#!/opt/imunify360/venv/bin/python3 # # imunify360-pam Python script to manage imunify360 pam module # enabled/diabled state. # import argparse import os import re import shutil import signal import subprocess import sys import traceback from collections import OrderedDict from configparser import ConfigParser from contextlib import closing, suppress from distutils.version import LooseVersion from enum import Enum from functools import lru_cache, wraps from pathlib import Path from string import Template from typing import Iterable, Tuple import yaml from pam_i360.internals import getLogger, logger_init, pam_imunify_config CONFIG_DOVECOT = "/etc/dovecot/dovecot.conf" CONFIG_DOVECOT_DATASTORE = "/var/cpanel/conf/dovecot/main" CONFIG_DOVECOT_BASEDIR = "/var/cpanel/templates/dovecot" CONFIG_DOVECOT_DEFAULT_SUFFIX = "2.3" CONFIG_DOVECOT_TMPL = "main.default" CONFIG_DOVECOT_LOCAL = "main.local" CONFIG_PAM_DOVECOT = "/etc/pam.d/dovecot_imunify" CONFIG_PAM_DOVECOT_DOMAINOWNER = "/etc/pam.d/dovecot_imunify_domainowner" CONFIG_PROFTPD = "/etc/proftpd.conf" CONFIG_PAM_PROFTPD = "/etc/pam.d/proftpd_imunify" CONFIG_PUREFTPD = "/etc/pure-ftpd.conf" CONFIG_TEMPLATE_PUREFTPD = "/var/cpanel/conf/pureftpd/local" CONFIG_PAM_PUREFTPD = "/etc/pam.d/pure-ftpd" CONFIG_IMUNIFY360 = "/etc/sysconfig/imunify360/imunify360-merged.config" LEVELDB = "/opt/i360_pam_imunify/db/leveldb" DOVECOT_LIB_IMUNIFY="lib_imunify360_%s.%s.%s.so" if os.path.exists("/etc/pam.d/common-auth"): # Debian-like DOVECOT_I360_DIR = "/usr/lib/i360_pam_imunify" DOVECOT_AUTH_DIR = "/lib64/dovecot/auth" else: # RHEL-like DOVECOT_I360_DIR = "/usr/lib64/i360_pam_imunify" DOVECOT_AUTH_DIR = "/usr/lib64/dovecot/auth" DOVECOT_LIB_LINK = os.path.join(DOVECOT_AUTH_DIR, "lib_imunify360.so") PAM_UNIX_REGEX = re.compile(r"auth\s+.+?\s+pam_unix\.so") # body of a dovecot passdb block, one level of nested braces is allowed # so that "lua_settings { ... }" stays inside the block PASSDB_BODY_REGEX = r"(?:[^{}]|\{[^{}]*\})*" # dovecot 2.4 accepts an optional instance name: "passdb cpauthd extra {" # dovecot 2.3: unnamed blocks, no nesting. \b so that a foreign driver whose # name merely starts with ours (driver = imunify360_of_someone_else) is not # swallowed by the removal - that pattern now runs against 2.4 files too. DOVECOT23_IMUNIFY_PASSDB_REGEX = r"passdb\s*\{\s*driver\s*=\s*imunify360\b[^}]*\}" # logger late init in order to let sigterm_handler() to break # logger_init() if needed logger = None class DovecotExeNotFound(Exception): pass class Imunify360DovecotNotFound(Exception): pass class DovecotState(Enum): DISABLED = 0 PAM = 1 NATIVE = 2 DOVECOT_STATES = { "disabled": DovecotState.DISABLED, "pam": DovecotState.PAM, "native": DovecotState.NATIVE, } class Output: def status_changed(self, services): enabled = [] already_enabled = [] disabled = [] already_disabled = [] services = OrderedDict(sorted(services.items(), key=lambda x: x[0])) for key, value in services.items(): enabled_prev, enabled_now = value if enabled_now: if enabled_prev: already_enabled.append(key) else: enabled.append(key) else: if not enabled_prev: already_disabled.append(key) else: disabled.append(key) message = None if len(enabled) > 0: message = "imunify360-pam (%s) is now enabled." % ", ".join(enabled) if len(already_enabled) > 0: message = "imunify360-pam (%s) is already enabled." % ", ".join( already_enabled ) if len(disabled) > 0: message = "imunify360-pam (%s) is now disabled." % ", ".join(disabled) if len(already_disabled) > 0: message = "imunify360-pam (%s) is already disabled." % ", ".join( already_disabled ) if message: self._print(message) def status(self, services): services = OrderedDict(sorted(services.items(), key=lambda x: x[1])) enabled = [key for key, value in services.items() if value] if len(enabled) > 0: self._print("status: enabled (%s)" % ", ".join(enabled)) else: self._print("status: disabled") def warning(self, *args, **kwargs): self._print("[WARNING]", *args, **kwargs) def error(self, *args, **kwargs): self._print("[ERROR]", *args, **kwargs) def run_and_log(self, *args, **kwargs): subprocess.run(*args, **kwargs) def flush(self): pass def _print(self, *args, **kwargs): print(*args, **kwargs) # duplicate to pam.log if args[0] == "[WARNING]": logfun = logger.warning args = args[1:] elif args[0] == "[ERROR]": logfun = logger.error args = args[1:] else: logfun = logger.info logfun(" ".join(args)) class YamlOutput(Output): def __init__(self): self._buffer = {} def flush(self): print(yaml.safe_dump(self._buffer, default_flow_style=False)) # duplicate to pam.log for k in ["status_changed", "status"]: if k in self._buffer: logger.info("%s=%r", k, self._buffer[k]) def status_changed(self, services): for service, value in services.items(): enabled_prev, enabled_now = value self._buffer.setdefault("status_changed", {})[service] = { "from": "enabled" if enabled_prev else "disabled", "to": "enabled" if enabled_now else "disabled", } def status(self, services): for service, enabled in services.items(): self._buffer.setdefault("status", {})[service] = ( "enabled" if enabled else "disabled" ) def warning(self, *args, **kwargs): self._buffer.setdefault("warnings", []).append(" ".join(args)) logger.warning(" ".join(args)) def error(self, *args, **kwargs): self._buffer.setdefault("errors", []).append(" ".join(args)) # catch message and backtrace for sentry logger.error(" ".join(args)) def