Add a new clamav role

This will be needed to migrate Dist Git from puppet to ansible.

roles/clamav/files/freshclam-cron

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+### A simple update script for the clamav virus database.
+### This could as well be replaced by a SysV script.
+
+### fix log file if needed
+LOG_FILE="/var/log/clamav/freshclam.log"
+if [ ! -f "$LOG_FILE" ]; then
+    touch "$LOG_FILE"
+    chmod 644 "$LOG_FILE"
+    chown clam.clam "$LOG_FILE"
+fi
+
+/usr/bin/freshclam \
+    --quiet \
+    --datadir="/var/lib/clamav" \
+    --log="$LOG_FILE"

roles/clamav/files/freshclam.conf

@@ -0,0 +1,197 @@
+##
+## Example config file for freshclam
+## Please read the freshclam.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+
+# Path to the database directory.
+# WARNING: It must match clamd.conf's directive!
+# Default: hardcoded (depends on installation options)
+#DatabaseDirectory /var/lib/clamav
+
+# Path to the log file (make sure it has proper permissions)
+# Default: disabled
+# UpdateLogFile /var/log/freshclam.log
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
+# in bytes just don't use modifiers.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+#LogTime yes
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Use system logger (can work together with UpdateLogFile).
+# Default: no
+LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# This option allows you to save the process identifier of the daemon
+# Default: disabled
+#PidFile /var/run/freshclam.pid
+
+# By default when started freshclam drops privileges and switches to the
+# "clamav" user. This directive allows you to change the database owner.
+# Default: clamav (may depend on installation options)
+#DatabaseOwner clamav
+
+# Initialize supplementary group access (freshclam must be started by root).
+# Default: no
+#AllowSupplementaryGroups yes
+
+# Use DNS to verify virus database version. Freshclam uses DNS TXT records
+# to verify database and software versions. With this directive you can change
+# the database verification domain.
+# WARNING: Do not touch it unless you're configuring freshclam to use your
+# own database verification domain.
+# Default: current.cvd.clamav.net
+#DNSDatabaseInfo current.cvd.clamav.net
+
+# Uncomment the following line and replace XY with your country
+# code. See http://www.iana.org/cctld/cctld-whois.htm for the full list.
+#DatabaseMirror db.XY.clamav.net
+
+# database.clamav.net is a round-robin record which points to our most 
+# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is 
+# not working. DO NOT TOUCH the following line unless you know what you
+# are doing.
+DatabaseMirror database.clamav.net
+
+# How many attempts to make before giving up.
+# Default: 3 (per mirror)
+#MaxAttempts 5
+
+# With this option you can control scripted updates. It's highly recommended
+# to keep it enabled.
+# Default: yes
+#ScriptedUpdates yes
+
+# By default freshclam will keep the local databases (.cld) uncompressed to
+# make their handling faster. With this option you can enable the compression;
+# the change will take effect with the next database update.
+# Default: no
+#CompressLocalDatabase no
+
+# Number of database checks per day.
+# Default: 12 (every two hours)
+#Checks 24
+
+# Proxy settings
+# Default: disabled
+#HTTPProxyServer myproxy.com
+#HTTPProxyPort 1234
+#HTTPProxyUsername myusername
+#HTTPProxyPassword mypass
+
+# If your servers are behind a firewall/proxy which applies User-Agent
+# filtering you can use this option to force the use of a different
+# User-Agent header.
+# Default: clamav/version_number
+#HTTPUserAgent SomeUserAgentIdString
+
+# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
+# multi-homed systems.
+# Default: Use OS'es default outgoing IP address.
+#LocalIPAddress aaa.bbb.ccc.ddd
+
+# Send the RELOAD command to clamd.
+# Default: no
+#NotifyClamd /path/to/clamd.conf
+
+# Run command after successful database update.
+# Default: disabled
+#OnUpdateExecute command
+
+# Run command when database update process fails.
+# Default: disabled
+#OnErrorExecute command
+
+# Run command when freshclam reports outdated version.
+# In the command string %v will be replaced by the new version number.
+# Default: disabled
+#OnOutdatedExecute command
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Timeout in seconds when connecting to database server.
+# Default: 30
+#ConnectTimeout 60
+
+# Timeout in seconds when reading from database server.
+# Default: 30
+#ReceiveTimeout 60
+
+# When enabled freshclam will submit statistics to the ClamAV Project about
+# the latest virus detections in your environment. The ClamAV maintainers
+# will then use this data to determine what types of malware are the most
+# detected in the field and in what geographic area they are.
+# This feature requires LogTime and LogFile to be enabled in clamd.conf.
+# Default: no
+#SubmitDetectionStats /path/to/clamd.conf
+
+# Country of origin of malware/detection statistics (for statistical
+# purposes only). The statistics collector at ClamAV.net will look up
+# your IP address to determine the geographical origin of the malware
+# reported by your installation. If this installation is mainly used to
+# scan data which comes from a different location, please enable this
+# option and enter a two-letter code (see http://www.iana.org/domains/root/db/)
+# of the country of origin.
+# Default: disabled
+#DetectionStatsCountry country-code
+
+# This option enables support for our "Personal Statistics" service. 
+# When this option is enabled, the information on malware detected by
+# your clamd installation is made available to you through our website.
+# To get your HostID, log on http://www.stats.clamav.net and add a new
+# host to your host list. Once you have the HostID, uncomment this option
+# and paste the HostID here. As soon as your freshclam starts submitting
+# information to our stats collecting service, you will be able to view
+# the statistics of this clamd installation by logging into
+# http://www.stats.clamav.net with the same credentials you used to
+# generate the HostID. For more information refer to:
+# http://www.clamav.net/support/faq/faq-cctts/
+# This feature requires SubmitDetectionStats to be enabled.
+# Default: disabled
+#DetectionStatsHostID unique-id
+
+
+
+# This option enables support for Google Safe Browsing. When activated for
+# the first time, freshclam will download a new database file (safebrowsing.cvd)
+# which will be automatically loaded by clamd and clamscan during the next
+# reload, provided that the heuristic phishing detection is turned on. This
+# database includes information about websites that may be phishing sites or
+# possible sources of malware. When using this option, it's mandatory to run
+# freshclam at least every 30 minutes.
+# Freshclam uses the ClamAV's mirror infrastructure to distribute the
+# database and its updates but all the contents are provided under Google's
+# terms of use. See http://code.google.com/support/bin/answer.py?answer=70015
+# and http://safebrowsing.clamav.net for more information.
+# Default: disabled
+#SafeBrowsing yes
+#
+
+# This option enables downloading of bytecode.cvd, which includes additional
+# detection mechanisms and improvements to the ClamAV engine.
+# Default: enabled
+#Bytecode yes

