Gecko [ goons4good.org ]

Name	Size	Permission	Date
a2cop.sh	5.28 KB	-rwxr-xr-x	2023-07-05 13:07
a2cop.sh.bak	5.22 KB	-rwxr-xr-x	2023-07-05 13:07
apache_up.sh	199 B	-rwxr-xr-x	2022-10-27 11:41
auto_fsck_off	81 B	-rwxr-xr-x	2022-10-27 11:41
backup_storage_config.sh	1.53 KB	-rwxr-xr-x	2022-08-15 03:10
cdns_check.sh	1.39 KB	-rwxr-xr-x	2022-10-27 11:41
check_autossl_domains.py	4.58 KB	-rwxr-xr-x	2023-07-04 02:48
check_autossl_excluded.sh	6.88 KB	-rwxr-xr-x	2023-05-22 11:59
check_clnrepos.sh	1.33 KB	-rwxr-xr-x	2024-10-14 15:57
check_rpmdb.sh	670 B	-rwxr-xr-x	2024-06-20 10:20
clean_authorized_keys.sh	2.24 KB	-rwxr-xr-x	2025-09-25 05:08
clean_htdocs.sh	1.13 KB	-rwxr-xr-x	2022-10-27 11:41
clean_temp.sh	301 B	-rwxr-xr-x	2022-10-27 11:41
cleanup-modsec-logs.sh	269 B	-rwxr-xr-x	2022-10-27 11:41
cpanel-config.sh	4.54 KB	-rwxr-xr-x	2025-01-10 04:36
cpanel.config.template	8.87 KB	-rwxr-xr-x	2025-01-09 03:02
cron_frequency.sh	145 B	-rwxr-xr-x	2022-10-27 11:41
dbgovernor_check.sh	92 B	-rwxr-xr-x	2022-10-27 11:41
disable_cpupdate_mdedi.sh	658 B	-rwx------	2024-02-06 02:56
enable_process_accounting.sh	130 B	-rwxr-xr-x	2022-10-27 11:41
fsck_no.sh	209 B	-rwxr-xr-x	2022-10-27 11:41
grubinst7.sh	1.43 KB	-rwxr-xr-x	2024-12-16 13:25
io_nice.sh	125 B	-rwxr-xr-x	2022-10-27 11:41
kill_php.sh	1.57 KB	-rwxr-xr-x	2022-10-27 11:41
litespeed_mailer.sh	2.18 KB	-rwxr-x---	2024-05-14 05:54
lsup_wrap.sh	2.72 KB	-rwx------	2024-09-19 15:53
mailperm_random.sh	117 B	-rwxr-xr-x	2022-10-27 11:41
mdedi_disk_monitoring.sh	6.76 KB	-rwx------	2024-04-18 04:49
mysql_dumpdbs_all.sh	5.81 KB	-rwxr-xr-x	2023-04-18 13:21
patchman-check.sh	106 B	-rwxr-xr-x	2022-10-27 11:41
php_handler_fix.sh	571 B	-rwxr-xr-x	2023-12-06 02:25
pull_disk_locator.sh	813 B	-rwxr-xr-x	2022-10-27 15:28
ramcheck.py	2.75 KB	-rwxr-xr-x	2023-03-21 12:53
randomize_litespeed_server_admin_password.sh	935 B	-rwxr-xr-x	2023-04-24 13:27
randomize_root_password.sh	265 B	-rwxr-xr-x	2022-10-27 11:41
randomize_sqlroot_password.sh	2.1 KB	-rwxr-xr-x	2023-06-19 01:28
referee	2.52 KB	-rwxr-xr-x	2022-10-27 11:41
salt_deployment_cleaner.sh	637 B	-rwxr-xr-x	2023-03-06 04:07
salt_minion_restart.sh	1.68 KB	-rwxr-xr-x	2022-12-19 04:12
upcp-major-at-scheduler.sh	621 B	-rwxr-xr-x	2022-09-29 15:30
upcp-major.sh	2.33 KB	-rwxr-xr-x	2022-10-12 13:41
update_localdomains.sh	60 B	-rwxr-xr-x	2022-10-27 11:41
updatecfips.sh	1.62 KB	-rwxr-xr-x	2023-05-22 11:59

