaults requiretty/" /etc/sudoers 44 | 45 | # Fix sshd config for CentOS 7 1611 (reboot issue) 46 | cat >> /etc/ssh/sshd_config << EOF_sshd_config 47 | 48 | TCPKeepAlive yes 49 | ClientAliveInterval 0 50 | ClientAliveCountMax 3 51 | 52 | EOF_sshd_config 53 | 54 | %end 55 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/setup/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: installing pre requsuites for elastalert 2 | apt: 3 | name: "{{ item }}" 4 | state: present 5 | update_cache: yes 6 | 7 | with_items: 8 | - python-pip 9 | - python-dev 10 | - libffi-dev 11 | - libssl-dev 12 | - python-setuptools 13 | - build-essential 14 | 15 | - name: installing elastalert 16 | pip: 17 | name: elastalert 18 | 19 | - name: creating elastalert directories 20 | file: 21 | path: "{{ item }}" 22 | state: directory 23 | mode: 0755 24 | 25 | with_items: 26 | - /opt/elastalert/rules 27 | - /opt/elastalert/config 28 | 29 | - name: creating elastalert configuration 30 | template: 31 | src: "{{ item.src }}" 32 | dest: "{{ item.dst }}" 33 | 34 | with_items: 35 | - { src: 'elastalert-config.j2', dst: '/opt/elastalert/config/config.yml' } 36 | - { src: 'elastalert-service.j2', dst: '/lib/systemd/system/elastalert.service' } 37 | - { src: 'elastalert-sshrule.j2', dst: '/opt/elastalert/rules/ssh-bruteforce.yml' } 38 | 39 | - name: enable elastalert service 40 | service: 41 | name: elastalert 42 | state: started 43 | enabled: yes -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins_home/configureTestEnv.yml: -------------------------------------------------------------------------------- 1 | # Configure launched instance for test 2 | - name: Configure instance(s) 3 | hosts: tstlaunched 4 | become: True 5 | remote_user: ubuntu 6 | gather_facts: True 7 | tasks: 8 | - name: update package manager 9 | apt: update_cache=yes 10 | - name: Install docker 11 | apt: name=docker.io state=present 12 | - name: Install docker-compose 13 | apt: name=docker-compose update_cache=yes state=present 14 | - name: Install kbtin for lynis to produce html report 15 | apt: name=kbtin state=present 16 | - name: Install make to build the pythonapp 17 | apt: name=make state=present 18 | - name: Copy the zip file of project 19 | copy: 20 | src: pythonapp.tar.gz 21 | dest: /home/ubuntu/pythonapp.tar.gz 22 | - name: Create directory for unarchiving app 23 | file: 24 | path: /home/ubuntu/gossip-world 25 | state: directory 26 | - name: Unzip it 27 | unarchive: 28 | src: /home/ubuntu/pythonapp.tar.gz 29 | dest: /home/ubuntu/gossip-world/ 30 | copy: no 31 | - name: Run the application with docker 32 | shell: make install 33 | args: 34 | chdir: gossip-world/ 35 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-full-scan/site.yml: -------------------------------------------------------------------------------- 1 | - name: Running OWASP ZAP Full Scan 2 | hosts: zap 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | vars: 7 | owasp_zap_image_name: owasp/zap2docker-weekly 8 | website_url: http://192.168.33.111 9 | reports_location: /zapdata/ 10 | scan_name: owasp-zap-full-scan-dvws 11 | 12 | tasks: 13 | - name: adding write permissions to reports directory 14 | file: 15 | path: "{{ reports_location }}" 16 | state: directory 17 | owner: root 18 | group: root 19 | recurse: yes 20 | mode: 0777 21 | 22 | - name: running owasp zap full scan container against "{{ website_url }}" 23 | docker_container: 24 | name: "{{ scan_name }}" 25 | image: "{{ owasp_zap_image_name }}" 26 | interactive: yes 27 | auto_remove: yes 28 | state: started 29 | volumes: "{{ reports_location }}:/zap/wrk:rw" 30 | command: "zap-full-scan.py -t {{ website_url }} -r {{ scan_name }}_report.html" 31 | 32 | - name: getting raw output of the scan 33 | raw: "docker logs -f {{ scan_name }}" 34 | register: scan_output 35 | 36 | - debug: 37 | msg: "{{ scan_output }}" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-setup-playbook/zap-full-scan/site.yml: -------------------------------------------------------------------------------- 1 | - name: Running OWASP ZAP Full Scan 2 | hosts: zap 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | vars: 7 | owasp_zap_image_name: owasp/zap2docker-weekly 8 | website_url: http://192.168.33.111 9 | reports_location: /zapdata/ 10 | scan_name: owasp-zap-full-scan-dvws 11 | 12 | tasks: 13 | - name: adding write permissions to reports directory 14 | file: 15 | path: "{{ reports_location }}" 16 | state: directory 17 | owner: root 18 | group: root 19 | recurse: yes 20 | mode: 0777 21 | 22 | - name: running owasp zap full scan container against "{{ website_url }}" 23 | docker_container: 24 | name: "{{ scan_name }}" 25 | image: "{{ owasp_zap_image_name }}" 26 | interactive: yes 27 | auto_remove: yes 28 | state: started 29 | volumes: "{{ reports_location }}:/zap/wrk:rw" 30 | command: "zap-full-scan.py -t {{ website_url }} -r {{ scan_name }}_report.html" 31 | 32 | - name: getting raw output of the scan 33 | raw: "docker logs -f {{ scan_name }}" 34 | register: scan_output 35 | 36 | - debug: 37 | msg: "{{ scan_output }}" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nikto/nikto-scan/main.yml: -------------------------------------------------------------------------------- 1 | - name: Nikto Playbook 2 | hosts: scanner 3 | remote_user: ubuntu 4 | become: yes 5 | vars: 6 | domain_name: idontexistdomainnamewebsite.com # Add the domain to scan 7 | report_name: report.html 8 | 9 | tasks: 10 | - name: installing pre requisuites 11 | apt: 12 | name: "{{ item }}" 13 | state: present 14 | update_cache: yes 15 | 16 | with_items: 17 | - git 18 | - perl 19 | - libnet-ssleay-perl 20 | - openssl 21 | - libauthen-pam-perl 22 | - libio-pty-perl 23 | - libmd-dev 24 | 25 | - name: downloading nikto 26 | git: 27 | repo: https://github.com/sullo/nikto.git 28 | dest: /usr/share/nikto/ 29 | 30 | - name: Nikto scanning in action 31 | # Output available in csv, html, msf+, nbe, txt, xml formats 32 | command: "/usr/share/nikto/program/nikto.pl -h {{ domain_name }} -o /tmp/{{ domain_name }}-report.html" 33 | 34 | - name: downloading the report 35 | fetch: 36 | src: "/tmp/{{ domain_name }}-report.html" 37 | dest: "{{ report_name }}" 38 | flat: yes 39 | 40 | - debug: 41 | msg: "Report can be found at {{ report_name }}" 42 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-baseline-scan/site.yml: -------------------------------------------------------------------------------- 1 | - name: Running OWASP ZAP Baseline Scan 2 | hosts: zap 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | vars: 7 | owasp_zap_image_name: owasp/zap2docker-weekly 8 | website_url: http://192.168.33.111 9 | reports_location: /zapdata 10 | scan_name: owasp-zap-base-line-scan-dvws 11 | 12 | tasks: 13 | - name: adding write permissions to reports directory 14 | file: 15 | path: "{{ reports_location }}" 16 | state: directory 17 | owner: root 18 | group: root 19 | recurse: yes 20 | mode: 0770 21 | 22 | - name: running owasp zap baseline scan container against "{{ website_url }}" 23 | docker_container: 24 | name: "{{ scan_name }}" 25 | image: "{{ owasp_zap_image_name }}" 26 | interactive: yes 27 | auto_remove: yes 28 | state: started 29 | volumes: "{{ reports_location }}:/zap/wrk:rw" 30 | command: "zap-baseline.py -t {{ website_url }} -r {{ scan_name }}_report.html" 31 | 32 | - name: getting raw output of the scan 33 | raw: "docker logs -f {{ scan_name }}" 34 | register: scan_output 35 | 36 | - debug: 37 | msg: "{{ scan_output }}" 38 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/aws-serverless/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: installing node run time and npm 2 | apt: 3 | name: "{{ item }}" 4 | state: present 5 | update_cache: yes 6 | 7 | with_items: 8 | - nodejs 9 | - npm 10 | 11 | - name: installing serverless package 12 | npm: 13 | name: "{{ item }}" 14 | global: yes 15 | state: present 16 | 17 | with_items: 18 | - serverless 19 | - aws-sdk 20 | 21 | - name: copy the setup files 22 | template: 23 | src: "{{ item.src }}" 24 | dest: "{{ item.dst }}" 25 | 26 | with_items: 27 | - { src: 'config.js.j2', dst: '/opt/serverless/config.js' } 28 | - { src: 'handler.js.j2', dst: '/opt/serverless/handler.js' } 29 | - { src: 'iamRoleStatements.json.j2', dst: '/opt/serverless/iamRoleStatements.json' } 30 | - { src: 'initDb.js.j2', dst: '/opt/serverless/initDb.js' } 31 | - { src: 'serverless.yml.j2', dst: '/opt/serverless/serverless.yml' } 32 | - { src: 'aws-credentials.j2', dst: '~/.aws/credentials' } 33 | 34 | - name: create dynamo db table 35 | command: "node initDb.js" 36 | args: 37 | chdir: /opt/serverless/ 38 | 39 | - name: deploy the serverless 40 | command: "serverless deploy" 41 | args: 42 | chdir: /opt/serverless/ -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-ZAP/zap-setup-playbook/zap-baseline-scan/site.yml: -------------------------------------------------------------------------------- 1 | - name: Running OWASP ZAP Baseline Scan 2 | hosts: zap 3 | remote_user: ubuntu 4 | gather_facts: no 5 | become: yes 6 | vars: 7 | owasp_zap_image_name: owasp/zap2docker-weekly 8 | website_url: http://192.168.33.111 9 | reports_location: /zapdata 10 | scan_name: owasp-zap-base-line-scan-dvws 11 | 12 | tasks: 13 | - name: adding write permissions to reports directory 14 | file: 15 | path: "{{ reports_location }}" 16 | state: directory 17 | owner: root 18 | group: root 19 | recurse: yes 20 | mode: 0770 21 | 22 | - name: running owasp zap baseline scan container against "{{ website_url }}" 23 | docker_container: 24 | name: "{{ scan_name }}" 25 | image: "{{ owasp_zap_image_name }}" 26 | interactive: yes 27 | auto_remove: yes 28 | state: started 29 | volumes: "{{ reports_location }}:/zap/wrk:rw" 30 | command: "zap-baseline.py -t {{ website_url }} -r {{ scan_name }}_report.html" 31 | 32 | - name: getting raw output of the scan 33 | raw: "docker logs -f {{ scan_name }}" 34 | register: scan_output 35 | 36 | - debug: 37 | msg: "{{ scan_output }}" 38 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/jenkins/site.yml: -------------------------------------------------------------------------------- 1 | - name: installing jenkins in ubuntu 16.04 2 | hosts: "192.168.1.7" 3 | remote_user: ubuntu 4 | gather_facts: False 5 | become: True 6 | 7 | tasks: 8 | - name: install python 2 9 | raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) 10 | 11 | - name: install curl and git 12 | apt: name={{ item }} state=present update_cache=yes 13 | 14 | with_items: 15 | - curl 16 | - git 17 | 18 | - name: adding jenkins gpg key 19 | apt_key: 20 | url: https://pkg.jenkins.io/debian/jenkins-ci.org.key 21 | state: present 22 | 23 | - name: jeknins repository to system 24 | apt_repository: 25 | repo: http://pkg.jenkins.io/debian-stable binary/ 26 | state: present 27 | 28 | - name: installing jenkins 29 | apt: 30 | name: jenkins 31 | state: present 32 | update_cache: yes 33 | 34 | - name: adding jenkins to startup 35 | service: 36 | name: jenkins 37 | state: started 38 | enabled: yes 39 | 40 | - name: printing jenkins default administration password 41 | command: cat /var/lib/jenkins/secrets/initialAdminPassword 42 | register: jenkins_default_admin_password 43 | 44 | - debug: 45 | msg: "{{ jenkins_default_admin_password.stdout }}" -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/tasks/setup-RedHat.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Ensure old versions of Docker are not installed. 3 | package: 4 | name: 5 | - docker 6 | - docker-common 7 | - docker-engine 8 | state: absent 9 | 10 | - name: Add Docker GPG key. 11 | rpm_key: 12 | key: "{{ docker_yum_gpg_key }}" 13 | state: present 14 | 15 | - name: Add Docker repository. 16 | get_url: 17 | url: "{{ docker_yum_repo_url }}" 18 | dest: '/etc/yum.repos.d/docker-{{ docker_edition }}.repo' 19 | owner: root 20 | group: root 21 | mode: 0644 22 | 23 | - name: Configure Docker Edge repo. 24 | ini_file: 25 | dest: '/etc/yum.repos.d/docker-{{ docker_edition }}.repo' 26 | section: 'docker-{{ docker_edition }}-edge' 27 | option: enabled 28 | value: '{{ docker_yum_repo_enable_edge }}' 29 | 30 | - name: Configure Docker Test repo. 31 | ini_file: 32 | dest: '/etc/yum.repos.d/docker-{{ docker_edition }}.repo' 33 | section: 'docker-{{ docker_edition }}-test' 34 | option: enabled 35 | value: '{{ docker_yum_repo_enable_test }}' 36 | 37 | - name: Install containerd separately (CentOS 8). 38 | package: 39 | name: https://download.docker.com/linux/centos/7/x86_64/stable/Packages/containerd.io-1.2.6-3.3.el7.x86_64.rpm 40 | state: present 41 | when: ansible_distribution_major_version | int == 8 42 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-brakeman/brakeman-scan/main.yml: -------------------------------------------------------------------------------- 1 | - name: Brakeman Scanning Playbook 2 | hosts: scanner 3 | remote_user: ubuntu 4 | become: yes 5 | gather_facts: false 6 | vars: 7 | repo_url: https://github.com/OWASP/railsgoat.git 8 | output_dir: /tmp/railsgoat/ 9 | report_name: report.html 10 | 11 | tasks: 12 | - name: installing ruby and git 13 | apt: 14 | name: "{{ item }}" 15 | update_cache: yes 16 | state: present 17 | 18 | with_items: 19 | - ruby-full 20 | - git 21 | 22 | - name: installing brakeman gem 23 | gem: 24 | name: brakeman 25 | state: present 26 | 27 | - name: cloning the {{ repo_url }} 28 | git: 29 | repo: "{{ repo_url }}" 30 | dest: "{{ output_dir }}" 31 | 32 | - name: Brakeman scanning in action 33 | # Output available in text, html, tabs, json, markdown and csv formats 34 | command: "brakeman -p {{ output_dir }} -o {{ output_dir }}report.html" 35 | # Error handling for brakeman output 36 | failed_when: result.rc != 3 37 | register: result 38 | 39 | - name: Downloading the report 40 | fetch: 41 | src: "{{ output_dir }}/report.html" 42 | dest: "{{ report_name }}" 43 | flat: yes 44 | 45 | - debug: 46 | msg: "Report can be found at {{ report_name }}" 47 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/vuls/roles/vuls_database_download/tasks/main.yml: -------------------------------------------------------------------------------- 1 | - name: fetching NVD database locally 2 | docker_container: 3 | name: "cve-{{ item }}" 4 | image: vuls/go-cve-dictionary 5 | auto_remove: yes 6 | interactive: yes 7 | state: started 8 | command: fetchnvd -years "{{ item }}" 9 | volumes: 10 | - "{{ vuls_data_directory }}:/vuls" 11 | - "{{ vuls_data_directory }}/go-cve-dictionary-log:/var/log/vuls" 12 | with_sequence: start=2002 end="{{ nvd_database_years }}" 13 | 14 | - name: fetching redhat oval data 15 | docker_container: 16 | name: "redhat-oval-{{ item }}" 17 | image: vuls/goval-dictionary 18 | auto_remove: yes 19 | interactive: yes 20 | state: started 21 | command: fetch-redhat "{{ item }}" 22 | volumes: 23 | - "{{ vuls_data_directory }}:/vuls" 24 | - "{{ vuls_data_directory }}/goval-dictionary-log:/var/log/vuls" 25 | with_items: "{{ redhat_oval_versions }}" 26 | 27 | - name: fetching ubuntu oval data 28 | docker_container: 29 | name: "ubuntu-oval-{{ item }}" 30 | image: vuls/goval-dictionary 31 | auto_remove: yes 32 | interactive: yes 33 | state: started 34 | command: "fetch-ubuntu {{ item }}" 35 | volumes: 36 | - "{{ vuls_data_directory }}:/vuls" 37 | - "{{ vuls_data_directory }}/goval-dictionary-log:/var/log/vuls" 38 | with_items: "{{ ubuntu_oval_versions }}" -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-dependency-check/owasp-scala-dependency-check/README.md: -------------------------------------------------------------------------------- 1 | ### Pre: Install sbt on jenkins-slave 2 | 3 | CentOS Example: 4 | ``` 5 | curl https://bintray.com/sbt/rpm/rpm | sudo tee /etc/yum.repos.d/bintray-sbt-rpm.repo 6 | sudo yum install sbt 7 | ``` 8 | ### build.sbt (SCALA-PROJECT-example) 9 | ``` 10 | ... 11 | dependencyCheckSuppressionFiles += (ThisBuild / baseDirectory).value / "project" / "owasp.xml" 12 | dependencyCheckFormat := "ALL" 13 | dependencyCheckAssemblyAnalyzerEnabled := Some(false) 14 | ... 15 | ``` 16 | ### owasp.xml (SCALA-PROJECT-example) 17 | 18 | ``` 19 | 20 | 21 | 22 | 26 | ^org\.postgresql:postgresql:.*$ 27 | cpe:/a:postgresql:postgresql 28 | 29 | 30 | ... 31 | 32 | 33 | 34 | ``` 35 | ### DevSecOps J.Pipeline example: [Jenkinsfile](https://github.com/adavarski/DevSecOps-pipelines/blob/main/scala-owasp/Jenkinsfile-SCALA-PROJECT-example) 36 | 37 | Based on [DependencyCheck](https://github.com/jeremylong/DependencyCheck) & [SBT Plugin for OWASP DependencyCheck](https://github.com/albuch/sbt-dependency-check) 38 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/anchore-cli-scan/main.yml: -------------------------------------------------------------------------------- 1 | - name: anchore-cli scan 2 | hosts: anchore 3 | become: yes 4 | vars: 5 | scan_image_name: "docker.io/library/ubuntu:latest" 6 | anchore_vars: 7 | ANCHORE_CLI_URL: http://localhost:8228/v1 8 | ANCHORE_CLI_USER: admin 9 | ANCHORE_CLI_PASS: secretpassword 10 | 11 | tasks: 12 | - name: installing anchore-cli 13 | pip: 14 | name: "{{ item }}" 15 | 16 | with_items: 17 | - anchorecli 18 | - pyyaml 19 | 20 | - name: downloading image 21 | docker_image: 22 | name: "{{ scan_image_name }}" 23 | 24 | - name: adding image for analysis 25 | command: "anchore-cli image add {{ scan_image_name }}" 26 | environment: "{{anchore_vars}}" 27 | 28 | - name: wait for analysis to compelte 29 | command: "anchore-cli image content {{ scan_image_name }} os" 30 | register: analysis 31 | until: analysis.rc != 1 32 | retries: 10 33 | delay: 30 34 | ignore_errors: yes 35 | environment: "{{anchore_vars}}" 36 | 37 | - name: vulnerabilities results 38 | command: "anchore-cli image vuln {{ scan_image_name }} os" 39 | register: vuln_output 40 | environment: "{{anchore_vars}}" 41 | 42 | - name: "vulnerabilities in {{ scan_image_name }}" 43 | debug: 44 | msg: "{{ vuln_output.stdout_lines }}" 45 | 46 | -------------------------------------------------------------------------------- /infrastructure/aws/terraform/Jenkins-EC2/main.tf.Route53: -------------------------------------------------------------------------------- 1 | # Use AWS Terraform provider 2 | provider "aws" { 3 | region = "us-east-2" 4 | } 5 | 6 | 7 | data "template_file" "myuserdata" { 8 | template = "${file("${path.cwd}/user-data.tpl")}" 9 | } 10 | 11 | # Create EC2 instance 12 | resource "aws_instance" "jenkins-tf" { 13 | ami = var.ami 14 | key_name = var.key_name 15 | vpc_security_group_ids = [aws_security_group.demo-tf.id] 16 | source_dest_check = false 17 | instance_type = var.instance_type 18 | user_data = "${data.template_file.myuserdata.template}" 19 | tags = { 20 | Name = "Instance for Jenkins testing" 21 | } 22 | } 23 | 24 | 25 | # Create Security Group for EC2 26 | resource "aws_security_group" "demo-tf" { 27 | name = "terraform-demo-sg" 28 | 29 | ingress { 30 | from_port = 0 31 | to_port = 0 32 | protocol = "-1" 33 | cidr_blocks = ["0.0.0.0/0"] 34 | } 35 | 36 | 37 | egress { 38 | from_port = 0 39 | to_port = 0 40 | protocol = "-1" 41 | cidr_blocks = ["0.0.0.0/0"] 42 | } 43 | 44 | } 45 | 46 | resource "aws_route53_zone" "primary" { 47 | name = "devops-demo.com" 48 | } 49 | 50 | resource "aws_route53_record" "jenkins" { 51 | zone_id = aws_route53_zone.primary.id 52 | name = "jenkins" 53 | type = "A" 54 | ttl = "300" 55 | records = [aws_instance.jenkins-tf.public_ip] 56 | } 57 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/anchore-server/main.yml: -------------------------------------------------------------------------------- 1 | - name: anchore server setup 2 | hosts: anchore 3 | become: yes 4 | vars: 5 | db_password: changeme 6 | admin_password: secretpassword 7 | 8 | tasks: 9 | - name: creating volumes 10 | file: 11 | path: "{{ item }}" 12 | recurse: yes 13 | state: directory 14 | 15 | with_items: 16 | - /root/aevolume/db 17 | - /root/aevolume/config 18 | 19 | - name: copying anchore-engine configuration 20 | template: 21 | src: config.yaml.j2 22 | dest: /root/aevolume/config/config.yaml 23 | 24 | - name: starting anchore-db container 25 | docker_container: 26 | name: anchore-db 27 | image: postgres:9 28 | volumes: 29 | - "/root/aevolume/db/:/var/lib/postgresql/data/pgdata/" 30 | env: 31 | POSTGRES_PASSWORD: "{{ db_password }}" 32 | PGDATA: "/var/lib/postgresql/data/pgdata/" 33 | 34 | - name: starting anchore-engine container 35 | docker_container: 36 | name: anchore-engine 37 | image: anchore/anchore-engine 38 | ports: 39 | - 8228:8228 40 | - 8338:8338 41 | volumes: 42 | - "/root/aevolume/config/config.yaml:/config/config.yaml:ro" 43 | - "/var/run/docker.sock:/var/run/docker.sock:ro" 44 | links: 45 | - anchore-db:anchore-db 46 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Lynis/lynis/main.yml: -------------------------------------------------------------------------------- 1 | - name: Lynis security audit playbook 2 | hosts: lynis 3 | remote_user: ubuntu 4 | become: yes 5 | vars: 6 | # refer to https://packages.cisofy.com/community 7 | code_name: xenial 8 | 9 | tasks: 10 | - name: adding lynis repo key 11 | apt_key: 12 | keyserver: keyserver.ubuntu.com 13 | id: C80E383C3DE9F082E01391A0366C67DE91CA5D5F 14 | state: present 15 | 16 | - name: installing apt-transport-https 17 | apt: 18 | name: apt-transport-https 19 | state: present 20 | 21 | - name: adding repo 22 | apt_repository: 23 | repo: "deb https://packages.cisofy.com/community/lynis/deb/ {{ code_name }} main" 24 | state: present 25 | filename: "cisofy-lynis" 26 | 27 | - name: installing lynis 28 | apt: 29 | name: lynis 30 | update_cache: yes 31 | state: present 32 | 33 | - name: audit scan the system 34 | shell: lynis audit system > /tmp/lynis-output.log 35 | 36 | - name: downloading report locally 37 | fetch: 38 | src: /tmp/lynis-output.log 39 | dest: ./{{ inventory_hostname }}-lynis-report-{{ ansible_date_time.date }}.log 40 | flat: yes 41 | 42 | - name: report location 43 | debug: 44 | msg: "Report can be found at ./{{ inventory_hostname }}-lynis-report-{{ ansible_date_time.date }}.log" -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/geerlingguy.docker/defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # Edition can be one of: 'ce' (Community Edition) or 'ee' (Enterprise Edition). 3 | docker_edition: 'ce' 4 | docker_package: "docker-{{ docker_edition }}" 5 | docker_package_state: present 6 | 7 | # Service options. 8 | docker_service_state: started 9 | docker_service_enabled: true 10 | docker_restart_handler_state: restarted 11 | 12 | # Docker Compose options. 13 | docker_install_compose: true 14 | docker_compose_version: "1.25.4" 15 | docker_compose_path: /usr/local/bin/docker-compose 16 | 17 | # Used only for Debian/Ubuntu. Switch 'stable' to 'edge' if needed. 18 | docker_apt_release_channel: stable 19 | docker_apt_arch: amd64 20 | docker_apt_repository: "deb [arch={{ docker_apt_arch }}] https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} {{ docker_apt_release_channel }}" 21 | docker_apt_ignore_key_error: true 22 | docker_apt_gpg_key: https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg 23 | 24 | # Used only for RedHat/CentOS/Fedora. 25 | docker_yum_repo_url: https://download.docker.com/linux/{{ (ansible_distribution == "Fedora") | ternary("fedora","centos") }}/docker-{{ docker_edition }}.repo 26 | docker_yum_repo_enable_edge: '0' 27 | docker_yum_repo_enable_test: '0' 28 | docker_yum_gpg_key: https://download.docker.com/linux/centos/gpg 29 | 30 | # A list of users who will be added to the docker group. 31 | docker_users: [] 32 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins/setupJenkins.groovy: -------------------------------------------------------------------------------- 1 | import jenkins.model.* 2 | import hudson.security.* 3 | import jenkins.security.s2m.AdminWhitelistRule 4 | import jenkins.model.Jenkins 5 | import hudson.security.csrf.DefaultCrumbIssuer 6 | 7 | //don't let slave instance kill the master 8 | Jenkins.instance.getInjector().getInstance(AdminWhitelistRule.class) 9 | .setMasterKillSwitch(false) 10 | 11 | def env = System.getenv() 12 | 13 | /* 14 | Jenkins needs URL in order for reference links to point to other pages, resources, pipeline build etc 15 | */ 16 | jlc = JenkinsLocationConfiguration.get() 17 | jlc.setUrl("http://"+env.JenkinsPublicHostname +":8080/") 18 | jlc.save() 19 | 20 | //Set CSRF token for Jenkins server 21 | def instance = Jenkins.instance 22 | instance.setCrumbIssuer(new DefaultCrumbIssuer(true)) 23 | instance.save() 24 | 25 | /* 26 | Create admin user to login 27 | */ 28 | def jenkins = Jenkins.getInstance() 29 | if(!(jenkins.getSecurityRealm() instanceof HudsonPrivateSecurityRealm)) 30 | jenkins.setSecurityRealm(new HudsonPrivateSecurityRealm(false)) 31 | 32 | if(!(jenkins.getAuthorizationStrategy() instanceof GlobalMatrixAuthorizationStrategy)) 33 | jenkins.setAuthorizationStrategy(new GlobalMatrixAuthorizationStrategy()) 34 | 35 | def user = jenkins.getSecurityRealm().createAccount("admin", env.Jenkins_PW) 36 | user.save() 37 | jenkins.getAuthorizationStrategy().add(Jenkins.ADMINISTER, "admin") 38 | 39 | jenkins.save() 40 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/reports/docker_lynis-report.dat: -------------------------------------------------------------------------------- 1 | # Lynis Report 2 | report_version_major=1 3 | report_version_minor=0 4 | report_datetime_start=2021-03-01 08:28:16 5 | auditor=[Not Specified] 6 | lynis_version=2.7.5 7 | os=Linux 8 | os_name=Debian 9 | os_fullname=Debian 10.8 10 | os_version=10.8 11 | linux_version=Debian 12 | os_kernel_version=5.0.0 13 | os_kernel_version_full=5.0.0-32-generic 14 | hostname=daaeb5e00ea6 15 | test_category=all 16 | test_group=all 17 | plugin_directory=./plugins 18 | lynis_update_available=-1 19 | suggestion[]=LYNIS|This release is more than 4 months old. Consider upgrading|-|-| 20 | binaries_count=940 21 | binary_paths=/bin,/sbin,/usr/bin,/usr/sbin,/usr/local/bin,/usr/local/sbin,/opt/java/openjdk/bin 22 | vm=2 23 | container=1 24 | container_type=Docker 25 | systemd=0 26 | hostid=655b6bfe5059ad5dc8bba308dabe61094ebbcc4e 27 | warning[]=dockerfile|No maintainer found. Unclear who created this file.|-|-| 28 | warning[]=dockerfile|No ENTRYPOINT defined in Dockerfile.