|
Server : Apache System : Linux cvar2.toservers.com 3.10.0-962.3.2.lve1.5.73.el7.x86_64 #1 SMP Wed Aug 24 21:31:23 UTC 2022 x86_64 User : njnconst ( 1116) PHP Version : 8.4.18 Disable Function : NONE Directory : /proc/self/root/opt/alt/python37/lib/python3.7/site-packages/__pycache__/ |
Upload File : |
B
��cQ� �
@ s d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl m Z d dl
mZ d dlZd dlmZ d dlmZmZmZmZ d dlZd dlmZmZ d d l m Z m Z d d
l m Z d d l!m"Z" d d l#m$Z$ d d
l%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl m2Z2 d dl3m4Z4 d dl5m6Z6m7Z7 d dl8Z8dZ9dZ:dZ;dZ<dZ=dZ>dZ?dZ@de@� �ZAd ZBd ZCd ZDe d d d!g�ZEd"d#d#d#d#d#d#d#d#d$� ZFd%d&d'd&d&d&d&d&d&d$� ZGeH� ZId(d)eGd*�eId+< d,d-eFd*�eId.< d/ZJd0ZKd1d2� ZLd�d4d5�ZMd�d7d8�ZNd9d:� ZOd;d<� ZPeLd=�ePd>d?� ��ZQeeReeS f d@�dAdB�ZTdCdD� ZUeLdE�dFdG� �ZVeSeSeEdH�dIdJ�ZWeLdK�ePeUdLdM� ���ZXeLdN�ePeUdOdP� ���ZYeLdQ�ePeUdRdS� ���ZZeLdT�ePeUdUdV� ���Z[eLdW�dXdY� �Z\eLdZ�ePd[d\� ��Z]d]d^� Z^eLd_�ePd`da� ��Z_eLdb�ePdcdd� ��Z`eLde�ePdfdg� ��ZaeLdh�ePdidj� ��ZbeLdk�ePdldm� ��ZceLdn�ePdodp� ��ZdeLdq�ePdrds� ��ZeeLdt�ePdudv� ��ZfdwZgdxZhdydzd{d|d}d~gZidd�d�gZjd�d�� Zkd�d�� Zld�d�� ZmeLd��ePd�d�� ��ZneLd��ePd�d�� ��ZoeLd��ePd�d�� ��Zpd�d�� ZqeSeeS d��d�d��Zresd@�d�d��Ztesd@�d�d��ZueSesd��d�d��ZveeS d@�d�d��Zwd�d�� Zxd�d�� ZyeLd��ePd�d�� ��Zzd�d�d��Z{eRd@�d�d��Z|eee d@�d�d��Z}eee dd��d�d��Z~eLd��ePd�d�� ��ZeLd��ePeEd@�d�d����Z�dS )�� )�print_function)�absolute_importN)�
namedtuple)�Path)�wraps)�AnyStr�List�Optional�Tuple)�DEFAULT_JWT_ES_TOKEN_PATH�DISABLE_CMT_FILE)�is_cl_solo_edition�CLEditionDetectionError)�jwt_token_check)�RHN_CHECK_FILE)�LimitsValidator)�ExternalProgramFailed� service_is_enabled_and_present� run_command�process_is_running�is_litespeed_running�demote)�is_cmt_disabled�is_client_enabled)�
WhmApiRequest� WhmApiError)� is_ubuntu)�get_pkg_version)�ClPwd�drop_privileges�OK�FAILED�SKIPPED�INTERNAL_TEST_ERRORz/https://docs.cloudlinux.com/command-line_tools/Z disabled_cldiag_cron_checkersZ cldiag_cronz5https://docs.cloudlinux.com/cloudlinux-os-plus/#faq-2z Link to FAQ and troubleshooting zWPlease write to support https://cloudlinux.zendesk.com/ if you can't resolve the issue.zCentralized Monitoringz;This checker is not supported on CloudLinux OS Solo edition� ChkResult�res�msgz /usr/local/apache/bin/suexecz/usr/sbin/suexec) �cPanelZ
cPanel_ea4� DirectAdminZPleskZ
ISPManagerZ InterWorxzH-SphereZ HostingNG�Unknownz/opt/suphp/sbin/suphpz/usr/sbin/suphpz/usr/local/suphp/sbin/suphpZSuPHPzdetect.get_suPHP_status())�name�status_function�location�suphpZSuEXECzdetect.get_suEXEC_status()�suexecz/var/lve/cldiag_userZ
cldiaguserc s � fdd�}|S )Nc s
� | _ | S )N)� pretty_name)�func)�name_of_checker� �:/opt/alt/python37/lib/python3.7/site-packages/cldiaglib.py� decorators s z pretty_name.<locals>.decoratorr2 )r1 r4 r2 )r1 r3 r/ r s r/ Fc
C s� d}d}|r,dd� | D �}||d< t �|�S g }xX| D ]P\}}}|� d|j� d|j� �} |dk r|| � d |� d
|� d |� d �} |�| � q6W d
�|d|� d�g �}|S )z2
Formatter of output from all of checkers
z)Command for disabling this cron checker: z cldiag --disable-cron-checkersc S s i | ]\}}}|� � |�qS r2 )�_asdict)�.0�checker_pretty_name�_�
