forgot template '/smb.conf.j2' - add also virusfilter support for Samba homes in that file.

group_vars/akb.yml

@@ -463,6 +463,7 @@ samba_shares:
     group_write_list: verwaltung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -482,6 +483,7 @@ samba_shares:
     group_write_list: ab
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -504,6 +506,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -576,6 +579,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -586,6 +590,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -596,6 +601,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -606,6 +612,7 @@ samba_shares:
     group_write_list: intern
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: false
     recycle_path: '@Recycle.Bin'
     user:
@@ -622,6 +629,7 @@ samba_shares:
     group_write_list: intern
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: false
     recycle_path: '@Recycle.Bin'
     user:

group_vars/all/main.yml

@@ -1747,6 +1747,12 @@ apt_install_client_samba:
   - samba-client
   - samba-common
 
+apt_install_server_samba_virusfilter:
+  - clamav
+  - clamav-daemon
+  - clamav-freshclam
+  - samba-vfs-modules
+
 
 # samba_workgroup
 #
@@ -1770,6 +1776,9 @@ samba_server_min_protocol: {}
 #
 samba_allow_insecure_wide_links: !!str no
 
+# include vfs object 'virusfilter' to (private) homes shares
+samba_homes_virusfilter: false
+
 samba_groups: []
 
 # samba_user:

group_vars/flr.yml

@@ -486,6 +486,7 @@ samba_shares:
     group_write_list: team
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -495,6 +496,7 @@ samba_shares:
     group_write_list: esf-bleibnet
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -504,6 +506,7 @@ samba_shares:
     group_write_list: amif
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -513,6 +516,7 @@ samba_shares:
     group_write_list: quali
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -522,6 +526,7 @@ samba_shares:
     group_write_list: aktion-mensch
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -531,6 +536,7 @@ samba_shares:
     group_write_list: foerderung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -540,6 +546,7 @@ samba_shares:
     group_write_list: buchhaltung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -549,6 +556,7 @@ samba_shares:
     group_write_list: verwaltung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -558,6 +566,7 @@ samba_shares:
     group_write_list: infrastruktur
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -568,6 +577,7 @@ samba_shares:
     file_create_mask: '0660'
     dir_create_mask: '2770'
     #wide_links: !!str yes
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 

group_vars/mbr.yml

@@ -504,6 +504,7 @@ nis_user:
       - direx
       - mbr-buero
       - mbr-finanzen-personal
+      - technik
       - vdk
     is_samba_user: true
     password: 'nA-y.I6ReJ-M'
@@ -745,7 +746,6 @@ nis_user:
     groups:
       - all-users
       - buero-scan
-      - mbr-buero
     is_samba_user: true
     password: '2001_RAT_urban!'
 
@@ -753,7 +753,6 @@ nis_user:
     groups:
       - all-users
       - buero-scan
-      - mbr-buero
     is_samba_user: true
     password: '20praktikum213'
 
@@ -856,6 +855,22 @@ nis_user:
     is_samba_user: true
     password: 'q2Sc.C7-6hZR'
 
+  - name: sophie.tadeus
+    groups:
+      - all-users
+      - buero-scan
+      - rias-berlin
+    is_samba_user: true
+    password: '3.5.JQby/ubw'
+
+  - name: steffen.klaevers
+    groups:
+      - all-users
+      - buero-scan
+      - rias-berlin
+    is_samba_user: true
+    password: 'pRU.g5W5h-rY'
+
 
 # ---
 # Regishut
@@ -908,6 +923,7 @@ nis_user:
       - all-users
       - buero-scan
       - regishut
+      - technik
     is_samba_user: true
     password: '7A2i-Iz.mUHz'
 
@@ -985,6 +1001,7 @@ samba_shares:
     group_write_list: all-users
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -994,6 +1011,7 @@ samba_shares:
     group_write_list: mbr-admins
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
 
   - name: Kamera
     path: /data/shares/Kamera
@@ -1008,8 +1026,9 @@ samba_shares:
     group_write_list: buero-scan
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
-    recycle_path: '@Recycle.Bin'
+    #recycle_path: '@Recycle.Bin'
 