run_and_log(self, cmd, *args, **kwargs): proc = subprocess.run( cmd, *args, **kwargs, stdin=subprocess.DEVNULL, # capture and combine both streams into one stdout=subprocess.PIPE, stderr=subprocess.STDOUT ) if proc.returncode != 0: self.warning("%s exit code %d" % (" ".join(cmd), proc.returncode)) if ( proc.returncode != 0 or options.verbose or pam_imunify_config().getboolean("verbose") ): self._buffer.setdefault("subprocess_call", []).append( { "cmd": " ".join(cmd), "returncode": proc.returncode, # .decode('ascii', errors='ignore') is to suppress # cPanel tools output colors "output": proc.stdout.decode("ascii", errors="ignore"), } ) # This function get CP name only @lru_cache(1) def get_cp_name(): panel = "generic" # cPanel check if os.path.isfile("/usr/local/cpanel/cpanel"): panel = "cpanel" # Plesk check elif os.path.isfile("/usr/local/psa/version"): panel = "plesk" # DirectAdmin check elif os.path.isfile("/usr/local/directadmin/directadmin"): panel = "directadmin" return panel @lru_cache() def get_dovecot_version(): dovecot_exe = shutil.which('dovecot') if dovecot_exe is None: raise DovecotExeNotFound("Dovecot executable not found in path") result = subprocess.check_output([dovecot_exe, "--version"]) version_str = result.decode().strip() match = re.match(r'^(\d+)\.(\d+)\.(\d+)', version_str) if match: major, minor, patch = map(int, match.groups()) return (major, minor, patch) return None def compare_dovecot_version( sign: str, major: int, minor: int, patch: int ) -> bool: current = get_dovecot_version() if current == None: raise ValueError("Failed to get dovecot version") target = (major, minor, patch) if sign == ">": return current > target elif sign == "<": return current < target elif sign == "=": return current == target elif sign == ">=": return current >= target elif sign == "<=": return current <= target else: raise ValueError( f"Invalid sign: {sign}. Use one of '>', '<', '=', '>=', '<='." ) def is_higher_than_dovecot24() -> bool: try: return compare_dovecot_version(">=", 2, 4, 0) except: return False def readlink_f(filename): """ Pythonic way of doing /bin/readlink --canonicalize filename and is needed for cPanel /etc/pam.d symlinks. """ try: result = os.readlink(filename) except OSError: # not a symlink return filename if os.path.isabs(result): return result else: return os.path.join(os.path.dirname(filename), result) def detect_conffiles(output=None): if not output: output = Output() if os.path.exists("/etc/pam.d/common-auth"): # debian, ubuntu conffiles = ("/etc/pam.d/common-auth",) else: conffiles = "/etc/pam.d/password-auth", "/etc/pam.d/system-auth" if not all(os.path.exists(conf) for conf in conffiles): output.error("PAM configuration file(s) not found: %s" % " ".join(conffiles)) sys.exit(1) return [readlink_f(fn) for fn in conffiles] def atomic_rewrite(filename, content, backup=True): """ Atomically rewrites filename with given content to avoid possible "No space left on device" or unintenrional PAM module break. Backup original file content to {filename}.i360bak :param backup: if False, skip creating .i360bak (used during reverse operations to preserve the original backup) """ if backup and os.path.exists(filename): shutil.copy(filename, filename + ".i360bak") tmp = filename + ".i360edit" with open(tmp, "wb" if isinstance(content, bytes) else "w") as tf: tf.write(content) try: st = os.stat(filename) except FileNotFoundError: pass else: os.fchmod(tf.fileno(), st.st_mode) os.fchown(tf.fileno(), st.st_uid, st.st_gid) ext = 3 while ext > 0: try: os.rename(tmp, filename) except OSError: ext = ext - 1 if ext == 0: output.error("Trouble in renaming of %s to %s" % (tmp, filename)) sys.exit(1) else: ext = 0 class i360RPatch: def __init__(self, conf_filename, output=None): self._conf_filename = conf_filename self.output = Output() if not output else output def filename(self): return os.path.join( os.path.dirname(self._conf_filename), ".%s.i360patch" % os.path.basename(self._conf_filename), ) def create_upon(self, content): cmd = ["/usr/bin/diff", "--unified=1", self._conf_filename, "-"] proc = subprocess.Popen( cmd, stdin=subprocess.PIPE, stdout=open(self.filename(), "w") ) proc.communicate(content.encode()) if proc.returncode != 1: # not a big deal: will use .i360bak as the last resort self.output.warning("'diff -u' error", file=sys.stderr) os.unlink(self.filename()) def apply(self): """ :raise CalledProcessError: """ cmd = ["/usr/bin/patch", "--reverse", self._conf_filename] subprocess.check_call( cmd, stdin=open(self.filename()), stdout=open("/dev/null", "w") ) os.unlink(self.filename()) def pam_unix_patch_around(pamconfig_lines, pam_unix_ln): match_offset = re.search( r"success=(\d)\s+default=ignore", pamconfig_lines[pam_unix_ln] ) patch_simple(pamconfig_lines, pam_unix_ln) pam_unix_ln += 1 if match_offset: fix_offset(pamconfig_lines, pam_unix_ln, int(match_offset.group(1))) def dovecot_manyconfigs_basedir() -> Tuple[Iterable[str], str]: """ As per DEF-18259 it comes out that dovecot config main.default and main.local files may reside in a directory /var/cpanel/conf/dovecot/main refers it via '_use_target_version: ...' :return: dovecot multiple configs basedir list and warning message if any """ result = set() warning_msg = None def check_and_use(path_): # unwind '/var/cpanel/templates/dovecot -> /var/cpanel/templates/dovecot2.3' path_ = readlink_f(path_) if os.path.exists(os.path.join(path_, CONFIG_DOVECOT_TMPL)): result.add(path_) return True return False check_and_use(CONFIG_DOVECOT_BASEDIR) check_and_use(CONFIG_DOVECOT_BASEDIR + CONFIG_DOVECOT_DEFAULT_SUFFIX) try: with open(CONFIG_DOVECOT_DATASTORE) as f: target_version = yaml.safe_load(f)["_use_target_version"] except (FileNotFoundError, UnicodeError, yaml.YAMLError) as e: warning_msg = "%s: %s" % (CONFIG_DOVECOT_DATASTORE, e) except KeyError: pass else: path_ = CONFIG_DOVECOT_BASEDIR + target_version if not check_and_use(path_): warning_msg = ( "%s '_use_target_version: %s' refers a non existent " "configuration file %r" % (CONFIG_DOVECOT_DATASTORE, target_version, path_) ) return result, warning_msg def named_passdb_regex(driver): """ Regex source of a whole dovecot 2.4 "passdb {...