|-|-| 29 | warning[]=dockerfile|No user declared in Dockerfile. Container will execute command as root|-|-| 30 | lynis_tests_done=1 31 | report_datetime_end=2021-03-01 08:28:23 32 | dhcp_client_running= 33 | arpwatch_running= 34 | firewall_active=0 35 | firewall_empty_ruleset= 36 | firewall_installed=0 37 | package_audit_tool= 38 | package_audit_tool_found= 39 | vulnerable_packages_found=0 40 | hardening_index=1 41 | tests_executed=CORE-1000| 42 | tests_skipped= 43 | finish=true 44 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/group_vars/all.yml: -------------------------------------------------------------------------------- 1 | #ec2 information 2 | instance_type: t2.medium 3 | security_group_build: "sgBuild" 4 | security_group_deployment: "sgDeploy" 5 | id_token_build: "550e8400-e29b-41d4-a716-446655440070" 6 | id_token_preprod: "550e8400-e29b-41d4-a716-446655440071" 7 | id_token_prod: "550e8400-e29b-41d4-a716-446655440072" 8 | host_group_name_build: "build" 9 | host_group_name_preprod: "preprod" 10 | host_group_name_prod: "prod" 11 | aim_centos7: "ami-0083662ba17882949" 12 | key_name: "aws-us-east1-devsecops" 13 | region: "us-east-1" 14 | 15 | #deployment information 16 | home: "/home/centos" 17 | dns_addr_server_gitlab: "ec2-18-211-180-13.compute-1.amazonaws.com" 18 | gitlab_docker_repo: "mypipeline" 19 | source_branch: "master" 20 | application_name: "visitors-app" 21 | application_name_db: "visitors-db" 22 | application_name_backend: "visitors-service" 23 | application_name_frontend: "visitors-webui" 24 | 25 | gitlab_repos_application_name: "ssh://git@ec2-18-211-180-13.compute-1.amazonaws.com:2222/adavarski/app.git" 26 | 27 | image_name_back_end: "visitors-service" 28 | image_name_front_end: "visitors-webui" 29 | image_name_database: "visitors-db" 30 | clair_server: "172.17.0.1" 31 | 32 | #vaulted info 33 | gitlab_container_registry_username: "{{ gitlab_container_registry_username_vault }}" 34 | gitlab_container_registry_password: "{{ gitlab_container_registry_password_vault }}" 35 | certificate_domaine: "{{ certificate_domaine_vault }}" 36 | gitlab_private_key: "{{ gitlab_private_key_vault }}" 37 | -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/manifests/backend.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: apps/v1 3 | kind: Deployment 4 | metadata: 5 | name: visitors-backend 6 | spec: 7 | replicas: 1 8 | selector: 9 | matchLabels: 10 | app: visitors 11 | tier: backend 12 | template: 13 | metadata: 14 | labels: 15 | app: visitors 16 | tier: backend 17 | spec: 18 | containers: 19 | - name: visitors-backend 20 | image: "davarski/visitors-service:1.0.0" 21 | imagePullPolicy: Always 22 | ports: 23 | - name: visitors 24 | containerPort: 8000 25 | env: 26 | - name: MYSQL_DATABASE 27 | value: visitors_db 28 | - name: MYSQL_SERVICE_HOST 29 | value: mysql-service 30 | - name: MYSQL_USERNAME 31 | valueFrom: 32 | secretKeyRef: 33 | name: mysql-auth 34 | key: username 35 | - name: MYSQL_PASSWORD 36 | valueFrom: 37 | secretKeyRef: 38 | name: mysql-auth 39 | key: password 40 | --- 41 | apiVersion: v1 42 | kind: Service 43 | metadata: 44 | name: visitors-backend-service 45 | labels: 46 | app: visitors 47 | tier: backend 48 | spec: 49 | type: NodePort 50 | ports: 51 | - port: 8000 52 | targetPort: 8000 53 | nodePort: 30685 54 | protocol: TCP 55 | selector: 56 | app: visitors 57 | tier: backend 58 | -------------------------------------------------------------------------------- /infrastructure/k8s/minikube/manifests/backend.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: apps/v1 3 | kind: Deployment 4 | metadata: 5 | name: visitors-backend 6 | spec: 7 | replicas: 1 8 | selector: 9 | matchLabels: 10 | app: visitors 11 | tier: backend 12 | template: 13 | metadata: 14 | labels: 15 | app: visitors 16 | tier: backend 17 | spec: 18 | containers: 19 | - name: visitors-backend 20 | image: "davarski/visitors-service:1.0.0" 21 | imagePullPolicy: Always 22 | ports: 23 | - name: visitors 24 | containerPort: 8000 25 | env: 26 | - name: MYSQL_DATABASE 27 | value: visitors_db 28 | - name: MYSQL_SERVICE_HOST 29 | value: mysql-service 30 | - name: MYSQL_USERNAME 31 | valueFrom: 32 | secretKeyRef: 33 | name: mysql-auth 34 | key: username 35 | - name: MYSQL_PASSWORD 36 | valueFrom: 37 | secretKeyRef: 38 | name: mysql-auth 39 | key: password 40 | --- 41 | apiVersion: v1 42 | kind: Service 43 | metadata: 44 | name: visitors-backend-service 45 | labels: 46 | app: visitors 47 | tier: backend 48 | spec: 49 | type: NodePort 50 | ports: 51 | - port: 8000 52 | targetPort: 8000 53 | nodePort: 30685 54 | protocol: TCP 55 | selector: 56 | app: visitors 57 | tier: backend 58 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/setup-ubuntu.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | #apt-get update 4 | #apt install docker.io -y 5 | #apt-get install -y docker-compose 6 | #apt install default-jre -y 7 | 8 | #have to relogin as ubuntu user 9 | #usermod -aG docker ubuntu 10 | 11 | # restart new session with docker group 12 | #newgrp docker 13 | 14 | #let docker run when server is restarted 15 | #systemctl enable docker 16 | 17 | #create random password for jenkins user which will be created automatically 18 | export Jenkins_PW=$(openssl rand -base64 16) 19 | export JAVA_OPTS="-Djenkins.install.runSetupWizard=false" 20 | 21 | #we're providing the server its public hostname for its relative links 22 | #export JenkinsPublicHostname=$(curl -s http://169.254.169.254/latest/meta-data/public-hostname) 23 | #export SeleniumPrivateIp=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4) 24 | 25 | #build the jenkins container 26 | docker-compose up -d --build 27 | 28 | #let the jenkins docker complete bootstrapping with our groovy script provided 29 | sleep 45 30 | 31 | #create new environment without inheriting anything from this shell for this wget to work.. 32 | env -i /bin/bash -c 'wget http://127.0.0.1:8080/jnlpJars/jenkins-cli.jar' 33 | 34 | sleep 5 35 | 36 | #create the pipeline in jenkins 37 | java -jar ./jenkins-cli.jar -s http://localhost:8080 -auth admin:$Jenkins_PW create-job DevSecOps-pipeline-python < config.xml 38 | 39 | echo "------- Your temporary Jenkins login ---------" 40 | echo "admin" 41 | echo $Jenkins_PW 42 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins_home/hostaudit.yml: -------------------------------------------------------------------------------- 1 | # Run lynis audit on system and fetch logs 2 | - name: Run host audit in instance(s) 3 | hosts: tstlaunched 4 | remote_user: ubuntu 5 | gather_facts: False 6 | tasks: 7 | - name: Get the lynis installer 8 | get_url: 9 | url: https://downloads.cisofy.com/lynis/lynis-2.7.5.tar.gz 10 | dest: /tmp/ 11 | - name: Unzip it 12 | unarchive: 13 | src: /tmp/lynis-2.7.5.tar.gz 14 | dest: /home/ubuntu/ 15 | copy: no 16 | - name: Run system audit 17 | shell: ./lynis audit system --quick --auditor "The Auditor" | ansi2html > host_audit_report.html 18 | args: 19 | chdir: lynis/ 20 | - name: Fetch log file from host 21 | fetch: 22 | src: /tmp/lynis.log 23 | dest: "{{ logfolder }}" 24 | flat: yes 25 | - name: Fetch report file from host 26 | fetch: 27 | src: /tmp/lynis-report.dat 28 | dest: "{{ logfolder }}" 29 | flat: yes 30 | - name: Fetch fancy html report 31 | fetch: 32 | src: /home/ubuntu/lynis/host_audit_report.html 33 | dest: "{{ logfolder }}" 34 | flat: yes 35 | - name: Remove html report on host 36 | file: 37 | path: /home/ubuntu/lynis/host_audit_report.html 38 | state: absent 39 | - name: Remove log file on host 40 | file: 41 | path: /tmp/lynis.log 42 | state: absent 43 | - name: Remove report on host 44 | file: 45 | path: /tmp/lynis-report.dat 46 | state: absent 47 | -------------------------------------------------------------------------------- /infrastructure/k8s/aws-KOPS/manifests/database.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: v1 3 | kind: Secret 4 | metadata: 5 | name: mysql-auth 6 | type: Opaque 7 | stringData: 8 | username: visitors-user 9 | password: visitors-pass 10 | --- 11 | apiVersion: apps/v1 12 | kind: Deployment 13 | metadata: 14 | name: mysql 15 | spec: 16 | replicas: 1 17 | selector: 18 | matchLabels: 19 | app: visitors 20 | tier: mysql 21 | template: 22 | metadata: 23 | labels: 24 | app: visitors 25 | tier: mysql 26 | spec: 27 | containers: 28 | - name: visitors-mysql 29 | image: "mysql:5.7" 30 | imagePullPolicy: Always 31 | ports: 32 | - name: mysql 33 | containerPort: 3306 34 | protocol: TCP 35 | env: 36 | - name: MYSQL_ROOT_PASSWORD 37 | value: password 38 | - name: MYSQL_DATABASE 39 | value: visitors_db 40 | - name: MYSQL_USER 41 | valueFrom: 42 | secretKeyRef: 43 | name: mysql-auth 44 | key: username 45 | - name: MYSQL_PASSWORD 46 | valueFrom: 47 | secretKeyRef: 48 | name: mysql-auth 49 | key: password 50 | --- 51 | apiVersion: v1 52 | kind: Service 53 | metadata: 54 | name: mysql-service 55 | labels: 56 | app: visitors 57 | tier: mysql 58 | spec: 59 | clusterIP: None 60 | ports: 61 | - port: 3306 62 | selector: 63 | app: visitors 64 | tier: mysql 65 | -------------------------------------------------------------------------------- /infrastructure/k8s/minikube/manifests/database.