   - name: Technik-und-Sicherheit
     path: /data/shares/Technik-und-Sicherheit
@@ -1017,6 +1036,7 @@ samba_shares:
     group_write_list: technik
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1026,6 +1046,7 @@ samba_shares:
     group_write_list: ag-antisem
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1039,6 +1060,7 @@ samba_shares:
     group_write_list: vdk
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1048,6 +1070,7 @@ samba_shares:
     group_write_list: vdk
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1057,6 +1080,7 @@ samba_shares:
     group_write_list: vdk
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1079,6 +1103,7 @@ samba_shares:
     group_write_list: bgn-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1088,6 +1113,7 @@ samba_shares:
     group_write_list: bgn
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1101,6 +1127,7 @@ samba_shares:
     group_write_list: bmb
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1114,6 +1141,7 @@ samba_shares:
     group_write_list: mbr-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1123,6 +1151,7 @@ samba_shares:
     group_write_list: mbr-buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1132,6 +1161,7 @@ samba_shares:
     group_write_list: mbr-buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1141,6 +1171,7 @@ samba_shares:
     group_write_list: mbr-buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1154,6 +1185,7 @@ samba_shares:
     group_write_list: rias-berlin
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1163,6 +1195,7 @@ samba_shares:
     group_write_list: rias-berlin-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1172,6 +1205,7 @@ samba_shares:
     group_write_list: rias-bund
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1181,6 +1215,7 @@ samba_shares:
     group_write_list: rias-bund-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1194,6 +1229,7 @@ samba_shares:
     group_write_list: regishut
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1203,6 +1239,7 @@ samba_shares:
     group_write_list: regishut-personal-finanzen
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1216,6 +1253,7 @@ samba_shares:
     group_write_list: direx
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1225,6 +1263,7 @@ samba_shares:
     group_write_list: direx-personal-finanzen
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 

group_vars/sprachenatelier.yml

@@ -480,33 +480,9 @@ samba_shares:
     group_write_list: buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
-    user:
-      - anahit
-      - andrea
-      - bueropraktikum
-      - chema
-      - chris
-      - isadora
-      - jessica
-      - konstantin
-      - lara
-      - lena
-      - linda
-      - margit
-      - matija
-      - musa
-      - praktikant1
-      - praktikant2
-      - praktikant3
-      - praktikant4
-      - praktikant5
-      - praktikant6
-      - saravic
-      - sysadm
-      - simone
-      - yang
 
   - name: Verwaltung
     path: /data/samba/verwaltung
@@ -514,26 +490,9 @@ samba_shares:
     group_write_list: intern
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
-    user:
-      - anahit
-      - andrea
-      - bueropraktikum
-      - chema
-      - chris
-      - isadora
-      - jessica
-      - konstantin
-      - lara
-      - linda
-      - margit
-      - matija
-      - musa
-      - saravic
-      - sysadm
-      - simone
-      - yang
 
   - name: Multimedia
     path: /data/samba/no-backup-share/multimedia
@@ -541,12 +500,9 @@ samba_shares:
     group_write_list: no-backup
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
-    user:
-      - chris
-      - margit
-      - musa
 
 
 # ==========

roles/common/handlers/main.yml

@@ -109,3 +109,11 @@
   service:
     name: nfs-kernel-server
     state: restarted
+
+- name: Reload AppArmor profile clamd
+  command: apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd
+
+- name: Restart clamav-daemon
+  service:
+    name: clamav-daemon
+    state: restarted

roles/common/tasks/nis-install-server.yml

@@ -20,7 +20,7 @@
     src: etc/defaultdomain.j2
     owner: root
     group: root
-    mode: 0644
+    mode: 644
   tags:
     - nis-install
     - nis-install-server
@@ -31,7 +31,7 @@
     src: etc/yp.conf.j2
     owner: root
     group: root
-    mode: 0644
+    mode: 644
   tags:
     - nis-install
     - nis-install-client
@@ -42,7 +42,6 @@
     - nis-install
     - nis-install-server
 
