71 lines
3.1 KiB
Bash
71 lines
3.1 KiB
Bash
#!/usr/bin/env bash
|
|
# policy: dev_security-scan — daily ClamAV + rkhunter + chkrootkit scans + SMB upload at 02:00.
|
|
# Applied when host is member of dev_security-scan host-group.
|
|
|
|
SCAN_CRON="$CRON_DIR/ansipa-security-scan"
|
|
SCAN_SCRIPT="/usr/local/bin/ansipa-security-scan.sh"
|
|
|
|
if [[ "$WANT_SECURITY_SCAN" == true ]]; then
|
|
# (Re-)write the scan script so it stays current with this version of the enforcer.
|
|
cat > "$SCAN_SCRIPT" <<'SCAN'
|
|
#!/bin/bash
|
|
# ansipa-security-scan — daily ClamAV / rkhunter / chkrootkit run + SMB upload.
|
|
# Managed by ansipa-enforce-policies — do not edit manually.
|
|
LOG=/var/log/ansipa-security-scan.log
|
|
# `hostname` (inetutils) may be absent on minimal Arch; resolve without it.
|
|
HOSTNAME=$( { command -v hostname >/dev/null 2>&1 && hostname -f 2>/dev/null; } \
|
|
|| hostnamectl --static 2>/dev/null || cat /etc/hostname 2>/dev/null \
|
|
|| cat /proc/sys/kernel/hostname 2>/dev/null )
|
|
DATE=$(date +%Y-%m-%d)
|
|
{
|
|
echo "=== ansipa-security-scan: $DATE $HOSTNAME ==="
|
|
|
|
if command -v freshclam &>/dev/null; then
|
|
freshclam --quiet 2>/dev/null || true
|
|
fi
|
|
if command -v clamscan &>/dev/null; then
|
|
clamscan -r --infected --quiet /home /etc /tmp /var/tmp 2>/dev/null || true
|
|
fi
|
|
if command -v rkhunter &>/dev/null; then
|
|
rkhunter --update --quiet 2>/dev/null || true
|
|
rkhunter --check --skip-keypress --quiet 2>/dev/null || true
|
|
fi
|
|
if command -v chkrootkit &>/dev/null; then
|
|
chkrootkit 2>/dev/null || true
|
|
fi
|
|
|
|
echo "=== scan complete ==="
|
|
} >> "$LOG" 2>&1
|
|
|
|
# ── Upload to server SMB share ────────────────────────────────────────────────
|
|
IPA_SERVER=$(awk '/^server[[:space:]]*=/{print $3}' /etc/ipa/default.conf 2>/dev/null || echo "")
|
|
if [[ -n "$IPA_SERVER" ]] && [[ -f /etc/ansipa-smb.creds ]] && command -v smbclient &>/dev/null; then
|
|
# Create host archive dir (mkdir is idempotent; errors suppressed).
|
|
smbclient "//$IPA_SERVER/ansipa-scans" -A /etc/ansipa-smb.creds \
|
|
-c "mkdir archive; mkdir archive\\$HOSTNAME; put $LOG archive\\$HOSTNAME\\$DATE.log" \
|
|
>> "$LOG" 2>&1 \
|
|
&& echo "[ansipa] Scan results uploaded to $IPA_SERVER/ansipa-scans/archive/$HOSTNAME/$DATE.log" >> "$LOG" \
|
|
|| echo "[ansipa][WARN] SMB upload failed — results remain local at $LOG" >> "$LOG"
|
|
else
|
|
echo "[ansipa] SMB upload skipped (no credentials or smbclient not found)." >> "$LOG"
|
|
fi
|
|
SCAN
|
|
chmod 755 "$SCAN_SCRIPT"
|
|
|
|
if [[ ! -f "$SCAN_CRON" ]]; then
|
|
log "Enabling daily security scans (ClamAV / rkhunter / chkrootkit)"
|
|
cat > "$SCAN_CRON" <<'CRON'
|
|
# ansipa-dev_security-scan: managed by ansipa-enforce-policies — do not edit manually.
|
|
# Install scan tools by adding the host to the dev_mod_anti-malware group.
|
|
0 2 * * * root /usr/local/bin/ansipa-security-scan.sh
|
|
CRON
|
|
chmod 644 "$SCAN_CRON"
|
|
fi
|
|
else
|
|
if [[ -f "$SCAN_CRON" ]]; then
|
|
rm -f "$SCAN_CRON"
|
|
rm -f "$SCAN_SCRIPT"
|
|
log "Removed security scan policy (host left dev_security-scan group)"
|
|
fi
|
|
fi
|