chk_resultr2 r2 r3 �
<dictcomp>� s z _formatter.<locals>.<dictcomp>Z total_errorsz:
z: N�
z "� �"z
z
There are z errors found.)�json�dumpsr% r& �append�join)
�dataZ error_count�to_jsonr& Zcmd_tmpr% r7 Zchecker_public_namer9 Zchecker_resultr2 r2 r3 �
_formattery s
rD Tc C s� t | �r| g} g }d}x�| D ]x}y
|� }W n0 tk
rZ } zttt|��}W d d }~X Y nX |jttfkrr|d7 }|�|jt |d�r�|j
nd |f� q W t |||�}|r�t |� t
|� ||fS )Nr � � public_name)�callable� Exceptionr$ r# �reprr% r! r@ r/ �hasattrrF rD �print�exit) ZcheckersrC Zdo_exit�results�errors�fr9 �er% r2 r2 r3 �runner� s(
rQ c C s0 yt | �S tk
r* td�| �� dS X d S )Nz,WARNING
missing {} function in cldetectlib.F)�eval�AttributeErrorrK �format)r0 r2 r2 r3 �wrapper� s
rU c s t � �� fdd��}|S )Nc s@ yt dd�}W n tk
r& d}Y nX |r6ttt�S � | |�S )NT)�skip_jwt_checkF)r
r r$ r" �SKIPPED_ON_SOLO_MSG)�args�kwargsZis_solo_edition)rO r2 r3 �checker� s
z(skip_checker_on_cl_solo.<locals>.checker)r )rO rZ r2 )rO r3 �skip_checker_on_cl_solo� s r[ z Check cagefsc C s
t td�S )NzuCagefs version is too old. Please run cagefsctl --sanity-check directly or upgrade it to have full cldiag integration)r$ r" r2 r2 r2 r3 �fake_cagefs_checker� s r\ )�returnc C s� t � d�} dt � dt� d�}d}ddlm} |� }|dk rJ|d sJd
|fS |dkrjt� \}}}|sj||fS t� rxd
|fS t� s�d
| fS d S ) am
Check that a server is cl+, enabled and CM isn't disabled locally
The function returns True if the client has CL+ license, didn't disable CM
localy and activated CM on https://cm.cloudlinux.com. The function also
returns True if we can't read or parse JWT token, because
we want to continue and show to client CM related errors
z. is not activated on https://cm.cloudlinux.comzThe z& is disabled localy by creating file "r= z The server has no CL+ licenser )� get_client_data_from_jwt_tokenNZcl_plusF)TN)� cm_full_namer �clsummary.cl_summary_utilsr^ r r r )Zcm_is_not_activated_msgZcm_is_disabled_localy_msgZno_cl_plus_license_msgr^ � jwt_tokenZis_valid�messager8 r2 r2 r3 �_is_cmt_allowed_for_server� s
rc c s t � �� fdd��}|S )zi
Decorator: Skip check if a server isn't cl+, disabled and
CM is disabled locally
c s& t � \}}|r� | |�S tt|�S dS )z$
Decorated function
N)rc r$ r" )rX rY �resultrb )rO r2 r3 �decorated_function� s
z@skip_if_cmt_not_used_enabled_allowed.<locals>.decorated_function)r )rO re r2 )rO r3 �$skip_if_cmt_not_used_enabled_allowed� s
rf zCheck existing JWT tokenc C s� d} dt � dt� dt� dt� �}d}ddlm} tj�t �r�t � \}}}|rd|� }t
t d |� d
��S ||krvt
t d �S |d }t
t
|� d|� ��S nt
t || �S d
S )z%
Check an existing JWT token
zR Absence of JWT token is normal for the clients with volume license like GoDaddy. z$Please check for JWT token in path "zr". %sTry running "rhn_check" for getting a new token if it is absent. Server can't collect and send statistics to z( if you don't have a correct JWT token. z. z"JWT token doesn't have CL+ servicer )r^ zJWT token is valid: "r= z The server has no CL+ license� N)r r_ �cl_plus_doc_msg�write_to_support_msgr` r^ �os�path�existsr r$ r r" r! )Ztoken_is_absent_msgZmain_msgZtoken_is_not_cl_plusr^ rd rb r8 ra r2 r2 r3 �check_jwt_token s( rm )� service_name�process_file_pathr] c C s� t | �\}}yt|d�}W n tk
