Mercurial > repos > other > Puppet
changeset 85:50dd78dbf3db puppet-3.6
Fight back against spam
* Enable more Postscreen settings
* Configure Amavis for SpamAssassin and AV
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Sat, 26 Dec 2015 20:26:22 +0000 |
parents | ae30d98f294f |
children | 4f59d2fcd521 |
files | common/freshclam common/freshclam.conf manifests/templates.pp modules/postfix/files/master.CentOS7.cf modules/postfix/templates/main.cf.erb |
diffstat | 5 files changed, 307 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/common/freshclam Sat Dec 26 20:26:22 2015 +0000 @@ -0,0 +1,18 @@ +## When changing the periodicity of freshclam runs in the crontab, +## this value must be adjusted also. Its value is the timespan between +## two subsequent freshclam runs in minutes. E.g. for the default +## +## | 0 */3 * * * ... +## +## crontab line, the value is 180 (minutes). +# FRESHCLAM_MOD= + +## A predefined value for the delay in seconds. By default, the value is +## calculated by the 'hostid' program. This predefined value guarantees +## constant timespans of 3 hours between two subsequent freshclam runs. +## +## This option accepts two special values: +## 'disabled-warn' ... disables the automatic freshclam update and +## gives out a warning +## 'disabled' ... disables the automatic freshclam silently +# FRESHCLAM_DELAY= \ No newline at end of file
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/common/freshclam.conf Sat Dec 26 20:26:22 2015 +0000 @@ -0,0 +1,230 @@ +## +## Example config file for freshclam +## Please read the freshclam.conf(5) manual before editing this file. +## + + +# Path to the database directory. +# WARNING: It must match clamd.conf's directive! +# Default: hardcoded (depends on installation options) +#DatabaseDirectory /var/lib/clamav + +# Path to the log file (make sure it has proper permissions) +# Default: disabled +#UpdateLogFile /var/log/freshclam.log + +# Maximum size of the log file. +# Value of 0 disables the limit. +# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes) +# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). +# in bytes just don't use modifiers. If LogFileMaxSize is enabled, +# log rotation (the LogRotate option) will always be enabled. +# Default: 1M +#LogFileMaxSize 2M + +# Log time with each message. +# Default: no +#LogTime yes + +# Enable verbose logging. +# Default: no +#LogVerbose yes + +# Use system logger (can work together with UpdateLogFile). +# Default: no +LogSyslog yes + +# Specify the type of syslog messages - please refer to 'man syslog' +# for facility names. +# Default: LOG_LOCAL6 +#LogFacility LOG_MAIL + +# Enable log rotation. Always enabled when LogFileMaxSize is enabled. +# Default: no +#LogRotate yes + +# This option allows you to save the process identifier of the daemon +# Default: disabled +#PidFile /var/run/freshclam.pid + +# By default when started freshclam drops privileges and switches to the +# "clamav" user. This directive allows you to change the database owner. +# Default: clamav (may depend on installation options) +#DatabaseOwner clamupdate + +# Initialize supplementary group access (freshclam must be started by root). +# Default: no +#AllowSupplementaryGroups yes + +# Use DNS to verify virus database version. Freshclam uses DNS TXT records +# to verify database and software versions. With this directive you can change +# the database verification domain. +# WARNING: Do not touch it unless you're configuring freshclam to use your +# own database verification domain. +# Default: current.cvd.clamav.net +#DNSDatabaseInfo current.cvd.clamav.net + +# Uncomment the following line and replace XY with your country +# code. See http://www.iana.org/cctld/cctld-whois.htm for the full list. +# You can use db.XY.ipv6.clamav.net for IPv6 connections. +#DatabaseMirror db.XY.clamav.net + +# database.clamav.net is a round-robin record which points to our most +# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is +# not working. DO NOT TOUCH the following line unless you know what you +# are doing. +DatabaseMirror database.clamav.net + +# How many attempts to make before giving up. +# Default: 3 (per mirror) +#MaxAttempts 5 + +# With this option you can control scripted updates. It's highly recommended +# to keep it enabled. +# Default: yes +#ScriptedUpdates yes + +# By default freshclam will keep the