Merge pull request #18 from alphagov/add-apt

Add `apt`, configure `unattended-upgrades`
Add alphagov/clamav module to Puppetfile

Adds the alphagov/clamav module to Puppetfile. We're eating our own dog food here.
Add `base::clamav` and `clamav` classes to Hiera

To use the `alphagov/clamav` package and the `base::clamav` class to control
configuration, we need to add it to Hiera as we're using Hiera as a
lightweight ENC in this instance.
Add /srv/infected directory

The /srv/infected directory is used by ClamAV to move infected files to in
7660f5d. This change ensures that the directory exists.
Add shell script to scan /srv/backup-data

This commit adds a shell script to scan the contents of /srv/backup-data, log
output to a specified .log file, and move infected data to /srv/infected
Add clamav.pp manifest to control ClamAV scanning

This commit adds a manifest (clamav.pp) to Puppet in order to control ClamAV.
The manifest itself does not directly run ClamAV, but rather it contains a cron
type to run a shell script at a random number of minutes (between 0 and 60) past
every hour.
Amend binary

@dcarley is correct; the binary was incorrect.
Move /srv/infected dir to clamav.pp; set require

Move /srv/infected directory to clamav.pp and set a require param on the File
type for the shell script.
Add logrotate support

The scan-backup-data.sh script logs output to a file in /var/log. By default,
this file will then be allowed to grow indefinitely. We should curtail this by
using logrotate.

This commit adds a logrotate configuration for `/var/log/clamav/clamdscan.log',
which:

- sets the log rotation to daily
- keeps the prior seven days of logs
- compresses stored logs with gzip
- delays compression until next rotation
- doesn't halt on error
- avoids log rotation if the file is empty
- creates a new file after rotation

It also ensures the file is present in the clamav.pp Puppet manifest.
Amends rotation intervals

The comments in this file are already well documented; they serve little purpose
in-line in the file, and add extra overhead if the commands are ever changed.

The rotation interval has been changed to weekly; we keep a year's worth (52
weeks) of logs before logrotate rotates them. This was done for security
purposes.
Amend clamscan program

In it's original form, this script used `clamdscan`, rather than `clamscan`.
During testing, however, it was realised that the script died as `clamdscan` was
unable to access `/srv/infected`.

By default, AppArmor restricts the behaviour of the clamdscan executable, and
investigation using `aa-status` showed that AppArmor was holding `clamdscan` in
enforce mode. I amended AppArmor to put `clamdscan` in to complain mode
(allowing the executable to run, and logging errors, rather than disallowing it
to run entirely). This then allowed `clamdscan` to run successfully.

However, a second issue then arose: `/srv/backup-data/lost+found` was
unaccessible. `clamdscan` doesn't support the --exclude switch, whereas `clamscan`
does. To that end, the command has been changed to support `clamscan`, thereby
allowing us to exclude `lost+found` as we do not particularly care about data
stored within that folder. Unfortunately, `clamdscan` did not like the use of
the `--exclude` switch.

`clamscan` and `clamdscan` have subtle differences, it seems. The former is
meant to be run as one-off and in cron jobs; the latter is daemonized. The
former also processes the virus definitions each time it runs; the latter does
not.

After it was realised that simply changing the command from `clamdscan` to
`clamscan` allowed us to use the `--exclude` switch, I then tested to see if the
AppArmor changes were still required. It turns out that they were not - using
`clamscan` over `clamdscan` was the overall fix to the issue, and the AppArmor
changes were reverted.
Merge pull request #19 from alphagov/add-clam

Add ClamAV
Add `harden` module to Puppetfile

Harden is a Puppet module to secure a base installation of Ubuntu. Details can
be found at http://github.com/alphagov/puppet-harden. This commit adds Harden to
the Puppetfile to secure the host machine.
Adds 'harden' class to Hiera

In order to make use of 2c58258, we need to add the `harden` class to Hiera, as
this repository uses Hiera as a lightweight ENC.
Add blom/rssh module to Puppetfile

rssh (http://www.pizzashack.org/rssh) is a restricted shell for use with
OpenSSH. It allows us to lock down which programs can be run by which users from
the shell.

This commit adds the rSSH module in to the Puppetfile.
Allows rsync in rssh

The rssh Puppet module was added in be7e918, so this commit adds an rssh.pp
manifest in order to configure rssh.

This commit adds an `allow` attribute to the rssh class in order to specify that
only rsync should be allowed. Full details on the values the `allow` attribute
can accept are at https://forge.puppetlabs.com/blom/rssh.
Add rssh to packages manifest

This commit adds the `rssh` module to the packages manifest to ensure that rssh
is present when a Puppet run completes. If it is not present, Puppet installs
it.
Adds base::packages to Hiera

In order to use the packages.pp manifest, we need to add it to the list of
classes autoloaded by Puppet, which is defined within an array in Hiera. This
commit adds the `base::packages` class to the Hiera array.
Add `attachmentgenie/ssh` module to Puppetfile

This commit adds the `attachmentgenie/ssh` module to the Puppetfile. We use this
module due to the level of customisation it affords to us.
Add SSH class to Hiera

This commit adds the 'attachmentgenie/ssh' module to the list of classes used in
Hiera. We add this here as we are using Hiera as a lightweight ENC, rather than
the more traditional method of creating an `init.pp` file.

The module contains two classes - `ssh::client` and `ssh::server`. Adding
`ssh::server` in to Hiera to begin with - we can add the client if we decide to
change how we run rsync (currently push-based).