diff --git a/ansible/deploy_aw_windows.yml b/ansible/deploy_aw_windows.yml index 931a663..fa6d572 100644 --- a/ansible/deploy_aw_windows.yml +++ b/ansible/deploy_aw_windows.yml @@ -25,9 +25,9 @@ aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}" aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin" aw_windows_state_root: "C:\\ProgramData\\AWatch-rus" - aw_windows_policy_mode: "local" + aw_windows_policy_mode: "server" aw_windows_policy_refresh_seconds: 300 - aw_windows_policy_engine_enabled: false + aw_windows_policy_engine_enabled: true aw_windows_policy_engine_host: "{{ aw_windows_server_host }}" aw_windows_policy_engine_port: 5601 aw_windows_policy_engine_scheme: "http" diff --git a/ansible/group_vars/aw_windows.yml b/ansible/group_vars/aw_windows.yml index bc95cf9..4c62728 100644 --- a/ansible/group_vars/aw_windows.yml +++ b/ansible/group_vars/aw_windows.yml @@ -25,9 +25,9 @@ aw_windows_extra_users: [] aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin" aw_windows_state_root: "C:\\ProgramData\\AWatch-rus" aw_windows_hostname_override: "" -aw_windows_policy_mode: "local" +aw_windows_policy_mode: "server" aw_windows_policy_refresh_seconds: 300 -aw_windows_policy_engine_enabled: false +aw_windows_policy_engine_enabled: true aw_windows_policy_engine_host: "{{ aw_windows_server_host }}" aw_windows_policy_engine_port: 5601 aw_windows_policy_engine_scheme: "http" diff --git a/ansible/roles/dlp-policy-engine/tasks/main.yml b/ansible/roles/dlp-policy-engine/tasks/main.yml index 1fea9ab..ec4d99e 100644 --- a/ansible/roles/dlp-policy-engine/tasks/main.yml +++ b/ansible/roles/dlp-policy-engine/tasks/main.yml @@ -21,21 +21,26 @@ - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_schema.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_schema.py" } - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_storage.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_storage.py" } - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_distributor.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_distributor.py" } - - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/dlp-policy-engine.service", dest: "/etc/systemd/system/dlp-policy-engine.service" } + - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/requirements.txt", dest: "/opt/activitywatch/dlp-policy-engine/requirements.txt" } + - { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/dlp-policy-engine.service", dest: "/etc/systemd/system/aw-dlp-policy-engine.service" } -- name: Install python deps for policy engine +- name: Ensure policy engine venv exists + become: true + ansible.builtin.command: + cmd: python3 -m venv /opt/activitywatch/dlp-policy-engine/.venv + args: + creates: /opt/activitywatch/dlp-policy-engine/.venv/bin/python + +- name: Install python deps for policy engine venv become: true ansible.builtin.pip: - name: - - fastapi - - uvicorn - - pydantic - executable: pip3 + requirements: /opt/activitywatch/dlp-policy-engine/requirements.txt + virtualenv: /opt/activitywatch/dlp-policy-engine/.venv - name: Enable and restart policy engine become: true ansible.builtin.systemd: daemon_reload: true - name: dlp-policy-engine.service + name: aw-dlp-policy-engine.service enabled: true state: restarted diff --git a/windows/deploy-ensemble.ps1 b/windows/deploy-ensemble.ps1 index bc700fa..16c8891 100644 --- a/windows/deploy-ensemble.ps1 +++ b/windows/deploy-ensemble.ps1 @@ -116,7 +116,14 @@ if (-not $SkipHardening) { -LogonMarkerEnabled $LogonMarkerEnabled ` -AwHostname $AwHostname ` -CustomRulesPath $CustomRulesPath ` - -CustomPolicyPath $CustomPolicyPath + -CustomPolicyPath $CustomPolicyPath ` + -PolicyMode $PolicyMode ` + -PolicyEngineEnabled $PolicyEngineEnabled ` + -PolicyEngineHost $PolicyEngineHost ` + -PolicyEnginePort $PolicyEnginePort ` + -PolicyEngineScheme $PolicyEngineScheme ` + -PolicyRefreshSeconds $PolicyRefreshSeconds ` + -PolicyCachePath $PolicyCachePath } $report = [ordered]@{ diff --git a/windows/hardening-recovery.ps1 b/windows/hardening-recovery.ps1 index 5a7c9d5..1ed4e84 100755 --- a/windows/hardening-recovery.ps1 +++ b/windows/hardening-recovery.ps1 @@ -24,6 +24,15 @@ param( [string]$AwHostname, [string]$CustomRulesPath, [string]$CustomPolicyPath, + [ValidateSet('local', 'server')] + [string]$PolicyMode, + [bool]$PolicyEngineEnabled, + [string]$PolicyEngineHost, + [int]$PolicyEnginePort, + [ValidateSet('http', 'https')] + [string]$PolicyEngineScheme, + [int]$PolicyRefreshSeconds, + [string]$PolicyCachePath, [switch]$RepairPackage, [string]$Version, [string]$PackageUrl, @@ -59,6 +68,7 @@ $effectiveFileCollector = if ($existingConfig -and $existingConfig.paths.PSObjec $effectiveSessionCollector = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'sessionCollectorScript') { [string]$existingConfig.paths.sessionCollectorScript } else { Join-Path $effectiveStateRoot 'worktime-session-collector.ps1' } $effectiveRules = Join-Path $effectiveStateRoot 'web-category-rules.json' $effectivePolicy = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$existingConfig.paths.policyPath } else { Join-Path $effectiveStateRoot 'dlp-policy.json' } +$effectivePolicyClientScript = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'policyClientScript') { [string]$existingConfig.paths.policyClientScript } else { Join-Path $effectiveStateRoot 'dlp-policy-client.ps1' } $effectiveServerHost = if ($ServerHost) { $ServerHost } elseif ($existingConfig) { [string]$existingConfig.server.host } else { $null } $effectiveServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($existingConfig) { [int]$existingConfig.server.port } else { 5600 } @@ -76,6 +86,13 @@ $effectiveIncidentArtifactsRoot = if ($PSBoundParameters.ContainsKey('IncidentAr $effectiveLogonMarkerEnabled = if ($PSBoundParameters.ContainsKey('LogonMarkerEnabled')) { [bool]$LogonMarkerEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'sessionEvents' -and $existingConfig.sessionEvents.PSObject.Properties.Name -contains 'logonEnabled') { [bool]$existingConfig.sessionEvents.logonEnabled } else { $true } $effectiveAwHostname = if ($PSBoundParameters.ContainsKey('AwHostname') -and -not [string]::IsNullOrWhiteSpace($AwHostname)) { [string]$AwHostname } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'awHostname' -and -not [string]::IsNullOrWhiteSpace([string]$existingConfig.awHostname)) { [string]$existingConfig.awHostname } else { [string]$env:COMPUTERNAME } $effectiveVersion = if ($Version) { $Version } elseif ($existingConfig) { [string]$existingConfig.package.version } else { 'v0.13.2' } +$effectivePolicyMode = if ($PSBoundParameters.ContainsKey('PolicyMode') -and $PolicyMode) { [string]$PolicyMode } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'mode') { [string]$existingConfig.policyEngine.mode } else { 'local' } +$effectivePolicyEngineEnabled = if ($PSBoundParameters.ContainsKey('PolicyEngineEnabled')) { [bool]$PolicyEngineEnabled } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'enabled') { [bool]$existingConfig.policyEngine.enabled } else { $false } +$effectivePolicyEngineHost = if ($PSBoundParameters.ContainsKey('PolicyEngineHost') -and -not [string]::IsNullOrWhiteSpace($PolicyEngineHost)) { [string]$PolicyEngineHost } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'host') { [string]$existingConfig.policyEngine.host } else { [string]$effectiveServerHost } +$effectivePolicyEnginePort = if ($PSBoundParameters.ContainsKey('PolicyEnginePort')) { [int]$PolicyEnginePort } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'port') { [int]$existingConfig.policyEngine.port } else { 5601 } +$effectivePolicyEngineScheme = if ($PSBoundParameters.ContainsKey('PolicyEngineScheme') -and $PolicyEngineScheme) { [string]$PolicyEngineScheme } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'scheme') { [string]$existingConfig.policyEngine.scheme } else { 'http' } +$effectivePolicyRefreshSeconds = if ($PSBoundParameters.ContainsKey('PolicyRefreshSeconds')) { [int]$PolicyRefreshSeconds } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'refreshSeconds') { [int]$existingConfig.policyEngine.refreshSeconds } else { 300 } +$effectivePolicyCachePath = if ($PSBoundParameters.ContainsKey('PolicyCachePath') -and $PolicyCachePath) { [string]$PolicyCachePath } elseif ($existingConfig -and $existingConfig.PSObject.Properties.Name -contains 'policyEngine' -and $existingConfig.policyEngine.PSObject.Properties.Name -contains 'cachePath') { [string]$existingConfig.policyEngine.cachePath } else { Join-Path $effectiveStateRoot 'dlp-policy-cache.json' } $effectiveUsers = if ($Users -or $UserListPath) { Normalize-ActivityWatchUsers -Users $Users -UserListPath $UserListPath -Domain $Domain @@ -125,6 +142,7 @@ $config = New-ActivityWatchDeploymentConfig ` -LogsRoot $effectiveLogsRoot ` -CollectorScript $effectiveCollector ` -EndpointCollectorScript $effectiveEndpointCollector ` + -PolicyClientScript $effectivePolicyClientScript ` -EmailCollectorScript $assetResult.EmailCollectorScript ` -FileCollectorScript $effectiveFileCollector ` -SessionCollectorScript $effectiveSessionCollector ` @@ -142,6 +160,13 @@ $config = New-ActivityWatchDeploymentConfig ` -IncidentArtifactsRoot $effectiveIncidentArtifactsRoot ` -LogonMarkerEnabled $effectiveLogonMarkerEnabled ` -AwHostname $effectiveAwHostname ` + -PolicyMode $effectivePolicyMode ` + -PolicyEngineEnabled $effectivePolicyEngineEnabled ` + -PolicyEngineHost $effectivePolicyEngineHost ` + -PolicyEnginePort $effectivePolicyEnginePort ` + -PolicyEngineScheme $effectivePolicyEngineScheme ` + -PolicyRefreshSeconds $effectivePolicyRefreshSeconds ` + -PolicyCachePath $effectivePolicyCachePath ` -LaunchScriptPath $effectiveLaunchScript ` -RecoveryScriptPath $effectiveRecoveryScript ` -UserTasks $taskDefinitions `