local databases (.cld) uncompressed to +# make their handling faster. With this option you can enable the compression; +# the change will take effect with the next database update. +# Default: no +#CompressLocalDatabase no + +# With this option you can provide custom sources (http:// or file://) for +# database files. This option can be used multiple times. +# Default: no custom URLs +#DatabaseCustomURL http://myserver.com/mysigs.ndb +#DatabaseCustomURL file:///mnt/nfs/local.hdb + +# This option allows you to easily point freshclam to private mirrors. +# If PrivateMirror is set, freshclam does not attempt to use DNS +# to determine whether its databases are out-of-date, instead it will +# use the If-Modified-Since request or directly check the headers of the +# remote database files. For each database, freshclam first attempts +# to download the CLD file. If that fails, it tries to download the +# CVD file. This option overrides DatabaseMirror, DNSDatabaseInfo +# and ScriptedUpdates. It can be used multiple times to provide +# fall-back mirrors. +# Default: disabled +#PrivateMirror mirror1.mynetwork.com +#PrivateMirror mirror2.mynetwork.com + +# Number of database checks per day. +# Default: 12 (every two hours) +#Checks 24 + +# Proxy settings +# Default: disabled +#HTTPProxyServer myproxy.com +#HTTPProxyPort 1234 +#HTTPProxyUsername myusername +#HTTPProxyPassword mypass + +# If your servers are behind a firewall/proxy which applies User-Agent +# filtering you can use this option to force the use of a different +# User-Agent header. +# Default: clamav/version_number +#HTTPUserAgent SomeUserAgentIdString + +# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for +# multi-homed systems. +# Default: Use OS'es default outgoing IP address. +#LocalIPAddress aaa.bbb.ccc.ddd + +# Send the RELOAD command to clamd. +# Default: no +#NotifyClamd /path/to/clamd.conf + +# Run command after successful database update. +# Default: disabled +#OnUpdateExecute command + +# Run command when database update process fails. +# Default: disabled +#OnErrorExecute command + +# Run command when freshclam reports outdated version. +# In the command string %v will be replaced by the new version number. +# Default: disabled +#OnOutdatedExecute command + +# Don't fork into background. +# Default: no +#Foreground yes + +# Enable debug messages in libclamav. +# Default: no +#Debug yes + +# Timeout in seconds when connecting to database server. +# Default: 30 +#ConnectTimeout 60 + +# Timeout in seconds when reading from database server. +# Default: 30 +#ReceiveTimeout 60 + +# With this option enabled, freshclam will attempt to load new +# databases into memory to make sure they are properly handled +# by libclamav before replacing the old ones. +# Default: yes +#TestDatabases yes + +# When enabled freshclam will submit statistics to the ClamAV Project about +# the latest virus detections in your environment. The ClamAV maintainers +# will then use this data to determine what types of malware are the most +# detected in the field and in what geographic area they are. +# Freshclam will connect to clamd in order to get recent statistics. +# Default: no +#SubmitDetectionStats /path/to/clamd.conf + +# Country of origin of malware/detection statistics (for statistical +# purposes only). The statistics collector at ClamAV.net will look up +# your IP address to determine the geographical origin of the malware +# reported by your installation. If this installation is mainly used to +# scan data which comes from a different location, please enable this +# option and enter a two-letter code (see http://www.iana.org/domains/root/db/) +# of the country of origin. +# Default: disabled +#DetectionStatsCountry country-code + +# This option enables support for our "Personal Statistics" service. +# When this option is enabled, the information on malware detected by +# your clamd installation is made available to you through our website. +# To get your HostID, log on http://www.stats.clamav.net and add a new +# host to your host list. Once you have the HostID, uncomment this option +# and paste the HostID here. As soon as your freshclam starts submitting +# information to our stats collecting service, you will be able to view +# the statistics of this clamd installation by logging into +# http://www.stats.clamav.net with the same credentials you used