roles/clamav/tasks/main.yml

@@ -0,0 +1,42 @@
+---
+# tasklist for setting up a ClamAV scanner
+#
+# The following variables control the scan:
+# - clamscan_mailto
+# - clamscan_paths
+# - clamscan_excludes (optional)
+#
+# The following variables control scheduling of the cron job:
+# - clamscan_minute (optional)
+# - clamscan_hour (optional)
+# - clamscan_day (optional)
+# - clamscan_month (optional)
+# - clamscan_weekday (optional)
+
+- name: install the needed packages
+  yum: pkg={{item}} state=present
+  with_items:
+  - clamav
+  - clamav-db
+  - cronie-anacron
+
+- name: setup the freshclam configuration
+  copy: src=freshclam.conf dest=/etc/freshclam.conf
+
+- name: setup the freshclam cron job
+  copy: src=freshclam-cron dest=/etc/cron.daily/freshclam
+
+- name: setup the periodic clam scan
+  template: >
+    src=clamscan.sh.j2
+    dest=/usr/local/bin/clamscan.sh
+    mode=0755
+  cron: >
+    name="clamscan"
+    minute={{ clamscan_minute | default(35) }}
+    hour={{ clamscan_hour | default(4) }}
+    day={{ clamscan_day | default(*) }}
+    month={{ clamscan_month | default(*) }}
+    weekday={{ clamscan_weekday | default(5) }}
+    job="/usr/local/bin/clamscan.sh"
+    cron_file="ansible-clamscan"

roles/clamav/templates/clamscan.sh.j2

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# Scans various directories for baddies
+# Fri Jul 22 2011 athmane: modified to scan files older than $DAYS days
+
+LOGFILE="/var/log/clamscan.log"
+MAILTO="{{ clamscan_mailto }}"
+DAYS=7
+FILELIST="/tmp/clamscan_filelist.$$"
+
+rm -f $LOGFILE
+
+# Build file list to scan
+{% for path in clamscan_paths %}
+find {{ path }} -ctime -${DAYS} -type f >> $FILELIST
+{% endfor %}
+
+/bin/nice -5 /usr/bin/clamscan --infected --quiet --file-list=$FILELIST --log=$LOGFILE \
+{% for path in clamscan_excludes|default([]) %}
+--exclude={{ exclude }} \
+{% endfor %}
+2> /dev/null
+
+RESULT=$?
+
+if [ "$RESULT" -eq "1" ]
+then
+    mail -s "Virus found! on $(hostname)" $MAILTO -- < $LOGFILE
+fi
+
+if [ "$RESULT" -eq "2" ]
+then
+    mail -s "Virus scanning error on $(hostname)" $MAILTO -- < $LOGFILE
+fi
+
+rm -f $FILELIST