komehdaht/mailgw-salt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance Kaspersky integration in PMG by adding configurable excluded paths for KESL scanning. Updated README to reflect new functionality and modified Salt states to implement the changes, including a restart command for KESL when exclusions are modified.

Browse Source
This commit is contained in:
Ruslan Piatrovich
2026-06-08 12:48:15 +03:00
parent c492399300
commit 86dd59e462
3 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pmg/custom_check.sls
+29
View File
@@ -3,6 +3,7 @@
{% set custom_check_log_dir = salt['pillar.get']('pmg:custom_check:log_dir', '/var/log/mail_av') %}
{% set custom_check_managed_packages = salt['pillar.get']('pmg:custom_check:managed_packages', ['pwgen']) %}
{% set custom_check_required_services = salt['pillar.get']('pmg:custom_check:required_services', ['kesl', 'klnagent64']) %}
{% set custom_check_kesl_excluded_paths = salt['pillar.get']('pmg:custom_check:kesl_excluded_paths', ['/var/spool/pmg', '/var/lib/clamav', '/tmp/.proxdump_*']) %}
{% set ksc_superuser_enabled = salt['pillar.get']('pmg:custom_check:ksc_superuser:enabled', False) %}
{% set ksc_superuser_name = salt['pillar.get']('pmg:custom_check:ksc_superuser:name', '') %}
{% set ksc_superuser_manage_sudoers = salt['pillar.get']('pmg:custom_check:ksc_superuser:manage_sudoers', True) %}
@@ -93,6 +94,34 @@ pmg-custom-check-service-{{ service_name }}:
- test: pmg-custom-check-kaspersky-ready
{% endfor %}
{% for excluded_path in custom_check_kesl_excluded_paths %}
pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}:
cmd.run:
- name: >-
kesl-control --set-settings File_Threat_Protection
ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.Path='{{ excluded_path }}'
ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.UseScanArea=Yes
ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.AreaMask.item_0000='*'
- unless: >-
kesl-control --get-settings File_Threat_Protection 2>/dev/null
| grep -Fq "ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.Path={{ excluded_path }}"
- require:
- test: pmg-custom-check-kaspersky-ready
{% for service_name in custom_check_required_services %}
- service: pmg-custom-check-service-{{ service_name }}
{% endfor %}
{% endfor %}
pmg-custom-check-kesl-restart:
cmd.wait:
- name: systemctl restart kesl
- watch:
{% for excluded_path in custom_check_kesl_excluded_paths %}
- cmd: pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}
{% endfor %}
- require:
- test: pmg-custom-check-kaspersky-ready
pmg-custom-check-enable-in-pmg:
cmd.run:
- name: pmgsh set /config/admin --custom_check 1