-
 # ---
 # Since Debian 11 (bullseye) password hashing uses 'yescrypt' by default.
 #
@@ -73,17 +72,17 @@
     - ansible_facts['distribution'] == "Debian"
     - ansible_facts['distribution_major_version']|int >= 11
     - file_etc_pam_d_common_password.stat.exists == True
-
     #- ansible_distribution_major_version|int <= 12
 
-- name: (nis-install-server.yml) Change default password hash for local system accounts from SHA-512 to yescrypt
-  shell: perl -i -n -p -e "s/^(password.+)yescrypt/\1sha512/" /etc/pam.d/common-password
+- name: (nis-install-server.yml) Change default password hash for local system
+    accounts from SHA-512 to yescrypt
+  shell: perl -i -n -p -e "s/^(password.+)yescrypt/\1sha512/"
+    /etc/pam.d/common-password
   when:
     - ansible_facts['distribution'] == "Debian"
     - ansible_facts['distribution_major_version']|int >= 11
     - file_etc_pam_d_common_password.stat.exists == True
     - presence_of_passwprd_hashing_yescrypt is changed
-
     #- ansible_facts['distribution_major_version']|int <= 12
 
 
@@ -107,25 +106,26 @@
     - nis-install
     - nis-install-server
 
-- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER' (server)
+- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER'
+    (server)
   replace:
     path: /etc/default/nis
-    regexp: '^NISSERVER=.*'
-    replace: 'NISSERVER=master'
+    regexp: "^NISSERVER=.*"
+    replace: "NISSERVER=master"
   tags:
     - nis-install
     - nis-install-server
 
-- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (server)
+- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT'
+    (server)
   replace:
     path: /etc/default/nis
-    regexp: '^NISCLIENT=.*'
-    replace: 'NISCLIENT=false'
+    regexp: "^NISCLIENT=.*"
+    replace: "NISCLIENT=false"
   tags:
     - nis-install
     - nis-install-server
 
-
 # ---
 # /etc/ypserv.securenets
 # ---
@@ -146,37 +146,40 @@
     - nis-install
     - nis-install-server
 
-- name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file /etc/ypserv.securenets
+- name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file
+    /etc/ypserv.securenets
   replace:
     path: /etc/ypserv.securenets
-    regexp: '^(0.0.0.0\s+.*)'
-    replace: '#\1'
+    regexp: "^(0.0.0.0\\s+.*)"
+    replace: "#\\1"
   tags:
     - nis-install
     - nis-install-server
 
-- name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file /etc/ypserv.securenets
+- name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file
+    /etc/ypserv.securenets
   lineinfile:
     path: /etc/ypserv.securenets
-    line: '255.255.0.0 192.168.0.0'
+    line: "255.255.0.0 192.168.0.0"
     insertafter: EOF
     state: present
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   tags:
     - nis-install
     - nis-install-server
 
-- name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file /etc/ypserv.securenets
+- name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file
+    /etc/ypserv.securenets
   lineinfile:
     path: /etc/ypserv.securenets
-    line: '255.0.0.0 10.0.0.0'
+    line: "255.0.0.0 10.0.0.0"
     insertafter: EOF
     state: present
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   tags:
     - nis-install
     - nis-install-server
@@ -188,17 +191,17 @@
     - nis-install
     - nis-install-server
 
-
 # ---
 # Base directory containing users' home directory
 # ---
 
-- name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually /data/home) exists
+- name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually
+    /data/home) exists
   file:
-    path: '{{ nis_base_home }}'
+    path: "{{ nis_base_home }}"
     owner: root
     group: root
-    mode: '0755'
+    mode: "0755"
     state: directory
   when:
     - "groups['nis_server']|string is search(inventory_hostname)"
@@ -206,23 +209,22 @@
     - nis-install
     - nis-install-server
 