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: v1 3 | kind: Secret 4 | metadata: 5 | name: mysql-auth 6 | type: Opaque 7 | stringData: 8 | username: visitors-user 9 | password: visitors-pass 10 | --- 11 | apiVersion: apps/v1 12 | kind: Deployment 13 | metadata: 14 | name: mysql 15 | spec: 16 | replicas: 1 17 | selector: 18 | matchLabels: 19 | app: visitors 20 | tier: mysql 21 | template: 22 | metadata: 23 | labels: 24 | app: visitors 25 | tier: mysql 26 | spec: 27 | containers: 28 | - name: visitors-mysql 29 | image: "mysql:5.7" 30 | imagePullPolicy: Always 31 | ports: 32 | - name: mysql 33 | containerPort: 3306 34 | protocol: TCP 35 | env: 36 | - name: MYSQL_ROOT_PASSWORD 37 | value: password 38 | - name: MYSQL_DATABASE 39 | value: visitors_db 40 | - name: MYSQL_USER 41 | valueFrom: 42 | secretKeyRef: 43 | name: mysql-auth 44 | key: username 45 | - name: MYSQL_PASSWORD 46 | valueFrom: 47 | secretKeyRef: 48 | name: mysql-auth 49 | key: password 50 | --- 51 | apiVersion: v1 52 | kind: Service 53 | metadata: 54 | name: mysql-service 55 | labels: 56 | app: visitors 57 | tier: mysql 58 | spec: 59 | clusterIP: None 60 | ports: 61 | - port: 3306 62 | selector: 63 | app: visitors 64 | tier: mysql 65 | -------------------------------------------------------------------------------- /infrastructure/aws/terraform/Jenkins-EC2/user-data.tpl: -------------------------------------------------------------------------------- 1 | #cloud-config 2 | runcmd: 3 | # get/setup instance name 4 | - hostnamectl set-hostname `curl -s http://169.254.169.254/latest/meta-data/public-hostname` 5 | # Install jenkins 6 | - sudo apt update 7 | - sudo apt install -y openjdk-11-jre-headless 8 | - sudo sleep 60 9 | - wget -q -O - https://pkg.jenkins.io/debian/jenkins.io.key | sudo apt-key add - 10 | - sudo sh -c 'echo deb http://pkg.jenkins.io/debian-stable binary/ > /etc/apt/sources.list.d/jenkins.list' 11 | - sudo apt update 12 | - sudo apt install -y jenkins 13 | - sudo systemctl enable jenkins 14 | - sudo systemctl start jenkins 15 | #Install docker 16 | - sudo apt install -y apt-transport-https ca-certificates curl software-properties-common 17 | - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - 18 | - sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable" 19 | - sudo apt update 20 | - sudo apt-cache policy docker-ce 21 | - sudo apt install -y docker-ce 22 | - sudo usermod -aG docker jenkins 23 | - sudo usermod -aG docker ubuntu 24 | - sudo systemctl enable docker 25 | - sudo systemctl start docker 26 | # Install awscli 27 | - apt install -y python3-pip 28 | - pip3 install awscli 29 | #Install terraform 30 | - curl https://releases.hashicorp.com/terraform/0.14.4/terraform_0.14.4_linux_amd64.zip -o /tmp/terraform_0.14.4_linux_amd64.zip 31 | - sudo apt install -y unzip 32 | - unzip /tmp/terraform_0.14.4_linux_amd64.zip 33 | - sudo mv terraform /usr/local/bin/ 34 | #Install pkgs (for J.docker pipeline plugin) 35 | - sudo apt install -y gnupg2 pass 36 | -------------------------------------------------------------------------------- /utils/8-jenkins-docker-utils/docker-bandit/Jenkinsfile-SAST-Bandit-PYTHON_PROJECT-example: -------------------------------------------------------------------------------- 1 | pipeline { 2 | 3 | agent { 4 | label 'jenkins-slave-10' 5 | } 6 | 7 | options { 8 | timestamps() 9 | disableConcurrentBuilds() 10 | } 11 | 12 | stages { 13 | stage('Clone PYTHON_PROJECT_NAME Master Branch') { 14 | steps { 15 | 16 | checkout([$class: 'GitSCM', 17 | branches: [[name: "master"]], 18 | doGenerateSubmoduleConfigurations: false, 19 | extensions: [[$class: 'RelativeTargetDirectory', relativeTargetDir: 'PYTHON_PROJECT_NAME']], 20 | submoduleCfg: [], 21 | userRemoteConfigs: [[credentialsId: 'adavarski-github', url: 'git@github.com:adavarski/PYTHON_PROJECT_NAME.git']] 22 | ]) 23 | } 24 | } 25 | 26 | 27 | stage('Bandit Static Analyze PYTHON_PROJECT_NAME') { 28 | steps { 29 | dir('PYTHON_PROJECT_NAME') { 30 | script { 31 | sh 'docker run -u root --rm -v ${PWD}:/app davarski/bandit bandit -r ./ -f html -o PYTHON_PROJECT_NAME.html||true' 32 | } 33 | } 34 | } 35 | } 36 | 37 | 38 | stage('Publish Security Report') { 39 | steps { 40 | script { 41 | publishHTML (target: [ 42 | allowMissing: false, 43 | alwaysLinkToLastBuild: false, 44 | keepAll: true, 45 | reportDir: './PYTHON_PROJECT_NAME', 46 | reportFiles: 'PYTHON_PROJECT_NAME.html', 47 | reportName: "PYTHON_PROJECT_NAME Vulnerability Report" 48 | ]) 49 | } 50 | } 51 | } 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /infrastructure/k8s/minikube/README.md: -------------------------------------------------------------------------------- 1 | ### Setup k8s minikube-based development environment 2 | ``` 3 | $ ./setup_environment.sh 4 | ``` 5 | 6 | Check: 7 | 8 | ``` 9 | $ kubectl version 10 | Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:18:23Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"} 11 | Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:09:08Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"} 12 | ``` 13 | 14 | Note: Server & Client has to be the same Minor versions. 15 | 16 | ### Manifest-based installation 17 | 18 | ``` 19 | $ kubectl apply -f manifests/database.yaml 20 | $ kubectl apply -f manifests/backend.yaml 21 | $ kubectl apply -f manifests/frontend.yaml 22 | $ minikube ip 23 | 192.168.99.100 24 | ``` 25 | 26 | You can access the Visitors Site by opening a browser and 27 | going to http://192.168.99.100:30686. 28 | 29 | 30 | 31 | 32 | Cleaning up: 33 | 34 | ``` 35 | $ kubectl delete -f manifests/frontend.yaml 36 | $ kubectl delete -f manifests/backend.yaml 37 | $ kubectl delete -f manifests/database.yaml 38 | 39 | ``` 40 | ### Ref1: minikube + GitLab example: 41 | 42 | https://github.com/adavarski/minikube-gitlab-development 43 | 44 | ### Ref2: Kubernetes Operators (Helm, Ansible, Go) example: 45 | 46 | https://github.com/adavarski/k8s-operators-playground 47 | 48 | 49 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins_home/createAwsEc2.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # Create ec2 instance and add it to ansible inventory 3 | - name: Create a sandbox instance 4 | hosts: localhost 5 | connection: local 6 | gather_facts: False 7 | vars: 8 | keyname: devsecops 9 | instance_type: t2.micro 10 | security_group: devsecops-python 11 | image: ami-0be057a22c63962cb 12 | region: eu-west-2 13 | tagname: Name=DevSecOps 14 | 15 | tasks: 16 | - name: Upload public key to AWS 17 | ec2_key: 18 | name: "{{ keyname }}" 19 | key_material: "{{ lookup('file', '~/.ssh/{{ keyname }}.pub') }}" 20 | region: "{{ region }}" 21 | 22 | - name: Launch instance 23 | ec2: 24 | key_name: "{{ keyname }}" 25 | group: "{{ security_group }}" 26 | instance_type: "{{ instance_type }}" 27 | image: "{{ image }}" 28 | wait: true 29 | region: "{{ region }}" 30 | vpc_subnet_id: subnet-f97e5d90 31 | assign_public_ip: yes 32 | instance_tags: "{{tagname}}" 33 | register: ec2 34 | 35 | - name: Add new instance to hosts group for test 36 | local_action: lineinfile 37 | dest="~/ansible_hosts" 38 | regexp={{ item.public_ip }} 39 | insertafter="[tstlaunched]" 40 | line="{{ item.public_ip }}" 41 | state=present 42 | with_items: "{{ ec2.instances }}" 43 | 44 | - name: Wait for SSH to come up 45 | local_action: wait_for 46 | host={{ item.public_ip }} 47 | port=22 48 | state=started 49 | with_items: "{{ ec2.instances }}" 50 | -------------------------------------------------------------------------------- /utils/5-ansible-devsecops-docker-utils/osquery-setup/templates/osquery.conf: -------------------------------------------------------------------------------- 1 | { 2 | "options": { 3 | "config_plugin": "filesystem", 4 | "logger_plugin": "filesystem", 5 | "logger_path": "/var/log/osquery", 6 | "disable_logging": "false", 7 | "log_result_events": "true", 8 | "schedule_splay_percent": "10", 9 | "pidfile": "/var/osquery/osquery.pidfile", 10 | "events_expiry": "3600", 11 | "database_path": "/var/osquery/osquery.db", 12 | "verbose": "false", 13 | "worker_threads": "2", 14 | "enable_monitor": "true", 15 | "disable_events": "false", 16 | "disable_audit": "false", 17 | "audit_allow_config": "true", 18 | "host_identifier": "hostname", 19 | "enable_syslog": "true", 20 | "audit_allow_sockets": "true", 21 | "schedule_default_interval": "3600" 22 | }, 23 | "schedule": { 24 | "crontab": { 25 | "query": "SELECT * FROM crontab;", 26 | "interval": 300 27 | }, 28 | "system_profile": { 29 | "query": "SELECT * FROM osquery_schedule;" 30 | }, 31 | "system_info": { 32 | "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;", 33 | "interval": 3600 34 | } 35 | }, 36 | "decorators": { 37 | "load": [ 38 | "SELECT uuid AS host_uuid FROM system_info;", 39 | "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;" 40 | ] 41 | }, 42 | "packs": { 43 | "fim": "/usr/share/osquery/packs/fim.conf", 44 | "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf", 45 | "incident-response": "/usr/share/osquery/packs/incident-response.conf", 46 | "it-compliance": "/usr/share/osquery/packs/it-compliance.conf", 47 | "vuln-management": "/usr/share/osquery/packs/vuln-management.conf" 48 | } 49 | } -------------------------------------------------------------------------------- /app/docker/visitors-webui/public/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | Visitors Dashboard 24 | 25 | 26 |
