Add virusfilter support to Samba shares in multiple configuration files

group_vars/akb.yml

@@ -463,6 +463,7 @@ samba_shares:
     group_write_list: verwaltung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -482,6 +483,7 @@ samba_shares:
     group_write_list: ab
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -504,6 +506,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -576,6 +579,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -586,6 +590,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -596,6 +601,7 @@ samba_shares:
     group_write_list: scans
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
     user:
@@ -606,6 +612,7 @@ samba_shares:
     group_write_list: intern
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: false
     recycle_path: '@Recycle.Bin'
     user:
@@ -622,6 +629,7 @@ samba_shares:
     group_write_list: intern
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: false
     recycle_path: '@Recycle.Bin'
     user:

group_vars/all/main.yml

@@ -1747,6 +1747,12 @@ apt_install_client_samba:
   - samba-client
   - samba-common
 
+apt_install_server_samba_virusfilter:
+  - clamav
+  - clamav-daemon
+  - clamav-freshclam
+  - samba-vfs-modules
+
 
 # samba_workgroup
 #

group_vars/flr.yml

@@ -486,6 +486,7 @@ samba_shares:
     group_write_list: team
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -495,6 +496,7 @@ samba_shares:
     group_write_list: esf-bleibnet
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -504,6 +506,7 @@ samba_shares:
     group_write_list: amif
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -513,6 +516,7 @@ samba_shares:
     group_write_list: quali
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -522,6 +526,7 @@ samba_shares:
     group_write_list: aktion-mensch
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -531,6 +536,7 @@ samba_shares:
     group_write_list: foerderung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -540,6 +546,7 @@ samba_shares:
     group_write_list: buchhaltung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -549,6 +556,7 @@ samba_shares:
     group_write_list: verwaltung
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -558,6 +566,7 @@ samba_shares:
     group_write_list: infrastruktur
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -568,6 +577,7 @@ samba_shares:
     file_create_mask: '0660'
     dir_create_mask: '2770'
     #wide_links: !!str yes
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 

group_vars/mbr.yml

@@ -1001,6 +1001,7 @@ samba_shares:
     group_write_list: all-users
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1010,6 +1011,7 @@ samba_shares:
     group_write_list: mbr-admins
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
 
   - name: Kamera
     path: /data/shares/Kamera
@@ -1024,6 +1026,7 @@ samba_shares:
     group_write_list: buero-scan
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     #recycle_path: '@Recycle.Bin'
 
@@ -1033,6 +1036,7 @@ samba_shares:
     group_write_list: technik
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1042,6 +1046,7 @@ samba_shares:
     group_write_list: ag-antisem
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1055,6 +1060,7 @@ samba_shares:
     group_write_list: vdk
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1064,6 +1070,7 @@ samba_shares:
     group_write_list: vdk
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1073,6 +1080,7 @@ samba_shares:
     group_write_list: vdk
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1095,6 +1103,7 @@ samba_shares:
     group_write_list: bgn-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1104,6 +1113,7 @@ samba_shares:
     group_write_list: bgn
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1117,6 +1127,7 @@ samba_shares:
     group_write_list: bmb
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1130,6 +1141,7 @@ samba_shares:
     group_write_list: mbr-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1139,6 +1151,7 @@ samba_shares:
     group_write_list: mbr-buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1148,6 +1161,7 @@ samba_shares:
     group_write_list: mbr-buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1157,6 +1171,7 @@ samba_shares:
     group_write_list: mbr-buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1170,6 +1185,7 @@ samba_shares:
     group_write_list: rias-berlin
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1179,6 +1195,7 @@ samba_shares:
     group_write_list: rias-berlin-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1188,6 +1205,7 @@ samba_shares:
     group_write_list: rias-bund
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1197,6 +1215,7 @@ samba_shares:
     group_write_list: rias-bund-finanzen-personal
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1210,6 +1229,7 @@ samba_shares:
     group_write_list: regishut
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1219,6 +1239,7 @@ samba_shares:
     group_write_list: regishut-personal-finanzen
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1232,6 +1253,7 @@ samba_shares:
     group_write_list: direx
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 
@@ -1241,6 +1263,7 @@ samba_shares:
     group_write_list: direx-personal-finanzen
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
 

group_vars/sprachenatelier.yml

@@ -480,33 +480,9 @@ samba_shares:
     group_write_list: buero
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
-    user:
-      - anahit
-      - andrea
-      - bueropraktikum
-      - chema
-      - chris
-      - isadora
-      - jessica
-      - konstantin
-      - lara
-      - lena
-      - linda
-      - margit
-      - matija
-      - musa
-      - praktikant1
-      - praktikant2
-      - praktikant3
-      - praktikant4
-      - praktikant5
-      - praktikant6
-      - saravic
-      - sysadm
-      - simone
-      - yang
 
