forked from cPanelSSP/SSP
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathssp
7907 lines (6829 loc) · 268 KB
/
ssp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/perl
# SSP - System Status Probe
# Find and print useful troubleshooting info on cPanel servers
=head1 COPYRIGHT
This software is Copyright 2015 by cPanel, Inc.
THE SOFTWARE LICENSED HEREUNDER IS PROVIDED "AS IS" AND CPANEL HEREBY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, RELATING TO THE SOFTWARE, ITS THIRD PARTY COMPONENTS, AND ANY DATA ACCESSED THEREFROM, OR THE ACCURACY, TIMELINESS, COMPLETENESS, OR ADEQUACY OF THE SOFTWARE, ITS THIRD PARTY COMPONENTS, AND ANY DATA ACCESSED THEREFROM, INCLUDING THE IMPLIED WARRANTIES OF TITLE, MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. CPANEL DOES NOT WARRANT THAT THE SOFTWARE OR ITS THIRD PARTY COMPONENTS ARE ERROR-FREE OR WILL OPERATE WITHOUT INTERRUPTION. IF THE SOFTWARE, ITS THIRD PARTY COMPONENTS, OR ANY DATA ACCESSED THEREFROM IS DEFECTIVE, YOU ASSUME THE SOLE RESPONSIBILITY FOR THE ENTIRE COST OF ALL REPAIR OR INJURY OF ANY KIND, EVEN IF CPANEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DEFECTS OR DAMAGES. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY CPANEL, ITS AFFILIATES, LICENSEES, DEALERS, SUB-LICENSORS, AGENTS OR EMPLOYEES SHALL CREATE A WARRANTY OR IN ANY WAY.
=cut
use strict;
use warnings;
use File::Find;
use IO::Socket::INET;
use Sys::Hostname;
use Term::ANSIColor qw(:constants);
use Storable;
use POSIX;
use Time::Local;
use IPC::Open3;
use Cwd qw(abs_path);
use Getopt::Long;
my %opts = (
'bugreport' => undef,
'csi' => undef,
'timeout' => undef,
);
Getopt::Long::GetOptions(
'bugreport' => \$opts{'bugreport'},
'csi' => \$opts{'csi'},
'timeout=i' => \$opts{'timeout'},
);
if ( !-d '/usr/local/cpanel' ) {
die '/usr/local/cpanel not found';
}
if ( $^O ne 'linux' ) {
die "Unknown OS: $^O (only Linux is supported)";
}
if ( $< != 0 ) {
die "SSP must be run as root\n";
}
$ENV{'PATH'} = '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin';
my $version = '4.99.118';
$| = 1;
$Term::ANSIColor::AUTORESET = 1;
######################
## BEGIN GLOBALS ##
######################
my $cpanel_version = get_cpanel_version();
my ( $cpanel_version_parent, $cpanel_version_major, $cpanel_version_minor, $cpanel_version_build ) = split /\./, $cpanel_version;
my $hostname = hostname();
my $os = get_os();
my $is_cloudlinux = 0;
my $external_ip_address;
my $TIERS = get_tiers_file();
my @local_ipaddrs_list = get_local_ipaddrs();
my @process_list = get_process_list();
my %process; &get_process_pid_hash(\%process);
my %port; &get_lsof_port_hash(\%port);
my %ipcs; &get_ipcs_hash(\%ipcs);
my %hostinfo = get_hostinfo();
my %cpuinfo = get_cpuinfo();
my %sysctl = get_sysctl();
my ( $os_release, $os_ises ) = get_release_version();
my %mysql_conf; &get_mysql_conf(\%mysql_conf);
my $mysql_datadir = get_mysql_datadir(); # needs %mysql_conf
my $mysql_error_log = get_mysql_error_log(); # needs %mysql_conf
my @mysql_rpm_versions; # certain installed rpms that begin with MySQL- (e.g., MySQL-server, etc)
my @custom_opt_mods; # items in /var/cpanel/easy/apache/custom_opt_mods/
my @usr_local_cpanel_hooks; # items in /usr/local/cpanel/hooks/
my @easyapache_templates; # items in /var/cpanel/easy/apache/profile/
my @extended_rpm_list; # rpm -qa --queryformat '%{ARCH}\t%{NAME}\t%{VERSION}\t%{RELEASE}\n'
my @rpm_list; # rpm -qa
my %cpconf; # cpanel.config
my %pureftpdconf; # /etc/pure-ftpd.conf
my %proftpdconf; # /etc/proftpd.conf
my @apache_version_output; # httpd -v
my @apache_modules_output; # httpd -M
my $apache_version; # Version string
my $apache_built; # Build date
my $apache_ea_version; # EA version which built Apache
my $apache_per_user; # Type of per-user Apache module in effect such as Mod Ruid2 or MPM ITK
my $apache_modsec; # mod_security enabled
my $ea4 = is_ea4(); # True if system is running EA4
my $httpd_path = _get_httpd_path(); # location of operative httpd
my ( $lsws_full_version, $lsws_numeric_version ) = get_lsws_version();
my ( $phpversion, $php5version, $php4version, $php4handler, $php5handler, $suexec );
if ( $httpd_path ) {
@apache_version_output = split /\n/, timed_run( 0, $httpd_path, '-v' );
@apache_modules_output = split /\n/, timed_run( 0, $httpd_path, '-M' );
for (@apache_version_output) {
if (m{ \A Server \s version: \s+ Apache/(.*) \s \(.*\)\z }xms) {
$apache_version = $1;
}
if (m{ \A Server \s built: \s (.*) \z }xms ) {
