PeekabooAV-install.yml

---
#
#
#   PeekabooAV Installation Ansible Playbook
#
#   this playbook is work in progress
#   it has two purposes
#   - an easy way to have a fast installation
#   - documentation on how to set things up
#
#   it can also be used to update an installation
#
#
#   by felix bauer felix.bauer@atos.net
#
# 23.08.2017
#
# Copyright (C) 2016-2018 science + computing ag
#
#

#
# This ansible playbook describes and performs a basic installation 
# of PeekabooAV
#

# Require minimal ansible version
- hosts: all
  tasks:
    - name: Check for systemd module in ansible (minimal version required 2.5)
      systemd:
    - name: Verify ansible version
      assert:
        that: "ansible_version.full is version_compare('2.5', '>=')"
        msg: >
          "Minimum ansible version required is 2.5"

# The following code is just to have the owl and info scroll bye slowly.
- name: Print Peekaboo logo
  hosts: localhost
  become: no
  gather_facts: false
  vars:
    peekabooinst_banner: |
      Welcome to the PeekabooAV installer
      ====================================================================
                                                                          
                           ==                             =               
                           ========                 =======               
                             ===========?     ===========                 
                               ========================                   
                              ==       ========       ===                 
                             =           ====           =                 
                            +=     ?     ====     ?     ==                
                            ==           =,,=           ==                
                             =          ,,,,,,,         =+                
                             ==         =,,,,=         ==                 
                              +====+=======,====== =====                  
                              ==========================                  
                            ==============================                
                           ===============77===============               
                           =========77777777777777+========               
                           ======77777777777777777777======               
                           =====7777777777777777777777=====               
                            ===777777777777777777777777====               
                            ===7777777777777777777777777==                
                             ==7777777777777777777777777=                 
                             +=777777777777777777777777==                 
                              ==77777777777777777777777=                  
                               ==777777777777777777777=                   
                                +=7777777777777777777=                    
                                  =7777777777777777=                      
                                   ==777777777777==                       
                                      ==777777==                          
                              ,,,,,,::::::==::::::,,,,,,                  
                      ,,,,,,,,,,,,,,,              ,,,,,,,,,,,,,          
                ,,,,,,,,                                        ,,,,,,    
            ,,,,,                                                      ,,,
         ,,,                                                              
      ,                                                                   

  tasks:
    - debug:
        msg: "{{ peekabooinst_banner.split('\n') }}"


- name: Check OS version
  hosts: all
  tasks:
    - fail: 
        msg: "{{ ansible_distribution }} {{ ansible_distribution_version }} not supported. Please use the version that is specified in README.md"
      when: (ansible_distribution != "Ubuntu") or (ansible_distribution_version < "18.04")

- name: Install software packages
  hosts: all
  gather_facts: no
  become: yes
  tasks:
    - name: Refresh apt package repositories
      apt:
        update_cache: yes
    - name: Install basic tools
      apt:
        name:
          - vim
          - ipython3
          - less
          - iputils-ping
          - socket
          - netcat
          - git
          - curl
          - socat

- name: Install mysql database and setup users and databases
  hosts: peekabooav_server
  gather_facts: no
  become: true
  tags: mysql
  tasks:
    - name: Installing Software
      apt:
        name:
          - mariadb-server
          # required to be installed globally by our system-installed ansible
          # to be able to connect to the database in the next step
          - python3-mysqldb

    - name: Start database service
      systemd:
        name: mysql
        state: started

    - name: Create databases
      mysql_db:
        name: "{{ item }}"
        state: present
        encoding: utf8
      with_items:
        - cuckoo
        - peekaboo

    - name: Create database user cuckoo
      mysql_user:
        name: cuckoo
        password: "{{ cuckoo_db_password }}"
        host: localhost
        priv: 'cuckoo.*:ALL,GRANT'
        state: present

    - name: Create database user peekaboo
      mysql_user:
        name: peekaboo
        password: "{{ peekaboo_db_password }}"
        host: localhost
        priv: 'peekaboo.*:ALL,GRANT'
        state: present

- name: Create a new cuckoo user and group
  hosts: cuckoo_server
  gather_facts: no
  become: true
  tasks:
    - name: Create a new group cuckoo
      group:
        name: cuckoo
        state: present
        gid: 151
    - name: Create a new user cuckoo
      user:
        name: cuckoo
        group: cuckoo
        uid: 151
        home: /var/lib/cuckoo