-
 # ---
 # /etc/default/useradd
 # ---
 
-- name: (nis-install-server.yml) HOME in /etc/default/useradd setzen oder hinter Kommentar einfügen
+- name: (nis-install-server.yml) HOME in /etc/default/useradd setzen oder hinter
+    Kommentar einfügen
   ansible.builtin.lineinfile:
     path: /etc/default/useradd
-    regexp: '^HOME='
-    insertafter: '^#\s*HOME='
+    regexp: "^HOME="
+    insertafter: "^#\\s*HOME="
     line: "HOME={{ nis_base_home }}"
     backup: true
   when:
     - nis_base_home is defined
     - nis_base_home != '/home'
 
-
 # ---
 # /etc/adduser.conf
 # ---
@@ -240,7 +242,6 @@
 
 - name: (nis-install-server.yml) Backup existing file /etc/adduser.conf
   command: cp -a /etc/adduser.conf /etc/adduser.conf.ORIG
-  when:
   when:
     - nis_base_home is defined
     - nis_base_home != '/home'
@@ -249,19 +250,18 @@
     - nis-install
     - nis-install-server
 
-
-- name: (nis-install-server.yml) DHOME in /etc/adduser.conf setzen oder hinter Kommentar einfügen
+- name: (nis-install-server.yml) DHOME in /etc/adduser.conf setzen oder hinter
+    Kommentar einfügen
   ansible.builtin.lineinfile:
     path: /etc/adduser.conf
-    regexp: '^DHOME='
-    insertafter: '^#\s*DHOME='
+    regexp: "^DHOME="
+    insertafter: "^#\\s*DHOME="
     line: "DHOME={{ nis_base_home }}"
     backup: true
   when:
     - nis_base_home is defined
     - nis_base_home != '/home'
 
-
 # ---
 # /var/yp/Makefile
 # ---
@@ -285,8 +285,8 @@
 - name: (nis-install-server.yml) Adjust file  '/var/yp/Makefile'
   replace:
     path: /var/yp/Makefile
-    regexp: '^#?{{ item }}=.*'
-    replace: '{{ item }}=true'
+    regexp: "^#?{{ item }}=.*"
+    replace: "{{ item }}=true"
   with_items:
     - MERGE_PASSWD
     - MERGE_GROUP
@@ -296,6 +296,5 @@
     - nis-install
     - nis-install-server
 
-
 # TODO:
 # /var/yp/Makefile

roles/common/tasks/samba-install.yml

@@ -1,33 +1,234 @@
 ---
-
 # ---
 # Samba Server
 # ---
 
 - name: (samba-install.yml) Ensure samba packages server (buster) are installed.
   package:
-    pkg: '{{ apt_install_server_samba }}'
+    pkg: "{{ apt_install_server_samba }}"
     state: present
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
   tags:
     - samba-server
 
+- name: (samba-install.yml) Ensure quarantine directory exists
+  file:
+    path: /data/samba/QUARANTINE
+    owner: root
+    group: root
+    mode: "0750"
+    state: directory
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
+      selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
 - name: (samba-install.yml) Ensure samba share directories exists
   file:
     path: "{{ item.path }}"
     owner: "root"
     group: "{{ item.group_write_list }}"
-    mode: '2770'
+    mode: "{{ item.dir_create_mask | default('2770', true) }}"
     state: directory
+    recurse: no
   with_items: "{{ samba_shares }}"
   loop_control:
-    label: '{{ item.name }}'
+    label: "{{ item.name }}"
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
   tags:
     - samba-shares
 