$apache_built = $1;
$apache_built =~ s/^\s+//g;
}
if ( !$ea4 ) {
if (m{ \A Cpanel::Easy::Apache \s (.*) \z }xms) {
$apache_ea_version = $1;
}
}
}
if ( $ea4 ) {
chomp ( $apache_ea_version = timed_run( 0, 'rpm', '-qf', $httpd_path ) );
$apache_ea_version =~ s/\.\w\d{1,3}\D+\d+\n//;
}
$apache_per_user = "none";
$apache_modsec = 0;
for (@apache_modules_output) {
if (/ruid2_module/) { #
$apache_per_user = "ruid2";
}
if (/mpm_itk_module/) {
$apache_per_user = "itk";
}
if (/security\d?_module/) {
$apache_modsec = 1;
}
}
}
# TODO: use +c 15 so the entire process name is displayed if >9 chars
my @lsof_80 = split /\n/, timed_run( 0, 'lsof', '-n', '-i', 'tcp:80' );
my @phpini = get_phpini();
{
if ( open( my $cpconf_fh, '<', '/var/cpanel/cpanel.config' ) ) {
local $/ = undef;
%cpconf = map { ( split( /=/, $_, 2 ) )[ 0, 1 ] } split( /\n/, readline($cpconf_fh) );
close $cpconf_fh;
}
else {
die "/var/cpanel/cpanel.config could not be opened. Unable to proceed.\n";
}
}
chomp( my @libkeyutils_files = build_libkeyutils_file_list()); # must come before the malware checks
my $libkeyutils_files_ref = \@libkeyutils_files;
my $crit_buffer; # Critical output to be printed at the end
$SIG{'INT'} = sub {
print "\n\nJust being impatient, or did SSP actually hang? What if it didn't get a chance to check something really important?\n";
print "\nIf you really want out of here and it didn't work the first time then you interrupted a child and not the parent process. Keep hitting CTRL+C.\n";
if ( $crit_buffer ) {
print_magenta("\nThere was critical-level output above, here it is again:");
print $crit_buffer;
}
die;
};
if ( $opts{'timeout'} ) {
$opts{'timeout'} = int $opts{'timeout'};
if ($opts{'timeout'} < 5) {
$opts{'timeout'} = 5;
}
}
######################
## END GLOBALS ##
######################
if ($opts{'bugreport'}) {
print_bug_report();
exit;
}
if ($opts{'csi'}) {
csi_checks_only();
exit;
}
print "\n";
for ( 1 .. 3 ) {
print BOLD GREEN ON_RED "\tPlease DO NOT paste output from SSP into tickets unless it is relevant to an issue" . RESET . "\n";
}
## [CRIT] -- only stuff that we should check as early as possible
check_for_hacked_server_touchfile();
check_for_multiple_tech_logins();
check_for_lve_environment();
check_for_os_release_7();
## [INFO]
print "\n";
check_for_dnsonly();
print_tip();
print_version();
print_hostname();
print_os();
print_kernel_and_cpu();
print_cpanel_info();
check_for_cpanel_update();
print_uptime();
check_for_clustering();
print_apache_info();
print_lsws_info();
check_for_lsws_update();
print_ea3_php_configuration();
print_ea4_php_configuration();
check_sysinfo();
check_for_remote_mysql();
print_if_using_mydns_or_nsd();
print_if_using_modruid2_or_itk();
print_mysql_version();
print_backups_info();
print_mailserver_info();
print_ftpserver_info();
check_for_custom_zonetemplates();
print_news();
## [WARN]
check_port_hash();
check_selinux_status();
check_runlevel();
check_for_missing_root_cron();
check_for_missing_usr_bin_crontab();
check_if_upcp_is_running();
check_valid_upcp();
check_interface_lo();
check_cpanelconfig_filetype();
check_cpanelsync_exclude();
check_for_rawopts();
check_for_rawenv();
check_for_custom_opt_mods();
check_for_local_apache_templates();
check_for_missing_account_suspensions_conf();
check_for_local_makecpphp_template();
check_for_custom_apache_includes();
check_for_tomcatoptions();
check_for_sneaky_htaccess();
check_perl_sanity();
check_for_non_default_permissions();
check_for_non_default_sysctl();
check_for_stale_lockfiles();
check_var_cpanel_users_files_ownership();
check_root_suspended();
check_limitsconf();
check_disk_space();
check_disk_inodes();
check_for_hooks_in_scripts_directory();
check_for_huge_logs();
check_easy_skip_cpanelsync();
check_pkgacct_override();
check_for_gdm();
check_for_redhat_firewall();
check_easyapache();
check_for_easyapache_hooks();
check_for_home_noexec();
check_for_nat();
check_for_oracle_linux();
check_for_usr_local_cpanel_hooks();
check_for_sql_safe_mode();
check_for_domain_forwarding();
check_for_empty_apache_templates();
check_for_empty_postgres_config();
check_for_empty_easyapache_profiles();
check_for_missing_timezone_from_phpini();
check_for_proc_mdstat_recovery();
check_usr_local_cpanel_path_for_symlinks();
check_for_system_mem_below_required();
check_yumconf_sanity();
check_for_cpanel_files();
check_bash_history_for_certain_commands();
check_wwwacctconf_for_incorrect_minuid();
