Initial commit

.gitignore

@@ -1,13 +0,0 @@
-# Python / virtualenv
-.venv/
-venv/
-__pycache__/
-*.pyc
-
-# Salt runtime artifacts
-.salt/
-
-# IDE / OS files
-.idea/
-.vscode/
-.DS_Store

.yamllint

@@ -1,16 +0,0 @@
-extends: default
-
-ignore: |
-  .git/
-  .venv/
-  venv/
-
-rules:
-  comments-indentation: disable
-  document-start:
-    present: false
-  line-length:
-    max: 120
-    level: warning
-  truthy:
-    check-keys: false

Makefile

@@ -1,38 +0,0 @@
-SHELL := /usr/bin/env bash
-.RECIPEPREFIX := >
-
-SALT_CALL ?= salt-call
-SALT_LINT ?= salt-lint
-YAMLLINT ?= yamllint
-STATE_ROOT ?= .
-PILLAR_ROOT ?= ./pillar
-MINION_ID ?= p-mailgw-x2-01.lmru.tech
-
-.PHONY: lint check apply verify update-check update
-
-lint:
->@if command -v $(SALT_LINT) >/dev/null 2>&1; then \
->  $(SALT_LINT) pmg/*.sls pillar/*.sls top.sls; \
->else \
->  echo "salt-lint не найден, пропускаю"; \
->fi
->@if command -v $(YAMLLINT) >/dev/null 2>&1; then \
->  $(YAMLLINT) .; \
->else \
->  echo "yamllint не найден, пропускаю"; \
->fi
-
-check:
->sudo $(SALT_CALL) --local --id $(MINION_ID) --file-root=$(STATE_ROOT) --pillar-root=$(PILLAR_ROOT) state.apply pmg.init test=True
-
-apply:
->sudo $(SALT_CALL) --local --id $(MINION_ID) --file-root=$(STATE_ROOT) --pillar-root=$(PILLAR_ROOT) state.apply pmg.init
-
-verify:
->sudo $(SALT_CALL) --local --id $(MINION_ID) --file-root=$(STATE_ROOT) --pillar-root=$(PILLAR_ROOT) state.apply pmg.verify
-
-update-check:
->sudo $(SALT_CALL) --local --id $(MINION_ID) --file-root=$(STATE_ROOT) --pillar-root=$(PILLAR_ROOT) state.apply pmg.update test=True
-
-update:
->sudo $(SALT_CALL) --local --id $(MINION_ID) --file-root=$(STATE_ROOT) --pillar-root=$(PILLAR_ROOT) state.apply pmg.update

