IN PROGRESS: Pandora FMS

modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/install.pp

@@ -0,0 +1,59 @@
+class pandora_fms_rce::install{
+
+	$console_package= 'pandorafms_console-7.0NG.742.tar'
+	$server_package= 'pandorafms_server-7.0NG.742.tar'
+	$agent_package= 'pandorafms_agent_unix-7.0NG.742.tar'
+	#pandora denpencies
+	ensure_packages(['snmp','snmpd','libnet-telnet-perl','libgeo-ip-perl','libtime-format-perl','libxml-simple-perl','libxml-twig-perl','libdbi-perl','libnetaddr-ip-perl','libhtml-parser-perl','xprobe2','nmap','libmail-sendmail-perl','traceroute','libio-socket-inet6-perl','libhtml-tree-perl','libsnmp-perl','snmp-mibs-downloader','libio-socket-multicast-perl','libsnmp-perl','libjson-perl'])
+
+	#lamp dependencies 
+	ensure_packages(['mariadb-server','php-mysqli','php','php-common','php-gmp','php-curl','php-mbstring','php-xmlrpc','php-mysql','php-gd','php-bcmath','php-xml','php-cli','php-zip','php-pear','php-zip','php-sqlite3','php-snmp','graphviz','php-curl','php-ldap','dbconfig-common','unzip','git'])
+
+
+	# sets the default paths to use
+	Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
+
+
+	# copy archive 
+	file { 'console' :
+		path => "/usr/local/src/${console_package}.gz",
+		ensure => file,
+		source => "puppet:///modules/pandora_fms_rce/${console_package}.gz",
+	}
+	file { 'server' :
+		path => "/usr/local/src/${server_package}.gz",
+		ensure => file,
+		source => "puppet:///modules/pandora_fms_rce/${server_package}.gz",
+	}	
+	file { 'agent' :
+		path => "/usr/local/src/${agent_package}.gz",
+		ensure => file,
+		source => "puppet:///modules/pandora_fms_rce/${agent_package}.gz",
+	}
+
+	file { '/var/www/html/pandorafms/':
+		ensure => 'directory',
+	}
+
+	exec { 'unpack-console':
+		cwd     => '/usr/local/src/',
+		command => "tar -xf ${console_package}.gz -C /var/www/html/pandorafms/",
+		creates => '/var/www/html/pandorafms/pandora_console/',
+		require => File['/var/www/html/pandorafms/'],
+	} 
+
+	exec { 'unpack-server':
+		cwd     => '/usr/local/src/',
+		command => "tar -xf ${server_package}.gz -C /var/www/html/pandorafms/",
+		creates => '/var/www/html/pandorafms/pandora_server/',
+		require => File['/var/www/html/pandorafms/'],
+	}
+
+	exec { 'unpack-agent':
+		cwd     => '/usr/local/src/',
+		command => "tar -xf ${agent_package}.gz -C /var/www/html/pandorafms/",
+		creates => '/var/www/html/pandorafms/pandora_agent/',
+		require => File['/var/www/html/pandorafms/'],
+	}
+
+}

modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/lamp.pp

@@ -0,0 +1,154 @@
+class pandora_fms_rce::lamp{
+	$db_password = 'db_password' ##$secgen_parameters['db_password'][0]
+	$db_admin = 'db_admin' ##$secgen_parameters['db_admin'][0]
+	$db_name = 'pandora'##$secgen_parameters['db_name'][0]
+	$homedir = '/var/www/html/pandora_console'
+	$homeurl= '/pandora_console'
+	$auth= 'mysql'
+	$host = 'localhost'
+	$port = '80'
+	$docroot = '/var/www/html/pandorafms' 
+
+
+	# sets the default paths to use
+	Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
+
+
+
+	#set up mysql database
+	mysql::db { 'pandora_database':
+		user     => $db_admin,
+		password => $db_password,
+		dbname   => $db_name,
+		host     => $host,
+		grant    =>  ['ALL'],
+		sql => ['/var/www/html/pandorafms/pandora_console/pandoradb.sql'],
+	}->
+	#ensure db admin is a privledged user 
+	mysql_grant { "${db_admin}@${host}/*.*":
+	  user       => "${db_admin}@${host}",
+	  table      => '*.*',
+	  privileges => ['ALL'],
+	}->
+	exec { 'mysqldmin flush-privileges':
+		command => 'mysqldmin flush-privileges',
+		logoutput => true
+	}
+
+	file_line{ 'my.cnf_mysqld':
+		ensure => present,
+		path   => '/etc/mysql/my.cnf',
+		line   => '[mysqld]',
+		match  => '^\[mysqld\]',
+	}->
+	file_line{ 'my.cnf_sql_mode':
+		ensure => present,
+		path   => '/etc/mysql/my.cnf',
+		line   => 'sql_mode=NO_ENGINE_SUBSTITUTION',
+		after  => '\[mysqld\]',
+	}->
+	##TODO confirm charset uploading correctly
+	exec { 'populate-database':
+		command => "mysql ${db_name} < ${docroot}/pandora_console/pandoradb_data.sql",
+		logoutput => true, 
+
+	}->
+	exec { 'start-database': 
+		command => 'systemctl restart mariadb',
+		logoutput => true,  
+	}	
+
+	file{ 'console-install':
+		path => "${docroot}/pandora_console/install.php",
+		ensure => absent,
+    }
+
+	class { '::apache':
+		default_vhost => false,
+		default_mods => ['rewrite'],
+		overwrite_ports => false,
+		mpm_module => 'prefork'	
+	} 
+	#pandora configuration file
+	file { 'console-config.inc.php':
+		path => "${docroot}/pandora_console/include/config.inc.php",
+		ensure  => present,
+		content  => template('pandora_fms_rce/config.inc.php.erb'),
+    }
+
+	#update folder permissions 
+	exec { 'chown-pandora':
+		command => "chown www-data:www-data ${docroot} -R", 
+	}->
+	exec { 'chown-pandora-console':
+		command => "chown www-data:www-data ${docroot}/pandora_console -R",
+	}->
+	exec { 'chown-pandora-permissions':
+		command => "chown 775 ${docroot}/pandora_console -R",
+	}
+
+	::apache::vhost { 'www-pandora':
+		port    => $port,
+		docroot => "${docroot}/pandora_console",
+	} 
+	file{ 'remove-default-index':
+		path => '/var/www/html/index.html',
+		ensure => absent,
+		require => Class['::apache']
+    }
+	file{ 'remove-apache2-default-page-enabled':
+		path => '/etc/apache2/sites-enabled/000-default.conf',
+		ensure => absent,
+		require => Class['::apache']
+    }
+
+	file{ 'remove-apache2-default-page-available':
+		path => '/etc/apache2/sites-available/000-default.conf',
+		ensure => absent,
+		require => Class['::apache']
+    }
+
+	exec { 'restart-apache-pandora':
+		command => 'systemctl restart apache2',
+		logoutput => true,
+		require => [File['remove-default-index'],File['remove-apache2-default-page-enabled'],File['remove-apache2-default-page-available']],
+	} ->
+	exec { 'wait-apache-pandora':
+		command => 'sleep 4',
+		logoutput => true
+	}
+
+
+	file_line{ 'php.ini-memory_limit':
+		ensure => present,
+		path   => '/etc/php/7.3/apache2/php.ini',
+		line   => 'memory_limit = 256M',
+		match  => '^memory_limit =',
+	}->
+	file_line{ 'php.ini-upload_max_filesize':
+		ensure => present,
+		path   => '/etc/php/7.3/apache2/php.ini',
+		line   => 'upload_max_filesize = 100M',
+		match  => '^upload_max_filesize =',
+	}->
+	file_line{ 'php.ini-execution_time':
+		ensure => present,
+		path   => '/etc/php/7.3/apache2/php.ini',
+		line   => 'max_execution_time = 360',
+		match  => '^max_execution_time =',
+	}->
+	file_line{ 'php.ini-max_input_vars':
+		ensure => present,
+		path   => '/etc/php/7.3/apache2/php.ini',
+		line   => 'max_input_vars = 2000',
+		match  => '^max_input_vars =',
+	}->
+	file_line{ 'php.ini-date.timezone':
+		ensure => present,
+		path   => '/etc/php/7.3/apache2/php.ini',
+		line   => 'date.timezone = Europe/Paris',
+		match  => '^date.timezone =',
+	}
+
+
+}

modules/vulnerabilities/unix/http/pandora_fms_rce/manifests/pandora.pp

@@ -0,0 +1,7 @@
+class pandora_fms_rce::pandora{
+
+
+
+
+
+}

modules/vulnerabilities/unix/http/pandora_fms_rce/pandora_fms_rce.pp

@@ -0,0 +1,7 @@
+
+contain pandora_fms_rce::install
+contain pandora_fms_rce::lamp 
+contain pandora_fms_rce::pandora
+Class['pandora_fms_rce::install'] ->
+Class['pandora_fms_rce::lamp'] ->
+Class['pandora_fms_rce::pandora'] 

modules/vulnerabilities/unix/http/pandora_fms_rce/templates/config.inc.php.erb

@@ -0,0 +1,37 @@
+<?php
+// Pandora FMS - http://pandorafms.com
+// ==================================================
+// Copyright (c) 2005-2010 Artica Soluciones Tecnologicas
+//
+// This program is free software; you can redistribute it and/or
+// modify it under the terms of the  GNU Lesser General Public License
+// as published by the Free Software Foundation; version 2
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+/**
+ * @package    Include
+ * @subpackage Config
+ */
+
+// Default values
+	$config["dbname"]="<%=@db_name%>";
+    $config["dbuser"]="<%=@db_admin%>";
+    $config["dbpass"]="<%=@db_passsword%>";
+    $config["dbhost"]="<%=@db_host%>";
+// This is used for reporting, please add "/" character at the end
+	$config["homedir"]="<%=@homedir%>";
+    $config["homeurl"]="<%=@homeurl%>";
+    $config["auth"]["scheme"] = "<%=@auth%>";
+/**
+ * Do not display any ERROR
+ */
+error_reporting(E_ALL);
+
+// Display ALL errors
+// error_reporting(E_ERROR);
+$ownDir = dirname(__FILE__).DIRECTORY_SEPARATOR;
+require $ownDir.'config_process.php';