check_roots_cron_for_certain_commands();
check_for_missing_or_commented_customlog();
check_for_cpsources_conf();
check_for_apache_rlimits();
check_for_usr_local_lib_libz_so();
check_for_non_default_modsec_rules();
check_etc_hosts_sanity();
check_for_empty_or_missing_files();
check_for_apache_listen_host_is_localhost();
check_roundcube_mysql_pass_mismatch();
check_for_hooks_from_var_cpanel_hooks_yaml();
check_mysqld_warnings_errors();
check_mysql_config();
check_for_extra_mysql_config_files();
check_for_C_compiler_optimization();
check_perl_version_less_than_588();
check_for_low_ulimit_for_root();
check_for_fork_bomb_protection();
check_for_license_info();
check_for_harmful_php_mode_600_cron();
check_for_cPanel_lower_than_11_30_7_3();
check_for_custom_exim_conf_local();
check_for_maxclients_or_maxrequestworkers_reached();
check_for_non_default_umask();
check_for_multiple_imagemagick_installs();
check_for_custom_locales();
check_eximstats_size();
#check_eximstats_corrupt(); # !! Completely remove after shake-down period for new table check
check_for_broken_mysql_tables();
check_for_broken_mysql_horde();
check_for_clock_skew();
check_for_zlib_h();
check_if_httpdconf_ipaddrs_exist();
check_distcache_and_libapr();
check_for_custom_postgres_repo();
check_for_rpm_overrides();
check_for_odd_yum_conf();
check_var_cpanel_immutable_files();
check_for_noxsave_in_grub_conf();
check_for_rpm_dist_ver_unknown();
check_for_homeloader_php_extension();
check_for_networkmanager();
check_for_dhclient();
check_for_var_cpanel_roundcube_install();
check_for_missing_etc_localtime();
check_for_cloudlinux_mysql_gov();
check_cpanel_config();
check_cpanel_config_for_bad_root();
check_pure_ftpd_conf_for_upload_script_and_dead();
check_for_perl_env_var();
check_for_disabled_services();
check_for_cpbackup_exclude_everything();
check_for_usr_local_include_jpeglib_h();
check_for_bw_module_and_more_than_1024_vhosts();
check_for_uppercase_chars_in_hostname();
check_for_bad_permissions_on_named_ca();
check_for_use_compiled_dnsadmin();
check_for_mysql_root_pass_with_single_quote();
check_for_jailshell_additional_mounts_trailing_slash();
check_for_allow_query_localhost();
check_for_nocloudlinux_touchfile();
check_for_mysql_upgrade_touchfile();
check_for_stupid_touchfile();
check_for_phphandler_and_opcode_caching_incompatibility();
check_for_invalid_HOMEDIR();
check_for_unsupported_options_in_phpini(); # FB-75397
check_for_suphp_but_no_fileprotect();
check_for_assp_hates_appconfig_cron();
check_for_missing_var_cpanel_dynamicui_ftp();
check_if_backup_dir_is_nfs();
check_if_hostname_missing_from_localdomains();
check_for_eximstats_newline();
check_for_nfs();
check_for_processes_killed_by_lfd();
check_for_processes_killed_by_oom();
check_for_processes_killed_by_prm();
check_for_broken_userdatadomains();
check_ssl_db_perms();
check_for_nat_plus_mod_evasive();
check_for_stray_index_php();
check_for_missing_cpanelconfig_items();
check_for_port_80_not_apache();
check_for_missing_groups();
check_for_cgihidepass();
check_for_noquotafs();
check_for_mod_rpaf();
check_for_mod_spdy();
check_for_roundcube_overlay();
check_for_hostname_park_zoneexists();
check_for_pgpass_colon_in_password_field();
check_for_dirs_that_break_ea();
check_for_extra_uid_0_user();
check_for_easyparams_attributes();
check_for_stale_backup_pidfile();
check_for_allow_update_in_named_conf();
check_for_mailman_low_uid();
check_for_missing_skiphttpauth();
check_for_mpm_itk_and_suexec();
check_for_modruid2_warnings();
check_for_broken_mysqldump();
check_exim_log_sanity();
check_updatelog();
check_for_readonly_filesystems();
check_for_cl_unsupported_memory_limits();
check_for_eblockers();
check_for_php_selector_incompatibilities();
check_for_missing_cloudlinux_files();
check_for_modsec2_stage_files();
check_for_cron_allow();
# [3RDP]
check_smtp_processes();
check_for_varnish();
check_for_nginx();
check_for_mailscanner();
check_for_apf();
check_for_csf();
check_for_prm();
check_for_les();
check_for_1h();
check_for_webmin();
check_for_symantec();
check_for_newrelic();
check_for_zamfoo(); # Master reseller software
check_for_whmreseller(); # Master reseller software
check_for_whmphp(); # Master reseller software
check_for_cpremote();
check_for_els();
check_for_whmxtra();
check_for_usr_local_mis();
check_for_opt_gsi_tools();
# [CRIT] - Anything that requires a pre-defined response to be sent, escalation, or extreme care.
check_for_unsupported_php(); # Extreme care!
