{"id":497,"date":"2019-03-08T04:48:12","date_gmt":"2019-03-08T04:48:12","guid":{"rendered":"https:\/\/mrjsec.co.uk\/blog\/?p=497"},"modified":"2019-03-13T19:25:10","modified_gmt":"2019-03-13T19:25:10","slug":"saltstack","status":"publish","type":"post","link":"https:\/\/mrjsec.co.uk\/blog\/saltstack\/","title":{"rendered":"
SaltStack<\/center>"},"content":{"rendered":"\n

I won’t be creating a full guide on how to use SaltStack, just a simple setup guide. More information on SaltStack is on their website here<\/a>.<\/p>\n\n\n\n

Installing the salt master is simple and can be done by using the commands<\/p>\n\n\n\n

sudo apt update\nsudo apt install salt-master -y<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
I\u2019m using Ubuntu 18.04.2 x64 as the Salt Master; if you’re facing issues installing I would recommend checking out the SaltStack install page<\/a> it covers most distros and windows! <\/p>\n\n\n\n
Using the\ncommand \u201csudo salt-master \u2013version\u201d shows what Salt Master version you have\ninstalled and to ensure installed correctly. \n<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Salt master is\nup and running its time to add minions, for this example three minions Kali,\nMint and Parrot. One of the best parts I love about SaltStack is the fact\nminions won’t need any open ports, only the salt master needs TCP port 4505 and\n4506 open.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Using the\napt command to install the salt-minion, the commands as followed:<\/p>\n\n\n\n
sudo apt update\nsudo apt install salt-minion -y<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Using the\ncommand \u201csudo salt-minion \u2013version” shows what Salt Minion version you\nhave installed and to ensure it installed correctly.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Again, if you’re facing issues installing, I would recommend checking out the SaltStack install page<\/a> it covers most distros and windows!<\/p>\n\n\n\n
Now that we\nhave the salt-minion installed on our distros, we need to tell the minions\nwhere to find the salt master, for this example my salt master is at 177.31.249.68.\nCreate local.conf within “\/etc\/salt\/minion.d\/” also, ensure to add\nthe correct fields:<\/p>\n\n\n\n
master: 177.31.249.68\n(Change this to your Salt Master\u2019s IP address).<\/p>\n\n\n\n
id: Mint (If\nyou wish to set an ID for your minion, for example, you could call it test box,\nSteve, Robot).<\/p>\n\n\n\n
I have also\ncreated a simple code which can create the local.conf:<\/p>\n\n\n\n
sudo sh -c \u201cecho 'master: 177.31.249.68\nid: '$HOSTNAME'' > \/etc\/salt\/minion.d\/local.conf\u201d<\/code><\/pre>\n\n\n\n
Run within a\nterminal, creates the file local.conf within\n“\/etc\/salt\/minion.d\/local.conf” The code puts the master IP (Ensure\nto change this to your Master’s IP), and uses the hostname of the computer as\nthe id (Again, you can change this).<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Don’t forget\nto restart the salt-minion service or else it won’t take effect!<\/p>\n\n\n\n
sudo service salt-minion restart<\/code><\/pre>\n\n\n\n
Now that you\nhave both your Salt Master and Salt minions installed and running, let\u2019s jump\nback to the Salt Master again and accept the minions to the salt master, using\nthe command salt-key you should (If everything has gone correctly) see all the\nminions (depending what you had named them using the id: )<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
So, we now\nhave three minions in our \u201cUnaccepted keys\u201d, if you wish to choose which minion\nto accept the -a minion name (-a accept) for example if you wish to accept kali\nonly you would need to do the following:<\/p>\n\n\n\n
salt-key -a kali<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now kali is\npart of our accepted keys, and if you wanted to delete a minion you would use\nthe -d (-d delete) for example let\u2019s delete kali only:<\/p>\n\n\n\n
salt-key -d kali<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
 Kali is no more, don’t worry if you deleted a minion by mistake, restart the minion service again:<\/p>\n\n\n\n
sudo service salt-minion restart<\/code><\/pre>\n\n\n\n
Kali comes\nback, and you need to reaccept them again!<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Let’s move\non and to save time, use the command -A and -y (-A accepts all and -y yes) this\naccepts all unaccepted keys:<\/p>\n\n\n\n
salt-key -A -y<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now we have all our minions added to our salt master if you wish to find more commands for the salt-key use:<\/p>\n\n\n\n
