155 lines
4.6 KiB
Puppet
155 lines
4.6 KiB
Puppet
|
|
# Install Clam AntiVirus
|
|
#
|
|
# === Parameters
|
|
#
|
|
# $update:
|
|
# Set to false to disable automatic virus database updates.
|
|
#
|
|
class clamav($update=true) {
|
|
|
|
package { "clamav":
|
|
ensure => installed,
|
|
}
|
|
|
|
case $::operatingsystem {
|
|
"centos","redhat": {
|
|
if (versioncmp($::operatingsystemrelease, 7) < 0) {
|
|
if (!$update) {
|
|
file { "/etc/cron.daily/freshclam":
|
|
ensure => absent,
|
|
}
|
|
}
|
|
} else {
|
|
package { "clamav-update":
|
|
ensure => $update ? {
|
|
true => "present",
|
|
false => "absent",
|
|
}
|
|
}
|
|
if $update {
|
|
augeas { "enable-freshclam":
|
|
context => "/files/etc/sysconfig/freshclam",
|
|
changes => "set FRESHCLAM_DELAY ''",
|
|
require => Package["clamav-update"],
|
|
}
|
|
exec { "sed -i 's/^Example$/#Example/' /etc/freshclam.conf":
|
|
path => "/bin:/usr/bin:/sbin:/usr/sbin",
|
|
user => "root",
|
|
onlyif => "egrep '^Example$' /etc/freshclam.conf",
|
|
require => Package["clamav-update"],
|
|
}
|
|
}
|
|
}
|
|
}
|
|
default: {
|
|
fail("clamav module not supported on ${::operatingsystem}")
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
|
|
# Install Clam Antivirus Daemon
|
|
#
|
|
class clamav::daemon {
|
|
|
|
require clamav
|
|
|
|
case $::operatingsystem {
|
|
"centos","redhat": {
|
|
if (versioncmp($::operatingsystemrelease, 7) < 0) {
|
|
$package = "clamd"
|
|
$service = "clamd"
|
|
$socket = "/var/run/clamav/clamd.sock"
|
|
} else {
|
|
$package = "clamav-scanner-systemd"
|
|
$service = "clamd@scan"
|
|
$socket = "/var/run/clamd.scan/clamd.sock"
|
|
exec { "sed -i 's/^Example$/#Example/' /etc/clamd.d/scan.conf":
|
|
path => "/bin:/usr/bin:/sbin:/usr/sbin",
|
|
user => "root",
|
|
onlyif => "egrep '^Example$' /etc/clamd.d/scan.conf",
|
|
require => Package["clamd"],
|
|
notify => Service["clamd"],
|
|
}
|
|
exec { "sed -i 's/^#LocalSocket /LocalSocket /' /etc/clamd.d/scan.conf":
|
|
path => "/bin:/usr/bin:/sbin:/usr/sbin",
|
|
user => "root",
|
|
onlyif => "egrep '#LocalSocket ' /etc/clamd.d/scan.conf",
|
|
require => Package["clamd"],
|
|
notify => Service["clamd"],
|
|
}
|
|
file { "/etc/clamd.conf":
|
|
ensure => link,
|
|
target => "/etc/clamd.d/scan.conf",
|
|
owner => "root",
|
|
group => "root",
|
|
require => Package["clamd"],
|
|
}
|
|
file { "/etc/tmpfiles.d/clamd.scan.conf":
|
|
ensure => present,
|
|
content => "d /var/run/clamd.scan 0711 clamscan clamscan",
|
|
mode => "0644",
|
|
owner => "root",
|
|
group => "root",
|
|
require => Package[$package],
|
|
notify => Service[$service],
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
package { "clamd":
|
|
ensure => installed,
|
|
name => $package,
|
|
}
|
|
|
|
service { "clamd":
|
|
ensure => running,
|
|
name => $service,
|
|
enable => true,
|
|
require => Package["clamd"],
|
|
}
|
|
|
|
}
|
|
|
|
|
|
# Scan directories periodically
|
|
#
|
|
# === Parameters:
|
|
#
|
|
# $name:
|
|
# Directory path to scan.
|
|
# $hour:
|
|
# At what hour should scanning occur. Defaults to 4am.
|
|
# $weekday:
|
|
# At what day should sacnning occur. For daily scanning you
|
|
# can use "*". Defaults to Sunday.
|
|
# $exclude:
|
|
# Directories matching to this regex will be excluded from
|
|
# scanning. Default is to scan everything.
|
|
#
|
|
# === Sample usage:
|
|
#
|
|
# clamav::scan { "/export/roles":
|
|
# exclude => "/export/roles/[a-z]*/library/archive",
|
|
# }
|
|
#
|
|
define clamav::scan($hour="04", $weekday="Sunday", $exclude=undef) {
|
|
|
|
require clamav
|
|
|
|
if $exclude {
|
|
$exclude_opts = "--exclude-dir='${exclude}'"
|
|
}
|
|
|
|
cron { "virusscan-${name}":
|
|
command => "clamscan -r --infected --no-summary ${name} ${exclude_opts}",
|
|
user => "root",
|
|
hour => $hour,
|
|
minute => "00",
|
|
weekday => $weekday,
|
|
}
|
|
|
|
}
|