27 | 37 | 38 | 39 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/scan-artefact/meta/main.yml: -------------------------------------------------------------------------------- 1 | galaxy_info: 2 | author: your name 3 | description: your role description 4 | company: your company (optional) 5 | 6 | # If the issue tracker for your role is not on github, uncomment the 7 | # next line and provide a value 8 | # issue_tracker_url: http://example.com/issue/tracker 9 | 10 | # Choose a valid license ID from https://spdx.org - some suggested licenses: 11 | # - BSD-3-Clause (default) 12 | # - MIT 13 | # - GPL-2.0-or-later 14 | # - GPL-3.0-only 15 | # - Apache-2.0 16 | # - CC-BY-4.0 17 | license: license (GPL-2.0-or-later, MIT, etc) 18 | 19 | min_ansible_version: 2.9 20 | 21 | # If this a Container Enabled role, provide the minimum Ansible Container version. 22 | # min_ansible_container_version: 23 | 24 | # 25 | # Provide a list of supported platforms, and for each platform a list of versions. 26 | # If you don't wish to enumerate all versions for a particular platform, use 'all'. 27 | # To view available platforms and versions (or releases), visit: 28 | # https://galaxy.ansible.com/api/v1/platforms/ 29 | # 30 | # platforms: 31 | # - name: Fedora 32 | # versions: 33 | # - all 34 | # - 25 35 | # - name: SomePlatform 36 | # versions: 37 | # - all 38 | # - 1.0 39 | # - 7 40 | # - 99.99 41 | 42 | galaxy_tags: [] 43 | # List tags for your role here, one per line. A tag is a keyword that describes 44 | # and categorizes the role. Users find roles by searching for tags. Be sure to 45 | # remove the '[]' above, if you add tags to this list. 46 | # 47 | # NOTE: A tag is limited to a single word comprised of alphanumeric characters. 48 | # Maximum 20 tags per role. 49 | 50 | dependencies: [] 51 | # List your role dependencies here, one per line. Be sure to remove the '[]' above, 52 | # if you add dependencies to this list. 53 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-application/meta/main.yml: -------------------------------------------------------------------------------- 1 | galaxy_info: 2 | author: your name 3 | description: your role description 4 | company: your company (optional) 5 | 6 | # If the issue tracker for your role is not on github, uncomment the 7 | # next line and provide a value 8 | # issue_tracker_url: http://example.com/issue/tracker 9 | 10 | # Choose a valid license ID from https://spdx.org - some suggested licenses: 11 | # - BSD-3-Clause (default) 12 | # - MIT 13 | # - GPL-2.0-or-later 14 | # - GPL-3.0-only 15 | # - Apache-2.0 16 | # - CC-BY-4.0 17 | license: license (GPL-2.0-or-later, MIT, etc) 18 | 19 | min_ansible_version: 2.9 20 | 21 | # If this a Container Enabled role, provide the minimum Ansible Container version. 22 | # min_ansible_container_version: 23 | 24 | # 25 | # Provide a list of supported platforms, and for each platform a list of versions. 26 | # If you don't wish to enumerate all versions for a particular platform, use 'all'. 27 | # To view available platforms and versions (or releases), visit: 28 | # https://galaxy.ansible.com/api/v1/platforms/ 29 | # 30 | # platforms: 31 | # - name: Fedora 32 | # versions: 33 | # - all 34 | # - 25 35 | # - name: SomePlatform 36 | # versions: 37 | # - all 38 | # - 1.0 39 | # - 7 40 | # - 99.99 41 | 42 | galaxy_tags: [] 43 | # List tags for your role here, one per line. A tag is a keyword that describes 44 | # and categorizes the role. Users find roles by searching for tags. Be sure to 45 | # remove the '[]' above, if you add tags to this list. 46 | # 47 | # NOTE: A tag is limited to a single word comprised of alphanumeric characters. 48 | # Maximum 20 tags per role. 49 | 50 | dependencies: [] 51 | # List your role dependencies here, one per line. Be sure to remove the '[]' above, 52 | # if you add dependencies to this list. 53 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/deploy-infrastructure/meta/main.yml: -------------------------------------------------------------------------------- 1 | galaxy_info: 2 | author: your name 3 | description: your role description 4 | company: your company (optional) 5 | 6 | # If the issue tracker for your role is not on github, uncomment the 7 | # next line and provide a value 8 | # issue_tracker_url: http://example.com/issue/tracker 9 | 10 | # Choose a valid license ID from https://spdx.org - some suggested licenses: 11 | # - BSD-3-Clause (default) 12 | # - MIT 13 | # - GPL-2.0-or-later 14 | # - GPL-3.0-only 15 | # - Apache-2.0 16 | # - CC-BY-4.0 17 | license: license (GPL-2.0-or-later, MIT, etc) 18 | 19 | min_ansible_version: 2.9 20 | 21 | # If this a Container Enabled role, provide the minimum Ansible Container version. 22 | # min_ansible_container_version: 23 | 24 | # 25 | # Provide a list of supported platforms, and for each platform a list of versions. 26 | # If you don't wish to enumerate all versions for a particular platform, use 'all'. 27 | # To view available platforms and versions (or releases), visit: 28 | # https://galaxy.ansible.com/api/v1/platforms/ 29 | # 30 | # platforms: 31 | # - name: Fedora 32 | # versions: 33 | # - all 34 | # - 25 35 | # - name: SomePlatform 36 | # versions: 37 | # - all 38 | # - 1.0 39 | # - 7 40 | # - 99.99 41 | 42 | galaxy_tags: [] 43 | # List tags for your role here, one per line. A tag is a keyword that describes 44 | # and categorizes the role. Users find roles by searching for tags. Be sure to 45 | # remove the '[]' above, if you add tags to this list. 46 | # 47 | # NOTE: A tag is limited to a single word comprised of alphanumeric characters. 48 | # Maximum 20 tags per role. 49 | 50 | dependencies: [] 51 | # List your role dependencies here, one per line. Be sure to remove the '[]' above, 52 | # if you add dependencies to this list. 53 | -------------------------------------------------------------------------------- /utils/1-ansible-aws-infra/roles/set-infrastructure-build/meta/main.yml: -------------------------------------------------------------------------------- 1 | galaxy_info: 2 | author: your name 3 | description: your role description 4 | company: your company (optional) 5 | 6 | # If the issue tracker for your role is not on github, uncomment the 7 | # next line and provide a value 8 | # issue_tracker_url: http://example.com/issue/tracker 9 | 10 | # Choose a valid license ID from https://spdx.org - some suggested licenses: 11 | # - BSD-3-Clause (default) 12 | # - MIT 13 | # - GPL-2.0-or-later 14 | # - GPL-3.0-only 15 | # - Apache-2.0 16 | # - CC-BY-4.0 17 | license: license (GPL-2.0-or-later, MIT, etc) 18 | 19 | min_ansible_version: 2.9 20 | 21 | # If this a Container Enabled role, provide the minimum Ansible Container version. 22 | # min_ansible_container_version: 23 | 24 | # 25 | # Provide a list of supported platforms, and for each platform a list of versions. 26 | # If you don't wish to enumerate all versions for a particular platform, use 'all'. 27 | # To view available platforms and versions (or releases), visit: 28 | # https://galaxy.ansible.com/api/v1/platforms/ 29 | # 30 | # platforms: 31 | # - name: Fedora 32 | # versions: 33 | # - all 34 | # - 25 35 | # - name: SomePlatform 36 | # versions: 37 | # - all 38 | # - 1.0 39 | # - 7 40 | # - 99.99 41 | 42 | galaxy_tags: [] 43 | # List tags for your role here, one per line. A tag is a keyword that describes 44 | # and categorizes the role. Users find roles by searching for tags. Be sure to 45 | # remove the '[]' above, if you add tags to this list. 46 | # 47 | # NOTE: A tag is limited to a single word comprised of alphanumeric characters. 