mailgw-salt/pmg/custom_check.sls

{% set custom_check_enabled = salt['pillar.get']('pmg:custom_check:enabled', True) %}
{% set custom_check_script_path = salt['pillar.get']('pmg:custom_check:script_path', '/usr/local/bin/pmg-custom-check') %}
{% set custom_check_log_dir = salt['pillar.get']('pmg:custom_check:log_dir', '/var/log/mail_av') %}
{% set custom_check_log_dir_user = salt['pillar.get']('pmg:custom_check:log_dir_user', 'pmg-smtp-filter') %}
{% set custom_check_log_dir_group = salt['pillar.get']('pmg:custom_check:log_dir_group', 'pmg') %}
{% set custom_check_log_dir_mode = salt['pillar.get']('pmg:custom_check:log_dir_mode', '0770') %}
{% set custom_check_log_file_mode = salt['pillar.get']('pmg:custom_check:log_file_mode', '0660') %}
{% set custom_check_managed_packages = salt['pillar.get']('pmg:custom_check:managed_packages', ['pwgen']) %}
{% set custom_check_required_services = salt['pillar.get']('pmg:custom_check:required_services', ['kesl', 'klnagent64']) %}
{% set custom_check_kesl_excluded_paths = salt['pillar.get']('pmg:custom_check:kesl_excluded_paths', ['/var/spool/pmg', '/var/lib/clamav', '/tmp/.proxdump_*']) %}
{% set ksc_superuser_enabled = salt['pillar.get']('pmg:custom_check:ksc_superuser:enabled', False) %}
{% set ksc_superuser_name = salt['pillar.get']('pmg:custom_check:ksc_superuser:name', '') %}
{% set ksc_superuser_manage_sudoers = salt['pillar.get']('pmg:custom_check:ksc_superuser:manage_sudoers', True) %}
{% set kesl_installed = salt['pkg.version']('kesl') != '' %}
{% set klnagent64_installed = salt['pkg.version']('klnagent64') != '' %}
{% set custom_check_kaspersky_ready = kesl_installed and klnagent64_installed %}

{% if custom_check_enabled %}
{% if ksc_superuser_enabled and ksc_superuser_name %}
pmg-custom-check-ksc-superuser:
  user.present:
    - name: {{ ksc_superuser_name }}
    - shell: /bin/bash
    - createhome: true

{% if ksc_superuser_manage_sudoers %}
pmg-custom-check-ksc-superuser-sudo-package:
  pkg.installed:
    - name: sudo

pmg-custom-check-ksc-superuser-sudoers:
  file.managed:
    - name: /etc/sudoers.d/90-kaspersky-superuser
    - user: root
    - group: root
    - mode: '0440'
    - contents:
      - '{{ ksc_superuser_name }} ALL = (ALL) NOPASSWD: ALL'
    - check_cmd: visudo -cf
    - require:
      - pkg: pmg-custom-check-ksc-superuser-sudo-package
      - user: pmg-custom-check-ksc-superuser
{% endif %}
{% elif ksc_superuser_enabled %}
pmg-custom-check-ksc-superuser-missing-name:
  test.fail_without_changes:
    - name: "pmg.custom_check.ksc_superuser.enabled=true but pmg.custom_check.ksc_superuser.name is empty."
{% endif %}

pmg-custom-check-managed-packages:
  pkg.installed:
    - pkgs: {{ custom_check_managed_packages }}

pmg-custom-check-log-dir:
  file.directory:
    - name: {{ custom_check_log_dir }}
    - user: {{ custom_check_log_dir_user }}
    - group: {{ custom_check_log_dir_group }}
    - mode: '{{ custom_check_log_dir_mode }}'
    - recurse:
      - user
      - group

pmg-custom-check-log-file:
  file.managed:
    - name: {{ custom_check_log_dir }}/checked
    - user: {{ custom_check_log_dir_user }}
    - group: {{ custom_check_log_dir_group }}
    - mode: '{{ custom_check_log_file_mode }}'
    - replace: false
    - require:
      - file: pmg-custom-check-log-dir

pmg-custom-check-script:
  file.managed:
    - name: {{ custom_check_script_path }}
    - source: salt://pmg/files/pmg-custom-check.jinja
    - template: jinja
    - user: root
    - group: root
    - mode: '0755'
    - context:
        custom_check_log_dir: {{ custom_check_log_dir }}
    - require:
      - pkg: pmg-custom-check-managed-packages
      - file: pmg-custom-check-log-dir

{% if custom_check_kaspersky_ready %}
pmg-custom-check-kaspersky-ready:
  test.nop:
    - name: "KESL and klnagent64 are installed."
{% else %}
pmg-custom-check-kaspersky-missing-note:
  test.show_notification:
    - text: "KESL/klnagent64 не найдены. Установите через Kaspersky Administration Center (сервисный superuser/NOPASSWD), затем повторите state.apply pmg.custom_check."
{% endif %}

{% if custom_check_kaspersky_ready %}
{% for service_name in custom_check_required_services %}
pmg-custom-check-service-{{ service_name }}:
  service.running:
    - name: {{ service_name }}
    - enable: true
    - require:
      - test: pmg-custom-check-kaspersky-ready
{% endfor %}

{% for excluded_path in custom_check_kesl_excluded_paths %}
pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}:
  cmd.run:
    - name: >-
        kesl-control --set-settings File_Threat_Protection
        ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.Path='{{ excluded_path }}'
        ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.UseScanArea=Yes
        ExcludedFromScanScope.item_{{ "%04d" | format(loop.index0) }}.AreaMask.item_0000='*'
    - unless: >-
        kesl-control --get-settings File_Threat_Protection 2>/dev/null
        | grep -Fq "Path={{ excluded_path }}"
    - require:
      - test: pmg-custom-check-kaspersky-ready
{% for service_name in custom_check_required_services %}
      - service: pmg-custom-check-service-{{ service_name }}
{% endfor %}
{% endfor %}

pmg-custom-check-kesl-restart:
  cmd.wait:
    - name: systemctl restart kesl
    - watch:
{% for excluded_path in custom_check_kesl_excluded_paths %}
      - cmd: pmg-custom-check-kesl-excluded-scope-{{ loop.index0 }}
{% endfor %}
    - require:
      - test: pmg-custom-check-kaspersky-ready

pmg-custom-check-enable-in-pmg:
  cmd.run:
    - name: pmgsh set /config/admin --custom_check 1
    - unless: "pmgsh get /config/admin | grep -q '\"custom_check\" : 1'"
    - require:
      - file: pmg-custom-check-script
      - pkg: pmg-custom-check-managed-packages
{% for service_name in custom_check_required_services %}
      - service: pmg-custom-check-service-{{ service_name }}
{% endfor %}
{% endif %}
{% else %}
pmg-custom-check-disabled-note:
  test.show_notification:
    - text: "PMG custom_check disabled by pillar (pmg.custom_check.enabled=false)."
{% endif %}