r2 d}Y nX |rR|rR|rRttd| � d��S g }|sd|�d� |sr|�d� |s�|�d� ttd�|�� dt� d | � d
t � d t
� � �S d S )
z�
Check that a service is present, enabled and active
:param service_name: name of a service
:param process_file_path: path to a file which is run by a service
Fz Service "z " is present, enabled and activezService is not present.zService is not enabled.zService is not active.r< z1 The server can't collect and send statistics to z if service z$ isn't present, enabled and active. z. N) r r �FileNotFoundErrorr$ r r@ r! rA r_ rh ri )rn ro Z
is_presentZ
is_enabledZ is_activeZmessagesr2 r2 r3 �_check_service_state+ s&
rq z=Check service `cl_plus_sender` is present, enabled and activec C s ddl m} d}t|| �S )zL
Check that service `cl_plus_sender` is present, enabled and active
r )�CL_PLUS_SENDER_FILE_PATHZcl_plus_sender)r` rr rq )rr rn r2 r2 r3 � check_cl_plus_sender_serviceO s rs z<Check service `node_exporter` is present, enabled and activec C sH d} d}t j�t j�| d��s4t j�t j�| d��r:d}nd}t||�S )a
Check that service `node_exporter` or `cl_node_exporter` is present,
enabled and active
Since it was renamed node_exporter -> cl_node_exporter
let`s handle both cases:
- old `node_exporter` service
- renamed `cl_node_exporter` service
z&/usr/share/cloudlinux/cl_plus/service/z+/usr/share/cloudlinux/cl_plus/node_exporterZcl_node_exporterzcl_node_exporter.serviceZ
node_exporter)rj rk rl rA rq )Zbase_service_pathro rn r2 r2 r3 �check_node_exporter_service\ s rt z7Check service `lvestats` is present, enabled and activec C s d} d}t | |�S )zF
Check that service `lvestats` is present, enabled and active
Zlvestatsz'/usr/share/lve-stats/lvestats-server.py)rq )rn ro r2 r2 r3 �check_lvestats_services s ru zeCheck that the server has the minimal required packages for correct working of Centralized Monitoringc C sF x:dD ]2} t | �dkrttd| � dt� dt� dt� ��S qW ttd�S )zD
Check that the server has minimal required packages for CM
)zcl-end-server-toolszcl-node-exporterNz!System doesn't have the package "z". It's required for zA feature to work and it usually installed automatically by cron. z. zVSystem has the minimal required packages for correct working of Centralized Monitoring)r r$ r! r_ rh ri r )Z package_namer2 r2 r3 �check_cmt_packages s
"rv zACheck control panel and it's configuration (for DirectAdmin only)c C s� d� td �} t�� t�� }|dkr0ttd�S d� |tj�}tdd�sz|dkrzt� � rftt
|d �S tt |d
| �S n
tt
|�S d S ) NzY Fixing the issue will provide CloudLinux support on your control panel.
See details: {}z#diag-cpr) zCan't detect contol panelz Control Panel - {}; Version {};T)rV r( z File "options.conf" is finez1 File "options.conf" has no line "cloudlinux=yes") rT �cldiag_doc_link�detectZgetCP� getCPNamer$ r" Z
CP_VERSIONr
Zda_check_optionsr r! )�fix_motivationZcp_nameZres_msgr2 r2 r3 �
check_cp_diag� s
r{ zDCheck fs.enforce_symlinksifowner is correctly enabled in sysctl confc
C s� d� td �} t�� r ttd�S y t�� }W n< tk
rh } z d}ttd� t t
|�|���S d }~X Y nX |dkr�ttd| �S tt d� |��S ) Nz� Fixing that issue makes server more secure against symlink attacks and enables protection of PHP configs or other sensitive files.