+# ---
+# Virusfilter (ClamAV) - only when at least one share has vfs_object_virusfilter: true
+# ---
+
+- name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
+  package:
+    pkg: "{{ apt_install_server_samba_virusfilter }}"
+    state: present
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
+      selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Check if ClamAV virus databases are present
+  find:
+    paths: /var/lib/clamav
+    patterns:
+      - "*.cvd"
+      - "*.cld"
+  register: clamav_db_files
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Stop clamav-freshclam service before initial database download
+  service:
+    name: clamav-freshclam
+    state: stopped
+  failed_when: false
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+    - clamav_db_files.files | length == 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Ensure clamav-daemon service is started before database update
+  service:
+    name: clamav-daemon
+    state: started
+    enabled: yes
+  failed_when: false
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Download initial ClamAV virus databases via freshclam
+  command: freshclam
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+    - clamav_db_files.files | length == 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Ensure clamav-daemon service is enabled and started
+  service:
+    name: clamav-daemon
+    state: started
+    enabled: yes
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Ensure clamav-freshclam service is enabled and started
+  service:
+    name: clamav-freshclam
+    state: started
+    enabled: yes
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-install.yml) Ensure clamav user is member of all NIS groups
+  user:
+    name: clamav
+    groups: "{{ item.name }}"
+    append: yes
+  loop: "{{ nis_groups }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
+      selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+    - nis_groups | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Ensure clamav user is member of all NIS user groups (homes virusfilter)
+  user:
+    name: clamav
+    groups: "{{ item.name }}"
+    append: yes
+  loop: "{{ nis_user }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_homes_virusfilter | default(false) | bool
+    - nis_user | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Get home directories of samba users (NIS users) via getent (homes virusfilter)
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ item.name }}"
+  loop: "{{ nis_user }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: samba_user_getent
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_homes_virusfilter | default(false) | bool
+    - nis_user | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-config-server.yml) Ensure home directories are group-traversable for clamd (homes virusfilter)
+  file:
+    path: "{{ item.ansible_facts.getent_passwd[item.item.name][4] }}"
+    mode: "0750"
+    state: directory
+  loop: "{{ samba_user_getent.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_homes_virusfilter | default(false) | bool
+    - item.ansible_facts is defined
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+
+- name: (samba-config-server.yml) Configure AppArmor local profile for clamd (data paths)
+  template:
+    src: etc/apparmor.d/local/usr.sbin.clamd.j2
+    dest: /etc/apparmor.d/local/usr.sbin.clamd
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload AppArmor profile clamd
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
+      selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+  
+- name: (samba-config-server.yml) Ensure AllowAllMatchScan is enabled in clamd.conf
+  lineinfile:
+    path: /etc/clamav/clamd.conf
+    regexp: "^#?\\s*AllowAllMatchScan\\s"
+    line: "AllowAllMatchScan true"
+    state: present
+  notify: Restart clamav-daemon
+  when:
+    - inventory_hostname in groups['samba_server']
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') |
+      selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
 
 # ---
 # /etc/samba/smb.conf
@@ -38,51 +239,48 @@
     path: /etc/samba/smb.conf.ORIG
   register: smb_conf_exists
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
   tags:
     - samba-server
 
 - name: (samba-install.yml) Backup existing file /etc/samba/smb.conf
   command: cp -a /etc/samba/smb.conf /etc/samba/smb.conf.ORIG
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
     - smb_conf_exists.stat.exists == False
   tags:
     - samba-server
 
-
 - name: (samba-install.yml) /etc/samba/smb.conf
   template:
     dest: /etc/samba/smb.conf
     src: etc/samba/smb.conf.j2
     owner: root
     group: root
-    mode: 0644
+    mode: 644
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
   notify:
     - Restart smbd
     - Restart nmbd
   tags:
     - samba-server
 
-
 - name: (samba-install.yml) Ensure file /etc/samba/users.map exists
   copy:
     src: "{{ role_path + '/files/etc/samba/users.map' }}"
     dest: /etc/samba/users.map
     owner: root
     group: root
-    mode: 0644
+    mode: 644
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
   notify:
     - Restart smbd
     - Restart nmbd
   tags:
     - samba-server
 
-
 # ---
 # Cronjob for cleaning up samba trash dirs
 # ---
@@ -92,25 +290,26 @@
     path: /root/bin/samba/clean_samba_trash.sh
   register: clean_samba_trash_exists
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
   tags:
     - samba-server
+    - samba-cron
 
 - name: (samba-install.yml) Adjust configuration for script 'clean_samba_trash.sh'
   template:
     dest: /root/bin/samba/conf/clean_samba_trash.conf
     src: root/bin/samba/conf/clean_samba_trash.conf.j2
   when:
-    - "groups['samba_server']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['samba_server']
     - clean_samba_trash_exists.stat.exists|bool
   tags:
     - samba-server
-
+    - samba-cron
 