- name: Install tcpdump and set capability
  hosts: cuckoo_server
  gather_facts: no
  become: true
  tasks:
    - name: Install tcpdump
      apt:
        name: tcpdump
        state: latest
    - name: Restrict access to tcpdump
      file:
        path: /usr/sbin/tcpdump
        # cuckoo stats the sniffer during configuration initialisation so we
        # need r+x for group cuckoo here
        mode: 0750
        owner: root
        group: cuckoo
    - name: Set capability
      capabilities:
        path: /usr/sbin/tcpdump
        capability: cap_net_raw,cap_net_admin=eip
        state: present

- name: Install Cuckoo
  hosts: cuckoo_server
  gather_facts: no
  become: true
  vars:
    services:
      - cuckoo-rooter.service
      - cuckoo-web.service
      - cuckoo-api.service
      - cuckoo.service
    processor_unit:
      - cuckoo-process@.service
    processor_services:
      # generate list of service instances from template:
      # - cuckoo-process@1.service
      # - cuckoo-process@2.service
      # - ...
      "{{ range(1, cuckoo_processors + 1) | map('regex_replace', '^(.*)$', 'cuckoo-process@\\1.service') | list }}"
    legacy_services:
      - cuckoohttpd.service
      - cuckooapi.service
      - cuckoosandbox.service
    legacy_service_aliases:
      - cuckoo-http.service
      - cuckoo-api.service
      - cuckoo-sandbox.service
  tasks:
    - name: Install Cuckoo system dependencies
      apt:
        name:
          - python
          - python-dev
          - mongodb
          - libffi-dev
          - libssl-dev
          - libjpeg-dev
          - zlib1g-dev
          - swig
          - build-essential
          # required to install mysql python module in venv using pip
          - libmysqlclient-dev

    - name: Install virtualenv command for Ubuntu < 20
      apt:
        name:
          - python-virtualenv
      when: ansible_lsb.id == "Ubuntu" and ansible_lsb.major_release | int < 20

    - name: Install virtualenv command for Ubuntu >= 20
      apt:
        name:
          - python3-virtualenv
      when: ansible_lsb.id == "Ubuntu" and ansible_lsb.major_release | int >= 20

    # work around flask not pinning its dependency versions, pulling in a
    # werkzeug that is too new for itself. We rely on pip's laziness in
    # upgrading leave to this version alone as long as it suffices for flask.
    # Should become irrelevant as cuckoo switches to a newer flask which
    # supports and pulls in a newer werkzeug. We do this in a separate step to
    # avoid conflicts within a single transaction.
    - name: Work around flask werkzeug version mismatch
      pip:
        name:
          - werkzeug==0.16.1
        virtualenv: /opt/cuckoo
        virtualenv_python: python2.7
    - name: Install Cuckoo packages
      pip:
        name:
          - pip
          - setuptools
          - cuckoo
          - mysqlclient
        virtualenv: /opt/cuckoo
        virtualenv_python: python2.7

    - name: Stop Cuckoo services
      systemd:
        name: "{{ item }}"
        state: stopped
      with_items: "{{ services + processor_services + legacy_services }}"
      register: stop_result
      failed_when: stop_result is failed and not 'Could not find the requested service' in stop_result.msg

    - name: Remove legacy systemd unit files
      file:
        dest: "/etc/systemd/system/{{ item }}"
        state: absent
      with_items: "{{ legacy_services + legacy_service_aliases }}"

    - name: Copy Cuckoo systemd unit files to /etc
      copy:
        src: systemd/{{ item }}
        dest: /etc/systemd/system/
        owner: root
        group: root
        mode: 0644
        backup: true
      with_items: "{{ services + processor_unit }}"

    - name: Now place wrapper to run vboxmanage command on remote host
      # This is necessary to control vm start, stop and snapshot
      # restore on the host from within the Peekaboo-VM.
      copy:
        src: vbox/vboxmanage
        dest: /usr/local/bin/
        owner: root
        group: root
        mode: 0755
        backup: true

    - name: Secure storage directory
      file:
        path: /var/lib/cuckoo
        mode: 0700