salt-key -h<\/code><\/pre>\n\n\n\n
Shows what\ncommands are available and what they offer.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now let\u2019s\nmove onto issuing commands to our minions from the salt master, the first\ncommand (and mostly always noted) is the ping command, this command tells you\nif the minion is online and if the master can “speak” to them:<\/p>\n\n\n\n
salt '*' test.ping<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
All of our minions are awake, and the salt master can “speak” to them, let\u2019s try another command and this time let\u2019s try and issue a terminal command from the salt master to the minions using cmd.run:<\/p>\n\n\n\n
salt '*' cmd.run 'df -h'<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
So, we have\ntold the minions to issue the command df -h (df is a Unix command to show the disk\nspace) SaltStack automatedly returns the results and errors if any! Let\u2019s issue\nsome more commands.<\/p>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
We just issued whoami, pwd, w and even did an echo, all from one salt master! You noticed we use the \u2018*’ a lot, and this means to send the commands to all minions (* is a wildcard). If you only wanted to send commands to one minion you would change the \u2018*\u2019 with the id name of that minion, for example:<\/p>\n\n\n\n
salt \u2018Mate\u2019 cmd.run \u2018command here.'<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Salt master issued the commands only to the Mate minion, and only the Mate minion gave back any results, parrot and kali didn\u2019t, this is how you can issue commands to one minion at a time. However, if you wish to issue commands to multiple minions you would need to use -L (-L Take a comma or space delimited list of minions.) which would be something like this:<\/p>\n\n\n\n
salt -L 'Mate,kali' cmd.run 'uname -a' <\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Now, the\nsalt master is issuing commands to Mate and kali only and is getting results\nback from Mate and kali only, and parrot doesn’t do anything. Now let\u2019s do\nsomething a bit more fun, let\u2019s run a nmap scan from one of our salt minions\nand get the results back kind of like a Zombie. <\/p>\n\n\n\n
Let’s use\nthe minion Mate this way we can install a package using the salt master:<\/p>\n\n\n\n
salt 'Mate' cmd.run 'apt install nmap -y'<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Nmap\ninstalled successfully on the Mate minion, and now we issue the following\ncommand:<\/p>\n\n\n\n
salt 'Mate' cmd.run 'nmap -p 1-100 scanme.nmap.org'<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
So, we were\nable to install nmap and then perform a nmap scan just from the salt master and\nnothing else, from a security point of view you can see how \u201cfun\u201d this can be,\nyou\u2019re able to run any Linux command in root mode without being asked for the\nroot password (unless changed within he minion settings).<\/p>\n\n\n\n
SaltStack is a big project, as I said at the start of this guide, I won\u2019t be covering everything about SaltStack as there is a lot to cover! Such as states, Pillars, Grains and so much more. SaltStack Documentation<\/a> is a great place to start.<\/p>\n\n\n\n
I hope you\nhave enjoyed my little guide on SaltStack.<\/p>\n\n\n\n
Thanks for reading!
 -Mr J <\/p>\n\n\n\n
 \u201cMade for educational purposes Only.\u201d <\/p>\n","protected":false},"excerpt":{"rendered":"
I won’t be creating a full guide on how to use SaltStack, just a simple setup guide. More information on SaltStack is on their website here. Installing the salt master is simple and can be…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"
A small but simple guide on how to use SaltStack on Linux<\/center>","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[19],"tags":[23,22,25,24,20,21],"class_list":["post-497","post","type-post","status-publish","format-standard","hentry","category-linux-stuff","tag-kali","tag-linux","tag-mint","tag-parrot","tag-salt","tag-saltstack"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paD3U6-81","_links":{"self":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=497"}],"version-history":[{"count":5,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/497\/revisions"}],"predecessor-version":[{"id":524,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/497\/revisions\/524"}],"wp:attachment":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}