ansible/nis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add ClamAV integration and AppArmor configuration for Samba virusfilter support

Browse Source
This commit is contained in:
Christoph
2026-05-26 02:18:17 +02:00
parent 6b684e5d54
commit 91bda857dc
3 changed files with 120 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/common/handlers/main.yml
+8
View File
@@ -109,3 +109,11 @@
service: service:
name: nfs-kernel-server name: nfs-kernel-server
state: restarted state: restarted
- name: Reload AppArmor profile clamd
command: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
- name: Restart clamav-daemon
service:
name: clamav-daemon
state: restarted
roles/common/tasks/samba-install.yml
+77 -32
View File
@@ -6,25 +6,25 @@
- name: (samba-install.yml) Ensure samba packages server (buster) are installed. - name: (samba-install.yml) Ensure samba packages server (buster) are installed.
package: package:
pkg: '{{ apt_install_server_samba }}' pkg: "{{ apt_install_server_samba }}"
state: present state: present
when: when:
- "groups['samba_server']|string is search(inventory_hostname)" - "groups['samba_server']|string is search(inventory_hostname)"
tags: tags:
- samba-server - samba-server
# --- # ---
# Virusfilter (ClamAV) — only when at least one share has vfs_object_virusfilter: true # Virusfilter (ClamAV) — only when at least one share has vfs_object_virusfilter: true
# --- # ---
- name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed - name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
package: package:
pkg: '{{ apt_install_server_samba_virusfilter }}' pkg: "{{ apt_install_server_samba_virusfilter }}"
state: present state: present
when: when:
- "groups['samba_server']|string is search(inventory_hostname)" - "groups['samba_server']|string is search(inventory_hostname)"
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
@@ -34,32 +34,83 @@
path: /data/samba/QUARANTINE path: /data/samba/QUARANTINE
owner: root owner: root
group: root group: root
mode: '0750' mode: "0750"
state: directory state: directory
when: when:
- "groups['samba_server']|string is search(inventory_hostname)" - "groups['samba_server']|string is search(inventory_hostname)"
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0 - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
tags: tags:
- samba-server - samba-server
- samba-virusfilter - samba-virusfilter
- name: (samba-install.yml) Ensure clamav user is member of all NIS groups
user:
name: clamav
groups: "{{ item.name }}"
append: yes
loop: "{{ nis_groups }}"
loop_control:
label: "{{ item.name }}"
when:
- "groups['samba_server']|string is search(inventory_hostname)"
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
- nis_groups | length > 0
tags:
- samba-server
- samba-virusfilter
- name: (samba-install.yml) Configure AppArmor local profile for clamd (data paths)
blockinfile:
path: /etc/apparmor.d/local/usr.sbin.clamd
create: yes
owner: root
group: root
mode: "0644"
marker: "# {mark} ANSIBLE MANAGED - smba virusfilter paths"
block: |
/data/** r,
/data/samba/QUARANTINE/** rw,
notify: Reload AppArmor profile clamd
when:
- "groups['samba_server']|string is search(inventory_hostname)"
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
tags:
- samba-server
- samba-virusfilter
- name: (samba-install.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
lineinfile:
path: /etc/clamav/clamd.conf
regexp: "^#?\\s*AllowAllMatchScan\\s"
line: "AllowAllMatchScan true"
state: present
notify: Restart clamav-daemon
when:
- "groups['samba_server']|string is search(inventory_hostname)"
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
tags:
- samba-server
- samba-virusfilter
- name: (samba-install.yml) Ensure samba share directories exists - name: (samba-install.yml) Ensure samba share directories exists
file: file:
path: "{{ item.path }}" path: "{{ item.path }}"
owner: "root" owner: "root"
group: "{{ item.group_write_list }}" group: "{{ item.group_write_list }}"
mode: '2770' mode: "2770"
state: directory state: directory
with_items: "{{ samba_shares }}" with_items: "{{ samba_shares }}"
loop_control: loop_control:
label: '{{ item.name }}' label: "{{ item.name }}"
when: when:
- "groups['samba_server']|string is search(inventory_hostname)" - "groups['samba_server']|string is search(inventory_hostname)"
tags: tags:
- samba-shares - samba-shares
# --- # ---
# /etc/samba/smb.conf # /etc/samba/smb.conf
# --- # ---
@@ -81,14 +132,13 @@
tags: tags:
- samba-server - samba-server
- name: (samba-install.yml) /etc/samba/smb.conf - name: (samba-install.yml) /etc/samba/smb.conf
template: template:
dest: /etc/samba/smb.conf dest: /etc/samba/smb.conf
src: etc/samba/smb.conf.j2 src: etc/samba/smb.conf.j2
owner: root owner: root
group: root group: root
mode: 0644 mode: 644
when: when:
- "groups['samba_server']|string is search(inventory_hostname)" - "groups['samba_server']|string is search(inventory_hostname)"
notify: notify:
@@ -97,14 +147,13 @@
tags: tags:
- samba-server - samba-server
- name: (samba-install.yml) Ensure file /etc/samba/users.map exists - name: (samba-install.yml) Ensure file /etc/samba/users.map exists
copy: copy:
src: "{{ role_path + '/files/etc/samba/users.map' }}" src: "{{ role_path + '/files/etc/samba/users.map' }}"