README.md

@@ -1,91 +1,2 @@
-# Salt baseline для PMG
+# mailgw-salt
 
-Репозиторий содержит автономный набор Salt states для базовой эксплуатации и hardening Proxmox Mail Gateway.
-
-## Что внутри
-
-- `top.sls` — привязка состояний к minion ID.
-- `pillar/pmg.sls` — переменные и параметры PMG.
-- `pmg/*.sls` — состояния:
-  - `common` (базовые пакеты),
-  - `ssh_hardening`,
-  - `custom_check` (кастомная AV-проверка PMG через KESL),
-  - `security_agents` (Wazuh/Qualys),
-  - `update` (пакетные обновления + pre/post проверки PMG),
-  - `auto_updates` (security-only, без auto reboot),
-  - `audit_logging`,
-  - `pmg_baseline` (проверка/поддержание сервисов PMG),
-  - `verify` (проверки состояния).
-- `pmg/files/*` — шаблоны конфигов.
-
-## Требования
-
-- Salt (рекомендуется актуальная LTS-ветка).
-- Debian/PMG узлы с systemd.
-- root-доступ на узел.
-
-## Быстрый запуск
-
-```bash
-make lint
-make check
-make apply
-make verify
-make update-check
-make update
-```
-
-По умолчанию `MINION_ID=p-mailgw-x2-01.lmru.tech`. Можно переопределить:
-
-```bash
-make check MINION_ID=p-mailgw-x1-01.lmru.tech
-```
-
-## Основные переменные
-
-Все параметры задаются в `pillar/pmg.sls`:
-
-- `pmg.base_packages`
-- `pmg.ssh_allow_users`
-- `pmg.ssh_password_authentication`
-- `pmg.journald_system_max_use`
-- `pmg.journald_max_file_sec`
-- `pmg.pmg_services`
-- `pmg.update_dist_upgrade`
-- `pmg.update_auto_reboot`
-- `pmg.update_reboot_delay_minutes`
-- `pmg.custom_check.*`
-- `pmg.manage_hosts_file`
-- `pmg.hosts_file_entries`
-- `pmg.wazuh.*`
-- `pmg.qualys.*`
-
-## Отдельное обновление PMG
-
-Перед обновлением:
-
-```bash
-make update-check MINION_ID=p-mailgw-x1-01.lmru.tech
-```
-
-Применение:
-
-```bash
-make update MINION_ID=p-mailgw-x1-01.lmru.tech
-make verify MINION_ID=p-mailgw-x1-01.lmru.tech
-```
-
-State `pmg.update` выполняет:
-- precheck кластера (`pmgcm status`);
-- precheck критичных PMG сервисов;
-- пакетное обновление (`pkg.uptodate`, с `dist_upgrade` по `pmg.update_dist_upgrade=true`);
-- postcheck кластера и сервисов;
-- уведомление, если требуется reboot (`/var/run/reboot-required`).
-- опциональный автоперезапуск по `pmg.update_auto_reboot=true` (через `shutdown -r +N`).
-
-## PMG custom check (Kaspersky)
-
-Коротко про `pmg.custom_check`:
-- готовит окружение (`pwgen`, `/var/log/mail_av`, `/usr/local/bin/pmg-custom-check`);
-- готовит Kaspersky-учетку (`pmg.custom_check.ksc_superuser.*`; сейчас `superuser` + `NOPASSWD`);
-- если `kesl/klnagent64` установлены — включает сервисы и `custom_check` в PMG, если нет — выводит уведомление "ставится через Kaspersky Administration Center"; сервисы включатся вторым прогоном после установки пакетов.

pillar/pmg.sls

@@ -1,63 +0,0 @@
-pmg:
-  base_packages:
-    - curl
-    - vim-tiny
-    - rsync
-    - ca-certificates
-    - jq
-
-  ssh_allow_users: []
-  ssh_password_authentication: true
-
-  journald_system_max_use: 1G
-  journald_max_file_sec: 1month
-
-  pmg_services:
-    - postfix
-    - pmg-smtp-filter
-    - pmgpolicy
-    - pmgdaemon
-    - pmgmirror
-    - pmgtunnel
-  update_dist_upgrade: true
-  update_auto_reboot: false
-  update_reboot_delay_minutes: 1
-
-  custom_check:
-    enabled: true
-    script_path: /usr/local/bin/pmg-custom-check
-    log_dir: /var/log/mail_av
-    managed_packages:
-      - pwgen
-    ksc_superuser:
-      enabled: true
-      name: superuser
-      manage_sudoers: true
-    required_services:
-      - kesl
-      - klnagent64
-
-  manage_hosts_file: false
-  hosts_file_entries:
-    - ip: 10.80.38.152
-      hostname: p-mailgw-x1-01
-      aliases:
-        - p-mailgw-x1-01.lmru.tech
-    - ip: 10.220.41.152
-      hostname: p-mailgw-x2-01
-      aliases:
-        - p-mailgw-x2-01.lmru.tech
-
-  wazuh:
-    enabled: true
-    version: 4.14.0-1
-    manager: 10.80.120.205
-    group: test_auditd_unix
-
-  qualys:
-    enabled: true
-    package_url: https://storage.yandexcloud.net/qualys-agent/QualysCloudAgent.deb
-    package_path: /opt/QualysCloudAgent.deb
-    activation_id: 5eb9ad8e-02cc-431a-9afb-b8caad175ec1
-    customer_id: 4d868109-dad3-5536-82b4-9f3a6f3010bc
-    server_uri: https://qagpublic.qg1.apps.qualys.eu/CloudAgent/

