Add cluster join functionality and Kaspersky agent configuration to PMG. Updated Makefile for cluster bootstrap command, enhanced README with new service details, and modified pillar states for KESL and KLN agent integration. Added verification and management for cluster-only services in Salt states.

pmg/cluster_join.sls

@@ -0,0 +1,30 @@
+{% set cluster_join_enabled = salt['pillar.get']('pmg:cluster_join:enabled', False) %}
+{% set cluster_join_master_ip = salt['pillar.get']('pmg:cluster_join:master_ip', '') %}
+{% set cluster_join_fingerprint = salt['pillar.get']('pmg:cluster_join:fingerprint', '') %}
+{% set cluster_join_password = salt['pillar.get']('pmg:cluster_join:password', '') %}
+
+{% if cluster_join_enabled and cluster_join_master_ip and cluster_join_fingerprint %}
+pmg-cluster-join-passwordless-ssh-check:
+  cmd.run:
+    - name: ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new root@{{ cluster_join_master_ip }} "exit 0"
+    - timeout: 20
+
+{% if cluster_join_password %}
+pmg-cluster-join:
+  cmd.run:
+    - name: pmgcm join {{ cluster_join_master_ip }} --fingerprint {{ cluster_join_fingerprint }}
+    - stdin: "{{ cluster_join_password }}"
+    - timeout: 60
+    - require:
+      - cmd: pmg-cluster-join-passwordless-ssh-check
+    - unless: "pmgcm status 2>/dev/null | awk 'BEGIN { ok=1 } /no cluster defined/ { ok=0 } END { exit(ok ? 0 : 1) }'"
+{% else %}
+pmg-cluster-join-skipped-password:
+  test.show_notification:
+    - text: "Cluster join skipped: set pmg.cluster_join.password (PMG root@pam password on master) for non-interactive join."
+{% endif %}
+{% elif cluster_join_enabled %}
+pmg-cluster-join-skipped:
+  test.show_notification:
+    - text: "Cluster join skipped: set pmg.cluster_join.master_ip and pmg.cluster_join.fingerprint in pillar."
+{% endif %}

pmg/custom_check.sls

@@ -104,7 +104,7 @@ pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}:
         ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.AreaMask.item_0000='*'
     - unless: >-
         kesl-control --get-settings File_Threat_Protection 2>/dev/null
-        | grep -Fq "ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.Path={{ excluded_path }}"
+        | grep -Fq "Path={{ excluded_path }}"
     - require:
       - test: pmg-custom-check-kaspersky-ready
 {% for service_name in custom_check_required_services %}

pmg/init.sls

@@ -5,6 +5,7 @@ include:
   - pmg.ssh_hardening
   - pmg.custom_check
   - pmg.security_agents
+  - pmg.cluster_join
   - pmg.auto_updates
   - pmg.audit_logging
   - pmg.pmg_baseline

pmg/pmg_baseline.sls

@@ -1,4 +1,5 @@
 {% set pmg_services = salt['pillar.get']('pmg:pmg_services', []) %}
+{% set pmg_cluster_only_services = salt['pillar.get']('pmg:pmg_cluster_only_services', ['pmgmirror', 'pmgtunnel']) %}
 {% set manage_hosts_file = salt['pillar.get']('pmg:manage_hosts_file', False) %}
 {% set hosts_file_entries = salt['pillar.get']('pmg:hosts_file_entries', []) %}
 
@@ -7,6 +8,9 @@ pmg-service-{{ svc }}:
   service.running:
     - name: {{ svc }}
     - enable: true
+{% if svc in pmg_cluster_only_services %}
+    - onlyif: "pmgcm status 2>/dev/null | awk 'BEGIN { ok=1 } /no cluster defined/ { ok=0 } END { exit(ok ? 0 : 1) }'"
+{% endif %}
 {% endfor %}
 
 pmg-cluster-status:

pmg/security_agents.sls

@@ -6,6 +6,32 @@
 {% set wazuh_pkg_url = 'https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/' ~ wazuh_pkg_name %}
 {% set wazuh_pkg_path = '/var/tmp/' ~ wazuh_pkg_name %}
 