    - name: Copy /var/lib/cuckoo/vboxmanage.conf
      # The configuration contains IP address and username of the
      # target user on the host that owns all virtual box vms.
      copy:
        src: vbox/vboxmanage.conf
        dest: /var/lib/cuckoo/vboxmanage.conf
        owner: cuckoo
        group: cuckoo
        mode: 0644
        backup: true

    - name: Install ssh
      apt:
        name: ssh
        state: latest

    - name: Setup ssh key for cuckoo user
      file:
        path: /var/lib/cuckoo/.ssh
        state: directory
        mode: 0700
        owner: cuckoo
        group: cuckoo

    - name: This key will have to be allowed on the host to authenticate the vm user
      become_user: cuckoo
      command: ssh-keygen -t ed25519 -f /var/lib/cuckoo/.ssh/id_ed25519 -P ''
      args:
        chdir: /var/lib/cuckoo
        creates: /var/lib/cuckoo/.ssh/id_ed25519

    - name: Create Cuckoo configuration directory /opt/cuckoo/etc
      tags: cuckooconf
      file:
        dest: /opt/cuckoo/etc
        state: directory

    - name: Instantiate and install custom config overlay for cuckoo
      tags: cuckooconf
      template:
        src: cuckoo/custom.kv.conf
        dest: /opt/cuckoo/etc/custom.kv.conf
        owner: cuckoo
        group: cuckoo
        mode: 0600
        backup: true

    # chicken'n'egg problem here: Cuckoo init connects to the database using
    # the old config (if it exists), creates the schema, initializes the cwd
    # (if it didn't exist) and then finally writes out the config merged with
    # stuff from the key-value config file, including the new database password.
    # There does not seem a way to first update the config and then the
    # database. Throwing away the whole old cwd seems too drastic a solution.
    - name: Check if cuckoo config exists
      stat: path=/var/lib/cuckoo/.cuckoo/conf/cuckoo.conf
      register: cuckoo_conf

    - name: Potentially hack new DB password into old config
      tags: cuckooconf
      replace:
        path: /var/lib/cuckoo/.cuckoo/conf/cuckoo.conf
        regexp: '^connection = .*'
        replace: "connection = mysql://cuckoo:{{ cuckoo_db_password }}@{{ mariadb_server }}/cuckoo"
      when: cuckoo_conf.stat.exists == True

    - name: Initial run of Cuckoo to create default configuration in cuckoo $HOME
      tags: cuckooconf
      become_user: cuckoo
      command: /opt/cuckoo/bin/cuckoo init --conf=/opt/cuckoo/etc/custom.kv.conf
      args:
        chdir: /var/lib/cuckoo

    # cuckoo ignores the api token in custom.kv.conf :(
    - name: Hack api token into config
      tags: cuckooconf
      replace:
        path: /var/lib/cuckoo/.cuckoo/conf/cuckoo.conf
        regexp: '^api_token = .*'
        replace: "api_token = {{ cuckoo_api_token }}"

    - name: Install cuckoo community signatures
      command: /opt/cuckoo/bin/cuckoo community
      become_user: cuckoo
      args:
        chdir: /var/lib/cuckoo

    - name: Start and enable Cuckoo services
      systemd:
        name: "{{ item }}"
        enabled: yes
        state: started
        daemon_reload: yes
      with_items: "{{ services + processor_services }}"


- name: Create a new peekaboo user and group
  hosts: peekabooav_server
  gather_facts: no
  become: true
  tasks:
    - name: Create a new group peekaboo
      group:
        name: peekaboo
        state: present
        gid: 150
    - name: Create a new user peekaboo
      user:
        name: peekaboo
        group: peekaboo
        uid: 150
        home: /var/lib/peekaboo


- name: Install Peekaboo
  hosts: peekabooav_server
  gather_facts: no
  become: true
  tasks:
    - name: Install Peekaboo system dependencies
      apt:
        name:
          - build-essential
          # required to install mysql python module in venv using pip
          - libmysqlclient-dev
    - name: Install Peekaboo python system dependencies
      apt:
        name:
          - python3
          - python3-dev
          - python3-virtualenv
    - name: Check if Peekaboo is switching python versions
      stat: path=/opt/peekaboo/bin/python
      register: peekaboo_python

    - name: Force python version switch in Peekaboo virtualenv
      file:
        path: /opt/peekaboo/bin/activate
        state: absent
      when: peekaboo_python.stat.exists and peekaboo_python.stat.lnk_target != "python3"