See details: {}z#symlinksifownerz$Not supported for OpenVZ environmentz+To see full error run /sbin/sysctl --systemzlSome parameter in sysctl config has wrong configuration. Error: {} It`s recommended to fix it and try again � z fs.enforce_symlinksifowner = 2z fs.enforce_symlinksifowner = {}) rT rw rx � is_openvzr$ r" Zget_symlinksifownerr r! �get_short_error_message�strr )rz Zsymlinks_if_ownerrP � detailed_outr2 r2 r3 �check_symlinksifowner� s
r� c C s� | d � � }td | }d�||�}tj�d�s:ttd�S t| d �sZttd�| d ��S t �
| d �}|d kr�ttd �| d ��S |s�tt d
| �S tt d �S ) Nr* z#check-z� Fix that issue to be sure that users run their sites inside CageFS and provide stable work of sites that are using apache {} module. This may improve server security
See details: {}z/usr/sbin/cagefsctlzCagefs is not installedr+ z{} is not enabledr, zgUnable to check {} module binary for custom control panel. This feature may be added in future updates.zBinary without CageFS jail zbinary has jail)
�lowerrw rT rj rk rl r$ r" rU rx Zcheck_binary_has_jailr! r )ZparamsZ module_name�linkrz Zhas_jailr2 r2 r3 � binary_check� s
r� z Check suexec has cagefs jailc C s( t �� rt� rttd�S ttd �S d S )NuV Сurrent PHP selector uses LiteSpeed, which doesn't require the patches in suEXEC bin.r. )rx �detect_litespeedr r$ r" r� �BINARY_CHECK_PARAMETERSr2 r2 r2 r3 � check_suexec� s
r� zCheck suphp has cagefs jailc C s t td �S )Nr- )r� r� r2 r2 r2 r3 � check_suphp� s r� z$Check UsePAM in /etc/ssh/sshd_configc C sH d� td �} t�� }|d kr(ttd�S |r6ttd�S ttd| �S d S )NziFix the issue to provide correct work of pam_lve module with sshd and CageFS ssh sessions
See details: {}z
#check-usepamz&Unable to open SSHd configuration filezConfig is finez Line "UsePAM yes" is missing )rT rw rx Zcheck_SSHd_UsePAMr$ r" r r! )rz Z check_resultr2 r2 r3 �
check_use_pam� s
r� z*Check the validity of LVE limits on serverc C sF d} d| }d}t � }|�� }|dkr0tt|�S tt|d | �S dS )z
Validate lve limits
z6https://docs.cloudlinux.com/lve-limits-validation.htmlz'Invalid LVE limits on server. See doc: zValid LVE limits on server.Nr; )r Zvalidate_existing_limitsr$ r r! )�doc_link�failed_message�passed_messageZlimits_validatorrd r2 r2 r3 �check_lve_limits� s
r� z$Check compatibility for PHP Selectorc
sn d} d� td �}t� }|r&ttd�S tj�d�s<ttd�S t� � rXt
� rXtt | d �S dddd �� d
}d }tj�|��rty(t |d �}d
d� |�
� D �}|�� W n< tk
r� } z d|t|�f }tt|| �S d
}~X Y nX x@|D ]"} | �d�r�| �d�d �� }
P q�W d| }tt|| �S x0|D ](} | �d|
��r(| �d�d �� }�q(W |dk�rtd| }tt|| �S t�� } | d
k �r�d| k�r�tt|d �S d| k� d< d| k� d < d | k� d < t� d � d g��s�tt|d �S � d �s� d �r2|d k�r2d!|d"�� fd#d$�� D ��f } tt | | �S d%|d
k�rBd&n|d"�� fd'd$�� D ��f }tt|| �S )(z�
1. mod_ruid not present
2. suphp
3. mod_lsapi
4. suexec and (fcgi or cgi)
5. litespeed
6. do not support other
zIt looks ok [%s]z�Looks like your PHP handler doesn't support CloudLinux PHP Selector and as a result does not work http://docs.cloudlinux.com/index.html?compatiblity_matrix.html [%s]
Please, see: {} and try to fix issue to have working selectorz#check-phpselectorz-PHP Selector is not supported. Skipping checkz/etc/cpanel/ea4/is_ea4z+It is not cPanel with EA4, can diag nothingZ LitespeedF)r. r- �lsapiNz/etc/cpanel/ea4/php.conf�rc S s g | ] }|� � �qS r2 )�strip)r6 �xr2 r2 r3 �
<listcomp>; s z%check_phpselector.<locals>.<listcomp>zCan not read %s (%s)zdefault:�:rE z)%s config should have default php versionz%s:)�cgi�fcgir- r� z*doesn't support %s handler in ea4/php.confZ ruid2_modulez�It looks like you use mod_ruid. CloudLinux PHP Selector doesn't work properly with it. How to delete mod_ruid and install mod_suexec in cPanel https://docs.cloudlinux.com/cloudlinux_os_components/#installation-5Z suphp_moduler- Z lsapi_moduler� Z
suexec_moduler. zyIt looks like you do not have mod_suphp or mod_suexec installed. CloudLinux PHP Selector doesn't work properly without it)r- r� r� r� zphp.conf:%s with %sz, c 3 s | ]}� | r|V qd S )Nr2 )r6 �s)�statusr2 r3 � <genexpr>c s z$check_phpselector.<locals>.<genexpr>z`Some unknown php handler, perhaps we don't support it [found handler: %s and apache modules: %s]�-c 3 s | ]}� | r|V qd S )Nr2 )r6 �module)r� r2 r3 r� g s )rT rw r r$ r" rj rk rl rx r� r r �open� readlines�close�IOErrorr r! �
startswith�splitr� Zget_apache_modules�anyrA )
Z ok_prefixZ fail_prefixZ is_ubuntu_osZhandlerZ conf_path�fd�configrP �err�lineZ default_ver�modulesZcurrentr2 )r� r3 �check_phpselector sn
r� zCheck fs.symlinkown_gidc
C s" d� td �} ttd�}d| }d}t�� r6ttd�S t�� tj}yt �
|� W n t k
rr ttd� |��S X yt t
|��� �� �}W n4 tk
r� } zttd� |t|���S d }~X Y nX tj|kr�|S yt�|�j}W n t k
� r� g }Y nX |�r||k�r|S tt|� ||��S ) Nz~Fix the issue to provide symlink protection for apache user and as a result make your Web Server more secure.