pillar/top.sls

@@ -1,3 +0,0 @@
-base:
-  '*':
-    - pmg

pmg/audit_logging.sls

@@ -1,56 +0,0 @@
-{% set journald_system_max_use = salt['pillar.get']('pmg:journald_system_max_use', '1G') %}
-{% set journald_max_file_sec = salt['pillar.get']('pmg:journald_max_file_sec', '1month') %}
-
-pmg-journald-dropin-dir:
-  file.directory:
-    - name: /etc/systemd/journald.conf.d
-    - user: root
-    - group: root
-    - mode: '0755'
-
-pmg-journald-retention:
-  file.managed:
-    - name: /etc/systemd/journald.conf.d/99-retention.conf
-    - source: salt://pmg/files/journald-retention.conf.jinja
-    - template: jinja
-    - context:
-        journald_system_max_use: {{ journald_system_max_use }}
-        journald_max_file_sec: {{ journald_max_file_sec }}
-    - user: root
-    - group: root
-    - mode: '0644'
-
-pmg-restart-journald:
-  cmd.run:
-    - name: systemctl restart systemd-journald
-    - onchanges:
-      - file: pmg-journald-retention
-
-pmg-auditd-package:
-  pkg.installed:
-    - name: auditd
-
-pmg-audit-rules:
-  file.managed:
-    - name: /etc/audit/rules.d/99-pmg-baseline.rules
-    - source: salt://pmg/files/99-pmg-baseline.rules.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: '0640'
-
-pmg-reload-audit-rules:
-  cmd.run:
-    - name: augenrules --load
-    - onchanges:
-      - file: pmg-audit-rules
-
-pmg-auditd-service:
-  service.running:
-    - name: auditd
-    - enable: true
-
-pmg-rsyslog-service:
-  service.running:
-    - name: rsyslog
-    - enable: true

pmg/auto_updates.sls

@@ -1,28 +0,0 @@
-pmg-updates-packages:
-  pkg.installed:
-    - pkgs:
-      - unattended-upgrades
-      - apt-listchanges
-
-pmg-apt-auto-upgrades:
-  file.managed:
-    - name: /etc/apt/apt.conf.d/20auto-upgrades
-    - source: salt://pmg/files/20auto-upgrades.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: '0644'
-
-pmg-unattended-policy:
-  file.managed:
-    - name: /etc/apt/apt.conf.d/50unattended-upgrades
-    - source: salt://pmg/files/50unattended-upgrades.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: '0644'
-
-pmg-unattended-service:
-  service.running:
-    - name: unattended-upgrades
-    - enable: true

pmg/common.sls

@@ -1,5 +0,0 @@
-{% set base_packages = salt['pillar.get']('pmg:base_packages', []) %}
-
-pmg-base-packages:
-  pkg.installed:
-    - pkgs: {{ base_packages }}