}" block. Deliberately no optional instance name. 252a5fa accepted one on the grounds that a cPanel template might write 'passdb cpauthd extra {', but no shipped template, rendered config or fixture does, and the restore in remove_imunify_passdb_modifications() substitutes globally: an instance it matched was overwritten with a copy of the first cpauthd block from main.default, losing whatever the server had there. A block we do not understand has to be left alone, not rewritten. """ return ( rf"passdb\s+{driver}\b" rf"\s*\{{{PASSDB_BODY_REGEX}\}}" ) def line_start_of(data, pos): """ Start of the line pos belongs to, as long as everything in front of pos on that line is indentation, pos itself otherwise. """ start = data.rfind("\n", 0, pos) + 1 return start if data[start:pos].strip() == "" else pos def drop_passdb_blocks(data, block_regex): """ Delete every block matching block_regex, without ever consuming a newline that belongs to the surrounding configuration. DEF-55117: the previous r'\n?\n?' pattern was not tied to the newlines insert_imunify_passdb() had actually written, so on a template where the block was not surrounded by exactly one newline on each side it ate the newline of the preceding line and glued it onto the next one ("##" + "passdb cpauthd {" -> "##passdb cpauthd {"), which cPanel then quarantined as an unparseable main.local and Dovecot refused to start. The only newlines removed here are: * the one terminating the block's own last line, * a single blank line next to the block (that is the separator insert_imunify_passdb() adds, above the check_only block and below the regular one), and * the line break in front of the block when the block ends the file, none of which can ever join two configuration tokens together. """ blank_line = r"[ \t]*\r?\n" pattern = ( # block ending the file: nothing can be glued to anything here rf"\r?\n[ \t]*{block_regex}[ \t]*(?:\r?\n)?\Z" # block standing on its own line(s): take the whole line, plus one # blank line next to it if there is one rf"|(?P(?:(?<=\n)|\A){blank_line})?" rf"^[ \t]*{block_regex}[ \t]*" rf"(?:(?P\r?\n)(?P{blank_line})?|\Z)" # block glued to something else: take the block only, keep every # newline around it rf"|{block_regex}" ) def replace(match): # a blank line on both sides means only one of them was ours if match.group("below") and match.group("above"): return match.group("below") return "" return re.sub(pattern, replace, data, flags=re.MULTILINE) def remove_imunify_passdb_modifications(local_data, template_data): """ Restore passdb configuration to original template state. Removes Imunify passdb blocks and restores modified cpauthd/dict passdb. """ if is_higher_than_dovecot24(): # Step 1: Remove all imunify360 passdb blocks local_data = drop_passdb_blocks(local_data, imunify_passdb_regex()) # Step 2: Get original cpauthd from template original_cpauthd = re.search( named_passdb_regex("cpauthd"), template_data, ) if original_cpauthd: # a plain string would make re.sub() interpret backslashes and # group references found in the template as substitutions original_block = original_cpauthd.group(0) restore = lambda _match: original_block # noqa: E731 # Replace pam passdb (PAM mode) with original cpauthd local_data = re.sub( named_passdb_regex("pam"), restore, local_data, ) # Replace modified cpauthd (NATIVE mode) with original local_data = re.sub( named_passdb_regex("cpauthd"), restore, local_data, ) else: # Older dovecot (simpler, no nested braces) # Step 1: Remove imunify360 blocks local_data = drop_passdb_blocks(local_data, imunify_passdb_regex()) # Step 2: Get original dict passdb from template original_passdb = re.search( r'passdb\s*\{\s*driver\s*=\s*dict[^}]*\}', template_data, re.DOTALL ) if original_passdb: original_block = original_passdb.group(0) restore = lambda _match: original_block # noqa: E731 # Replace pam passdb with original local_data = re.sub( r'passdb\s*\{\s*driver\s*=\s*pam[^}]*\}', restore, local_data, flags=re.DOTALL ) # Replace modified dict passdb with original local_data = re.sub( r'passdb\s*\{\s*driver\s*=\s*dict[^}]*\}', restore, local_data, flags=re.DOTALL ) return local_data def insert_imunify_passdb(data, output=None): if not output: output = Output() if is_higher_than_dovecot24(): # dovecot 2.4 passdb if not re.search( r"passdb\s*imunify360\s*\{", data, re.DOTALL ): # passdb is already in config match = re.search( r"passdb\s+cpauthd\s*\{(?:(?:[^{}]+|\{[^{}]*\})*)\}", data, re.DOTALL, ) if match: imunify_passdb_template = Template( "passdb $passdb_name {\n" " driver = imunify360\n" " fields {\n" " key=/opt/i360_pam_imunify/key\n" " secret=/opt/i360_pam_imunify/secret\n" " socket=/opt/i360_pam_imunify/pam_imunify360.sock" "$check_only" " }\n" "$result_action\n" "}" ) imunify_passdb = imunify_passdb_template.substitute( passdb_name="imunify360", check_only="\n", result_action=f" result_success = " f"[%IF allow_domainowner_mail_pass %]continue" f"[% ELSE %]return[% END %]" ) imunify_passdb_check_only = imunify_passdb_template.substitute( passdb_name="imunify360_check_only", check_only="\n check_only=1\n", result_action=" result_failure = return-fail\n", ) # insert imunify passdb after default passdb data_after = ( data[: match.end()] + "\n" + imunify_passdb + "\n" + data[match.end() :] ) # insert imunify_check_only passdb before default passdb, # in front of its indentation so that the line the default # passdb lives on is not split in two before = line_start_of(data, match.start()) return ( data_after[:before] + "\n" + imunify_passdb_check_only + "\n" + data_after[before:] ) else: # cpauthd passdb missing output.error( "PAM configuration file parse error: cpauthd missing" ) sys.exit(1) else: if not re.search( r"passdb\s*\{\s*driver\s*=\s*imunify360.*?}", data, re.DOTALL ): # passdb is already in config match = re.search( r"passdb\s*\{\s*driver\s*=\s*dict.*?}", data, re.DOTALL ) # find default passdb if match: imunify_passdb_template = Template( "passdb {\n" " driver = imunify360\n" " args = key=/opt/i360_pam_imunify/key \\\n" " secret=/opt/i360_pam_imunify/secret \\\n" " socket=/opt/i360_pam_imunify/pam_imunify360.sock" "$check_only" "$result_action\n" "}" ) data = ( data[: match.end()] + "\n" + imunify_passdb_template.substitute( check_only="\n", result_action=" result_success = continue" ) + "\n" + data[match.end() :] ) # insert imunify passdb after default passdb return ( data[: match.start()] + "\n" + imunify_passdb_template.substitute( check_only=" \\\n check_only=1\n", result_action=" result_failure = return-fail\n", ) + "\n" + data[match.start() :] # insert imunify passdb before default passdb ) else: # default passdb missing output.error("PAM configuration file parse error: passdb missing") sys.exit(1) # the imunify passdb is already there: hand the config back untouched. # Falling off the end here returned None, and the caller writes whatever # it gets into main.local - after open(..., "w") has already truncated it, # so the template was left at zero bytes. return data def ensure_dovecot_module_symlink(output): """ Ensure lib_imunify360.so points to a suitable lib in DOVECOT_I360_DIR based on the installed dovecot version. """ version = get_dovecot_version() if version is None: raise ValueError("failed to query dovecot version") major, minor, patch = version exact_name = DOVECOT_LIB_IMUNIFY % (major, minor, patch) src = os.path.join(DOVECOT_I360_DIR, exact_name) if not os.path.exists(src): raise Imunify360DovecotNotFound( "no suitable imunify360 dovecot library found in %s for version %s" % (DOVECOT_I360_DIR, version) ) dst_dir = DOVECOT_AUTH_DIR os.makedirs(dst_dir, exist_ok=True) dst = DOVECOT_LIB_LINK # If symlink already points to the exact version, skip updating if os.path.islink(dst): try: current_target = os.readlink(dst) if os.path.basename(current_target) == os.path.basename(src): logger.info( "symlink skipped: dovecot module points to the right version" ) return except OSError: pass with suppress(FileNotFoundError): os.unlink(dst) try: os.symlink(src, dst) logger.info("symlinked dovecot module: %s -> %s", dst, src) except OSError as e: output.error("failed to symlink %s -> %s: %s" % (dst, src, e)) raise e def patch_dovecot_config_template(dovecot_state: str, config_basedir: str): config_template = os.path.join(config_basedir, CONFIG_DOVECOT_TMPL) config_local = os.path.join(config_basedir, CONFIG_DOVECOT_LOCAL) is_dovecot24 = is_higher_than_dovecot24() if is_dovecot24: passdb_regex = re.compile( r"^\s*passdb\s*cpauthd(?:\s+\w+)?\s*\{(?:[^{}]|\{[^{}]*\})*\}\s*$", re.DOTALL | re.MULTILINE ) else: passdb_regex = re.compile(r"^\s*passdb\s*\{.*?\}\s*$", re.DOTALL | re.MULTILINE) if dovecot_state == DovecotState.PAM or dovecot_state == DovecotState.NATIVE: def passdb_replace(match): repl = None if dovecot_state == DovecotState.PAM: if is_dovecot24: repl = re.sub( r"passdb\s*cpauthd\s*\{", "passdb pam {", match.group(0) ) repl = re.sub( r"^\s*driver\s*=.*$", r" service_name = " r"[% IF allow_domainowner_mail_pass %]" r"dovecot_imunify_domainowner" r"[% ELSE %]dovecot_imunify[% END %]", repl, flags=re.MULTILINE ) repl = re.sub(r"^\s*lua_file\s*=.*\n", "", repl, flags=re.MULTILINE ) repl = re.sub( r"^\s*lua_settings\s*\{[^}]*\}\s*\n", "", repl, flags=re.MULTILINE | re.DOTALL ) else: repl = re.sub(r"driver\s*=.*", "driver = pam", match.group(0)) repl = re.sub( r"args\s*=.*", r"args = " r"[% IF allow_domainowner_mail_pass %]" r"dovecot_imunify_domainowner" r"[% ELSE %]dovecot_imunify[% END %]", repl, ) if dovecot_state == DovecotState.NATIVE: repl = re.sub( r"result_internalfail\s*=.*", "result_success = continue-ok", match.group(0), ) repl = re.sub( r"result_failure\s*=.