check_for_bash_secadv_20140924(); # advisory
check_for_UMBREON_rootkit(); # malware
check_for_jynx2_rootkit(); # malware
check_for_cdorked_A(); # malware
check_for_cdorked_B(); # malware
check_for_libkeyutils_filenames(); # malware
#check_for_unowned_libkeyutils_files($libkeyutils_files_ref); # malware
check_sha1_sigs_libkeyutils($libkeyutils_files_ref); # malware
check_sha1_sigs_httpd(); # malware
check_sha1_sigs_named(); # malware
check_sha1_sigs_ssh(); # malware
check_sha1_sigs_ssh_add(); # malware
check_sha1_sigs_sshd(); # malware
check_for_ebury_ssh_G(); # malware
check_for_ebury_ssh_banner(); # malware
check_for_ebury_ssh_shmem(); # malware
check_for_ebury_root_file(); # malware
check_for_ebury_socket(); # malware
check_for_bg_botnet(); # malware
check_for_dragnet(); # malware
check_for_xor_ddos(); # malware
check_for_ncom_filenames(); # malware
# These are run closer to the end since it has the potential to take the longest due to RPM usage
build_rpm_list();
my $openssl_rpm_changelog = get_openssl_rpm_changelog();
# These require build_rpm_list() to have been run, so that @rpm_list is populated
#check_for_ebury_3_digit_rpms(); # malware
check_for_openssl_heartbleed_bug(); # advisory
check_for_openssl_secadv_20140605(); # advisory
populate_mysql_rpm_versions_array();
check_for_mysql_4();
check_for_additional_rpms();
check_mysql_rpm_mismatch();
check_php_libmysqlclient_mismatch();
check_for_percona_rpms();
check_for_duplicate_rpms();
check_for_better_linux();
check_for_kernel_headers_rpm();
check_for_frontpage_rpms();
check_for_prelink();
check_for_broken_rpm();
print_info2('Done.');
if ( $crit_buffer ) {
print_magenta("\n\nThere was critical-level output above, here it is again:");
print $crit_buffer;
}
# All checks for DNSONLY go here
sub check_for_dnsonly {
if ( -e '/var/cpanel/dnsonly' ) {
print_version();
print_start("\t\tDNSONLY: ");
print_warning("/var/cpanel/dnsonly detected, assuming DNSONLY\n");
## [CRIT] -- only stuff that we should check as early as possible
check_for_hacked_server_touchfile();
check_for_multiple_tech_logins();
check_for_lve_environment();
check_for_os_release_7();
## [INFO]
print_hostname();
print_os();
print_kernel_and_cpu();
print_cpanel_info();
check_for_cpanel_update();
print_uptime();
check_for_clustering();
check_sysinfo();
## [WARN]
check_port_hash();
check_selinux_status();
check_runlevel();
check_for_missing_root_cron();
check_if_upcp_is_running();
check_interface_lo();
check_cpanelconfig_filetype();
check_cpanelsync_exclude();
check_perl_sanity();
check_for_non_default_permissions();
check_limitsconf();
check_disk_space();
check_disk_inodes();
check_for_gdm();
check_for_redhat_firewall();
check_for_home_noexec();
check_for_nat();
check_for_oracle_linux();
check_for_proc_mdstat_recovery();
check_usr_local_cpanel_path_for_symlinks();
check_for_system_mem_below_required();
check_yumconf_sanity();
check_for_cpanel_files();
check_bash_history_for_certain_commands();
check_roots_cron_for_certain_commands();
check_for_perl_env_var();
check_cpanel_config_for_bad_root();