    # the pip module will fall back to pip2 when ansible is run with python2
    # even if we forced python3 for the venv. Workaround is to make sure that
    # pip2 does not exist in the venv.
    - name: Prevent fallback to pip2
      file:
        path: /opt/peekaboo/bin/pip2
        state: absent

    - name: Install Peekaboo optional components
      pip:
        name:
          - mysqlclient
        virtualenv: /opt/peekaboo
        virtualenv_python: "python3"

    - name: Check if we are to install a manually supplied Peekaboo version
      stat:
        path: PeekabooAV
      register: manually_supplied_peekaboo

    - name: Potentially warn about usage of manually supplied Peekaboo version
      debug:
        msg: "CAUTION: Using manually supplied Peekaboo version from PeekabooAV subdirectory"
      when: manually_supplied_peekaboo.stat.exists

    - name: Install manually supplied Peekaboo
      pip:
        chdir: PeekabooAV
        name: .
        state: latest
        virtualenv: /opt/peekaboo
      when: manually_supplied_peekaboo.stat.exists

    - name: Install latest Peekaboo release from PyPI
      pip:
        name: peekabooav
        state: latest
        virtualenv: /opt/peekaboo
      when: not manually_supplied_peekaboo.stat.exists

    - name: Copy Peekaboo systemd unit to /etc
      copy:
        src: /opt/peekaboo/share/doc/peekaboo/systemd/peekaboo.service
        dest: /etc/systemd/system/
        owner: root
        group: root
        mode: 0644
        backup: true

    - name: Copy mysql proxy systemd unit files to /etc
      copy:
        src: systemd/{{ item }}
        dest: /etc/systemd/system/
        owner: root
        group: root
        mode: 0644
        backup: true
      with_items:
        - mysql-proxy.service
        - mysql-proxy.socket

    - name: Enable Peekaboo services to run on startup but leave stopped for now
      systemd:
        name: peekaboo
        enabled: yes
        state: stopped
        daemon_reload: yes

    - name: Create Peekaboo configuration directory /opt/peekaboo/etc
      tags: peekabooconf
      file:
        dest: /opt/peekaboo/etc
        state: directory

    - name: Check if an old Peekaboo configuration exists in /opt/peekaboo
      stat: path=/opt/peekaboo/peekaboo.conf
      register: peekaboo_conf_old_stat

    # does not copy the old file if the presumably already configured target
    # already exists
    - name: Migrate old Peekaboo config to /opt/peekaboo/etc
      tags: peekabooconf
      command: cp -a /opt/peekaboo/peekaboo.conf /opt/peekaboo/etc/peekaboo.conf
      when: peekaboo_conf_old_stat.stat.exists
      args:
        creates: /opt/peekaboo/etc/peekaboo.conf

    - name: Remove old Peekaboo config in /opt/peekaboo
      tags: peekabooconf
      file:
        dest: /opt/peekaboo/peekaboo.conf
        state: absent

    # takes a backup of the currently installed version - best compromise
    # between preserving admin changes and getting new options rolled out
    - name: Place Peekaboo config in /opt/peekaboo/etc
      tags: peekabooconf
      template:
        src: peekaboo/peekaboo.conf
        dest: /opt/peekaboo/etc/peekaboo.conf
        owner: root
        group: peekaboo
        mode: 0640
        backup: true

    - name: Place analyzers config in /opt/peekaboo/etc
      tags: peekabooconf
      template:
        src: peekaboo/analyzers.conf
        dest: /opt/peekaboo/etc/analyzers.conf
        owner: root
        group: peekaboo
        mode: 0640
        backup: true

    - name: Check if an old Peekaboo ruleset.conf exists in /opt/peekaboo
      stat: path=/opt/peekaboo/ruleset.conf
      register: ruleset_conf_old_stat

    - name: Migrate old Peekaboo ruleset config to /opt/peekaboo/etc
      tags: peekabooconf
      command: cp -a /opt/peekaboo/ruleset.conf /opt/peekaboo/etc/ruleset.conf
      when: ruleset_conf_old_stat.stat.exists
      args:
        creates: /opt/peekaboo/etc/ruleset.conf

    - name: Remove old Peekaboo ruleset config in /opt/peekaboo
      tags: peekabooconf
      file:
        dest: /opt/peekaboo/ruleset.conf
        state: absent