 - name: (samba-config-server.yml) Check if cleaning up trash dirs is configured
   ansible.builtin.lineinfile:
     path: /root/bin/samba/conf/clean_samba_trash.conf
-    regexp: '^trash_dirs=*'
+    regexp: "^trash_dirs=*"
     state: absent
   check_mode: true
   changed_when: false
@@ -119,7 +318,6 @@
     - inventory_hostname in groups['samba_server']
   tags: [ samba-server, samba-cron ]
 
-  
 - name: (samba-config-server.yml) Creates a cron job for cleaning up samba trash dirs
   ansible.builtin.cron:
     name: "{{ samba_cronjob_trash_dirs.name }}"
@@ -136,7 +334,6 @@
     - (clean_samba_trash_dirs.found | int) > 0
   tags: [ samba-server, samba-cron ]
 
-
 # ---
 # Cronjob for setting permissions on samba shares
 # ---
@@ -149,7 +346,6 @@
     - inventory_hostname in groups['samba_server']
   tags: [ samba-server, samba-cron ]
 
-
 - name: (samba-config-server.yml) Adjust configuration for script 'set_permissions_samba_shares.sh'
   ansible.builtin.template:
     dest: /root/bin/samba/conf/set_permissions_samba_shares.conf
@@ -159,7 +355,6 @@
     - set_permissions_on_samba_shares_exists.stat.exists | bool
   tags: [ samba-server, samba-cron ]
 
-    
 - name: (samba-config-server.yml) Creates a cron job for setting permissions to samba dirs
   ansible.builtin.cron:
     name: "{{ samba_cronjob_permissions.name }}"
@@ -175,7 +370,6 @@
     - (clean_samba_trash_dirs.found | int) > 0 # << int -> bool
   tags: [ samba-server, samba-cron ]
 
-
 # ---
 # Samba clients
 # ---
@@ -185,8 +379,7 @@
     pkg: "{{ apt_install_client_samba }}"
     state: present
   when:
-    - "groups['nis_client']|string is search(inventory_hostname)"
+    - inventory_hostname in groups['nis_client']
     - ansible_distribution == "Ubuntu"
   tags:
     - samba-client
-

roles/common/templates/etc/apparmor.d/local/usr.sbin.clamd.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+# see: roles/common/tasks/samba-config-server.yml
+
+/data/** r,
+/data/samba/QUARANTINE/** rw,
+{% if samba_homes_virusfilter | default(false) | bool %}
+{{ nis_base_home }}/** r,
+{% if nis_base_home != '/home' %}
+/home/** r,
+{% endif %}
+{% endif %}

roles/common/templates/etc/samba/smb.conf.j2

@@ -92,7 +92,7 @@
 
 # This tells Samba to use a separate log file for each machine
 # that connects
-;   log file = /var/log/samba/log.%m
+   log file = /var/log/samba/log.%m
    log file = /var/log/samba/%I.log
 
 # Cap the size of the individual log files (in KiB).
@@ -305,6 +305,14 @@
 # next parameter to 'no' if you want to be able to write to them.
    read only = no
 
+{% if samba_homes_virusfilter | default(false) | bool %}
+# Virusfilter aktiv: Gruppe benötigt Leserecht, damit clamd (als Gruppenmitglied)
+# Dateien und Verzeichnisse direkt öffnen kann (SCAN-Kommando an clamd).
+   create mask = 0640
+   force create mode = 0040
+   directory mask = 0750
+   force directory mode = 0050
+{% else %}
 # File creation mask is set to 0700 for security reasons. If you want to
 # create files with group=rw permissions, set next parameter to 0775.
    create mask = 0700
@@ -312,6 +320,7 @@
 # Directory creation mask is set to 0700 for security reasons. If you want to
 # create dirs. with group=rw permissions, set next parameter to 0775.
    directory mask = 0700
+{% endif %}
 