# check_for_cpsources_conf(); // does this exist on DNSONLY by default?
check_etc_hosts_sanity();
check_for_C_compiler_optimization();
check_perl_version_less_than_588();
check_for_fork_bomb_protection();
check_for_cPanel_lower_than_11_30_7_3();
check_for_non_default_umask();
check_for_clock_skew();
check_for_percona_rpms();
check_for_duplicate_rpms();
check_for_rpm_overrides();
check_var_cpanel_immutable_files();
check_for_noxsave_in_grub_conf();
check_for_networkmanager();
check_for_disabled_services();
check_for_harmful_php_mode_600_cron();
check_updatelog();
check_for_readonly_filesystems();
## [3RDP]
check_for_apf();
check_for_csf();
check_for_prm();
check_for_les();
check_for_1h();
check_for_webmin();
check_for_symantec();
## [CRIT]
check_for_bash_secadv_20140924(); # advisory
check_for_UMBREON_rootkit(); # malware
check_for_jynx2_rootkit(); # malware
check_for_libkeyutils_filenames(); # malware
check_sha1_sigs_libkeyutils($libkeyutils_files_ref); # malware
check_sha1_sigs_httpd(); # malware
check_sha1_sigs_named(); # malware
check_sha1_sigs_ssh(); # malware
check_sha1_sigs_ssh_add(); # malware
check_sha1_sigs_sshd(); # malware
check_for_ebury_ssh_G(); # malware
check_for_ebury_ssh_banner(); # malware
check_for_ebury_ssh_shmem(); # malware
check_for_ebury_root_file(); # malware
check_for_ebury_socket(); # malware
check_for_bg_botnet(); # malware
check_for_dragnet(); # malware
check_for_xor_ddos(); # malware
check_for_ncom_filenames(); # malware
# These are run closer to the end since it has the potential to take the longest due to RPM usage
build_rpm_list();
my $openssl_rpm_changelog = get_openssl_rpm_changelog();
# These require build_rpm_list() to have been run, so that @rpm_list is populated
check_for_openssl_heartbleed_bug();
check_for_openssl_secadv_20140605();
print_info2('Done.');
if ( $crit_buffer ) {
print_magenta("\n\nThere was critical-level output above, here it is again:");
print $crit_buffer;
}
exit;
}
}
sub csi_checks_only {
check_port_hash();
check_for_bash_secadv_20140924(); # advisory
check_for_UMBREON_rootkit(); # malware
check_for_jynx2_rootkit(); # malware
check_for_cdorked_A(); # malware
check_for_cdorked_B(); # malware
check_for_libkeyutils_filenames(); # malware
check_sha1_sigs_libkeyutils($libkeyutils_files_ref); # malware
check_sha1_sigs_httpd(); # malware
check_sha1_sigs_named(); # malware
check_sha1_sigs_ssh(); # malware
check_sha1_sigs_ssh_add(); # malware
check_sha1_sigs_sshd(); # malware
check_for_ebury_ssh_G(); # malware
check_for_ebury_ssh_banner(); # malware
check_for_ebury_ssh_shmem(); # malware
check_for_ebury_root_file(); # malware
check_for_ebury_socket(); # malware
check_for_bg_botnet(); # malware
check_for_dragnet(); # malware
check_for_xor_ddos(); # malware
# These are run closer to the end since it has the potential to take the longest due to RPM usage
build_rpm_list();
my $openssl_rpm_changelog = get_openssl_rpm_changelog();
# These require build_rpm_list() to have been run, so that @rpm_list is populated
check_for_openssl_heartbleed_bug();
check_for_openssl_secadv_20140605();
print_info2('SSP checks done.');
}
sub get_phpini {
my $phpini = '/usr/local/lib/php.ini';
return if !-f $phpini;
if ( open my $fh, '<', $phpini ) {
while (<$fh>) {
next if (/^(?:;|$|\[)/);
chomp;
push @phpini, $_;
}
close $fh;
}
return @phpini;
}
sub _get_httpd_path {
if ( $ea4 && -x '/usr/sbin/httpd' ) {
return '/usr/sbin/httpd';
}
if ( !$ea4 && -x '/usr/local/apache/bin/httpd' ) {
return '/usr/local/apache/bin/httpd';
}
}
sub is_ea4 {
if ( -f '/etc/cpanel/ea4/is_ea4' ) {
print "\n";
print BOLD GREEN ON_RED "\t!!!!! EA4 DETECTED. Deployment is NOT SUPPORTED. !!!!!" . RESET . "\n";
return 1;
}
return undef;
}
sub get_cpanel_version {
my $cpanel_version_file = '/usr/local/cpanel/version';
if ( open my $file_fh, '<', $cpanel_version_file ) {
while (<$file_fh>) {
chomp( $cpanel_version = $_ );
}
close $file_fh;
}
if ( $cpanel_version =~ /(\d+\.\d+\.\d+\.\d+)/ ) {
return $cpanel_version;
}
else {
return 'unknown';
}
}
sub version_cmp { # should only be used by version_compare()
no warnings 'uninitialized'; # Prevent uninitialized value warnings when not using all 4 values
my ( $a1, $b1, $c1, $d1 ) = split /[\._]/, $_[0];
my ( $a2, $b2, $c2, $d2 ) = split /[\._]/, $_[1];
return $a1 <=> $a2 || $b1 <=> $b2 || $c1 <=> $c2 || $d1 <=> $d2;
}
sub version_compare {
# example: return if version_compare($ver_string, qw( >= 1.2.3.3 ));
# Must be no more than four version numbers separated by periods and/or underscores.
my ($ver1, $mode, $ver2) = @_;
return if ( $ver1 =~ /[^\._0-9]/ );
return if ( $ver2 =~ /[^\._0-9]/ );
# Shamelessly copied the comparison logic out of Cpanel::Version::Compare
my %modes = (
'>' => sub {
return if $_[0] eq $_[1];
return version_cmp(@_) > 0;
},
'<' => sub {
return if $_[0] eq $_[1];
return version_cmp(@_) < 0;
},
'==' => sub { return $_[0] eq $_[1] || version_cmp(@_) == 0; },
'!=' => sub { return $_[0] ne $_[1] && version_cmp(@_) != 0; },
'>=' => sub {
return 1 if $_[0] eq $_[1];
return version_cmp(@_) >= 0;
},
'<=' => sub {
return 1 if $_[0] eq $_[1];
return version_cmp(@_) <= 0;
}
);
return if ( ! exists $modes{$mode} );
return $modes{$mode}->( $ver1, $ver2 );
}
sub cpanel_version_is {
# example: return if cpanel_version_is(qw( >= 11.42.1.16 ));
return if $cpanel_version eq "unknown";
my ($mode, $ver) = @_;
return version_compare($cpanel_version, $mode, $ver);
}
sub timed_run { # Borrowed from Cpanel::SafeRun::Timed and modified
my ( $timer, @PROGA ) = @_;
$timer = $timer ? $timer : 25; # A timer value of 0 means use the default, currently 25.