See details: {}z#check-symlinkowngidz>Web-server user is protected by Symlink Owner Match Protectionz@Web-server user '{}' is not in protected group specified in {}. z/proc/sys/fs/symlinkown_gidz$Not supported for OpenVZ environmentz<There is no web-server user [{}] in system. Nothing to checkz%Can't read GID from {} with error: {})rT rw r$ r rx r} r" Zget_apache_gidZ APACHE_UNAME�pwd�getpwnam�KeyError�intr� �readr� rH r! rI Z
APACHE_GID�grpZgetgrgidZgr_mem)rz Zok_resZ warn_msg_tplZsymlinkown_gid_fileZ apache_unameZcurrent_symlinkown_gidrP Z grp_membersr2 r2 r3 �check_symlinkowngidk s@
r� z&Check existence of all user's packagesc
sl d�d} d}ddddg� dd d
d g}g �t �� d kr>ttd
�S t�| �sRttd�S tj�|�rht�|��tj |tj
tj
| dd�}|� � \}}|j }|dkr�d�
|�}tt|�S y.dd� |�� �d�D �}�fdd�|D �}W n4 tk
�r } zd�
| �}tt|�S d} ~ X Y nX �fdd�t���D ��� �fdd�|D �}
|
�r^d�
d �|
��}tt|�S ttd �S dS ) zL
Return user's packages that do not exist in /var/cpanel/packages/
z/var/cpanel/packages/z/var/cpanel/users/z/var/cpanel/suspended/Z undefined�defaultz#cPanel Ticket System temporary userZCustomz /bin/grepz-ezPLAN=z-rr' z should be run on cPanel onlyzno users on this serverT)�stdout�stderr�cwd�textr z!error getting user's packages: {}c S s6 g | ].}|� d �d � d�d |� d �d �� f�qS )�=r r� rE )r� r� )r6 Zplanr2 r2 r3 r� � s z9check_existence_of_all_users_packages.<locals>.<listcomp>r; c s g | ]\}}|� kr||f�qS r2 r2 )r6 �userZpkg)�suspended_usersr2 r3 r� � s z$error processing user's packages: {}Nc s& g | ] }t j�t j�� |��r|�qS r2 )rj rk �isfilerA )r6 �package)�packages_dir_pathr2 r3 r� � s c s, g | ]$\}}|� kr|�krd � ||��qS )z{}: {})rT )r6 r� r� )�excluded_packages_names�exists_packagesr2 r3 r� � s z�Found some nonexistent user's packages. List of "user: package" separated by semicolon: {}. If you want to apply package limits for those users - assign existing packages to them, otherwise limits will be applied incorrectly or not applied at all.z; z(nonexistent user's packages aren't found)rx ry r$ r" rj �listdirrk rl �
subprocess�Popen�PIPE� communicate�
returncoderT r! r� r� rH rA r ) Zusers_dir_pathZsuspended_dir_pathZ
user_plan_cmd�processZstd_outZstd_errZret_coder& Zall_users_packagesrP Znot_exists_users_packagesr2 )r� r� r� r� r3 �%check_existence_of_all_users_packages� sN
r� z$Check all resellers's packages filesc
C s� t �� dkrttd�S G dd� d�} ddlm} y&| � � |� �� W dQ R X ttd�S tk
r� } ztt t
|��S d}~X Y nX dS ) zT
Check reseller packages files reading on any errors
Caused by LU-2374
r( z!should be run on DirectAdmin onlyc @ s e Zd ZdZdd� Zdd� ZdS )z7check_da_resellers_packages_files.<locals>.HiddenPrintsz=
Redirect stdout to /dev/null to hide output
c S s t j| _ttjd�t _d S )N�w)�sysr� �_original_stdoutr� rj �devnull)�selfr2 r2 r3 � __enter__� s zAcheck_da_resellers_packages_files.<locals>.HiddenPrints.__enter__c S s t j�� | jt _d S )N)r� r� r� r� )r� �exc_typeZexc_valZexc_tbr2 r2 r3 �__exit__� s
z@check_da_resellers_packages_files.<locals>.HiddenPrints.__exit__N)�__name__�
__module__� __qualname__�__doc__r� r� r2 r2 r2 r3 � HiddenPrints� s r� r )r( Nz6all resellers packages are written in correct encoding) rx ry r$ r" Z clcontrollibr( Zlist_resellers_packagesr rH r! r )r� r( rP r2 r2 r3 �!check_da_resellers_packages_files� s
r� z /etc/cl.selector/defaults.cfgz/etc/cl.selector/php.confZ DirectiveZDefault�Type�CommentZRangeZRemark�value�list�boolc C s� g } d}d}t td��}|�� }W dQ R X xt|D ]l}|�d�r@q0t|�� �dkr�d}y | | W n | �g � Y nX | | �|�� � q0|s0d}|d7 }q0W | S )zL
Parse php.conf and split it into blocks by empty line
:return:
r Tr� N�#FrE )r� �
PHP_CONF_PATHr� r� �lenr� r@ )Z line_blocksZ block_indexZ new_blockZconfrB r� r2 r2 r3 �parse_php_conf s&