pmg/custom_check.sls

@@ -1,111 +0,0 @@
-{% set custom_check_enabled = salt['pillar.get']('pmg:custom_check:enabled', True) %}
-{% set custom_check_script_path = salt['pillar.get']('pmg:custom_check:script_path', '/usr/local/bin/pmg-custom-check') %}
-{% set custom_check_log_dir = salt['pillar.get']('pmg:custom_check:log_dir', '/var/log/mail_av') %}
-{% set custom_check_managed_packages = salt['pillar.get']('pmg:custom_check:managed_packages', ['pwgen']) %}
-{% set custom_check_required_services = salt['pillar.get']('pmg:custom_check:required_services', ['kesl', 'klnagent64']) %}
-{% set ksc_superuser_enabled = salt['pillar.get']('pmg:custom_check:ksc_superuser:enabled', False) %}
-{% set ksc_superuser_name = salt['pillar.get']('pmg:custom_check:ksc_superuser:name', '') %}
-{% set ksc_superuser_manage_sudoers = salt['pillar.get']('pmg:custom_check:ksc_superuser:manage_sudoers', True) %}
-{% set kesl_installed = salt['pkg.version']('kesl') != '' %}
-{% set klnagent64_installed = salt['pkg.version']('klnagent64') != '' %}
-{% set custom_check_kaspersky_ready = kesl_installed and klnagent64_installed %}
-
-{% if custom_check_enabled %}
-{% if ksc_superuser_enabled and ksc_superuser_name %}
-pmg-custom-check-ksc-superuser:
-  user.present:
-    - name: {{ ksc_superuser_name }}
-    - shell: /bin/bash
-    - createhome: true
-
-{% if ksc_superuser_manage_sudoers %}
-pmg-custom-check-ksc-superuser-sudo-package:
-  pkg.installed:
-    - name: sudo
-
-pmg-custom-check-ksc-superuser-sudoers:
-  file.managed:
-    - name: /etc/sudoers.d/90-kaspersky-superuser
-    - user: root
-    - group: root
-    - mode: '0440'
-    - contents:
-      - {{ ksc_superuser_name }} ALL = (ALL) NOPASSWD: ALL
-    - check_cmd: visudo -cf
-    - require:
-      - pkg: pmg-custom-check-ksc-superuser-sudo-package
-      - user: pmg-custom-check-ksc-superuser
-{% endif %}
-{% elif ksc_superuser_enabled %}
-pmg-custom-check-ksc-superuser-missing-name:
-  test.fail_without_changes:
-    - name: "pmg.custom_check.ksc_superuser.enabled=true but pmg.custom_check.ksc_superuser.name is empty."
-{% endif %}
-
-pmg-custom-check-managed-packages:
-  pkg.installed:
-    - pkgs: {{ custom_check_managed_packages }}
-
-pmg-custom-check-log-dir:
-  file.directory:
-    - name: {{ custom_check_log_dir }}
-    - user: root
-    - group: root
-    - mode: '0755'
-
-pmg-custom-check-log-file:
-  file.touch:
-    - name: {{ custom_check_log_dir }}/checked
-    - require:
-      - file: pmg-custom-check-log-dir
-
-pmg-custom-check-script:
-  file.managed:
-    - name: {{ custom_check_script_path }}
-    - source: salt://pmg/files/pmg-custom-check.jinja
-    - template: jinja
-    - user: root
-    - group: root
-    - mode: '0755'
-    - context:
-        custom_check_log_dir: {{ custom_check_log_dir }}
-    - require:
-      - pkg: pmg-custom-check-managed-packages
-      - file: pmg-custom-check-log-dir
-
-{% if custom_check_kaspersky_ready %}
-pmg-custom-check-kaspersky-ready:
-  test.nop:
-    - name: "KESL and klnagent64 are installed."
-{% else %}
-pmg-custom-check-kaspersky-missing-note:
-  test.show_notification:
-    - text: "KESL/klnagent64 не найдены. Установите через Kaspersky Administration Center (сервисный superuser/NOPASSWD), затем повторите state.apply pmg.custom_check."
-{% endif %}
-
-{% if custom_check_kaspersky_ready %}
-{% for service_name in custom_check_required_services %}
-pmg-custom-check-service-{{ service_name }}:
-  service.running:
-    - name: {{ service_name }}
-    - enable: true
-    - require:
-      - test: pmg-custom-check-kaspersky-ready
-{% endfor %}
-
-pmg-custom-check-enable-in-pmg:
-  cmd.run:
-    - name: pmgsh set /config/admin --custom_check 1
-    - unless: "pmgsh get /config/admin | grep -q '\"custom_check\" : 1'"
-    - require:
-      - file: pmg-custom-check-script
-      - pkg: pmg-custom-check-managed-packages
-{% for service_name in custom_check_required_services %}
-      - service: pmg-custom-check-service-{{ service_name }}
-{% endfor %}
-{% endif %}
-{% else %}
-pmg-custom-check-disabled-note:
-  test.show_notification:
-    - text: "PMG custom_check disabled by pillar (pmg.custom_check.enabled=false)."
-{% endif %}

pmg/files/20auto-upgrades.jinja

@@ -1,4 +0,0 @@
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::Unattended-Upgrade "1";
-APT::Periodic::AutocleanInterval "7";

pmg/files/50unattended-upgrades.jinja

@@ -1,14 +0,0 @@
-Unattended-Upgrade::Origins-Pattern {
-  "origin=Debian,codename=${distro_codename},label=Debian-Security";
-  "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
-};
-
-Unattended-Upgrade::Package-Blacklist {
-};
-
-Unattended-Upgrade::MinimalSteps "true";
-Unattended-Upgrade::InstallOnShutdown "false";
-Unattended-Upgrade::MailOnlyOnError "true";
-Unattended-Upgrade::Remove-Unused-Dependencies "true";
-Unattended-Upgrade::Automatic-Reboot "false";
-Unattended-Upgrade::SyslogEnable "true";

pmg/files/99-hardening.conf.jinja

@@ -1,10 +0,0 @@
-# Managed by Salt.
-PasswordAuthentication {{ "yes" if ssh_password_authentication else "no" }}
-PermitRootLogin prohibit-password
-PubkeyAuthentication yes
-X11Forwarding no
-MaxAuthTries 3
-LoginGraceTime 30
-{% if ssh_allow_users %}
-AllowUsers {{ " ".join(ssh_allow_users) }}
-{% endif %}