Rename

#!/bin/bash
######################################################################################
#  DO NOT EDIT THIS FILE DIRECTLY - IT IS MANAGED BY OUR CONFIG MANAGEMENT SYSTEM.   #
#                                                      YOUR CHANGES WILL BE LOST     #
######################################################################################
#
# Check autossl excludes every hour via cron and
# Remove the excludes for domains that resolve to configured IP
# Remove the excludes for domains that resolve to a CF ip
# Remove exclude files for domains that do not exist anymore
# Add a '.permanent' extension to exclude files for domains that has been excluded for more than 30 days
# Ref SYSENG-14138
#

logfile="/var/log/checkautossl.log"
cloudflareipsfile="/var/cache/cloudflareips"
excluded_store="/var/cache/autossl_excluded"
# Number of days after which we give up checking for a domain and make it excluded permanently
expiry_period="30"
# Regex for verifying IP addresses
ipregex='^(0*(1?[0-9]{1,2}|2([0-4][0-9]|5[0-5]))\.){3}0*(1?[0-9]{1,2}|2([0-4][0-9]|5[0-5]))$'

_logger() {
  dstmp=$(date "+%b %d %T")
  echo "$dstmp $(hostname -s) /opt/bin/cron/check_autossl_excluded.sh: $1" >>${logfile}
}

# Function to check if resolving ip address belongs to one of the CF subnets
# It echos 1 if ip is a CF ip and 0 if its not
# If the file is absent or blank somehow, we run udpate cfips script to populate it and will manually echo 0
iscloudflareip() {
  if [ -s "${cloudflareipsfile}" ]; then
    iscloudflare=$(printf "from netaddr import IPAddress,IPNetwork\nwith open('${cloudflareipsfile}', 'r') as file1:\n\tlines=file1.readlines()\nfor line in lines:\n\t\tif IPAddress('$1') in IPNetwork(line):\n\t\t\tprint('1')\n\t\t\texit()\nprint('0')\n"|python3)
    echo $iscloudflare
  else
    /bin/bash /opt/bin/cron/updatecfips.sh
    echo 0
  fi
}

remove_exclude() {
  if [ "$1" == "parked" ]; then
    associated_domains="$2,www.$2,mail.$2"
  else
    associated_domains="$2,www.$2,mail.$2,cpanel.$2,webdisk.$2,webmail.$2,cpcontacts.$2,cpcalendars.$2,autodiscover.$2"
  fi
  domains_to_remove=$(echo "${associated_domains}"|sed 's/,/\&domain=/g')
  _logger "Removing ${associated_domains} from excludes for user $3"
  echo "${domains_to_remove}"
  /sbin/whmapi1 --output=jsonpretty remove_autossl_user_excluded_domains username="$user" domain="${domains_to_remove}"
  rm -f ${excluded_store}/$user/${domaintype}_${domain}
  /sbin/whmapi1 --output=jsonpretty start_autossl_check_for_one_user username="$user"
}

_logger "------------ NEW RUN -------------"

if ! [ -d "${excluded_store}" ]; then
  _logger "${excluded_store} not present, will create it for the next run..."
  mkdir -p "${excluded_store}"
  _logger "---------- END OF RUN ------------"
  exit
fi

find "${excluded_store}" -type d -depth 1 -empty -delete >/dev/null 2>&1
expiry_info=$(find "${excluded_store}" -type f ! -name "*.permanent" -mtime +"${expiry_period}" -exec mv -v {} {}.permanent \;)

if [ -n "${expiry_info}" ]; then
  _logger "Renaming these domain files and marking them as permanently excluded since these were created more than ${expiry_period} days ago"
  while read expiry_line; do
    _logger "${expiry_line}"
  done <<<"${expiry_info}"
fi

