Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/puppetlabs-seteam/tse-demo-vagrant-stack
This repository is no longer in use by the Puppet SE Team, and will be official Archived on Friday, July 1st. It will then be deleted on Friday, July 15th. If you are using any of the included code in any way, please take efforts to preserver your access to the code at your earlier convenience.
Thanks! - The Puppetlabs SE Team
This project provides a demo environment for running a Puppet master and several agents.
This tool is built on top of a few different technologies, mainly VirtualBox and Vagrant, so you'll need to ensure that those are present before you continue. You'll also need to have the Git tools installed to checkout the repository.
$ vagrant plugin install oscar
$ vagrant plugin install vagrant-hosts
$ vagrant plugin install vagrant-reload
$ vagrant plugin install vagrant-multiprovider-snap
(Required for snapshot functionaility in Vagrant versions less than 1.8, functionaility is part of Vagrant core from v1.8 by utilising the "vagrant snapshot" command )In addition, keep in mind the raw cpu and memory requirements. The master is 2CPU and 8G of memory.
After getting the pre-reqs setup, run scripts/init.sh. This will stand up the master and all configured agents. For all agents, the will be snapshotted after provisioning and then shutdown. The master will be left running. To complete the setup run vagrant hosts list
and update your hosts file.
The new master is already fully deployed, running with a hostname of master.inf.puppet.vm
. In additon, an internal Git server is running on the new master.
SSH:
vagrant ssh /master/
Enterprise Console:
user
: adminpassword
: puppetlabsGit Server:
user
: puppetpassword
: puppetlabsOnce the master is up and running, you'll need to add your license key to the master. Code manager deployments will not work successfully until you add a license key because there are some PE only modules in use.
Optional: Login to the Git server (here) and update the puppet users ssh keys with your own public so that you can make updates to the control-repo.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.