$timer = $opts{'timeout'} ? $opts{'timeout'} : $timer;
return if ( substr( $PROGA[0], 0, 1 ) eq '/' && !-x $PROGA[0] );
open( my $save_stderr_fh, '>&STDERR' );
open( STDERR, '>', '/dev/null' );
my $output = ""; # In the event of time-out or failure, return empty string instead of undef.
my $complete = 0;
my $pid;
my $fh; # FB-63723: must declare $fh before eval block in order to avoid unwanted implicit waitpid on die
eval {
local $SIG{'__DIE__'} = 'DEFAULT';
local $SIG{'ALRM'} = sub { $output = ""; print RED ON_BLACK "Timeout while executing: " . join( ' ', @PROGA ) . "\n"; die; };
alarm($timer);
if ( $pid = open( $fh, '-|' ) ) {
local $/;
$output = readline($fh);
close($fh);
}
elsif ( defined $pid ) {
open( STDIN, '<', '/dev/null' );
exec(@PROGA) or exit 1;
}
else {
warn 'Error while executing: [' . join( ' ', @PROGA ) . ']: ' . $!;
alarm(0);
open( STDERR, '>&=' . fileno($save_stderr_fh) );
return "";
}
$complete = 1;
alarm 0;
};
alarm 0;
if ( !$complete && $pid && $pid > 0 ) {
kill( 15, $pid ); #TERM
sleep(2); # Give the process a chance to die 'nicely'
kill( 9, $pid ); #KILL
}
open( STDERR, '>&=' . fileno($save_stderr_fh) );
return $output;
}
sub timed_run_trap_stderr { # Borrowed from Cpanel::SafeRun::Timed and modified
my ( $timer, @PROGA ) = @_;
$timer = $timer ? $timer : 25; # A timer value of 0 means use the default, currently 25.
$timer = $opts{'timeout'} ? $opts{'timeout'} : $timer;
return if ( substr( $PROGA[0], 0, 1 ) eq '/' && !-x $PROGA[0] );
open( my $save_stderr_fh, '>&STDERR' );
open( STDERR, '>', '/dev/null' );
my $output = ""; # In the event of time-out or failure, return empty string instead of undef.
my $complete = 0;
my $pid;
my $fh; # FB-63723: must declare $fh before eval block in order to avoid unwanted implicit waitpid on die
eval {
local $SIG{'__DIE__'} = 'DEFAULT';
local $SIG{'ALRM'} = sub { $output = ""; print RED ON_BLACK "Timeout while executing: " . join( ' ', @PROGA ) . "\n"; die; };
alarm($timer);
if ( $pid = open( $fh, '-|' ) ) {
local $/;
$output = readline($fh);
close($fh);
}
elsif ( defined $pid ) {
open( STDIN, '<', '/dev/null' );
open( STDERR, '>&STDOUT' );
exec(@PROGA) or exit 1;
}
else {
warn 'Error while executing: [' . join( ' ', @PROGA ) . ']: ' . $!;
alarm(0);
open( STDERR, '>&=' . fileno($save_stderr_fh) );
return "";
}
$complete = 1;
alarm 0;
};
alarm 0;
if ( !$complete && $pid && $pid > 0 ) {
kill( 15, $pid ); #TERM
sleep(2); # Give the process a chance to die 'nicely'
kill( 9, $pid ); #KILL
}
open( STDERR, '>&=' . fileno($save_stderr_fh) );
return $output;
}
sub get_local_ipaddrs {
my @ifconfig = split /\n/, timed_run( 0, 'ifconfig', '-a' );
for my $line (@ifconfig) {
if ( $line =~ m{ (\d+\.\d+\.\d+\.\d+) }xms ) {
my $ipaddr = $1;
unless ( $ipaddr =~ m{ \A 127\. }xms ) {
push @local_ipaddrs_list, $ipaddr;
}
}
}
return @local_ipaddrs_list;
}
sub get_os {
chomp( my $_os = lc timed_run( 0, 'uname') );
return $_os;
}
# ripped from /usr/local/cpanel/Cpanel/Sys/OS.pm
sub get_release_version {
my $ises = 0;
my $ver;
if ( open my $fh, '<', '/etc/redhat-release' ) {
my $line = readline $fh;
close $fh;
chomp $line;
if ( $line =~ m/(?:Corporate|Advanced\sServer|Enterprise)/i ) { $ises = 1; }
elsif ( $line =~ /CloudLinux|CentOS/i ) { $ises = 2; }
elsif ( $line =~ /WhiteBox/i ) { $ises = 3; }
elsif ( $line =~ /caos/i ) { $ises = 4; }
if ( $line =~ /(\d+\.\d+)/ ) { $ver = $1; }
elsif ( $line =~ /(\d+)/ ) { $ver = $1; }
}
if ($ises) {
return ( $ver, $ises );
}
else {
return ( $ver, 0 );
}
}
sub print_version {
print BOLD YELLOW ON_BLACK "\tSSP $version\n\n";
}
sub print_tip {
my @tips = (
'[FB-86549] (Fixed in 11.42.1.1) cPHulk may report root logins to Pure-FTPd despite no evidence being found',
'[FB-78617] (By design) sysup always installs bind',
'[FB-75793] (By design) Proxy subdomains are not created for addon domains',
'[FB-73369] Can\'t log into SquirrelMail, but Horde and Roundcube work? Check if webmail pass contains "odd" characters',
'[FB-72801] (By design) File Manager creates new files with 0600 perms, even when saving an existing file as a new one',
