107 lines
3.4 KiB
YAML
107 lines
3.4 KiB
YAML
---
|
|
- name: Installation et configuration du clamAV
|
|
hosts: infra
|
|
become: true
|
|
gather_facts: true
|
|
tasks:
|
|
- name: Vérifier si ClamAV existe dans les dépôts
|
|
ansible.builtin.command: apt-cache search ^clamav$
|
|
register: clamav_search
|
|
changed_when: false
|
|
|
|
- name: Afficher résultat
|
|
ansible.builtin.debug:
|
|
var: clamav_search.stdout
|
|
|
|
- name: Installer ClamAV si disponible
|
|
ansible.builtin.apt:
|
|
name:
|
|
- clamav
|
|
- clamav-daemon
|
|
state: present
|
|
update_cache: true
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Démarrer ClamAV
|
|
ansible.builtin.service:
|
|
name: clamav-daemon
|
|
state: started
|
|
enabled: true
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Arrêter clamav-freshclam avant la mise à jour
|
|
ansible.builtin.service:
|
|
name: clamav-freshclam
|
|
state: stopped
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Mettre à jour la base de données virale (freshclam)
|
|
ansible.builtin.command: freshclam
|
|
register: freshclam_result
|
|
changed_when: "'Database updated' in freshclam_result.stdout"
|
|
failed_when: freshclam_result.rc != 0
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Redémarrer clamav-freshclam après la mise à jour
|
|
ansible.builtin.service:
|
|
name: clamav-freshclam
|
|
state: started
|
|
enabled: true
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Configurer ClamAV - activer la détection PUA
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/clamav/clamd.conf
|
|
regexp: "^#?DetectPUA"
|
|
line: "DetectPUA yes"
|
|
backup: true
|
|
when: clamav_search.stdout != ""
|
|
notify: Redémarrer clamav-daemon
|
|
|
|
- name: Configurer ClamAV - activer les logs
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/clamav/clamd.conf
|
|
regexp: "^#?LogFile "
|
|
line: "LogFile /var/log/clamav/clamav.log"
|
|
backup: true
|
|
when: clamav_search.stdout != ""
|
|
notify: Redémarrer clamav-daemon
|
|
|
|
- name: Configurer ClamAV - taille max des fichiers scannés
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/clamav/clamd.conf
|
|
regexp: "^#?MaxFileSize"
|
|
line: "MaxFileSize 100M"
|
|
backup: true
|
|
when: clamav_search.stdout != ""
|
|
notify: Redémarrer clamav-daemon
|
|
|
|
- name: Planifier un scan quotidien via cron
|
|
ansible.builtin.cron:
|
|
name: "ClamAV daily scan"
|
|
minute: "30"
|
|
hour: "2"
|
|
job: >
|
|
ionice -c 3 nice -n 19
|
|
docker exec gestion-clamav
|
|
clamscan -r /home /tmp /app/uploads
|
|
--log=/var/log/clamav/daily_scan.log --quiet
|
|
user: root
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Afficher résultat final
|
|
ansible.builtin.debug:
|
|
msg: "ClamAV installé et configuré avec succès"
|
|
when: clamav_search.stdout != ""
|
|
|
|
- name: Afficher message si ClamAV non disponible
|
|
ansible.builtin.debug:
|
|
msg: "ClamAV n'est pas disponible dans les dépôts"
|
|
when: clamav_search.stdout == ""
|
|
|
|
handlers:
|
|
- name: Redémarrer clamav-daemon
|
|
ansible.builtin.service:
|
|
name: clamav-daemon
|
|
state: restarted
|