r� c C s� d}d}xv| D ]n}|� d�}|d �� tkrDd}|d dt| � }|d �� dkr|d �� tkrd}|d d
t| � }qW ||gS ) NTrg r� r Fr; zBlock %s has wrong param
r� rE z Block %s has wrong directive
)r� r� �PARAM_NAME_LIST�block_to_string�TYPES)�blockrd r& r� Z
line_partsr2 r2 r3 � check_block' s
r� c C s& d}x | D ]}|t |� d }q
W |S )Nr; )r )r� Z
res_stringr� r2 r2 r3 r� 6 s
r� z"Checking /etc/cl.selector/php.confc C s� d} d� | �}d}d}tj�t�s0ttdt �S t� }x0|D ](}t|�\}}|oR|}|r<|d | }q<W |sztt || �S tt
d�S d S )Nz7https://docs.cloudlinux.com/custom_php_ini_options.htmlz�To fix the issue provide valid format for /etc/cl.selector/php.conf file. It is used for PHP Selector and invalid format lead to directives misconfiguration and as a result misconfiguration of selector
Please, read more about php.conf file in {}Trg zFile %s does not exist
r; �Ok) rT rj rk rl r� r$ r" r� r� r! r )Zphp_ini_doc_linkrz rd r& Zblocksr� Zr1Zmsg1r2 r2 r3 �check_php_conf= s
r� z&Checking /etc/cl.selector/defaults.cfgc
C s� d� td �} tj�t�s(ttdt �S y tj d dd�}|�
t� W n, t k
rp } ztt t
|��S d }~X Y nX y|�dd�}W n& tjtjfk
r� tt d| �S X x�|�� D ]�}|�d�r�|d d � }y|�|d
�}W n tjk
� r� d }Y nX y|�|d �}W n tjk
�r( d
}Y nX ||k�rP|dk�rPtt d� || ��S |r�d|kr�|�d�}x$|D ] } | �sltj�d| � �qlW q�W ttd�S )Nz�Details: this config file is used by php selector and stores it`s global options, so it is important to keep needed configurations and valid syntax for PHP modules settings to avoid selector`s misconfiguration
See details: {}z#cldiagz%s does not existF)�
interpolation�strict�versionsZphpz!Default php version is undefined
� �stateZenabler� rg Zdisabledz%Default php version {} is disabled
{}�,z0Warning: Modules list for version %s is strange
r )rT rw rj rk rl �DEFAULTS_CFG_PATHr$ r" � configparser� ConfigParserr� rH r! r �getZ
NoOptionErrorZNoSectionError�sectionsr� r� r� r� �writer )
rz Z defaults_cfgrP Zdefault_php_versionZsectionZ php_versionr� r� Z module_namesr* r2 r2 r3 �check_defaults_cfgU sF
r� z Checking domains compatibilityc C sD t �� dkrttd�S d} d}t� }|d kr6tt|�S tt| �S d S )Nr' z should be run on cPanel onlyz�Some domains/subdomains don't use PHP Selector because they have a non-system default version (in MultiPHP Manager) or PHP_FPM enabled. You can find their list on domains tab and pass control to PHP Selector if necessary.r� )rx ry r$ r" � domains_compatibility_checkerr r! )r� r� rd r2 r2 r3 �check_domains_compatibility s
r� c C sl y t d��� } t d��� }W n tk
r0 d S X x4| �d�D ]&}|�d�|�d�ks`|�d�r>dS q>W d S )NZphp_get_vhost_versionsZ php_get_system_default_versionr� �versionZphp_fpmzIncompatible version)r Zcallr r� )ZdomainsZsystem_versionZdomainr2 r2 r3 r� � s r� )�dirpathr] c C s| t j�| �sdS d| � �}tj|�d�tjtjdd�}|jdkrDdS y |j�d�d �d�d }W n t k
rv dS X |S )
zZ
Get mountpoint for dirpath directory from output of
df -h {dirpath} utility.
Nzdf -h r< T)r� r� r� r r; rE ���)
rj rk �isdirr� �runr� r� r� r� �
IndexError)r� Zget_mountpoint_cmdr� Z
mounted_onr2 r2 r3 �get_dir_mountpoint� s
r� c C sR d} t j�d�rNtd��0}x(|D ] }|�d�r t|�d�d �} q W W dQ R X | S )z[
Returns maximum uid from /etc/login.defs
If file does not exist returns 60000
i`� z/etc/login.defszUID_MAX r< r� N)rj rk r� r� r� r� r� )�max_uidrO r� r2 r2 r3 � get_max_uid� s
r� c C sD d} yt | �d�dd�}W n tk
r6 td��Y nX t|�}|S )z
Returns min cagefs uid
z!/usr/sbin/cagefsctl --get-min-uidr< T)Zconvert_to_strz /usr/sbin/cagefsctl not found)r r� r rH r� )Zget_min_uid_cmdr� �min_uidr2 r2 r3 � get_min_uid� s r� )�usernamer] c C s� t � }t� }||k r.td| � d|� d|� ���t|d�}| |�� krN|�| �S |�� s\|}n.|}|�� }x t||�D ]}||krt|}P qtW ||kr�td| � d|� d���d|� d| � �}t|� d �d
d �\}} }
|d kr�t|
��|S )
z�
Creates user with max available uid that greater than min cagefs uid
and less than max system uid.