48 | # Maximum 20 tags per role. 49 | 50 | dependencies: [] 51 | # List your role dependencies here, one per line. Be sure to remove the '[]' above, 52 | # if you add dependencies to this list. 53 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-dependency-check/owasp-dependency-check/main.yml: -------------------------------------------------------------------------------- 1 | - name: OWASP Dependency Check Playbook 2 | hosts: scanner 3 | remote_user: ubuntu 4 | become: yes 5 | vars: 6 | repo_url: https://github.com/psiinon/bodgeit.git 7 | output_dir: /tmp/bodgeit/ 8 | project_name: bodgeit 9 | report_name: report.html 10 | 11 | tasks: 12 | - name: installing pre requisuites 13 | apt: 14 | name: "{{ item }}" 15 | state: present 16 | update_cache: yes 17 | 18 | with_items: 19 | - git 20 | - unzip 21 | - mono-runtime 22 | - mono-devel 23 | - default-jre 24 | 25 | - name: downloading owasp dependency-check 26 | unarchive: 27 | src: http://dl.bintray.com/jeremy-long/owasp/dependency-check-3.0.2-release.zip 28 | dest: /usr/share/ 29 | remote_src: yes 30 | 31 | - name: adding symlink to the system 32 | file: 33 | src: /usr/share/dependency-check/bin/dependency-check.sh 34 | dest: /usr/bin/dependency-check 35 | mode: 0755 36 | state: link 37 | 38 | - name: cloning the {{ repo_url }} 39 | git: 40 | repo: "{{ repo_url }}" 41 | dest: "{{ output_dir }}" 42 | 43 | - name: updating CVE database 44 | command: "dependency-check --updateonly" 45 | 46 | - name: OWASP dependency-check scanning in action 47 | # Output available in XML, HTML, CSV, JSON, VULN, ALL formats 48 | command: "dependency-check --project {{ project_name }} --scan {{ output_dir }} -o {{ output_dir }}{{ project_name }}-report.html" 49 | 50 | - name: Downloading the report 51 | fetch: 52 | src: "{{ output_dir }}{{ project_name }}-report.html" 53 | dest: "{{ report_name }}" 54 | flat: yes 55 | 56 | - debug: 57 | msg: "Report can be found at {{ report_name }}" 58 | -------------------------------------------------------------------------------- /utils/9-jenkins-pipeline-python-end-to-end/jenkins/plugins.txt: -------------------------------------------------------------------------------- 1 | pipeline-input-step:2.11 2 | git-server:1.9 3 | junit:1.28 4 | workflow-multibranch:2.21 5 | apache-httpcomponents-client-4-api:4.5.10-2.0 6 | lockable-resources:2.7 7 | matrix-auth:2.5 8 | pipeline-milestone-step:1.3.1 9 | workflow-job:2.36 10 | ldap:1.21 11 | token-macro:2.10 12 | structs:1.20 13 | script-security:1.68 14 | workflow-support:3.3 15 | ssh-credentials:1.18 16 | pipeline-model-declarative-agent:1.1.1 17 | ws-cleanup:0.38 18 | git-client:3.0.0 19 | resource-disposer:0.14 20 | display-url-api:2.3.2 21 | gradle:1.35 22 | ant:1.10 23 | email-ext:2.68 24 | ace-editor:1.1 25 | docker-commons:1.16 26 | cloudbees-folder:6.10.1 27 | authentication-tokens:1.3 28 | pipeline-model-definition:1.5.0 29 | antisamy-markup-formatter:1.6 30 | workflow-scm-step:2.9 31 | bouncycastle-api:2.17 32 | trilead-api:1.0.5 33 | ssh-slaves:1.31.0 34 | timestamper:1.10 35 | workflow-step-api:2.21 36 | jdk-tool:1.4 37 | durable-task:1.33 38 | mailer:1.29 39 | workflow-api:2.38 40 | workflow-aggregator:2.6 41 | pipeline-github-lib:1.0 42 | pipeline-model-extensions:1.5.0 43 | pipeline-model-api:1.5.0 44 | workflow-durable-task-step:2.35 45 | github-branch-source:2.5.8 46 | branch-api:2.5.5 47 | jackson2-api:2.10.1 48 | build-timeout:1.19 49 | pam-auth:1.6 50 | jsch:0.1.55.1 51 | workflow-cps-global-lib:2.15 52 | jquery-detached:1.2.1 53 | git:4.0.0 54 | pipeline-stage-step:2.3 55 | subversion:2.13.0 56 | github:1.29.5 57 | pipeline-stage-tags-metadata:1.5.0 58 | command-launcher:1.4 59 | scm-api:2.6.3 60 | matrix-project:1.14 61 | pipeline-graph-analysis:1.10 62 | mapdb-api:1.0.9.0 63 | momentjs:1.1.1 64 | workflow-cps:2.78 65 | pipeline-stage-view:2.12 66 | plain-credentials:1.5 67 | credentials-binding:1.20 68 | credentials:2.3.0 69 | pipeline-build-step:2.10 70 | handlebars:1.1.1 71 | docker-workflow:1.21 72 | workflow-basic-steps:2.18 73 | github-api:1.95 74 | pipeline-rest-api:2.12 75 | -------------------------------------------------------------------------------- /app/docker/README.md: -------------------------------------------------------------------------------- 1 | 2 | ### Application Overview 3 | 4 | • A web frontend, implemented in React 5 | 6 | • A REST API, implemented in Python using the Django framework 7 | 8 | • A database, using MySQL 9 | 10 | ### Build docker images 11 | 12 | ``` 13 | $ docker login 14 | 15 | $ cd visitor-service 16 | $ docker build --tag visitors-service:1.0.0 . 17 | $ docker push davarski/visitors-service:1.0.0 18 | 19 | $ cd visitor-webui 20 | $ docker build --tag visitors-webui:1.0.0 . 21 | $ docker push davarski/visitors-webui:1.0.0 22 | ``` 23 | 24 | ### Runing app on Docker (using docker-compose) 25 | ``` 26 | docker-compose up -d 27 | ``` 28 | Example: 29 | ``` 30 | $ docker-compose up -d 31 | Building with native build. Learn about native build in Compose here: https://docs.docker.com/go/compose-native-build/ 32 | Creating network "docker_default" with the default driver 33 | Creating docker_visitors-mysql_1 ... done 34 | Creating docker_visitors-service_1 ... done 35 | Creating docker_visitors-webui_1 ... done 36 | $ docker-compose ps 37 | Name Command State Ports 38 | --------------------------------------------------------------------------------------------------- 39 | docker_visitors-mysql_1 docker-entrypoint.sh mysqld Up 0.0.0.0:3306->3306/tcp, 33060/tcp 40 | docker_visitors-service_1 bash startup.sh Up 0.0.0.0:8000->30685/tcp, 8000/tcp 41 | docker_visitors-webui_1 npm start Up 0.0.0.0:3000->3000/tcp 42 | 43 | ``` 44 | 45 | After executing, you will have 3 running cointainers on your Docker host: visitor-service, visitors-webui and visitors-mysql. For accessing the web application, open your browser and go to http://your-docker-host-ip-address:3000 (or http://localhost:3000/) 46 | 47 | To destroy the containers, execute: 48 | ``` 49 | docker-compose down 50 | 51 | or (remove docker images) 52 | 53 | docker-compose down --rmi all 54 | ``` 55 | -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/architecture/README.md: -------------------------------------------------------------------------------- 1 | # aws-security-benchmark 2 | ```create-benchmark-rules.yaml``` is an AWS CloudFormation template for establishing CIS AWS 1.1 benchmark governance rules (download the benchmarks [here](https://benchmarks.cisecurity.org/en-us/?route=downloads.form.awsfoundations.110)). 3 | 4 | ```cis-benchmark-matrix.xlsx``` is a spreadsheet that maps the CIS Amazon Web Services Foundations benchmarks to the specific security controls provisioned in the CloudFormation template. 5 | 6 | The AWS services used for these benchmarks are used in the following relationship: 7 | 8 | ![CIS Benchmark Architecture Diagram](https://github.com/awslabs/aws-security-benchmark/blob/master/architecture/assets/cis-benchmark-architecture.jpg) 9 | 10 | The following preconditions must be met before the stack can be launched: 11 | 12 | 1. AWS Config must be running in the region where this template will be run. This is needed for Config Rules. 13 | 2. Amazon CloudTrail must be delivering logs to CloudWatch Logs. This is needed for CloudWatch metrics and alarms. 14 | 3. AWS Lambda must be supported in the region where this template will be launched. See [this](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) page for region support. 15 | 16 | The controls are a combination of AWS Config Rules (both AWS-managed and custom), Amazon CloudWatch rules, and Amazon CloudWatch alarms. 17 | Please note that these resources will incur costs in your account; please refer to the pricing model for each service. 18 | 19 | For example, an estimate in us-east-1: 20 | * Config Rules: 17 rules @ $2.00/rule/month = $34.00/month 21 | * CloudWatch Alarms: 6 alarms @ $0.10/alarm/month = $0.60/month 22 | * CloudWatch Metrics: 6 metrics @ $0.30/metric/month = $1.80/month 23 | * CloudWatch Logs: 17 logs @ $0.50/GB ingested = based on usage 24 | * Lambda: variable (first 1 million requests per month are free) 25 | -------------------------------------------------------------------------------- /utils/3-ansible-devops-utils/gitlab/.github/workflows/ci.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: CI 3 | 'on': 4 | pull_request: 5 | push: 6 | branches: 7 | - master 8 | schedule: 9 | - cron: "0 7 * * 1" 10 | 11 | defaults: 12 | run: 13 | working-directory: 'geerlingguy.gitlab' 14 | 15 | jobs: 16 | 17 | lint: 18 | name: Lint 19 | runs-on: ubuntu-latest 20 | steps: 21 | - name: Check out the codebase. 22 | uses: actions/checkout@v2 23 | with: 24 | path: 'geerlingguy.gitlab' 25 | 26 | - name: Set up Python 3. 27 | uses: actions/setup-python@v2 28 | with: 29 | python-version: '3.x' 30 | 31 | - name: Install test dependencies. 32 | run: pip3 install yamllint ansible ansible-lint 33 | 34 | - name: Lint code. 35 | run: | 36 | yamllint . 37 | ansible-lint 38 | 39 | molecule: 40 | name: Molecule 41 | runs-on: ubuntu-latest 42 | strategy: 43 | matrix: 44 | include: 45 | - distro: centos7 46 | playbook: converge.yml 47 | - distro: ubuntu1804 48 | playbook: converge.yml 49 | - distro: debian9 50 | playbook: converge.yml 51 | - distro: centos7 52 | playbook: version.yml 53 | - distro: ubuntu1804 54 | playbook: version.yml 55 | 56 | steps: 57 | - name: Check out the codebase. 