dest: /etc/samba/users.map dest: /etc/samba/users.map
owner: root owner: root
group: root group: root
mode: 0644 mode: 644
when: when:
- "groups['samba_server']|string is search(inventory_hostname)" - "groups['samba_server']|string is search(inventory_hostname)"
notify: notify:
@@ -113,12 +162,12 @@
tags: tags:
- samba-server - samba-server
# --- # ---
# Cronjob for cleaning up samba trash dirs # Cronjob for cleaning up samba trash dirs
# --- # ---
- name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists - name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh'
exists
stat: stat:
path: /root/bin/samba/clean_samba_trash.sh path: /root/bin/samba/clean_samba_trash.sh
register: clean_samba_trash_exists register: clean_samba_trash_exists
@@ -137,19 +186,17 @@
tags: tags:
- samba-server - samba-server
- name: (samba-config-server.yml) Check if cleaning up trash dirs is configured - name: (samba-config-server.yml) Check if cleaning up trash dirs is configured
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /root/bin/samba/conf/clean_samba_trash.conf path: /root/bin/samba/conf/clean_samba_trash.conf
regexp: '^trash_dirs=*' regexp: "^trash_dirs=*"
state: absent state: absent
check_mode: true check_mode: true
changed_when: false changed_when: false
register: clean_samba_trash_dirs register: clean_samba_trash_dirs
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
tags: [samba-server, samba-cron] tags: [ samba-server, samba-cron ]
- name: (samba-config-server.yml) Creates a cron job for cleaning up samba trash dirs - name: (samba-config-server.yml) Creates a cron job for cleaning up samba trash dirs
ansible.builtin.cron: ansible.builtin.cron:
@@ -165,33 +212,33 @@
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- clean_samba_trash_exists.stat.exists | bool - clean_samba_trash_exists.stat.exists | bool
- (clean_samba_trash_dirs.found | int) > 0 - (clean_samba_trash_dirs.found | int) > 0
tags: [samba-server, samba-cron] tags: [ samba-server, samba-cron ]
# --- # ---
# Cronjob for setting permissions on samba shares # Cronjob for setting permissions on samba shares
# --- # ---
- name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists - name: (samba-config-server.yml) Check if file
'/root/bin/samba/set_permissions_samba_shares.sh' exists
ansible.builtin.stat: ansible.builtin.stat:
path: /root/bin/samba/set_permissions_samba_shares.sh path: /root/bin/samba/set_permissions_samba_shares.sh
register: set_permissions_on_samba_shares_exists register: set_permissions_on_samba_shares_exists
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
tags: [samba-server, samba-cron] tags: [ samba-server, samba-cron ]
- name: (samba-config-server.yml) Adjust configuration for script
- name: (samba-config-server.yml) Adjust configuration for script 'set_permissions_samba_shares.sh' 'set_permissions_samba_shares.sh'
ansible.builtin.template: ansible.builtin.template:
dest: /root/bin/samba/conf/set_permissions_samba_shares.conf dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2 src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- set_permissions_on_samba_shares_exists.stat.exists | bool - set_permissions_on_samba_shares_exists.stat.exists | bool
tags: [samba-server, samba-cron] tags: [ samba-server, samba-cron ]
- name: (samba-config-server.yml) Creates a cron job for setting permissions to
- name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs samba dirs
ansible.builtin.cron: ansible.builtin.cron:
name: "{{ samba_cronjob_permissions.name }}" name: "{{ samba_cronjob_permissions.name }}"
minute: "{{ samba_cronjob_permissions.minute }}" minute: "{{ samba_cronjob_permissions.minute }}"
@@ -203,9 +250,8 @@
job: "{{ samba_cronjob_permissions.job }}" job: "{{ samba_cronjob_permissions.job }}"
when: when:
- inventory_hostname in groups['samba_server'] - inventory_hostname in groups['samba_server']
- (clean_samba_trash_dirs.found | int) > 0 # << int -> bool - (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
tags: [samba-server, samba-cron] tags: [ samba-server, samba-cron ]
# --- # ---
# Samba clients # Samba clients
@@ -220,4 +266,3 @@
- ansible_distribution == "Ubuntu" - ansible_distribution == "Ubuntu"
tags: tags:
- samba-client - samba-client
roles/common/templates/etc/samba/smb.conf.j2
+8 -2
View File
@@ -92,7 +92,7 @@
# This tells Samba to use a separate log file for each machine # This tells Samba to use a separate log file for each machine
# that connects # that connects
; log file = /var/log/samba/log.%m log file = /var/log/samba/log.%m
log file = /var/log/samba/%I.log log file = /var/log/samba/%I.log
# Cap the size of the individual log files (in KiB). # Cap the size of the individual log files (in KiB).
@@ -489,7 +489,13 @@
# Scan-Zeitpunkt: nur beim Öffnen, nicht beim Schließen # Scan-Zeitpunkt: nur beim Öffnen, nicht beim Schließen
virusfilter:scan on open = yes virusfilter:scan on open = yes
virusfilter:scan on close = no virusfilter:scan on close = yes
# Fehlercode bei infizierter Datei (beim Öffnen)
virusfilter:infected file errno on open = EACCES
# Fehlercode beim Schließen
virusfilter:infected file errno on close = EACCES
# Timeouts (Millisekunden) # Timeouts (Millisekunden)
virusfilter:connect timeout = 30000 virusfilter:connect timeout = 30000