Внедрение KESL на ВМ2 + замена CLAMAV на KESL

2026-09-08 01:39:37 +03:00
parent 85df788f2d
commit fdfdeaffb4
43 changed files with 2210 additions and 329 deletions
@@ -0,0 +1,62 @@
+# Reference decisions for KESL 12.4 on HAN Processing VM2.
+# Do not import this partial file into KESL. Export the installed-build
+# settings, review them, and apply individual values from RUNBOOK.KESL.ru.md.
+
+[deployment]
+product_major_minor=12.4
+mode=standard_standalone
+gui=disabled
+update_source=KLServers
+interceptor=fanotify
+network_features=disabled
+ksn=<Yes_OR_No_AFTER_SECURITY_AND_LEGAL_APPROVAL>
+
+[resource_budget]
+# VM2 starts at 8 GiB RAM. Values require measured baseline and coexistence gate.
+scan_memory_limit_mb=<1024_OR_APPROVED_VALUE>
+max_memory=<2048MB_OR_APPROVED_VALUE>
+use_on_demand_cpu_limit=Yes
+on_demand_cpu_limit_percent=<APPROVED_VALUE>
+
+[update_task_6]
+rule_type=Hourly
+required_result=completed_successfully
+required_bases_loaded=Yes
+stale_bases_alert_hours=240
+
+[file_threat_protection_task_1]
+steady_state=Started
+action_on_threat=DisinfectDeleteIfNotPossible
+scan_archived=No
+
+[message_safety_broker]
+socket=/run/han-kesl/scan.sock
+max_file_bytes=5242880
+scan_action=Inform
+fail_closed=Yes
+staging=/var/lib/han-kesl-scan/staging
+# Do not add staging to ExcludedFromScanScope: KESL Scan_File can skip it.
+staging_exclusion=forbidden
+explicit_scan_before_allow=required
+
+[allowed_hot_data_exclusions]
+item_0000=<REDIS_SAFETY_DATA_MOUNTPOINT>
+item_0001=<OTEL_QUEUE_MOUNTPOINT>
+
+[forbidden_broad_exclusions]
+item_0000=/var/lib/docker
+item_0001=/var/lib/docker/overlay2
+item_0002=/opt/han-chat
+item_0003=/var/lib/han-deploy/incoming
+item_0004=/etc/han
+item_0005=/run/han-chat
+item_0006=/tmp
+item_0007=/
+
+[acceptance]
+host_on_access_eicar=required
+broker_clean_eicar_error=required
+automatic_hourly_update_observed=required
+message_safety_200_403_503=required
+performance_two_files_per_second=required
+resource_comparison_24h=required