Gecko [ goons4good.org ]

Name	Size	Permission	Date
cron	[ DIR ]	drwxr-xr-x	2025-07-23 04:12
add-pgsql-ipv6-support.sh	564 B	-rwxr-xr-x	2022-09-28 10:30
allow_cl.sh	3.3 KB	-rwxr-xr-x	2024-03-05 16:15
auth-removal.sh	1.95 KB	-rwx------	2023-01-23 13:29
block_ssh.sh	1.15 KB	-rwxr-xr-x	2023-05-23 21:01
cfm_control	4.65 KB	-rwxr-xr-x	2024-03-28 12:14
check_autossl_excluded.sh	6.88 KB	-rwxr-xr-x	2023-05-22 11:59
convert_to_clos.sh	5.73 KB	-rwxr-xr-x	2023-02-09 14:50
convert_to_core.sh	276 B	-rwx------	2025-04-01 06:33
disable_cpbackups.sh	1.39 KB	-rwxr-xr-x	2024-10-10 07:11
domain_check.py	6.24 KB	-rwxr-xr-x	2024-08-27 10:40
grubinst6.sh	230 B	-rwxr-xr-x	2022-10-27 11:41
grubinst7.sh	323 B	-rwxr-xr-x	2024-01-24 12:57
install-ipa.sh	2 KB	-rwxr-xr-x	2024-09-26 04:24
install-ipa.sh.bak	2.37 KB	-rwxr-xr-x	2023-07-05 13:07
install_cloudlinux.sh	1.31 KB	-rwxr-xr-x	2022-09-29 15:30
install_csf.sh	2.91 KB	-rwx------	2023-05-08 10:57
install_elasticsearch.sh	2.19 KB	-rwx------	2022-07-25 14:24
install_litespeed.sh	4.33 KB	-rwx------	2024-06-13 10:28
install_multiphp.sh	976 B	-rwx------	2022-10-10 14:55
install_redis.sh	709 B	-rwx------	2022-09-28 10:30
ipmicfg	429.04 KB	-rwxr-xr-x	2023-10-04 10:59
lets_encrypt_accept.sh	306 B	-rwxr-xr-x	2024-05-14 09:32
mailqueue_check.sh	1.65 KB	-rwxr-xr-x	2022-04-11 09:40
mysql_minor_upgrade.sh	9.33 KB	-rwxr-xr-x	2024-09-11 17:25
server-scripts_deployer.sh	13.54 KB	-rwxr-xr-x	2024-03-28 12:59
set_autossl_onlynotify_expiry.sh	1.91 KB	-rwxr-xr-x	2022-09-14 08:37
updatecfips.sh	1.62 KB	-rwxr-xr-x	2023-05-22 11:59
wp_plugin_scan.py	14.8 KB	-rw-------	2025-01-21 11:31

Rename

#!/bin/bash
######################################################################################
#  DO NOT EDIT THIS FILE DIRECTLY - IT IS MANAGED BY OUR CONFIG MANAGEMENT SYSTEM.   #
#                                                      YOUR CHANGES WILL BE LOST     #
######################################################################################
#
# Check autossl excludes every hour via cron and
# Remove the excludes for domains that resolve to configured IP
# Remove the excludes for domains that resolve to a CF ip
# Remove exclude files for domains that do not exist anymore
# Add a '.permanent' extension to exclude files for domains that has been excluded for more than 30 days
# Ref SYSENG-14138
#

logfile="/var/log/checkautossl.log"
cloudflareipsfile="/var/cache/cloudflareips"
excluded_store="/var/cache/autossl_excluded"
# Number of days after which we give up checking for a domain and make it excluded permanently
expiry_period="30"
# Regex for verifying IP addresses
ipregex='^(0*(1?[0-9]{1,2}|2([0-4][0-9]|5[0-5]))\.){3}0*(1?[0-9]{1,2}|2([0-4][0-9]|5[0-5]))$'

_logger() {
  dstmp=$(date "+%b %d %T")
  echo "$dstmp $(hostname -s) /opt/bin/cron/check_autossl_excluded.sh: $1" >>${logfile}
}

# Function to check if resolving ip address belongs to one of the CF subnets
# It echos 1 if ip is a CF ip and 0 if its not
# If the file is absent or blank somehow, we run udpate cfips script to populate it and will manually echo 0
iscloudflareip() {
  if [ -s "${cloudflareipsfile}" ]; then
    iscloudflare=$(printf "from netaddr import IPAddress,IPNetwork\nwith open('${cloudflareipsfile}', 'r') as file1:\n\tlines=file1.readlines()\nfor line in lines:\n\t\tif IPAddress('$1') in IPNetwork(line):\n\t\t\tprint('1')\n\t\t\texit()\nprint('0')\n"|python3)
    echo $iscloudflare
  else
    /bin/bash /opt/bin/cron/updatecfips.sh
    echo 0
  fi
}

remove_exclude() {
  if [ "$1" == "parked" ]; then
    associated_domains="$2,www.$2,mail.$2"
  else
    associated_domains="$2,www.$2,mail.$2,cpanel.$2,webdisk.$2,webmail.$2,cpcontacts.$2,cpcalendars.$2,autodiscover.$2"
  fi
  domains_to_remove=$(echo "${associated_domains}"|sed 's/,/\&domain=/g')
  _logger "Removing ${associated_domains} from excludes for user $3"
  echo "${domains_to_remove}"
  /sbin/whmapi1 --output=jsonpretty remove_autossl_user_excluded_domains username="$user" domain="${domains_to_remove}"
  rm -f ${excluded_store}/$user/${domaintype}_${domain}
  /sbin/whmapi1 --output=jsonpretty start_autossl_check_for_one_user username="$user"
}

