Add ClamAV integration and AppArmor configuration for Samba virusfilter support
This commit is contained in:
@@ -109,3 +109,11 @@
|
||||
service:
|
||||
name: nfs-kernel-server
|
||||
state: restarted
|
||||
|
||||
- name: Reload AppArmor profile clamd
|
||||
command: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
|
||||
|
||||
- name: Restart clamav-daemon
|
||||
service:
|
||||
name: clamav-daemon
|
||||
state: restarted
|
||||
|
||||
@@ -6,25 +6,25 @@
|
||||
|
||||
- name: (samba-install.yml) Ensure samba packages server (buster) are installed.
|
||||
package:
|
||||
pkg: '{{ apt_install_server_samba }}'
|
||||
pkg: "{{ apt_install_server_samba }}"
|
||||
state: present
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
# ---
|
||||
# Virusfilter (ClamAV) — only when at least one share has vfs_object_virusfilter: true
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
|
||||
package:
|
||||
pkg: '{{ apt_install_server_samba_virusfilter }}'
|
||||
pkg: "{{ apt_install_server_samba_virusfilter }}"
|
||||
state: present
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
|
||||
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
@@ -34,32 +34,83 @@
|
||||
path: /data/samba/QUARANTINE
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0750'
|
||||
mode: "0750"
|
||||
state: directory
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
|
||||
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-install.yml) Ensure clamav user is member of all NIS groups
|
||||
user:
|
||||
name: clamav
|
||||
groups: "{{ item.name }}"
|
||||
append: yes
|
||||
loop: "{{ nis_groups }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
|
||||
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
- nis_groups | length > 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-install.yml) Configure AppArmor local profile for clamd (data paths)
|
||||
blockinfile:
|
||||
path: /etc/apparmor.d/local/usr.sbin.clamd
|
||||
create: yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
marker: "# {mark} ANSIBLE MANAGED - smba virusfilter paths"
|
||||
block: |
|
||||
/data/** r,
|
||||
/data/samba/QUARANTINE/** rw,
|
||||
notify: Reload AppArmor profile clamd
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
|
||||
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-install.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
|
||||
lineinfile:
|
||||
path: /etc/clamav/clamd.conf
|
||||
regexp: "^#?\\s*AllowAllMatchScan\\s"
|
||||
line: "AllowAllMatchScan true"
|
||||
state: present
|
||||
notify: Restart clamav-daemon
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
- samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
|
||||
selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
|
||||
tags:
|
||||
- samba-server
|
||||
- samba-virusfilter
|
||||
|
||||
- name: (samba-install.yml) Ensure samba share directories exists
|
||||
file:
|
||||
path: "{{ item.path }}"
|
||||
owner: "root"
|
||||
group: "{{ item.group_write_list }}"
|
||||
mode: '2770'
|
||||
mode: "2770"
|
||||
state: directory
|
||||
with_items: "{{ samba_shares }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
label: "{{ item.name }}"
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- samba-shares
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/samba/smb.conf
|
||||
# ---
|
||||
@@ -81,14 +132,13 @@
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: (samba-install.yml) /etc/samba/smb.conf
|
||||
template:
|
||||
dest: /etc/samba/smb.conf
|
||||
src: etc/samba/smb.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: 644
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
notify:
|
||||
@@ -97,14 +147,13 @@
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: (samba-install.yml) Ensure file /etc/samba/users.map exists
|
||||
copy:
|
||||
src: "{{ role_path + '/files/etc/samba/users.map' }}"
|
||||
dest: /etc/samba/users.map
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
mode: 644
|
||||
when:
|
||||
- "groups['samba_server']|string is search(inventory_hostname)"
|
||||
notify:
|
||||
@@ -113,12 +162,12 @@
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
# ---
|
||||
# Cronjob for cleaning up samba trash dirs
|