    - name: Place Peekaboo ruleset.conf in /opt/peekaboo/etc
      tags: peekabooconf
      copy:
        src: /opt/peekaboo/share/doc/peekaboo/ruleset.conf.sample
        dest: /opt/peekaboo/etc/ruleset.conf
        owner: root
        group: root
        mode: 0644
        backup: true

    - name: Place cuckoo processor wrapper in /opt/peekaboo/bin
      copy:
        src: cuckoo/cuckooprocessor.sh
        dest: /opt/peekaboo/bin
        owner: root
        group: root
        mode: 0755
        backup: true

    - name: Secure storage directory
      file:
        path: /var/lib/peekaboo
        mode: 0700


- name: Install amavis and dependencies
  hosts: peekabooav_server
  gather_facts: no
  become: true
  tasks:
    - name: Installing software
      apt:
        name:
          - amavisd-new
          - arj
          - bzip2
          - cabextract
          - cpio
          - file
          - gzip
          - lhasa
          - nomarch
          # p7zip-full (7za) needed to correctly identify AES-encrypted ZIPs
          # (zip: unsupported compression method 99)
          - p7zip-full
          - pax
          - rar
          - unrar
          - unzip
          - zip

    - name: Copy amavis configs to conf.d
      template:
        src: amavis/{{ item }}
        dest: /etc/amavis/conf.d/
        owner: root
        group: root
        mode: 0644
        backup: true
      with_items:
        - 15-av_scanners
        - 15-content_filter_mode
        - 50-peekaboo

    - name: Copy amavis plugin to conf.d
      copy:
        # assumes that peekaboo and amavis are on the same box, needs a rethink
        # once those roles are separated
        src: /opt/peekaboo/share/doc/peekaboo/amavis/10-ask_peekaboo
        dest: /etc/amavis/conf.d/
        owner: root
        group: root
        mode: 0644
        backup: true

    - name: Restart amavis
      systemd:
        state: restarted
        daemon_reload: yes
        name: amavis

# As long as we still need access to files created by amavis. Once we receive
# them via a rest api between amavis and peekaboo we no longer need to be in
# group amavis and peekaboo service start can be moved back to the peekaboo
# play.
- name: Allow access to files and sockets for amavis and peekaboo
  hosts: peekabooav_server
  gather_facts: no
  become: true
  tasks:
    - name: Add secondary group amavis to user peekaboo
      user:
        name: peekaboo
        groups: amavis
        append: true
    - name: Start Peekaboo
      systemd:
        name: peekaboo
        state: started


- name: Install INetSim
  hosts: inetsim_server
  gather_facts: no
  become: true
  tasks:
    - name: Installing software
      apt:
        name:
          - inetsim
          - iptables

    - name: DNAT to INetSim
      iptables:
        table: nat
        chain: PREROUTING
        in_interface: enp0s3
        jump: DNAT
        to_destination: 192.168.56.5
        comment: Direct all trafic routed over us directly at us so inetsim gets the connections
      become: yes

    - name: Copy /etc/inetsim/inetsim.conf
      copy:
        src: net/inetsim.conf
        dest: /etc/inetsim/inetsim.conf
        owner: root
        group: root
        mode: 0644
        backup: true

    - name: Restart inetsim
      systemd:
        state: restarted
        enabled: yes
        daemon_reload: yes
        name: inetsim

- name: Install dnsmasq
  hosts: dnsmasq_server
  gather_facts: no
  become: true
  tasks:
    - name: Installing software
      apt:
        name:
          - dnsmasq

    - name: Copy /etc/dnsmasq.conf
      copy:
        src: vm/dnsmasq.conf
        dest: /etc/dnsmasq.conf
        owner: root
        group: root
        mode: 0644
        backup: true

    - name: Copy /opt/confgenerator.sh
      copy:
        src: vm/confgenerator.sh
        dest: /opt/confgenerator.sh
        owner: root
        group: root
        mode: 0755
        backup: true


- name: Clean up installer directory
  hosts: localhost
  gather_facts: no
  tasks:
    - name: Remove temporary storage files of deployed passwords
      file:
        state: absent
        path: "{{ item }}"
      with_items:
        - cuckoo_db_password
        - cuckoo_api_token
        - peekaboo_db_password