'[FB-72733] (By design) File Manager\'s "Compress" feature has a hard coded timeout due to using cPanel\'s form upload logic',
'[FB-63530] When setting up a remote MySQL server, that server must have the openssh-clients package installed',
'[FB-63193] File Manager showing "Out of memory" in cPanel error_log? Try renaming $HOME/$USER/.cpanel/datastore/SYSTEMMIME',
'[FB-62819] "License File Expired: LTD: 1334782495 NOW: 1246416504 FUT!" likely just means the server clock is wrong',
'[FB-62054] (By design) The "Dedicated IP" box can only be modified when creating a package - not when editing',
'[FB-61735] (By design) "/u/l/c/whostmgr/bin/whostmgr2 --updatetweaksettings" destroys custom proxy subdomain records. Use WHM >> Tweak Settings instead.',
'[FB-59450] (By design) Email quotas cannot exceed 2048MB, but they can be unlimited',
'[FB-58625] Apache 2.0.x links to the wrong PCRE libs. This can cause preg_match*() errors, and "PCRE is not compiled with UTF-8 support"',
'[FB-57237] (By design) Per ISO 3166-1, the country code for the UK is GB (not UK). Look for this in WHM >> Generate an SSL Certificate [...]',
'[FB-50745] (By design) The cPanel UI displays differently (more columns than rows) when changing your locale',
'[FB-46853] Customer complaining that they can\'t log into cPanel as root? Update FB-46853',
'[FB-44884] upcp resets Mailman lists\' hostnames. pre/postupcp hooks workaround in ticket 3541643',
'[FB-42027] "Recently Uploaded Cgi Script Mail" scans and sends email alerts about downloaded files too',
'[FB-21774] Pure-FTPd is not linked against libwrap. As such, Host Access Control does nothing for it',
'The cpanel-postgresql* packages are for phpPgAdmin. The postgresql-* packages are for PostgreSQL',
'For a list of obscure issues, see the RareIssues wiki article',
'11.35+: Use /scripts/check_cpanel_rpms to fix problems in /usr/local/cpanel/3rdparty/ - not checkperlmodules',
'php.ini for phpMyAdmin, phpPgAdmin, Horde, and RoundCube can be found in /usr/local/cpanel/3rdparty/etc/',
'If Dovecot/POP/IMAP dies every day around the same time, the server\'s clock could be skewed. Check /var/log/maillog for "moved backwards"',
'"Allowed memory size of x bytes exhausted" when uploading a db via phpMyAdmin may be resolved by increasing max_allowed_packet',
'Need to edit php.ini for Horde, RoundCube, phpMyAdmin, or phpPgAdmin? Edit /u/l/c/3rdparty/etc/php.ini, then run /u/l/c/b/install_php_inis',
'Seeing "domainadmin" errors (e.g. "domainadmin-domainexistsglobal")? Check the Domainadmin-Errors wiki article',
'Transfers showing "sshcmdpermissiondeny"? Check for modified openssh-clients package (see ticket 3664533)',
'Learn how cPanel 11.36+ handles rpms: http://go.cpanel.net/rpmversions',
'Use "rlog <file>" to see a file\'s revision history, and "co -p1.1 <file>" (for example) to see that revision',
'Files under revision control: fstab, localdomains, named.conf, passwd, shadow, trueuserowners, httpd.conf, php.ini (system and cPanel)',
'Imagick install issues on PHP 5.4? You may need to run \'pear config-set preferred_state beta\' (see ticket 3754991)',
'Need to enable ZTS support for PHP? Try \'--enable-maintainer-zts\' (see ticket 3769493)',
'WHM\'s "Apache mod_userdir Tweak" can be toggled via /scripts/userdirctl',
'Issues with MySQL for a single user? Check for /home/${USER}/.my.cnf',
'Services reported as failing while backups are running? chksrvd may be simply timing out due to excessive disk I/O',
'Blank page in File Manager\'s HTML Editor and iconv "illegal input sequence" in cPanel error_log? Try windows-1251 encoding (see ticket 4088633)',
'Older CentOS 5.x and CloudLinux 5.x do not support SNI. See the "SNI" wiki article for more info',
'domlogs are created 0644 by default. cpanellogd changes permissions on them to 0640 a few minutes later',
'cPanel >> Error Log only searches "recent" logs in Apache\'s error_log . Showing as blank? Maybe there are no recent errors',
'Horde showing "server configuration did not allow file to be uploaded"? Check disk/inode usage on /tmp',
'IMAP/webmail showing no email? The cPanel account may have been over its quota. Try renaming dovecot-uidlist, send account an email (see ticket 4314723)',
