Add Salt baseline states for Proxmox Mail Gateway.

Co-authored-by: Cursor <cursoragent@cursor.com>

pmg/files/20auto-upgrades.jinja

@@ -0,0 +1,4 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::AutocleanInterval "7";

pmg/files/50unattended-upgrades.jinja

@@ -0,0 +1,14 @@
+Unattended-Upgrade::Origins-Pattern {
+  "origin=Debian,codename=${distro_codename},label=Debian-Security";
+  "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+};
+
+Unattended-Upgrade::Package-Blacklist {
+};
+
+Unattended-Upgrade::MinimalSteps "true";
+Unattended-Upgrade::InstallOnShutdown "false";
+Unattended-Upgrade::MailOnlyOnError "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::SyslogEnable "true";

pmg/files/99-hardening.conf.jinja

@@ -0,0 +1,10 @@
+# Managed by Salt.
+PasswordAuthentication {{ "yes" if ssh_password_authentication else "no" }}
+PermitRootLogin prohibit-password
+PubkeyAuthentication yes
+X11Forwarding no
+MaxAuthTries 3
+LoginGraceTime 30
+{% if ssh_allow_users %}
+AllowUsers {{ " ".join(ssh_allow_users) }}
+{% endif %}

pmg/files/99-pmg-baseline.rules.jinja

@@ -0,0 +1,14 @@
+## Managed by Salt.
+-D
+-b 8192
+
+-w /etc/passwd -p wa -k identity
+-w /etc/group -p wa -k identity
+-w /etc/shadow -p wa -k identity
+-w /etc/gshadow -p wa -k identity
+
+-w /etc/sudoers -p wa -k privilege-escalation
+-w /etc/sudoers.d/ -p wa -k privilege-escalation
+
+-w /etc/ssh/sshd_config -p wa -k ssh
+-w /etc/ssh/sshd_config.d/ -p wa -k ssh

pmg/files/journald-retention.conf.jinja

@@ -0,0 +1,3 @@
+[Journal]
+SystemMaxUse={{ journald_system_max_use }}
+MaxFileSec={{ journald_max_file_sec }}

pmg/files/pmg-custom-check.jinja

@@ -0,0 +1,49 @@
+#!/bin/bash
+# Managed by Salt: PMG custom check via Kaspersky KESL.
+
+set -u
+
+LOG_DIR="{{ custom_check_log_dir }}"
+KESL_BIN="/opt/kaspersky/kesl/bin/kesl-control"
+SCAN_TARGET="${2:-}"
+
+if [ -z "${SCAN_TARGET}" ]; then
+  echo "v1"
+  echo "ERROR: empty scan target"
+  exit 0
+fi
+
+mkdir -p "${LOG_DIR}"
+
+POLICY_NAME="$(pwgen 10 -1 -s -0)"
+POLICY_FILE="${LOG_DIR}/${POLICY_NAME}.pol"
+
+cat > "${POLICY_FILE}" <<EOF
+ActionOnThreat=Inform
+ReportCleanObjects=No
+ScanFiles=Yes
+ScanMailBases=Yes
+ScanPlainMail=Yes
+UseAnalyzer=Yes
+HeuristicLevel=Medium
+[ScanScope.item_0000]
+Path=${SCAN_TARGET}
+EOF
+
+"${KESL_BIN}" --create-task "${POLICY_NAME}" --type ODS --file "${POLICY_FILE}" >/dev/null
+VIRUS_NAME="$("${KESL_BIN}" --start-task "${POLICY_NAME}" -W | grep 'DetectName' | awk -F'=' '{print $2}' | head -1)"
+"${KESL_BIN}" --delete-task "${POLICY_NAME}"
+
+if [ -z "${VIRUS_NAME}" ]; then
+  rm -f "${POLICY_FILE}"
+  echo "Mail ${SCAN_TARGET} was checked successfully" >> "${LOG_DIR}/checked"
+  echo "v1"
+  echo "OK"
+else
+  echo "In mail ${SCAN_TARGET} find ${VIRUS_NAME}" >> "${POLICY_FILE}"
+  echo "Mail ${SCAN_TARGET} was blocked. More info in ${POLICY_FILE}" >> "${LOG_DIR}/checked"
+  echo "v1"
+  echo "VIRUS: ${VIRUS_NAME}"
+fi
+
+exit 0