 # By default, \\server\username shares can be connected to by anyone
 # with access to the samba server.
@@ -319,6 +328,35 @@
 # to \\server\username
 # This might need tweaking when using external authentication schemes
    valid users = %S
+{% if samba_homes_virusfilter | default(false) | bool %}
+
+   # --- Virusfilter-Einstellungen [homes] ---
+
+   vfs objects = virusfilter
+
+   virusfilter:scanner = clamav
+   virusfilter:socket path = /var/run/clamav/clamd.ctl
+
+   virusfilter:infected file action = delete
+
+   virusfilter:cache entry limit = 1000
+   virusfilter:cache time limit = 60
+
+   virusfilter:max file size = 26214400
+   virusfilter:min file size = 10
+
+   virusfilter:scan on open = yes
+   virusfilter:scan on close = yes
+
+   # Fehlercode bei infizierter Datei (beim Öffnen)
+   virusfilter:infected file errno on open = EACCES
+
+   # Fehlercode beim Schließen
+   virusfilter:infected file errno on close = EACCES
+
+   virusfilter:connect timeout = 30000
+   virusfilter:io timeout = 60000
+{% endif %}
 
 # Un-comment the following and create the netlogon directory for Domain Logons
 # (you need to configure Samba to act as a domain controller too.)
@@ -412,10 +450,19 @@
    #
    wide links = yes
 {%    endif %}
+{%-  set vfs_objects_parts = [] %}
+{%   if item.vfs_object_recycle is defined and item.vfs_object_recycle|bool and item.recycle_path is defined and item.recycle_path|length > 0 %}
+{%-    set _ = vfs_objects_parts.append('recycle') %}
+{%   endif %}
+{%   if item.vfs_object_virusfilter is defined and item.vfs_object_virusfilter|bool %}
+{%-    set _ = vfs_objects_parts.append('virusfilter') %}
+{%   endif %}
+{%   if vfs_objects_parts | length > 0 %}
+
+   vfs objects = {{ vfs_objects_parts | join(' ') }}
+{%   endif %}
 {%   if item.vfs_object_recycle is defined and item.vfs_object_recycle|bool %}
 {%      if item.recycle_path is defined and item.recycle_path|length > 0  %}
-
-   vfs objects = recycle
    recycle:keeptree = yes
    # touch access time from this file
    # note: this is not the modified time, which is
@@ -449,11 +496,48 @@
    veto files = /{{ item.recycle_path | default('@Recycle.Bin') }}/.DS_Store/
 {%         endif %}
    delete veto files = yes
-{%      else %}
-
 {%      endif %}
-{%   else %}
+{%   endif %}
+{%   if item.vfs_object_virusfilter is defined and item.vfs_object_virusfilter|bool %}
 
+   # --- Virusfilter-Einstellungen ---
+
+   # Scanner auswählen
+   virusfilter:scanner = clamav
+
+   # Socket-Pfad (Debian-Standard)
+   virusfilter:socket path = /var/run/clamav/clamd.ctl
+
+   # Verhalten bei Fund
+   virusfilter:infected file action = quarantine
+   virusfilter:quarantine directory = /data/samba/QUARANTINE
+
+   # Performance-Tuning: Ergebnis-Cache
+   #virusfilter:cache entry limit = 500
+   #virusfilter:cache time limit = 30
+
+   # Cache großzügig einstellen
+   virusfilter:cache entry limit = 1000
+   virusfilter:cache time limit = 60
+
+   # Dateigröße: Was wird gescannt?
+   #virusfilter:max file size = 52428800   # 50 MB max
+   virusfilter:max file size = 26214400   # 25 MB max
+   virusfilter:min file size = 10         # unter 10 Byte ignorieren
+
+   # Scan-Zeitpunkt: nur beim Öffnen, nicht beim Schließen
+   virusfilter:scan on open = yes
+   virusfilter:scan on close = yes
+
+   # Fehlercode bei infizierter Datei (beim Öffnen)
+   virusfilter:infected file errno on open = EACCES
+
+   # Fehlercode beim Schließen
+   virusfilter:infected file errno on close = EACCES
+
+   # Timeouts (Millisekunden)
+   virusfilter:connect timeout = 30000
+   virusfilter:io timeout = 60000
 {%   endif %}
 
 {% endfor %}