Does nothing if user already exists.
z
Can't create z user: min_uid z is greater than max_uid )r� z user: uid z is too bigz#/usr/sbin/useradd -s /bin/false -u z -m r< T)Zreturn_full_outputr )
r� r� rH r �get_user_full_dictZget_uidZ get_uid_dict�ranger r� ) r� r� r� ZclpwdZ
custom_uidZused_uids_dictZ_uidZ useradd_cmdr� r8 r� r2 r2 r3 �useradd� s,
r� c C sD y&t td��} | �� }W dQ R X |�� S ttfk
r> Y nX dS )zS
Retrive cldiag username from file
:return: username from file or None
r� N)r� �_CLDIAG_USERNAME_FILEr� r� �OSErrorr� )rO Zcontentr2 r2 r3 �get_username_from_file� s r c C sv t � } t�d�}| �� }xX|�� D ]L\}}|�|�s6q"y d|� �}t|�d�� W q" tt t
fk
rl Y q"X q"W dS )z3
Remove all trash cldiag users from system
z^cldiaguser_[a-f0-9]{21}$z/usr/sbin/userdel -r r< N) r �re�compiler� �items�matchr r� r r� r )Zcl_pwdZ
re_patternZ
users_dictr� r8 Z userdel_cmdr2 r2 r3 � remove_all_trash_cldiag_users s
r c C s: d} | dg}y t |�}W n tk
r, dS X |s6dS dS )z\
Detect quota is activated
:return: True/False - quotas activated/not activated
z/usr/sbin/repquotaz-nvaFT)r r )Z_REPQUOTA_PATH�cmdr� r2 r2 r3 �is_quota_active s r zGChecking if /var/cagefs is located on partition with disk quota enabledc C s� d} d}d}d}d}t d�}|dks<tj�d�r<tj�|�sFttd�S tj�d �s\ttd
�S t� sltt|�S d}d }tj�t �r�t
� }|dk r�y t � |�}|j
|j } }
W n tk
r� Y q�X d }nt� |�sLd
�tt�� j�dd� }t|� t � |�}|j
|j } }
y$tt d��} | �|� W dQ R X W n ttfk
�rJ Y nX |� d| � �} |� d|� d|� �}
|� d|� d|� �}�yz�d| d }d|� d|� d�}tt � � �}t ||�}tj�|��s�t | � d�� t |
� d�� t j!d|gt j"t j#d d |t$| |
�tj%dd i�d �}|�&� \}}t'|��@ |�(� �sLd |k�rLtt)| �S |�(� �s`t|��n|�*� W dQ R X W dt |� d�� X W n t+k
�r� tt|�S X tt|�S ) a�
Checker for check if /var/cagefs is located on partition
with disk quota enabled.
Algorithm for check: we trying to set cldiaguser's quota to 1 inode
(so that this user can't create any file if the quota activated on
this partition). Then we change uid of process to cldiaguser's uid,
and try to create file with his permissions.
If we can't create file (Disk quota exceeded) then it's alright and
disc quota enabled. Else we warn user to enable quota on that partition.
z3/var/cagefs located on partition with quota enabledz�Details: /var/cagefs located on partition with quota disabled.
Please, activate quota for /var/cagefs for better security.
See details: https://docs.cloudlinux.com/cloudlinux_os_components/#installation-and-update-2zYQuotas seems unworkable on this server. Please correctly setup quotas to run this checkerz/usr/sbin/cagefsctlz/usr/sbin/setquotaz /var/cagefsNzCagefs is not installedz /usr/share/cagefs-skeleton/binzCagefs is not initializedFTz{}_{}� r� z --cpetc z -u z 0 0 1 1 z 0 0 0 0 z%02d�d z /var/cagefs/�/z/etc/cl.selector/r< z
/bin/touch�LC_ALL�C)r� r� r� Zstart_new_sessionr� Z
preexec_fn�envzDisk quota exceeded),r� rj rk r� r� r$ r" r r! r r r� r� Zpw_uidZpw_gidr� r rT �_CLDIAG_TEST_USENAME_PREFIX�uuidZuuid4�hexr� r� r� r r� r �randomr r r� r� r� r� ZSTDOUTr �environr� r rl r �unlinkr )Z
ok_messager� Zquota_unworkable_messageZ cagefsctlZsetquotaZcagefs_mountpointr� Zis_testuser_existsZuser_pwZuser_uidZuser_gidrO Zcreate_cagefs_dir_cmdZset_quota_limit_cmdZreset_quota_limit_cmd�prefixZ tempfile_dirZ
tempfile_nameZtempfile_full_path�pr� r8 r2 r2 r3 �!check_cagefs_partition_disk_quota# s�
r �
c C sN | � d�}t|�|krJd�|d|d � dg || d d� |g �S | S )a.