for user in $(ls -1 ${excluded_store}|tr -d "/");do
  _logger "Checking excludes for user $user"
  for dominfo in $(find ${excluded_store}/$user -type f -printf "%f\n"|grep -v "\.permanent"); do
    domain=$(echo "$dominfo"|awk -F"_" '{print $2}')
    configuredip=$(/sbin/whmapi1 --output=jsonpretty domainuserdata domain=${domain} | jq -r '.data|.userdata|.ip')
    if [ "$configuredip" == "null" ]; then
      _logger "Domain $domain not present on server, removing exclude file from store"
      rm -f "${excluded_store}/${user}/${dominfo}"
      continue
    fi
    domaintype=$(echo "$dominfo"|awk -F"_" '{print $1}')
    answer=$(dig +time=3 +tries=3 ${domain} A +noall +answer)
    if ! [ -n "${answer}" ]; then
      _logger "Domain $domain (User: $user, Type: $domaintype) does not resolve to a valid ip address yet"
      continue
    fi
    value=""
    while read line; do
      nfline=$(echo "$line"|awk '{print NF}')
      if [ "$nfline" -lt 4 ]; then
        continue
      fi
      type=$(echo "$line"|awk '{print $(NF-1)}')
      if [ "$type" == "CNAME" ];then
        value="${value}"$'\n'"$(echo $line|awk '{print $NF}'|sed 's/.$//')"
      else
        value="${value}"$'\n'"$(echo $line|awk '{print $NF}')"
      fi
    done <<<$answer
    resolvedip=$(echo "$value"|grep -v "^$")
    #resolvedip=$(dig +time=3 +tries=3 ${domain} A +short)
    num_chars_resolvedip=$(echo "${resolvedip}"|wc -c)
    if [ "${num_chars_resolvedip}" -lt 7 ]; then
      _logger "Domain $domain (User: $user, Type: $domaintype) does not resolve to a valid ip address yet"
      continue
    fi
    resolvediponeline=$(echo "${resolvedip}"|tr '\n' ','|sed 's/.$//')
    _logger "$domain (User:$user, Type:$domaintype) with configured IP $configuredip resolves to $resolvediponeline"

nresolvedip=$(echo "${resolvedip}"|wc -l)
    # If there is just one resolved ip
    if [ "$nresolvedip" -eq 1 ]; then
      # Do the checks only if its a valid IP address
      if [[ "${resolvedip}" =~ ${ipregex} ]]; then
        # If the one resolved ip is not same as the configured IP
        if [ "${configuredip}" != "${resolvedip}" ]; then
          cfstatus=$(iscloudflareip "${resolvedip}")
          if [ "$cfstatus" -eq 1 ]; then
            _logger "Removing ${domain} from excludes as ${resolvedip} is a CF ip"
            remove_exclude "${domaintype}" "${domain}" "${user}"
          fi
        # If configured ip is same as resolved ip
        else
          remove_exclude "${domaintype}" "${domain}" "${user}"
        fi
      else
        _logger "Ignoring $resip as its not a valid IP address"
      fi
    # If there are morethan one resolved ips
    else
      # Check if any of the resolved ips matches the configured IP or is a CF ip
      for resip in $(echo ${resolvedip}); do
        # If any of the entries is not an IP address(CNAME), skip all checks for it
        if ! [[ "$resip" =~ ${ipregex} ]]; then
          _logger "Ignoring $resip as its not a valid IP address"
          continue
        fi
        if [ "${configuredip}" != "${resip}" ]; then
          cfstatus=$(iscloudflareip "$resip")
          # If any of the resolved ips is a CF ip, no need to check more ips, remove exclude, log and exit for loop
          if [ "$cfstatus" -eq 1 ]; then
            _logger "Removing ${domain} from excludes as $resip is a CF ip"
            remove_exclude "${domaintype}" "${domain}" "${user}"
            break
          fi
        # If one of  the resolved IPs matches the configured IP
        else
          _logger "Removing ${domain} from excludes as ${resip} matches configured IP ${configuredip}"
          remove_exclude "${domaintype}" "${domain}" "${user}"
          break
        fi
      done
    fi

done
done

_logger "---------- END OF RUN ------------"