pmg/files/99-pmg-baseline.rules.jinja

@@ -1,14 +0,0 @@
-## Managed by Salt.
--D
--b 8192
-
--w /etc/passwd -p wa -k identity
--w /etc/group -p wa -k identity
--w /etc/shadow -p wa -k identity
--w /etc/gshadow -p wa -k identity
-
--w /etc/sudoers -p wa -k privilege-escalation
--w /etc/sudoers.d/ -p wa -k privilege-escalation
-
--w /etc/ssh/sshd_config -p wa -k ssh
--w /etc/ssh/sshd_config.d/ -p wa -k ssh

pmg/files/journald-retention.conf.jinja

@@ -1,3 +0,0 @@
-[Journal]
-SystemMaxUse={{ journald_system_max_use }}
-MaxFileSec={{ journald_max_file_sec }}

pmg/files/pmg-custom-check.jinja

@@ -1,49 +0,0 @@
-#!/bin/bash
-# Managed by Salt: PMG custom check via Kaspersky KESL.
-
-set -u
-
-LOG_DIR="{{ custom_check_log_dir }}"
-KESL_BIN="/opt/kaspersky/kesl/bin/kesl-control"
-SCAN_TARGET="${2:-}"
-
-if [ -z "${SCAN_TARGET}" ]; then
-  echo "v1"
-  echo "ERROR: empty scan target"
-  exit 0
-fi
-
-mkdir -p "${LOG_DIR}"
-
-POLICY_NAME="$(pwgen 10 -1 -s -0)"
-POLICY_FILE="${LOG_DIR}/${POLICY_NAME}.pol"
-
-cat > "${POLICY_FILE}" <<EOF
-ActionOnThreat=Inform
-ReportCleanObjects=No
-ScanFiles=Yes
-ScanMailBases=Yes
-ScanPlainMail=Yes
-UseAnalyzer=Yes
-HeuristicLevel=Medium
-[ScanScope.item_0000]
-Path=${SCAN_TARGET}
-EOF
-
-"${KESL_BIN}" --create-task "${POLICY_NAME}" --type ODS --file "${POLICY_FILE}" >/dev/null
-VIRUS_NAME="$("${KESL_BIN}" --start-task "${POLICY_NAME}" -W | grep 'DetectName' | awk -F'=' '{print $2}' | head -1)"
-"${KESL_BIN}" --delete-task "${POLICY_NAME}"
-
-if [ -z "${VIRUS_NAME}" ]; then
-  rm -f "${POLICY_FILE}"
-  echo "Mail ${SCAN_TARGET} was checked successfully" >> "${LOG_DIR}/checked"
-  echo "v1"
-  echo "OK"
-else
-  echo "In mail ${SCAN_TARGET} find ${VIRUS_NAME}" >> "${POLICY_FILE}"
-  echo "Mail ${SCAN_TARGET} was blocked. More info in ${POLICY_FILE}" >> "${LOG_DIR}/checked"
-  echo "v1"
-  echo "VIRUS: ${VIRUS_NAME}"
-fi
-
-exit 0

pmg/init.sls

@@ -1,8 +0,0 @@
-include:
-  - pmg.common
-  - pmg.ssh_hardening
-  - pmg.custom_check
-  - pmg.security_agents
-  - pmg.auto_updates
-  - pmg.audit_logging
-  - pmg.pmg_baseline

pmg/pmg_baseline.sls

@@ -1,31 +0,0 @@
-{% set pmg_services = salt['pillar.get']('pmg:pmg_services', []) %}
-{% set manage_hosts_file = salt['pillar.get']('pmg:manage_hosts_file', False) %}
-{% set hosts_file_entries = salt['pillar.get']('pmg:hosts_file_entries', []) %}
-
-{% for svc in pmg_services %}
-pmg-service-{{ svc }}:
-  service.running:
-    - name: {{ svc }}
-    - enable: true
-{% endfor %}
-
-pmg-cluster-status:
-  cmd.run:
-    - name: pmgcm status
-
-{% if manage_hosts_file %}
-pmg-managed-hosts:
-  file.blockreplace:
-    - name: /etc/hosts
-    - marker_start: "#-- SALT PMG HOSTS START --"
-    - marker_end: "#-- SALT PMG HOSTS END --"
-    - append_if_not_found: true
-    - content: |
-{% for host in hosts_file_entries %}
-{% if host.get('aliases', []) %}
-        {{ host['ip'] }} {{ host['hostname'] }} {{ ' '.join(host['aliases']) }}
-{% else %}
-        {{ host['ip'] }} {{ host['hostname'] }}
-{% endif %}
-{% endfor %}
-{% endif %}