Handles error message making it shorter, if it is bigger than max limit
:param error: error message to make shorter
:param detailed_out: way for user to get full error manually
:param max_error_lines: max lines for error
:return: initial error (less than 10 lines) short error
r; Nr| z...)r� r� rA )�errorr� Zmax_error_linesZ error_linesr2 r2 r3 r~ � s
*
r~ c C s t jt jdddd�} | S )zY
Return true if automatic cldiag email notifications
about problems enabled.
Z
ENABLE_CLDIAGr� T)Z separatorZ default_val)rx Zget_boolean_param�CL_CONFIG_FILE)Z
enable_cldiagr2 r2 r3 � is_email_notification_enabled� s
r c C s` y0t jddtdid�} | �tj� | �tt�}W n t jk
rF g S X dd� |� � �
d�D �S )zc
Get list of disabled cldiag checkers which run by cron
from /etc/sysconfig/cloudlinux
NFrg )r� r� �defaultsc S s g | ]}|r|� � �qS r2 )r� )r6 �itemr2 r2 r3 r� � s z6get_list_of_disabled_cron_checkers.<locals>.<listcomp>r� ) r� r� � cron_cldiag_checkers_param_namer� rx r r� �cron_cldiag_section_name�Errorr� r� )r� rd r2 r2 r3 �"get_list_of_disabled_cron_checkers� s
r" )�disabled_cron_cherkersr] c
C s� y~t jddd�}|�tj� t|�� kr2|�t� t� }| rF| � |� |�
tt d� | �� t
tjd��}|�|� W dQ R X W n\ t jttfk
r� } z6tdtj� d|� d�� td � tt� t�d
� W dd}~X Y nX dS ) z`
Set list of disabled cldiag checker which run by cron
in /etc/sysconfig/cloudlinux
NF)r� r� r� zw+z3Can't set list of disabled cron checkers to config"z " because "r= z:Please check config's existence, integrity and permissionsrE )r� r� r� rx r r r� Z add_sectionr" �extend�setr rA r� r� r! r� r rK ri r� rL )r# r� Zcurrent_disabled_checkersrO r� r2 r2 r3 �"set_list_of_disabled_cron_checkers� s*
r& z!Check mount with hidepid=2 optionc C s| d} d| � �}d}d}t j�d�s,tt|�S tdd��6}x.|D ]&}|�d�r>|�d �d
kr>tt|�S q>W W d Q R X tt |�S ) z7
Check if system mounted with hidepid=2 option
zWhttps://docs.cloudlinux.com/cloudlinux_os_kernel/#remounting-procfs-with-hidepid-optionz�Details: hidepid protection disabled.
Please, mount system with hidepid=2 for better security.
Read more about hidepid option here: zhidepid protection enabledzCagefs is not installedz/usr/sbin/cagefsctlz /proc/mountsr� zproc z
,hidepid=2r� N)
rj rk r� r$ r" r� r� �findr! r )Zhidepid_doc_linkrz r� Zskipped_messagerO r� r2 r2 r3 �
check_hidepid� s
r( z Check user's low PMEM limitsc C s0 d} d| }d}t �� }|r&tt|�S tt|�S )z7
Checks low PMEM limits availability on server
z5https://docs.cloudlinux.com/limits/#limits-validationzLSome user(s) on server has low PMEM LVE limit (lower than 512 MB). See doc: z Check low PMEM limits passed)r Zis_low_pmem_limit_presentr$ r! r )r� r� r� rd r2 r2 r3 �check_low_pmem_limits� s
r) )F)FT)r )�Z
__future__r r r� r� r� r> rj r r� r� � collectionsr Zpathlibr r � functoolsr �typingr r r r
Z cldetectlibrx Zclcommon.lib.constsr r Zclcommon.lib.cleditionr
r Zclcommon.lib.jwt_tokenr Z cllicenselibr Zcllimits_validatorr Zclcommon.utilsr r r r r r Zclcommon.lib.cmt_utilsr r Zclcommon.lib.whmapi_libr r r Zclsentry.utilsr Zclcommon.clpwdr r r r r! r" r# rw r r Zcl_plus_doc_linkrh ri r_ rW r$ Z SUEXEC_PATHZ
SUPHP_PATH�dictr� r r r/ rD rQ rU r[ r\ r� r rc rf rm rq rs rt ru rv r{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r~ r r" r& r( r) r2 r2 r2 r3 �<module> s&
#'!
Z-E
")
!c