*", "result_failure = continue-fail", repl ) return repl if is_dovecot24 and os.path.exists(config_local): local_data = Path(config_local).read_text() template_data = Path(config_template).read_text() data = remove_imunify_passdb_modifications( local_data, template_data ) else: data = Path(config_template).read_text() data = re.sub(passdb_regex, passdb_replace, data) if dovecot_state == DovecotState.NATIVE: data = insert_imunify_passdb(data) if not options.dry: # never truncate main.local in place: a failure between the open() # and the write() used to leave dovecot with an empty template atomic_rewrite(config_local, data, backup=False) else: return elif dovecot_state == DovecotState.DISABLED: if is_dovecot24 is False: if not options.dry: with suppress(FileNotFoundError): os.unlink(config_local) return if os.path.exists(config_local) and not options.dry: local_data = Path(config_local).read_text() template_data = Path(config_template).read_text() data = remove_imunify_passdb_modifications( local_data, template_data ) atomic_rewrite(config_local, data, backup=False) def imunify_passdb_regex(): """ Regex of every passdb block we insert, dovecot 2.3 and 2.4 form both. DEF-55312: deliberately not chosen by the running dovecot version. This runs in the middle of a cPanel dovecot upgrade, where the binary can already be 2.4 while main.local and dovecot.conf still hold whatever the previous package rendered - a block in the other form would survive the removal and leave dovecot asking for a driver whose module we are about to unlink. Both alternatives are anchored on "imunify360", so neither can match a cpauthd, dict or pam block. """ return "(?:%s|%s)" % ( named_passdb_regex(r"imunify360(?:_check_only)?"), DOVECOT23_IMUNIFY_PASSDB_REGEX, ) # what actually makes dovecot go looking for our module, in either config # format. Deliberately not a "imunify360" substring test: that also fires on a # comment and on a foreign block the remover correctly leaves alone # (passdb imunify360_of_someone_else { driver = lua }), and a disable can then # never be reported as finished. A block of ours that has lost this line no # longer asks for the driver either - it is a broken passdb, which dovecot # rejects loudly, not a silently missing module. # Not anchored to the start of the line either: a one-line # "passdb { driver = imunify360 }" still asks for the driver. Only a '#' in # front of it on its own line turns it into a comment, and a comment that an # admin leaves behind ("# driver = imunify360 removed") must not keep every # later disable failing. IMUNIFY_DRIVER_REGEX = r"^[^#\n]*\bdriver\s*=\s*imunify360\b" def names_imunify_driver(text): return re.search(IMUNIFY_DRIVER_REGEX, text, re.MULTILINE) is not None def files_naming_imunify_driver(manyconfigs): """ The dovecot configuration files that still ask for our driver. A file we could not read counts as naming it. This is the check that decides whether the module link may go, and "I could not look" is not "it is clean" - answering clean there is how a disable reports success over a configuration that then has no module to answer it. A file that is not there at all is genuinely clean. """ files = [CONFIG_DOVECOT] + [ os.path.join(basedir, CONFIG_DOVECOT_LOCAL) for basedir in manyconfigs ] named = [] for filename in files: try: data = Path(filename).read_text() except FileNotFoundError: continue except (OSError, UnicodeError) as e: logger.warning("cannot read %s: %s", filename, e) named.append(filename) continue if names_imunify_driver(data): named.append(filename) return named # every systemd ActiveState that positively means "not running". Anything # else - an unknown unit, an empty answer, a systemctl that cannot reach # systemd - is "cannot tell", and that keeps the old behaviour of restarting. # Getting this list short is not safe: a state missing from it reads as # running, and on the dovecot-reset path that starts dovecot in the middle of # a package transaction, which is the outage this all exists to prevent. SYSTEMCTL_NOT_RUNNING = ( b"inactive", b"failed", b"deactivating", b"maintenance", ) def dovecot_service_active(): """Is dovecot running? When that cannot be told, say yes (restart, as before).""" try: proc = subprocess.run( ["systemctl", "is-active", "dovecot"], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=10, ) except (OSError, subprocess.SubprocessError): return True return proc.stdout.strip() not in SYSTEMCTL_NOT_RUNNING def restart_dovecot(output, only_if_running=False): if not os.path.isfile("/scripts/restartsrv_dovecot"): return if only_if_running and not dovecot_service_active(): output.warning( "dovecot is not running, not starting it from here; the package " "transaction that stopped it starts it again at its end" ) return output.run_and_log(["/scripts/restartsrv_dovecot"]) def remove_imunify_from_live_config(output): """ DEF-55147: inside a cpanel-dovecot upgrade /scripts/builddovecotconf refuses every render (pigeonhole's settings plugin is still the old ABI until it is installed), so the file dovecot actually reads is edited here. cPanel's %posttrans re-renders it from main.local at the end of the transaction. """ try: data = Path(CONFIG_DOVECOT).read_text() except FileNotFoundError: return except (OSError, UnicodeError) as e: # left as found; files_naming_imunify_driver() counts an unreadable # file as naming our driver, so the caller fails before the unlink output.error("left %s alone: cannot read it: %s" % (CONFIG_DOVECOT, e)) return if not names_imunify_driver(data): return new = drop_passdb_blocks(data, imunify_passdb_regex()) if names_imunify_driver(new): # a block we could not match survives. Writing the half of the edit we # did manage would leave the file modified and still asking for the # driver; the caller reports the failure and the file stays as found output.error( "left %s alone: a passdb of ours in it cannot be removed safely" % CONFIG_DOVECOT ) return atomic_rewrite(CONFIG_DOVECOT, new) output.warning("removed our passdb from %s directly" % CONFIG_DOVECOT) def disable_dovecot_native(output): """ DEF-55147: there is no module for the running dovecot, so nothing may keep asking for our driver - neither main.local nor the live dovecot.conf. """ manyconfigs, warn = dovecot_manyconfigs_basedir() if warn: output.warning(warn) for config_basedir in manyconfigs: patch_dovecot_config_template(DovecotState.DISABLED, config_basedir) if not options.dry: remove_imunify_from_live_config(output) # cPanel renders the live config from the template we just cleaned, so the # rebuild has to happen before anything is checked rebuild = not options.norestart and not options.dry if rebuild and os.path.isfile("/scripts/builddovecotconf"): output.run_and_log(["/scripts/builddovecotconf"]) # DEF-55312: verified before the module link goes and before dovecot is # restarted. A configuration we could not clean has to be left exactly as # it was found - restarting it onto a driver whose module we just removed # is the outage, not the report of it. still = [] if options.dry else files_naming_imunify_driver(manyconfigs) if still: output.error( "dovecot-native could not be disabled: %s still names our driver; " "the module is left in place and dovecot is not restarted" % ", ".join(still) ) sys.exit(1) if not options.dry: with suppress(FileNotFoundError): logger.info("Unlinking dovecot %s", DOVECOT_LIB_LINK) os.unlink(DOVECOT_LIB_LINK) if rebuild: restart_dovecot(output, only_if_running=True) if not options.dry: output.status_changed({"dovecot-native": (True, False)}) def change_dovecot_state(dovecot_state, output=None, only_restart_if_running=False): """ Enable or disable pam_imunify support for Dovecot """ if not output: output = Output() manyconfigs, warn = dovecot_manyconfigs_basedir() if warn: output.warning(warn) if len(manyconfigs) == 0: output.error("Dovecot config template file not found. Aborting.") sys.exit(1) for config_basedir in manyconfigs: patch_dovecot_config_template(dovecot_state, config_basedir) if not options.norestart: if os.path.isfile("/scripts/builddovecotconf"): output.run_and_log(["/scripts/builddovecotconf"]) restart_dovecot(output, only_if_running=only_restart_if_running) def service_incompatibility_panic(msg): """ So far we decided to report service incompatibility error as warning, with the only exception for --dry-run option. Otherwise we break agent PAM subsystem loop with the error when a client copied imunify360-merged.config from one server to another server in a case when the first server is compatible with that PAM integration feature but the second server is not capable with. """ if options.dry: output.error(msg) sys.exit(1) else: output.warning(msg) sys.exit(0) def cpanel_only_feature(service): def decorator(fun): @wraps(fun) def wrapper(*args, **kwargs): if get_cp_name() != "cpanel": service_incompatibility_panic( "%s is not supported for %s." % (service, get_cp_name().capitalize()) ) else: return fun(*args, **kwargs) return wrapper return decorator def toggle_proftpd_support(enable=True, output=None): """ Enable or disable pam_imunify support for ProFTPd """ conf = CONFIG_PROFTPD if not os.path.isfile(conf): output.error("ProFTPD config file not found. Aborting.") sys.exit(1) if enable: version_output = subprocess.check_output( [ "in.proftpd" if get_cp_name() == "plesk" else "proftpd", "--version-status", ], stderr=subprocess.DEVNULL, ).decode(sys.stdout.encoding) if "mod_auth_pam" not in version_output: service_incompatibility_panic( "ProFTPD built without PAM support. " "pam_imunify for FTP is NOT enabled." ) version_regex = re.compile(r"ProFTPD Version:\s([0-9a-z\.]+)") version_found = version_regex.search(version_output) if version_found: version = LooseVersion(version_found.group(1)) if version < LooseVersion("1.3.6c") or version.vstring.startswith( "1.3.6rc" ): if get_cp_name() == "cpanel": service_incompatibility_panic( "ProFTPD needs to be upgraded to " "cPanel version 88 or higher. " "pam_imunify for FTP is NOT enabled." ) else: service_incompatibility_panic( "ProFTPD needs to be upgraded. " "pam_imunify for FTP is NOT enabled." ) if not output: output = Output() authpam_imunify = ( "AuthOrder mod_auth_pam.c* mod_auth_file.c\n" "AuthPAM on\n" "AuthPAMConfig proftpd_imunify\n" ) authpam_regex = re.compile(r"(^AuthPAM.*\n?)+", re.MULTILINE) data = open(conf).read() authpam_found = authpam_regex.search(data) if enable: if authpam_found: authpam_span = authpam_found.span() data = data[: authpam_span[0]] + authpam_imunify + data[authpam_span[1] :] else: data = authpam_imunify + "\n" + data if not options.dry: atomic_rewrite(conf, data) else: return else: conf_bak = conf + ".i360bak" if os.path.isfile(conf_bak): os.rename(conf_bak, conf) else: output.error( "Failed to disable proftpd integration: %s not found" % conf_bak ) sys.exit(1) if os.path.isfile("/scripts/restartsrv_ftpd"): output.run_and_log(["/scripts/restartsrv_ftpd"]) def file_patchline(config: str, pattern, repl: bytes, reverse: bool) -> bool: """ Patch config file line inplace and backup config to '%s.i360bak' % config :param config: file path :param pattern: re.compile(b'...') result type :param reverse: revert back the previos operation on the same config file :return: True if the file was changed, False otherwise """ if reverse: # lookup replacement in config_i360bak try: with open("%s.i360bak" % config, "rb") as f: repl = next(ln for ln in f if re.match(pattern, ln)).rstrip(b"\n") except (FileNotFoundError, StopIteration): # there were no such entry before us repl = b"" if os.path.exists(config): with open(config, "rb") as f: conf_before = f.read() first_done = False def _replace_first(match): nonlocal first_done if not first_done: first_done = True return repl return b"" conf_after = pattern.sub(_replace_first, conf_before) if conf_after == conf_before and repl and repl not in conf_after: conf_after = ( conf_before + (b"" if conf_before.endswith(b"\n") else b"\n") + repl ) if conf_after != conf_before: atomic_rewrite(config, conf_after, backup=not reverse) return True return False else: atomic_rewrite(config, repl, backup=not reverse) return True def is_pureftpd_supported(): # Pure-FTPd writes output to stdin, so we have to use # pipes to read from stdin afterwards... pipe_r, pipe_w = map(os.fdopen, os.pipe()) def finalize(): pipe_w.close() pipe_r.close() try: subprocess.check_output( ["pure-ftpd", "-l", "pam"], stdin=pipe_w, stderr=subprocess.STDOUT, timeout=1, ) except subprocess.CalledProcessError: # after pipe_w.close() we can do pipe_r.read() pipe_w.close() with closing(pipe_r): # 421 Unknown authentication method: pam if pipe_r.read().startswith("421 "): return False except subprocess.TimeoutExpired: # This could happen if pam is supported # and pure-ftpd has started finalize() else: finalize() return True def is_pureftpd_enabled(): """ Check if pure-ftpd.conf contains /var/run/ftpd.imunify360.sock """ if not os.path.isfile(CONFIG_PUREFTPD): return False imunify360_regex = re.compile( rb"^(?!#).*\/var\/run\/ftpd.imunify360.sock", re.MULTILINE ) return imunify360_regex.search( open(CONFIG_PUREFTPD, "rb").read()) is not None def toggle_pureftpd_conf_support(enable, output): extauth_regex = re.compile(rb"^\s*ExtAuth\s.*$", re.MULTILINE) extauth_imunify = b"ExtAuth /var/run/ftpd.imunify360.sock" changed = file_patchline(CONFIG_PUREFTPD, extauth_regex, extauth_imunify, reverse=enable is False) if changed and not options.norestart_pureftpd and \ os.path.isfile("/scripts/restartsrv_ftpd"): output.run_and_log(["/scripts/restartsrv_ftpd"]) def toggle_pureftpd_cpanel_support(enable, output): extauth_regex = re.compile(rb"^\s*ExtAuth:\s.*$", re.MULTILINE) extauth_imunify = b"ExtAuth: /var/run/ftpd.imunify360.sock" changed = file_patchline(CONFIG_TEMPLATE_PUREFTPD, extauth_regex, extauth_imunify, reverse=enable is False) if changed and os.path.isfile("/scripts/setupftpserver"): output.run_and_log(["/usr/local/cpanel/scripts/setupftpserver", "--force", "pure-ftpd"]) def disable_ftp_protection(): if not os.path.exists(CONFIG_IMUNIFY360): return ftp_protection_pattern = re.compile( rb"^(?!#)([^\S\r\n]*ftp_protection:[^\S\r\n])*true", re.MULTILINE ) def replacement(match): return match.group(1) + b'false' with open(CONFIG_IMUNIFY360, "rb") as f: contents = f.read() if ftp_protection_pattern.search(contents): disabled_ftp_content = re.sub( ftp_protection_pattern, replacement, contents, count=1 ) atomic_rewrite(CONFIG_IMUNIFY360, disabled_ftp_content) def toggle_pureftpd_support(enable=True, output=None): """ Enable or disable pam_imunify support for PureFTPd """ conf = CONFIG_PUREFTPD if not os.path.isfile(conf): output.error("Pure-FTPd config file not found. Aborting.") sys.exit(1) if enable: if not is_pureftpd_supported(): service_incompatibility_panic( "Pure-FTPd built without PAM support. " "pam_imunify for FTP is NOT enabled." ) # ensure that ftp_protection is disabled in imunify360-merged.config if enable is False: disable_ftp_protection() if not output: output = Output() if options.dry: return toggle_pureftpd_conf_support(enable, output) def toggle_sshd_support(conffiles, enable=True, output=None): """ Enable or disable pam_imunify module for sshd authentication """ if not output: output = Output() if enable: for conf in conffiles: lines = open(conf).readlines() try: pam_unix_ln = next( ln for ln, line in enumerate(lines) if PAM_UNIX_REGEX.search(line) ) except StopIteration: output.error("PAM configuration file %s parse error" % conf) sys.exit(1) pam_unix_patch_around(lines, pam_unix_ln) content = "".join(lines) i360RPatch(conf, output).create_upon(content) if not options.dry: atomic_rewrite(conf, content) else: for conf in conffiles: rpatch = i360RPatch(conf, output) if os.path.exists(rpatch.filename()): try: rpatch.apply() continue except subprocess.CalledProcessError as e: output.warning( "'patch -R' was not successful: %s" % e, file=sys.stderr ) else: output.warning( "File not found: %s" % rpatch.filename(), file=sys.stderr ) atomic_rewrite(conf, open(conf + ".i360bak").read()) def set_panel_integration(confs, output=None): imunify_regex = re.compile(r"auth\s+sufficient\s+pam_imunify\.so") assert get_cp_name() == "cpanel", "The only supported integration so far." if not output: output = Output() for conf in confs: lines = open(conf).readlines() try: imunify_ln = next( ln for ln, line in enumerate(lines) if imunify_regex.search(line) ) except StopIteration: output.error("PAM configuration file %s parse error" % conf) sys.exit(1) match_count = 0 def panel_replace(match): nonlocal match_count if match.group() in ["cpanel", "plesk", "directadmin"]: match_count += 1 return