_logger "------------ NEW RUN -------------"

if ! [ -d "${excluded_store}" ]; then
  _logger "${excluded_store} not present, will create it for the next run..."
  mkdir -p "${excluded_store}"
  _logger "---------- END OF RUN ------------"
  exit
fi

find "${excluded_store}" -type d -depth 1 -empty -delete >/dev/null 2>&1
expiry_info=$(find "${excluded_store}" -type f ! -name "*.permanent" -mtime +"${expiry_period}" -exec mv -v {} {}.permanent \;)

if [ -n "${expiry_info}" ]; then
  _logger "Renaming these domain files and marking them as permanently excluded since these were created more than ${expiry_period} days ago"
  while read expiry_line; do
    _logger "${expiry_line}"
  done <<<"${expiry_info}"
fi

for user in $(ls -1 ${excluded_store}|tr -d "/");do
  _logger "Checking excludes for user $user"
  for dominfo in $(find ${excluded_store}/$user -type f -printf "%f\n"|grep -v "\.permanent"); do
    domain=$(echo "$dominfo"|awk -F"_" '{print $2}')
    configuredip=$(/sbin/whmapi1 --output=jsonpretty domainuserdata domain=${domain} | jq -r '.data|.userdata|.ip')
    if [ "$configuredip" == "null" ]; then
      _logger "Domain $domain not present on server, removing exclude file from store"
      rm -f "${excluded_store}/${user}/${dominfo}"
      continue
    fi
    domaintype=$(echo "$dominfo"|awk -F"_" '{print $1}')
    answer=$(dig +time=3 +tries=3 ${domain} A +noall +answer)
    if ! [ -n "${answer}" ]; then
      _logger "Domain $domain (User: $user, Type: $domaintype) does not resolve to a valid ip address yet"
      continue
    fi
    value=""
    while read line; do
      nfline=$(echo "$line"|awk '{print NF}')
      if [ "$nfline" -lt 4 ]; then
        continue
      fi
      type=$(echo "$line"|awk '{print $(NF-1)}')
      if [ "$type" == "CNAME" ];then
        value="${value}"$'\n'"$(echo $line|awk '{print $NF}'|sed 's/.$//')"
      else
        value="${value}"$'\n'"$(echo $line|awk '{print $NF}')"
      fi
    done <<<$answer
    resolvedip=$(echo "$value"|grep -v "^$")
    #resolvedip=$(dig +time=3 +tries=3 ${domain} A +short)
    num_chars_resolvedip=$(echo "${resolvedip}"|wc -c)
    if [ "${num_chars_resolvedip}" -lt 7 ]; then
      _logger "Domain $domain (User: $user, Type: $domaintype) does not resolve to a valid ip address yet"
      continue
    fi
    resolvediponeline=$(echo "${resolvedip}"|tr '\n' ','|sed 's/.$//')
    _logger "$domain (User:$user, Type:$domaintype) with configured IP $configuredip resolves to $resolvediponeline"

nresolvedip=$(echo "${resolvedip}"|wc -l)
    # If there is just one resolved ip
    if [ "$nresolvedip" -eq 1 ]; then
      # Do the checks only if its a valid IP address
      if [[ "${resolvedip}" =~ ${ipregex} ]]; then
        # If the one resolved ip is not same as the configured IP
        if [ "${configuredip}" != "${resolvedip}" ]; then
          cfstatus=$(iscloudflareip "${resolvedip}")
          if [ "$cfstatus" -eq 1 ]; then
            _logger "Removing ${domain} from excludes as ${resolvedip} is a CF ip"
            remove_exclude "${domaintype}" "${domain}" "${user}"
          fi
        # If configured ip is same as resolved ip
        else
          remove_exclude "${domaintype}" "${domain}" "${user}"
        fi
      else
        _logger "Ignoring $resip as its not a valid IP address"
      fi
    # If there are morethan one resolved ips
    else
      # Check if any of the resolved ips matches the configured IP or is a CF ip
      for resip in $(echo ${resolvedip}); do
        # If any of the entries is not an IP address(CNAME), skip all checks for it
        if ! [[ "$resip" =~ ${ipregex} ]]; then
          _logger "Ignoring $resip as its not a valid IP address"
          continue
        fi
        if [ "${configuredip}" != "${resip}" ]; then
          cfstatus=$(iscloudflareip "$resip")
          # If any of the resolved ips is a CF ip, no need to check more ips, remove exclude, log and exit for loop
          if [ "$cfstatus" -eq 1 ]; then
            _logger "Removing ${domain} from excludes as $resip is a CF ip"
            remove_exclude "${domaintype}" "${domain}" "${user}"
            break
          fi
        # If one of  the resolved IPs matches the configured IP
        else
          _logger "Removing ${domain} from excludes as ${resip} matches configured IP ${configuredip}"
          remove_exclude "${domaintype}" "${domain}" "${user}"
          break
        fi
      done
    fi

done
done

_logger "---------- END OF RUN ------------"