||||
# ---
|
||||
|
||||
- name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh' exists
|
||||
- name: (samba-install.yml) Check if file '/root/bin/samba/clean_samba_trash.sh'
|
||||
exists
|
||||
stat:
|
||||
path: /root/bin/samba/clean_samba_trash.sh
|
||||
register: clean_samba_trash_exists
|
||||
@@ -137,19 +186,17 @@
|
||||
tags:
|
||||
- samba-server
|
||||
|
||||
|
||||
- name: (samba-config-server.yml) Check if cleaning up trash dirs is configured
|
||||
ansible.builtin.lineinfile:
|
||||
path: /root/bin/samba/conf/clean_samba_trash.conf
|
||||
regexp: '^trash_dirs=*'
|
||||
regexp: "^trash_dirs=*"
|
||||
state: absent
|
||||
check_mode: true
|
||||
changed_when: false
|
||||
register: clean_samba_trash_dirs
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
tags: [samba-server, samba-cron]
|
||||
|
||||
tags: [ samba-server, samba-cron ]
|
||||
|
||||
- name: (samba-config-server.yml) Creates a cron job for cleaning up samba trash dirs
|
||||
ansible.builtin.cron:
|
||||
@@ -165,33 +212,33 @@
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- clean_samba_trash_exists.stat.exists | bool
|
||||
- (clean_samba_trash_dirs.found | int) > 0
|
||||
tags: [samba-server, samba-cron]
|
||||
|
||||
tags: [ samba-server, samba-cron ]
|
||||
|
||||
# ---
|
||||
# Cronjob for setting permissions on samba shares
|
||||
# ---
|
||||
|
||||
- name: (samba-config-server.yml) Check if file '/root/bin/samba/set_permissions_samba_shares.sh' exists
|
||||
- name: (samba-config-server.yml) Check if file
|
||||
'/root/bin/samba/set_permissions_samba_shares.sh' exists
|
||||
ansible.builtin.stat:
|
||||
path: /root/bin/samba/set_permissions_samba_shares.sh
|
||||
register: set_permissions_on_samba_shares_exists
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
tags: [samba-server, samba-cron]
|
||||
tags: [ samba-server, samba-cron ]
|
||||
|
||||
|
||||
- name: (samba-config-server.yml) Adjust configuration for script 'set_permissions_samba_shares.sh'
|
||||
- name: (samba-config-server.yml) Adjust configuration for script
|
||||
'set_permissions_samba_shares.sh'
|
||||
ansible.builtin.template:
|
||||
dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
|
||||
src: root/bin/samba/conf/set_permissions_samba_shares.conf.j2
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- set_permissions_on_samba_shares_exists.stat.exists | bool
|
||||
tags: [samba-server, samba-cron]
|
||||
tags: [ samba-server, samba-cron ]
|
||||
|
||||
|
||||
- name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs
|
||||
- name: (samba-config-server.yml) Creates a cron job for setting permissions to
|
||||
samba dirs
|
||||
ansible.builtin.cron:
|
||||
name: "{{ samba_cronjob_permissions.name }}"
|
||||
minute: "{{ samba_cronjob_permissions.minute }}"
|
||||
@@ -203,9 +250,8 @@
|
||||
job: "{{ samba_cronjob_permissions.job }}"
|
||||
when:
|
||||
- inventory_hostname in groups['samba_server']
|
||||
- (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
|
||||
tags: [samba-server, samba-cron]
|
||||
|
||||
- (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
|
||||
tags: [ samba-server, samba-cron ]
|
||||
|
||||
# ---
|
||||
# Samba clients
|
||||
@@ -220,4 +266,3 @@
|
||||
- ansible_distribution == "Ubuntu"
|
||||
tags:
|
||||
- samba-client
|
||||
|
||||
|
||||
@@ -92,7 +92,7 @@
|
||||
|
||||
# This tells Samba to use a separate log file for each machine
|
||||
# that connects
|
||||
; log file = /var/log/samba/log.%m
|
||||
log file = /var/log/samba/log.%m
|
||||
log file = /var/log/samba/%I.log
|
||||
|
||||
# Cap the size of the individual log files (in KiB).
|
||||
@@ -489,7 +489,13 @@
|
||||
|
||||
# Scan-Zeitpunkt: nur beim Öffnen, nicht beim Schließen
|
||||
virusfilter:scan on open = yes
|
||||
virusfilter:scan on close = no
|
||||
virusfilter:scan on close = yes
|
||||
|
||||
# Fehlercode bei infizierter Datei (beim Öffnen)
|
||||
virusfilter:infected file errno on open = EACCES
|
||||
|
||||
# Fehlercode beim Schließen
|
||||
virusfilter:infected file errno on close = EACCES
|
||||
|
||||
# Timeouts (Millisekunden)
|
||||
virusfilter:connect timeout = 30000
|
||||
|
||||
Reference in New Issue
Block a user