+{% set kesl_enabled = salt['pillar.get']('pmg:kesl:enabled', True) %}
+{% set kesl_package_url = salt['pillar.get']('pmg:kesl:package_url', 'https://products.s.kaspersky-labs.com/endpoints/keslinux10/12.4.0.1225/multilanguage-INT-12.4.0.1225/167a2f9c5bdb4e869f4603fbc3a829c1/kesl_12.4.0-1225_amd64.deb') %}
+{% set kesl_package_path = salt['pillar.get']('pmg:kesl:package_path', '/opt/kesl_12.4.0-1225_amd64.deb') %}
+{% set kesl_autoinstall_path = salt['pillar.get']('pmg:kesl:autoinstall_path', '/etc/opt/kaspersky/kesl/autoinstall.ini') %}
+{% set kesl_eula_agreed = salt['pillar.get']('pmg:kesl:eula_agreed', 'Yes') %}
+{% set kesl_privacy_policy_agreed = salt['pillar.get']('pmg:kesl:privacy_policy_agreed', 'Yes') %}
+{% set kesl_use_ksn = salt['pillar.get']('pmg:kesl:use_ksn', 'No') %}
+{% set kesl_group_clean = salt['pillar.get']('pmg:kesl:group_clean', 'No') %}
+{% set kesl_locale = salt['pillar.get']('pmg:kesl:locale', '') %}
+{% set kesl_updater_source = salt['pillar.get']('pmg:kesl:updater_source', 'SCServer') %}
+{% set kesl_install_license = salt['pillar.get']('pmg:kesl:install_license', '') %}
+{% set kesl_update_execute = salt['pillar.get']('pmg:kesl:update_execute', 'No') %}
+{% set kesl_ksvla_mode = salt['pillar.get']('pmg:kesl:ksvla_mode', 'No') %}
+{% set kesl_endpoint_agent_mode = salt['pillar.get']('pmg:kesl:endpoint_agent_mode', 'No') %}
+{% set kesl_setup_bin = '/opt/kaspersky/kesl/bin/kesl-setup.pl' %}
+{% set kesl_setup_marker = '/var/lib/salt/pmg-kesl-autoinstall.done' %}
+
+{% set klnagent_enabled = salt['pillar.get']('pmg:klnagent:enabled', True) %}
+{% set klnagent_package_url = salt['pillar.get']('pmg:klnagent:package_url', 'https://products.s.kaspersky-labs.com/administrationkit/ksc10/16.2.0.1023/russian-INT-29664057-ru/2129c97dba254c9fb8a4161f29a2241c/klnagent64_16.2.0-1023_amd64.deb') %}
+{% set klnagent_package_path = salt['pillar.get']('pmg:klnagent:package_path', '/opt/klnagent64_16.2.0-1023_amd64.deb') %}
+{% set klnagent_server = salt['pillar.get']('pmg:klnagent:administration_server', '10.80.38.76') %}
+{% set klnagent_autoanswers_path = salt['pillar.get']('pmg:klnagent:autoanswers_path', '/etc/opt/kaspersky/klnagent64/autoanswers.conf') %}
+{% set klnagent_autoinstall = salt['pillar.get']('pmg:klnagent:autoinstall', True) %}
+{% set klnagent_eula_accepted = salt['pillar.get']('pmg:klnagent:eula_accepted', True) %}
+{% set klnagent_config_marker = '/var/lib/salt/pmg-klnagent-autoinstall.done' %}
+
 {% set qualys_enabled = salt['pillar.get']('pmg:qualys:enabled', True) %}
 {% set qualys_package_url = salt['pillar.get']('pmg:qualys:package_url', 'https://storage.yandexcloud.net/qualys-agent/QualysCloudAgent.deb') %}
 {% set qualys_package_path = salt['pillar.get']('pmg:qualys:package_path', '/opt/QualysCloudAgent.deb') %}
@@ -13,6 +39,119 @@
 {% set qualys_customer_id = salt['pillar.get']('pmg:qualys:customer_id', '') %}
 {% set qualys_server_uri = salt['pillar.get']('pmg:qualys:server_uri', 'https://qagpublic.qg1.apps.qualys.eu/CloudAgent/') %}
 
