Server Installation via Control Repo¶
Add SIMP Server Components¶
Sicura is an extension of SIMP Server and requires those components be installed. Please follow the instructions here to add the SIMP Server components to your control repository.
There are several modules included in the SIMP Server Puppetfile (Puppetfile.simp) that are also included in the default Puppetfile. Use r10k deploy environment <environment name> -pv on the Puppet server to see a list of duplicates, if any, during deployment. If any are found, review the versions in each Puppetfile and keep only those relevant to your environment.
For more advanced options and features of r10k, see the official documentation here
Obtain the Sicura modules¶
The Sicura enforcement modules are hosted as git repositories on the Sicura customer GitLab instance at customers.sicura.us. Access credentials are set up when your organization is onboarded — please contact us if you need access.
For each release, Sicura publishes a Puppetfile that pins the exact version of each module to deploy from customers.sicura.us. Request the Puppetfile for your release from Sicura support.
Add the modules to the Control Repository¶
Add the entries from the provided Puppetfile to the Puppetfile in your control repository, then deploy the environment with r10k:
Modify Hiera settings¶
In order to use SIMP, you need to add some settings into a Hiera default layer. These settings are normally set by simp config, but because it needs to be part of a control-repo, it needs to be committed to the control-repo's data directories.
Copy the following file contents into your default layer. Values enclosed in < > will need to be modified for your environment.
# used by SIMP modules to set default access control rules. Add your local ip address subnets.
simp_options::trusted_nets:
- '<list of local networks>'
# As configured, this disables syslog redirection to an external syslog server. **We recommend that this be set to a valid list of syslog server IPs in a production environment.**
simp_options::syslog::log_servers: []
# If you have failover syslog servers, uncomment the following line and add the failover syslog server IP addresses to the list.
#simp_options::syslog::failover_log_servers: []
# This disables the use of `stunnel` to wrap SIMP services.
simp_options::stunnel: false
simp::rsync_stunnel: false
# This disables scheduled `yum update` runs.
simp::yum::schedule::enable: false
# Time synchronization needs both keys, because they feed different things:
# `chrony::servers` configures ongoing time sync on managed nodes, while
# `simp_options::ntp::servers` is the catalyst SIMP kickstart client bootstrap
# reads to slew a client's clock before PKI key distribution.
chrony::servers:
- '<NTP server IP>'
simp_options::ntp::servers:
- '<NTP server IP>'
# The following additional settings should be self-explanatory:
simp::runlevel: 3
simp_options::dns::search:
- "%"
simp_options::dns::servers:
- '<DNS server IP>'
simp_options::puppet::ca: '<MoM FQDN>'
simp_options::puppet::ca_port: 8140
simp_options::puppet::server: '<compile master FQDN>'
Enable and Configure SCE¶
To enable enforcement and reporting functionality, Sicura Compliance Engine will need to be enabled in Hiera and a compliance profile selected for systems.
See the SCE documentation here for additional details.
Classify Systems¶
Linux server and client nodes will also need to be classified with the simp and simp-options classes for enforcement to occur. Windows systems will need to be classified with the simp_windows class. This can be done in the Puppet Enterprise Console or by adding the following an appropriate manifest file.