'ClamAV not scanning emails? Check if /var/clamd is missing. This will be reflected in Exim\'s logs as well',
'Use custom_vhost_template_ap(1|2) in userdata files to make changes for an individual vhost',
'File Manager upload size limits can be adjusted at WHM >> Tweak Settings >> Max HTTP submission size',
'/var/cpanel/conf/apache/local can potentially cause issues. See ticket 3915299 for an example',
'System backups are not uploaded via FTP by default, requires manual config. See http://documentation.cpanel.net/display/1144Docs/System+Backups#SystemBackups-Manualconfigurationmethod',
'$PATH may differ when executing something via cron rather than the command line. See ticket 4419531',
'"failed to open scan directory /var/spool/exim/scan/[...]: Too many links" could mean a directory has reached limit of 32,000 files/dirs',
'If innodb_force_recovery is enabled in the MySQL configuration, this can sometimes prevent mysqldump from working (see ticket 5193581).',
'"Spawned \'ossec-dbd\' with \'/sbin/service restart ossec-hids\'" is from ASL (Atomic Secured Linux). Have customer contact ASL Support if necessary.',
'You can run SSP with the --bugreport option to print a pre-filled template for submitting a WHM/cPanel bug report.',
'The path for the modsec_audit.log changes with Mod Ruid2 or MPM ITK installed to /usr/local/apache/conf/modsec_audit/[user]/YYYYMMDD/YYYYMMDD-HHmm/YYYYMMDD-HHmmSS-[unique-id]',
'LiteSpeed (lsws) does NOT support the Apache web status page - see: http://www.litespeedtech.com/support/forum/threads/solved-cpanel-after-litespeed-installation-whm-server-status-gives-a-404-error.5536/',
'You can submit new ideas or bug reports for SSP by emailing ssp-requests(at)cpanel.net',
'You can format json files for more readability: python -m tool.json < file.json | less',
);
my $num = int rand scalar $#tips;
print BOLD WHITE ON_BLACK "\tDid you know? $tips[$num]" . RESET . "\n\n";
}
sub get_tiers_file {
local $SIG{'ALRM'} = sub { return (); };
alarm 5;
my $sock = IO::Socket::INET->new(
PeerAddr => 'httpupdate.cpanel.net',
PeerPort => '80',
Proto => 'tcp',
Timeout => 3,
);
if ($sock) {
print $sock "GET /cpanelsync/TIERS HTTP/1.1\r\nUser-Agent: SSP/" . $version . "\r\nHost: httpupdate.cpanel.net\r\n\r\n";
sysread $sock, $TIERS, 1000;
close $sock;
}
alarm 0;
return $TIERS;
}
sub get_process_list { # Usage of this needs to be deprecated in favor of the %process hash
return split /\n/, timed_run( 0, 'ps', 'axwwwf', '-o', 'user,pid,cmd' );
}
sub get_process_pid_hash {
my ($href) = @_;
for ( split /\n/, timed_run( 0, 'ps', 'axwww', '-o', 'user,pid,ppid,cmd' ) ) {
# nobody 5403 1666 /usr/local/apache/bin/httpd -k start -DSSL
if ( m{ ^ ([^\s]+) \s+ (\d+) \s+ (\d+) \s+ (.*?) \s* $ }xms ) {
${$href}{$2}{USER} = $1;
${$href}{$2}{PPID} = $3;
${$href}{$2}{CMD} = $4;
}
}
}
sub get_lsof_port_hash {
my ($href) = @_;
for ( split /\n/, timed_run( 0, 'lsof', '+c15', '-n', '-P', '-i' ) ) {
# cmd will be max 15 characaters due to lsof limitation
# Example from CentOS 6:
# spamd 1781 root 5u IPv4 10887 0t0 TCP 127.0.0.1:783 (LISTEN)
# nc 9468 root 3u IPv6 84415 0t0 TCP [::1]:25 (LISTEN)
# Example from an older CentOS 5 system (note empty SIZE column):
# exim 3066 mailnull 3u IPv6 2566011 TCP *:smtp (LISTEN)
my @lsof = split(/\s+/, $_, 10);
if (defined($lsof[9]) && $lsof[9] =~ /LISTEN/ ) {
splice(@lsof, 6, 1); # Drop the SIZE/OFF column which can sometimes be blank and throw everything off
}
if (defined($lsof[8]) && $lsof[8] =~ /LISTEN/ ) { # SIZE/OFF column is blank, or has been dropped
if ( $lsof[7] =~ /^(.*):(\d+)$/ ) {
my ($ip, $port) = ($1, $2);
push @{${$href}{"$port"}}, {
'CMD' => $lsof[0],
'PID' => $lsof[1],
'USER' => $lsof[2],
'IPV' => $lsof[4],
'PROTO' => $lsof[6],
'IP' => $ip
};
}
}
}
}
sub get_ipcs_hash {
my ($href) = @_;
my $header = 0;
# For now, all we need is shared memory segment owner and creator-pid, but the data structure is extensible.
# ipcs -m -p
#
#------ Shared Memory Creator/Last-op --------
#shmid owner cpid lpid
#2228224 root 992 992
#2588673 root 1309 1315