pmg/security_agents.sls

@@ -1,69 +0,0 @@
-{% set wazuh_enabled = salt['pillar.get']('pmg:wazuh:enabled', True) %}
-{% set wazuh_version = salt['pillar.get']('pmg:wazuh:version', '4.14.0-1') %}
-{% set wazuh_manager = salt['pillar.get']('pmg:wazuh:manager', '10.80.120.205') %}
-{% set wazuh_group = salt['pillar.get']('pmg:wazuh:group', 'test_auditd_unix') %}
-{% set wazuh_pkg_name = 'wazuh-agent_' ~ wazuh_version ~ '_amd64.deb' %}
-{% set wazuh_pkg_url = 'https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/' ~ wazuh_pkg_name %}
-{% set wazuh_pkg_path = '/var/tmp/' ~ wazuh_pkg_name %}
-
-{% set qualys_enabled = salt['pillar.get']('pmg:qualys:enabled', True) %}
-{% set qualys_package_url = salt['pillar.get']('pmg:qualys:package_url', 'https://storage.yandexcloud.net/qualys-agent/QualysCloudAgent.deb') %}
-{% set qualys_package_path = salt['pillar.get']('pmg:qualys:package_path', '/opt/QualysCloudAgent.deb') %}
-{% set qualys_activation_id = salt['pillar.get']('pmg:qualys:activation_id', '') %}
-{% set qualys_customer_id = salt['pillar.get']('pmg:qualys:customer_id', '') %}
-{% set qualys_server_uri = salt['pillar.get']('pmg:qualys:server_uri', 'https://qagpublic.qg1.apps.qualys.eu/CloudAgent/') %}
-
-{% if wazuh_enabled %}
-pmg-wazuh-download:
-  cmd.run:
-    - name: wget -qO {{ wazuh_pkg_path }} {{ wazuh_pkg_url }}
-    - unless: test -f {{ wazuh_pkg_path }}
-
-pmg-wazuh-install:
-  cmd.run:
-    - name: WAZUH_MANAGER='{{ wazuh_manager }}' WAZUH_AGENT_GROUP='{{ wazuh_group }}' WAZUH_AGENT_NAME="$(hostname -f)" dpkg -i {{ wazuh_pkg_path }}
-    - unless: dpkg-query -W -f='${Status}' wazuh-agent 2>/dev/null | grep -q 'install ok installed'
-    - require:
-      - cmd: pmg-wazuh-download
-
-pmg-wazuh-service:
-  service.running:
-    - name: wazuh-agent
-    - enable: true
-    - require:
-      - cmd: pmg-wazuh-install
-{% endif %}
-
-{% if qualys_enabled and qualys_package_path and qualys_activation_id and qualys_customer_id %}
-pmg-qualys-download:
-  cmd.run:
-    - name: wget -qO {{ qualys_package_path }} {{ qualys_package_url }}
-    - unless: test -f {{ qualys_package_path }}
-
-pmg-qualys-install:
-  cmd.run:
-    - name: dpkg --install {{ qualys_package_path }}
-    - onlyif: test -f {{ qualys_package_path }}
-    - unless: dpkg-query -W -f='${Status}' qualys-cloud-agent 2>/dev/null | grep -q 'install ok installed'
-    - require:
-      - cmd: pmg-qualys-download
-
-pmg-qualys-activate:
-  cmd.run:
-    - name: /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId={{ qualys_activation_id }} CustomerId={{ qualys_customer_id }} ServerUri={{ qualys_server_uri }}
-    - onchanges:
-      - cmd: pmg-qualys-install
-    - onlyif: test -x /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh
-
-pmg-qualys-service:
-  service.running:
-    - name: qualys-cloud-agent
-    - enable: true
-    - onlyif: test -f {{ qualys_package_path }}
-    - require:
-      - cmd: pmg-qualys-install
-{% elif qualys_enabled %}
-pmg-qualys-skipped:
-  test.show_notification:
-    - text: "Qualys agent skipped: set package_url + package_path + activation_id + customer_id in pillar."
-{% endif %}