+{% if kesl_enabled and kesl_package_path %}
+pmg-kesl-download:
+  cmd.run:
+    - name: wget -qO {{ kesl_package_path }} {{ kesl_package_url }}
+    - unless: test -f {{ kesl_package_path }}
+
+pmg-kesl-autoinstall-config:
+  file.managed:
+    - name: {{ kesl_autoinstall_path }}
+    - user: root
+    - group: root
+    - mode: '0600'
+    - makedirs: true
+    - contents:
+      - "KSVLA_MODE={{ kesl_ksvla_mode }}"
+      - "ENDPOINT_AGENT_MODE={{ kesl_endpoint_agent_mode }}"
+      - "EULA_AGREED={{ kesl_eula_agreed }}"
+      - "PRIVACY_POLICY_AGREED={{ kesl_privacy_policy_agreed }}"
+      - "USE_KSN={{ kesl_use_ksn }}"
+      - "GROUP_CLEAN={{ kesl_group_clean }}"
+{% if kesl_locale %}
+      - "LOCALE={{ kesl_locale }}"
+{% endif %}
+{% if kesl_install_license %}
+      - "INSTALL_LICENSE={{ kesl_install_license }}"
+{% endif %}
+      - "UPDATER_SOURCE={{ kesl_updater_source }}"
+      - "UPDATE_EXECUTE={{ kesl_update_execute }}"
+    - require:
+      - cmd: pmg-kesl-install
+
+pmg-kesl-install:
+  cmd.run:
+    - name: apt-get install -y {{ kesl_package_path }}
+    - onlyif: test -f {{ kesl_package_path }}
+    - unless: dpkg-query -W -f='${Status}' kesl 2>/dev/null | grep -q 'install ok installed'
+    - require:
+      - cmd: pmg-kesl-download
+
+pmg-kesl-setup:
+  cmd.run:
+    - name: mkdir -p /var/lib/salt && {{ kesl_setup_bin }} --autoinstall={{ kesl_autoinstall_path }} && touch {{ kesl_setup_marker }}
+    - onlyif: test -x {{ kesl_setup_bin }}
+    - unless: test -f {{ kesl_setup_marker }}
+    - require:
+      - cmd: pmg-kesl-install
+      - file: pmg-kesl-autoinstall-config
+
+pmg-kesl-service:
+  service.running:
+    - name: kesl
+    - enable: true
+    - require:
+      - cmd: pmg-kesl-install
+      - cmd: pmg-kesl-setup
+{% elif kesl_enabled %}
+pmg-kesl-skipped:
+  test.show_notification:
+    - text: "Kaspersky Endpoint Security skipped: set package_url + package_path in pillar."
+{% endif %}
+
+{% if klnagent_enabled and klnagent_package_path and klnagent_server %}
+pmg-klnagent-download:
+  cmd.run:
+    - name: wget -qO {{ klnagent_package_path }} {{ klnagent_package_url }}
+    - unless: test -f {{ klnagent_package_path }}
+
+pmg-klnagent-autoanswers:
+  file.managed:
+    - name: {{ klnagent_autoanswers_path }}
+    - user: root
+    - group: root
+    - mode: '0600'
+    - makedirs: true
+    - contents:
+      - "KLNAGENT_SERVER={{ klnagent_server }}"
+      - "KLNAGENT_AUTOINSTALL={{ '1' if klnagent_autoinstall else '0' }}"
+      - "EULA_ACCEPTED={{ '1' if klnagent_eula_accepted else '0' }}"
+
+pmg-klnagent-install:
+  cmd.run:
+    - name: DEBIAN_FRONTEND=noninteractive KLAUTOANSWERS={{ klnagent_autoanswers_path }} apt-get install -y {{ klnagent_package_path }}
+    - onlyif: test -f {{ klnagent_package_path }}
+    - unless: dpkg-query -W -f='${Status}' klnagent64 2>/dev/null | grep -q 'install ok installed'
+    - require:
+      - cmd: pmg-klnagent-download
+      - file: pmg-klnagent-autoanswers
+
+pmg-klnagent-autoinstall-configure:
+  cmd.run:
+    - name: >-
+        mkdir -p /var/lib/salt &&
+        DEBIAN_FRONTEND=noninteractive KLAUTOANSWERS={{ klnagent_autoanswers_path }} apt-get install -y --reinstall {{ klnagent_package_path }} &&
+        touch {{ klnagent_config_marker }}
+    - onlyif: dpkg-query -W -f='${Status}' klnagent64 2>/dev/null | grep -q 'install ok installed'
+    - unless: test -f {{ klnagent_config_marker }}
+    - require:
+      - cmd: pmg-klnagent-install
+      - file: pmg-klnagent-autoanswers
+
+pmg-klnagent-service:
+  service.running:
+    - name: klnagent64
+    - enable: true
+    - require:
+      - cmd: pmg-klnagent-install
+      - cmd: pmg-klnagent-autoinstall-configure
+{% elif klnagent_enabled %}
+pmg-klnagent-skipped:
+  test.show_notification:
+    - text: "Kaspersky Administration Agent skipped: set package_url + package_path + administration_server in pillar."
+{% endif %}
+
 {% if wazuh_enabled %}
 pmg-wazuh-download:
   cmd.run:

pmg/verify.sls

@@ -1,9 +1,13 @@
 {% set pmg_services = salt['pillar.get']('pmg:pmg_services', []) %}
+{% set pmg_cluster_only_services = salt['pillar.get']('pmg:pmg_cluster_only_services', ['pmgmirror', 'pmgtunnel']) %}
 
 {% for svc in pmg_services %}
 pmg-verify-service-{{ svc }}:
   cmd.run:
     - name: systemctl is-active --quiet {{ svc }}
+{% if svc in pmg_cluster_only_services %}
+    - onlyif: "pmgcm status 2>/dev/null | awk 'BEGIN { ok=1 } /no cluster defined/ { ok=0 } END { exit(ok ? 0 : 1) }'"
+{% endif %}
 {% endfor %}
 
 pmg-verify-cluster: