From d6b521372243b79105a1513d4559572dfab6db54 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 22 Sep 2015 15:04:33 -0400
Subject: add clamav filtering, with sanesecurity signature updating and
 provider whitelisting (#3625)

Change-Id: I15985ca00ee95bc62855f098a78e364ebbc32616
---
 puppet/modules/clamav/manifests/daemon.pp | 86 +++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100644 puppet/modules/clamav/manifests/daemon.pp

(limited to 'puppet/modules/clamav/manifests/daemon.pp')

diff --git a/puppet/modules/clamav/manifests/daemon.pp b/puppet/modules/clamav/manifests/daemon.pp
new file mode 100644
index 00000000..9aebf9b0
--- /dev/null
+++ b/puppet/modules/clamav/manifests/daemon.pp
@@ -0,0 +1,86 @@
+class clamav::daemon {
+
+  $domain_hash           = hiera('domain')
+  $domain                = $domain_hash['full_suffix']
+
+  package { [ 'clamav-daemon', 'arj' ]:
+    ensure => installed;
+  }
+
+  service {
+    'clamav-daemon':
+      ensure     => running,
+      name       => clamav-daemon,
+      pattern    => '/usr/sbin/clamd',
+      enable     => true,
+      hasrestart => true,
+      subscribe  => File['/etc/default/clamav-daemon'];
+  }
+
+  file {
+    '/var/run/clamav':
+      ensure => directory,
+      mode   => '0750',
+      owner  => clamav,
+      group  => postfix;
+
+    '/var/lib/clamav':
+      mode  => '0755',
+      owner => clamav,
+      group => clamav;
+
+    '/etc/default/clamav-daemon':
+      source => 'puppet:///modules/clamav/clamav-daemon_default',
+      mode   => '0644',
+      owner  => root,
+      group  => root;
+
+    # this file contains additional domains that we want the clamav
+    # phishing process to look for (our domain)
+    '/var/lib/clamav/local.pdb':
+      content => template('clamav/local.pdb.erb'),
+      mode    => '0644',
+      owner   => clamav,
+      group   => clamav;
+  }
+
+  file_line {
+    'clamav_daemon_tmp':
+      path    => '/etc/clamav/clamd.conf',
+      line    => 'TemporaryDirectory /var/tmp',
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
+
+     'enable_phishscanurls':
+      path    => '/etc/clamav/clamd.conf',
+      match   => 'PhishingScanURLs no',
+      line    => 'PhishingScanURLs yes',
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
+
+    'clamav_LogSyslog_true':
+      path    => '/etc/clamav/clamd.conf',
+      match   => '^LogSyslog false',
+      line    => 'LogSyslog true',
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
+
+    'clamav_MaxThreads':
+      path    => '/etc/clamav/clamd.conf',
+      match   => 'MaxThreads 20',
+      line    => 'MaxThreads 100',
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
+  }
+
+  # remove LogFile line
+  file_line {
+    'clamav_LogFile':
+      path    => '/etc/clamav/clamd.conf',
+      match   => '^LogFile .*',
+      line    => '',
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
+  }
+
+}
-- 
cgit v1.2.3


From 43595b105a21aaccb41c4d9199d87b3dc2d48ab5 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 13 Oct 2015 15:58:12 -0400
Subject: Fix ordering of clamav resources, by requiring the package
 installation as a pre-requisite

Change-Id: Ic9c8cc6ccfb31ce5e56937a2d95de7974707c368
---
 puppet/modules/clamav/manifests/daemon.pp | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

(limited to 'puppet/modules/clamav/manifests/daemon.pp')

diff --git a/puppet/modules/clamav/manifests/daemon.pp b/puppet/modules/clamav/manifests/daemon.pp
index 9aebf9b0..bf232e2c 100644
--- a/puppet/modules/clamav/manifests/daemon.pp
+++ b/puppet/modules/clamav/manifests/daemon.pp
@@ -14,20 +14,23 @@ class clamav::daemon {
       pattern    => '/usr/sbin/clamd',
       enable     => true,
       hasrestart => true,
-      subscribe  => File['/etc/default/clamav-daemon'];
+      subscribe  => File['/etc/default/clamav-daemon'],
+      require    => Package['clamav-daemon'];
   }
 
   file {
     '/var/run/clamav':
-      ensure => directory,
-      mode   => '0750',
-      owner  => clamav,
-      group  => postfix;
+      ensure  => directory,
+      mode    => '0750',
+      owner   => clamav,
+      group   => postfix,
+      require => [Package['postfix'], Package['clamav-daemon']];
 
     '/var/lib/clamav':
-      mode  => '0755',
-      owner => clamav,
-      group => clamav;
+      mode    => '0755',
+      owner   => clamav,
+      group   => clamav,
+      require => Package['clamav-daemon'];
 
     '/etc/default/clamav-daemon':
       source => 'puppet:///modules/clamav/clamav-daemon_default',
@@ -41,7 +44,8 @@ class clamav::daemon {
       content => template('clamav/local.pdb.erb'),
       mode    => '0644',
       owner   => clamav,
-      group   => clamav;
+      group   => clamav,
+      require => Package['clamav-daemon'];
   }
 
   file_line {
-- 
cgit v1.2.3