pmg/ssh_hardening.sls

@@ -1,35 +0,0 @@
-{% set ssh_allow_users = salt['pillar.get']('pmg:ssh_allow_users', []) %}
-{% set ssh_password_authentication = salt['pillar.get']('pmg:ssh_password_authentication', True) %}
-
-pmg-sshd-dropin-dir:
-  file.directory:
-    - name: /etc/ssh/sshd_config.d
-    - user: root
-    - group: root
-    - mode: '0755'
-
-pmg-sshd-hardening-config:
-  file.managed:
-    - name: /etc/ssh/sshd_config.d/99-hardening.conf
-    - source: salt://pmg/files/99-hardening.conf.jinja
-    - template: jinja
-    - context:
-        ssh_allow_users: {{ ssh_allow_users }}
-        ssh_password_authentication: {{ ssh_password_authentication }}
-    - user: root
-    - group: root
-    - mode: '0644'
-
-pmg-validate-sshd-config:
-  cmd.run:
-    - name: sshd -t
-    - onchanges:
-      - file: pmg-sshd-hardening-config
-
-pmg-sshd-service:
-  service.running:
-    - name: ssh
-    - enable: true
-    - reload: true
-    - watch:
-      - cmd: pmg-validate-sshd-config

pmg/update.sls

@@ -1,50 +0,0 @@
-{% set pmg_services = salt['pillar.get']('pmg:pmg_services', []) %}
-{% set pmg_update_dist_upgrade = salt['pillar.get']('pmg:update_dist_upgrade', True) %}
-{% set pmg_update_auto_reboot = salt['pillar.get']('pmg:update_auto_reboot', False) %}
-{% set pmg_update_reboot_delay_minutes = salt['pillar.get']('pmg:update_reboot_delay_minutes', 1) %}
-
-pmg-update-precheck-cluster:
-  cmd.run:
-    - name: pmgcm status
-
-{% for svc in pmg_services %}
-pmg-update-precheck-service-{{ svc }}:
-  cmd.run:
-    - name: systemctl is-active --quiet {{ svc }}
-{% endfor %}
-
-pmg-update-packages:
-  pkg.uptodate:
-    - refresh: true
-    - dist_upgrade: {{ pmg_update_dist_upgrade }}
-
-pmg-update-postcheck-cluster:
-  cmd.run:
-    - name: pmgcm status
-    - require:
-      - pkg: pmg-update-packages
-
-{% for svc in pmg_services %}
-pmg-update-postcheck-service-{{ svc }}:
-  cmd.run:
-    - name: systemctl is-active --quiet {{ svc }}
-    - require:
-      - pkg: pmg-update-packages
-{% endfor %}
-
-pmg-update-reboot-required-note:
-  test.show_notification:
-    - text: "После обновления требуется reboot: /var/run/reboot-required"
-    - onlyif: test -f /var/run/reboot-required
-
-{% if pmg_update_auto_reboot %}
-pmg-update-schedule-reboot:
-  cmd.run:
-    - name: "shutdown -r +{{ pmg_update_reboot_delay_minutes }} \"Salt pmg.update: reboot required\""
-    - onlyif: test -f /var/run/reboot-required
-    - require:
-      - cmd: pmg-update-postcheck-cluster
-{% for svc in pmg_services %}
-      - cmd: pmg-update-postcheck-service-{{ svc }}
-{% endfor %}
-{% endif %}

pmg/verify.sls

@@ -1,15 +0,0 @@
-{% set pmg_services = salt['pillar.get']('pmg:pmg_services', []) %}
-
-{% for svc in pmg_services %}
-pmg-verify-service-{{ svc }}:
-  cmd.run:
-    - name: systemctl is-active --quiet {{ svc }}
-{% endfor %}
-
-pmg-verify-cluster:
-  cmd.run:
-    - name: pmgcm status
-
-pmg-verify-sshd-config:
-  cmd.run:
-    - name: sshd -t

top.sls

@@ -1,3 +0,0 @@
-base:
-  'p-mailgw-x*-0*':
-    - pmg.init