58 | uses: actions/checkout@v2 59 | with: 60 | path: 'geerlingguy.gitlab' 61 | 62 | - name: Set up Python 3. 63 | uses: actions/setup-python@v2 64 | with: 65 | python-version: '3.x' 66 | 67 | - name: Install test dependencies. 68 | run: pip3 install ansible molecule[docker] docker 69 | 70 | - name: Run Molecule tests. 71 | run: molecule test 72 | env: 73 | PY_COLORS: '1' 74 | ANSIBLE_FORCE_COLOR: '1' 75 | MOLECULE_DISTRO: ${{ matrix.distro }} 76 | MOLECULE_PLAYBOOK: ${{ matrix.playbook }} 77 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/OWASP-dependency-check/owasp-scala-dependency-check/Jenkinsfile-SCALA-PROJECT-example: -------------------------------------------------------------------------------- 1 | pipeline { 2 | agent { 3 | label 'jenkins-slave10' 4 | } 5 | options { 6 | timestamps() 7 | disableConcurrentBuilds() 8 | } 9 | 10 | stages { 11 | stage('Clone SCALA-PROJECT Master Branch') { 12 | steps { 13 | 14 | checkout([$class: 'GitSCM', 15 | branches: [[name: "master"]], 16 | doGenerateSubmoduleConfigurations: false, 17 | extensions: [[$class: 'RelativeTargetDirectory', relativeTargetDir: 'SCALA-PROJECT']], 18 | submoduleCfg: [], 19 | userRemoteConfigs: [[credentialsId: 'adavarski-github', url: 'git@github.com:adavarski/SCALA-PROJECT.git']] 20 | ]) 21 | } 22 | } 23 | 24 | 25 | stage('PenTesting SCALA-PROJECT') { 26 | steps { 27 | dir('SCALA-PROJECT') { 28 | script { 29 | sh 'sbt dependencyCheck' 30 | } 31 | } 32 | } 33 | 34 | } 35 | 36 | 37 | stage('Publish Pentesting Vulnerability Report') { 38 | steps { 39 | script { 40 | publishHTML (target: [ 41 | allowMissing: false, 42 | alwaysLinkToLastBuild: false, 43 | keepAll: true, 44 | reportDir: './SCALA-PROJECT/target', 45 | reportFiles: 'dependency-check-vulnerability.html', 46 | reportName: "Petntesting Vulnerability Report" 47 | ]) 48 | } 49 | } 50 | } 51 | 52 | stage('Publish Pentesting Full Report') { 53 | steps { 54 | script { 55 | publishHTML (target: [ 56 | allowMissing: false, 57 | alwaysLinkToLastBuild: false, 58 | keepAll: true, 59 | reportDir: './SCALA-PROJECT/target', 60 | reportFiles: 'dependency-check-report.html', 61 | reportName: "Petntesting Full Report" 62 | ]) 63 | } 64 | } 65 | } 66 | 67 | } 68 | 69 | 70 | 71 | 72 | } 73 | -------------------------------------------------------------------------------- /utils/4-ansible-devsecops-general-utils/Nessus/nessus-restapi/main.yml: -------------------------------------------------------------------------------- 1 | - name: working with nessus rest api 2 | connection: local 3 | hosts: localhost 4 | gather_facts: no 5 | vars: 6 | scan_id: 17 7 | nessus_access_key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX 8 | nessus_secret_key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 | nessus_url: https://192.168.33.109:8834 10 | nessus_report_format: html 11 | 12 | tasks: 13 | - name: export the report for given scan "{{ scan_id }}" 14 | uri: 15 | url: "{{ nessus_url }}/scans/{{ scan_id }}/export" 16 | method: POST 17 | validate_certs: no 18 | headers: 19 | X-ApiKeys: "accessKey={{ nessus_access_key }}; secretKey={{ nessus_secret_key }}" 20 | body: "format={{ nessus_report_format }}&chapters=vuln_by_host;remediations" 21 | register: export_request 22 | 23 | - debug: 24 | msg: "File id is {{ export_request.json.file }} and scan id is {{ scan_id }}" 25 | 26 | - name: check the report status for "{{ export_request.json.file }}" 27 | uri: 28 | url: "{{ nessus_url }}/scans/{{ scan_id }}/export/{{ export_request.json.file }}/status" 29 | method: GET 30 | validate_certs: no 31 | headers: 32 | X-ApiKeys: "accessKey={{ nessus_access_key }}; secretKey={{ nessus_secret_key }}" 33 | register: report_status 34 | 35 | - debug: 36 | msg: "Report status is {{ report_status.json.status }}" 37 | 38 | - name: downloading the report locally 39 | uri: 40 | url: "{{ nessus_url }}/scans/{{ scan_id }}/export/{{ export_request.json.file }}/download" 41 | method: GET 42 | validate_certs: no 43 | headers: 44 | X-ApiKeys: "accessKey={{ nessus_access_key }}; secretKey={{ nessus_secret_key }}" 45 | return_content: yes 46 | dest: "./{{ scan_id }}_{{ export_request.json.file }}.{{ nessus_report_format }}" 47 | register: report_output 48 | 49 | - debug: 50 | msg: "Report can be found at ./{{ scan_id }}_{{ export_request.json.file }}.{{ nessus_report_format }}" -------------------------------------------------------------------------------- /utils/6-ansible-devsecops-aws-utils/aws-security-benchmark/aws_cis_foundation_framework/README.md: -------------------------------------------------------------------------------- 1 | # aws-cis-foundation-benchmark-checklist 2 | Script to evaluate your AWS account against the full CIS Amazon Web Services 3 | Foundations Benchmark 1.1 4 | The script have a number of different outputs, all optional by changing the 5 | settings inside the script. 6 | All outputs will generate a single report of all supported controls in short 7 | format, full JSON or HTML. 8 | Delivery of the report is console output for JSON structure, S3 SignedURL for 9 | HTML file and optional publish to SNS for the S3 SignedURL if you wish to 10 | receive an email or trigger other functions any time a new report is done. 11 | You can also store the reports in a central S3 bucket if you run this for 12 | multiple accounts 13 | 14 | ## Execution 15 | ### Requirement 16 | Verified with Python 2.7. 17 | Python 3.6 support in process. 18 | 19 | ### Config Rules 20 | By adding the script to you AWS account as a Lambda function you can tie it 21 | to a Config Rule. 22 | You don't need to change or enable anything in the script when using with 23 | Config Rule, the script will autosense it and automatically start reporting 24 | compliance status at the account level. 25 | The script will also report back a short-form version of the result using 26 | the annotation field. You can see this value using the Config API: 27 | ```aws configservice get-compliance-details-by-config-rule --config-rule-name``` 28 | ***Keep in mind that the lambda function needs to have timeout set to max time.*** 29 | 30 | ### Local execution 31 | You can also run this script from a admin console using python and AWS SDK. 32 | It will use the credentials you have stored in your profiles. 33 | 34 | Run without parameters to use default profile:') 35 | ```python aws-cis-foundation-benchmark-checklist.py``` 36 | Specify profile by using the -p or --profile 37 | ```python aws-cis-foundation-benchmark-checklist.py [-p|--profile] ``` 38 | 39 | ## IAM Policy 40 | The IAM policy required to run the script is located in the file 41 | aws-cis-foundation-benchmark-checklist-lambdarole.json 42 | -------------------------------------------------------------------------------- /utils/7-ansible-log-monitoring-elk-aws-serverless-utils/elastalert/roles/aws-serverless/templates/initDb.js.j2: -------------------------------------------------------------------------------- 1 | var config = require('./config.js') 2 | 3 | var AWS = require("aws-sdk") 4 | AWS.config.update({ 5 | region: config.region 6 | }); 7 | 8 | var dynamodb = new AWS.DynamoDB(); 9 | 10 | var params = { 11 | "AttributeDefinitions": [ 12 | { 13 | "AttributeName": "id", 14 | "AttributeType": "N" 15 | }, 16 | { 17 | "AttributeName": "ip", 18 | "AttributeType": "S" 19 | }, 20 | { 21 | "AttributeName": "expirymin", 22 | "AttributeType": "N" 23 | } 24 | ], 25 | "GlobalSecondaryIndexes": [ 26 | { 27 | "IndexName": "ip_index", 28 | "KeySchema": [ 29 | { 30 | "AttributeName": "ip", 31 | "KeyType": "HASH" 32 | } 33 | ], 34 | "Projection": { 35 | "ProjectionType": "ALL" 36 | }, 37 | "ProvisionedThroughput": { 38 | "ReadCapacityUnits": 100, 39 | "WriteCapacityUnits": 100 40 | } 41 | }, 42 | { 43 | "IndexName": "expirymin_index", 44 | "KeySchema": [ 45 | { 46 | "AttributeName": "expirymin", 47 | "KeyType": "HASH" 48 | } 49 | ], 50 | "Projection": { 51 | "ProjectionType": "ALL" 52 | }, 53 | "ProvisionedThroughput": { 54 | "ReadCapacityUnits": 100, 55 | "WriteCapacityUnits": 100 56 | } 57 | } 58 | ], 59 | "KeySchema": [ 60 | { 61 | "AttributeName": "id", 62 | "KeyType": "HASH" 63 | } 64 | ], 65 | "ProvisionedThroughput": { 66 | "ReadCapacityUnits": 100, 67 | "WriteCapacityUnits": 100 68 | }, 69 | "TableName": config.tableName 70 | } 71 | 72 | dynamodb.createTable(params, function(err, data) { 73 | if (err) { 74 | console.error("Unable to create table. Error JSON:", JSON.stringify(err, null, 2)); 75 | } else { 76 | console.log("Created table. Table description JSON:", JSON.stringify(data, null, 2)); 77 | } 78 | }); --------------------------------------------------------------------------------