   - name: Verwaltung
     path: /data/samba/verwaltung
@@ -514,26 +490,9 @@ samba_shares:
     group_write_list: intern
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
-    user:
-      - anahit
-      - andrea
-      - bueropraktikum
-      - chema
-      - chris
-      - isadora
-      - jessica
-      - konstantin
-      - lara
-      - linda
-      - margit
-      - matija
-      - musa
-      - saravic
-      - sysadm
-      - simone
-      - yang
 
   - name: Multimedia
     path: /data/samba/no-backup-share/multimedia
@@ -541,12 +500,9 @@ samba_shares:
     group_write_list: no-backup
     file_create_mask: '0660'
     dir_create_mask: '2770'
+    vfs_object_virusfilter: true
     vfs_object_recycle: true
     recycle_path: '@Recycle.Bin'
-    user:
-      - chris
-      - margit
-      - musa
 
 
 # ==========

roles/common/tasks/samba-install.yml

@@ -13,6 +13,37 @@
   tags:
     - samba-server
 
+
+# ---
+# Virusfilter (ClamAV) — only when at least one share has vfs_object_virusfilter: true
+# ---
+
+- name: (samba-install.yml) Ensure virusfilter (ClamAV) packages are installed
+  package:
+    pkg: '{{ apt_install_server_samba_virusfilter }}'
+    state: present
+  when:
+    - "groups['samba_server']|string is search(inventory_hostname)"
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+- name: (samba-install.yml) Ensure quarantine directory exists
+  file:
+    path: /data/samba/QUARANTINE
+    owner: root
+    group: root
+    mode: '0750'
+    state: directory
+  when:
+    - "groups['samba_server']|string is search(inventory_hostname)"
+    - samba_shares | selectattr('vfs_object_virusfilter', 'defined') | selectattr('vfs_object_virusfilter', 'equalto', true) | list | length > 0
+  tags:
+    - samba-server
+    - samba-virusfilter
+
+
 - name: (samba-install.yml) Ensure samba share directories exists
   file:
     path: "{{ item.path }}"

roles/common/templates/etc/samba/smb.conf.j2

@@ -412,10 +412,19 @@
    #
    wide links = yes
 {%    endif %}
+{%-  set vfs_objects_parts = [] %}
+{%   if item.vfs_object_recycle is defined and item.vfs_object_recycle|bool and item.recycle_path is defined and item.recycle_path|length > 0 %}
+{%-    set _ = vfs_objects_parts.append('recycle') %}
+{%   endif %}
+{%   if item.vfs_object_virusfilter is defined and item.vfs_object_virusfilter|bool %}
+{%-    set _ = vfs_objects_parts.append('virusfilter') %}
+{%   endif %}
+{%   if vfs_objects_parts | length > 0 %}
+
+   vfs objects = {{ vfs_objects_parts | join(' ') }}
+{%   endif %}
 {%   if item.vfs_object_recycle is defined and item.vfs_object_recycle|bool %}
 {%      if item.recycle_path is defined and item.recycle_path|length > 0  %}
-
-   vfs objects = recycle
    recycle:keeptree = yes
    # touch access time from this file
    # note: this is not the modified time, which is
@@ -449,11 +458,42 @@
    veto files = /{{ item.recycle_path | default('@Recycle.Bin') }}/.DS_Store/
 {%         endif %}
    delete veto files = yes
-{%      else %}
-
 {%      endif %}
-{%   else %}
+{%   endif %}
+{%   if item.vfs_object_virusfilter is defined and item.vfs_object_virusfilter|bool %}
 
+   # --- Virusfilter-Einstellungen ---
+
+   # Scanner auswählen
+   virusfilter:scanner = clamav
+
+   # Socket-Pfad (Debian-Standard)
+   virusfilter:socket path = /var/run/clamav/clamd.ctl
+
+   # Verhalten bei Fund
+   virusfilter:infected file action = quarantine
+   virusfilter:quarantine directory = /data/samba/QUARANTINE
+
+   # Performance-Tuning: Ergebnis-Cache
+   #virusfilter:cache entry limit = 500
+   #virusfilter:cache time limit = 30
+
+   # Cache großzügig einstellen
+   virusfilter:cache entry limit = 1000
+   virusfilter:cache time limit = 60
+
+   # Dateigröße: Was wird gescannt?
+   #virusfilter:max file size = 52428800   # 50 MB max
+   virusfilter:max file size = 26214400   # 25 MB max
+   virusfilter:min file size = 10         # unter 10 Byte ignorieren
+
+   # Scan-Zeitpunkt: nur beim Öffnen, nicht beim Schließen
+   virusfilter:scan on open = yes
+   virusfilter:scan on close = no
+
+   # Timeouts (Millisekunden)
+   virusfilter:connect timeout = 30000
+   virusfilter:io timeout = 60000
 {%   endif %}
 
 {% endfor %}