to +# generate the HostID. For more information refer to: +# http://www.clamav.net/documentation.html#cctts +# This feature requires SubmitDetectionStats to be enabled. +# Default: disabled +#DetectionStatsHostID unique-id + +# This option enables support for Google Safe Browsing. When activated for +# the first time, freshclam will download a new database file (safebrowsing.cvd) +# which will be automatically loaded by clamd and clamscan during the next +# reload, provided that the heuristic phishing detection is turned on. This +# database includes information about websites that may be phishing sites or +# possible sources of malware. When using this option, it's mandatory to run +# freshclam at least every 30 minutes. +# Freshclam uses the ClamAV's mirror infrastructure to distribute the +# database and its updates but all the contents are provided under Google's +# terms of use. See http://www.google.com/transparencyreport/safebrowsing +# and http://www.clamav.net/documentation.html#safebrowsing +# for more information. +# Default: disabled +#SafeBrowsing yes + +# This option enables downloading of bytecode.cvd, which includes additional +# detection mechanisms and improvements to the ClamAV engine. +# Default: enabled +#Bytecode yes + +# Download an additional 3rd party signature database distributed through +# the ClamAV mirrors. +# This option can be used multiple times. +#ExtraDatabase dbname1 +#ExtraDatabase dbname2
--- a/manifests/templates.pp Wed Dec 23 11:16:17 2015 +0000 +++ b/manifests/templates.pp Sat Dec 26 20:26:22 2015 +0000 @@ -566,6 +566,26 @@ class { 'dovecot': imapserver => $imapserver, } + package { [ 'amavisd-new', 'clamav', 'clamav-server-systemd', 'clamav-update' ]: + ensure => installed, + tag => 'av', + } + file { '/etc/freshclam.conf': + ensure => present, + source => 'puppet:///common/freshclam.conf', + tag => 'av', + } + file { '/etc/sysconfig/freshclam': + ensure => present, + source => 'puppet:///common/freshclam', + tag => 'av', + } + file { '/etc/amavisd/amavisd.conf': + ensure => present, + source => 'puppet:///private/postfix/amavisd.conf', + tag => 'av', + } + Package<| tag == 'av' |> -> File<| tag == 'av' |> } class cronjobs {
--- a/modules/postfix/files/master.CentOS7.cf Wed Dec 23 11:16:17 2015 +0000 +++ b/modules/postfix/files/master.CentOS7.cf Sat Dec 26 20:26:22 2015 +0000 @@ -11,6 +11,10 @@ #smtp inet n - n - - smtpd smtpd pass - - n - - smtpd smtp inet n - n - 1 postscreen +smtp inet n - n - - smtpd + -o smtpd_sasl_auth_enable=yes + -o receive_override_options=no_address_mappings + -o content_filter=smtp-amavis:127.0.0.1:10024 tlsproxy unix - - n - 0 tlsproxy dnsblog unix - - n - 0 dnsblog #submission inet n - n - - smtpd @@ -109,3 +113,26 @@ policy unix - n n - 0 spawn user=nobody argv=/usr/bin/perl /usr/local/lib/postfix-policyd-spf-perl/postfix-policyd-spf-perl + +# +# spam/virus section +# +smtp-amavis unix - - y - 2 smtp + -o smtp_data_done_timeout=1200 + -o disable_dns_lookups=yes + -o smtp_send_xforward_command=yes +127.0.0.1:10025 inet n - y - - smtpd + -o content_filter= + -o smtpd_helo_restrictions= + -o smtpd_sender_restrictions= + -o smtpd_recipient_restrictions=permit_mynetworks,reject + -o mynetworks=127.0.0.0/8 + -o smtpd_error_sleep_time=0 + -o smtpd_soft_error_limit=1001 + -o smtpd_hard_error_limit=1000 + -o receive_override_options=no_header_body_checks + -o smtpd_helo_required=no + -o smtpd_client_restrictions= + -o smtpd_restriction_classes= + -o disable_vrfy_command=no + -o strict_rfc821_envelopes=yes \ No newline at end of file
--- a/modules/postfix/templates/main.cf.erb Wed Dec 23 11:16:17 2015 +0000 +++ b/modules/postfix/templates/main.cf.erb Sat Dec 26 20:26:22 2015 +0000 @@ -69,5 +69,15 @@ # The following may not be used by all versions of Postfix postscreen_dnsbl_threshold = 2 postscreen_dnsbl_sites = zen.spamhaus.org*2 bl.spamcop.net*1 b.barracudacentral.org*1 -#postscreen_greet_action = enforce -#postscreen_dnsbl_action = enforce \ No newline at end of file +postscreen_dnsbl_action = enforce + +postscreen_greet_banner = Establishing connection... +postscreen_greet_action = enforce + +postscreen_pipelining_enable = yes +postscreen_pipelining_action = enforce + +postscreen_non_smtp_command_enable = yes +postscreen_non_smtp_command_action = enforce + +content_filter = smtp-amavis:[127.0.0.1]:10024 \ No newline at end of file