get_cp_name() return match.group() lines[imunify_ln] = re.sub(r"\b([^\s]+)\b", panel_replace, lines[imunify_ln]) if match_count == 0: lines[imunify_ln] = "%s %s\n" % (lines[imunify_ln].strip(), get_cp_name()) content = "".join(lines) atomic_rewrite(conf, content) os.unlink(conf + ".i360bak") def patch_simple(pamconfig_lines, pam_unix_ln): pamconfig_lines.insert(pam_unix_ln + 1, "auth\trequired\tpam_imunify.so\n") pamconfig_lines.insert(pam_unix_ln, "auth\trequired\tpam_imunify.so\tcheck_only\n") def fix_offset(pamconfig_lines, pam_unix_ln, pam_unix_success_offset): bump_to = pam_unix_success_offset + 1 pamconfig_lines[pam_unix_ln] = re.sub( r"success=\d", "success=%d" % bump_to, pamconfig_lines[pam_unix_ln] ) def config_dovecot_state(): """ Read dovecot state from imunify360-merged.config :return: DovecotState based on exim_dovecot_native and exim_dovecot_protection: - NATIVE if exim_dovecot_native is true - PAM if exim_dovecot_protection is true - DISABLED if both are false Returns None if config file doesn't exist or can't be parsed """ if not os.path.exists(CONFIG_IMUNIFY360): return None try: with open(CONFIG_IMUNIFY360, "r") as f: config = yaml.safe_load(f) if not config: return None pam_config = config.get("PAM", {}) exim_dovecot_native = pam_config.get("exim_dovecot_native", False) exim_dovecot_protection = pam_config.get( "exim_dovecot_protection", False ) if exim_dovecot_native and exim_dovecot_protection: return DovecotState.NATIVE if exim_dovecot_protection: return DovecotState.PAM return DovecotState.DISABLED except (yaml.YAMLError, IOError, KeyError) as e: logger.warning( "Failed to read dovecot stats from %s: %s", CONFIG_IMUNIFY360, e ) return None def dovecot_state(): pam_dovecot_enabled = ( os.path.isfile(CONFIG_DOVECOT) and "dovecot_imunify" in open(CONFIG_DOVECOT).read() ) native_dovecot_enabled = ( os.path.isfile(CONFIG_DOVECOT) and "imunify360" in open(CONFIG_DOVECOT).read() ) if pam_dovecot_enabled: return DovecotState.PAM elif native_dovecot_enabled: return DovecotState.NATIVE else: return DovecotState.DISABLED class Cmd: @classmethod def enable(cls, conffiles, output=None): if not output: output = Output() if any("pam_imunify.so" in open(conf).read() for conf in conffiles): cls._cphulk_check() output.status_changed({"sshd": (True, True)}) return toggle_sshd_support(conffiles, True, output) if not options.dry: cls._cphulk_check(output) output.status_changed({"sshd": (False, True)}) @staticmethod @cpanel_only_feature("Dovecot") def set_dovecot(conffiles, output=None): if not output: output = Output() target_dovecot_state = DOVECOT_STATES[options.dovecot_state] if target_dovecot_state: prev_dovecot_state = dovecot_state() if prev_dovecot_state != target_dovecot_state: set_panel_integration( [CONFIG_PAM_DOVECOT, CONFIG_PAM_DOVECOT_DOMAINOWNER], output ) if not options.dry \ and target_dovecot_state == DovecotState.NATIVE: try: ensure_dovecot_module_symlink(output) except Imunify360DovecotNotFound as e: output.error("Missing imunify360 dovecot-native:%s" % e) sys.exit(1) change_dovecot_state(target_dovecot_state, output) if target_dovecot_state in [DovecotState.PAM, DovecotState.NATIVE]: output.status_changed( { "dovecot-{}".format(options.dovecot_state): ( prev_dovecot_state == target_dovecot_state, True, ) } ) else: output.status_changed( {"dovecot": (prev_dovecot_state != target_dovecot_state, False)} ) else: output.error("Unexpected dovecot state {}".format(options.dovecot_state)) @staticmethod @cpanel_only_feature("Dovecot") def dovecot_native(output=None): if not output: output = Output() if not options.dry: ensure_dovecot_module_symlink(output) @staticmethod @cpanel_only_feature("Dovecot") def dovecot_reset(conffiles, output=None): if not output: output = Output() logger.info("Resetting dovecot state") current_config_state = config_dovecot_state() imunify360DovecotLinkMissing = False try: ensure_dovecot_module_symlink(output) except Imunify360DovecotNotFound as e: imunify360DovecotLinkMissing = True logger.info("no dovecot module for the running dovecot: %s", e) # DEF-55147: decide on the files dovecot reads, not on the agent's # merged config - it has been seen to say something else at # exactly this moment, which left main.local asking for a driver # that no longer had a module manyconfigs, _warn = dovecot_manyconfigs_basedir() if files_naming_imunify_driver(manyconfigs): disable_dovecot_native(output) elif not options.dry: with suppress(FileNotFoundError): logger.info("Unlinking dovecot %s", DOVECOT_LIB_LINK) os.unlink(DOVECOT_LIB_LINK) # DEF-55147: this runs from cpanel-dovecot's %triggerin, with dovecot # stopped by that package's %pre - do not start it from here if current_config_state == DovecotState.PAM: change_dovecot_state(DovecotState.DISABLED, output, only_restart_if_running=True) change_dovecot_state(DovecotState.PAM, output, only_restart_if_running=True) output.status_changed({f"dovecot-pam": (False, True)}) elif current_config_state == DovecotState.NATIVE \ and imunify360DovecotLinkMissing is False: change_dovecot_state(DovecotState.DISABLED, output, only_restart_if_running=True) change_dovecot_state(DovecotState.NATIVE, output, only_restart_if_running=True) output.status_changed({f"dovecot-native": (False, True)}) return @staticmethod @cpanel_only_feature("ProFTPd") def enable_proftpd(conffiles, output=None): if not output: output = Output() set_panel_integration([CONFIG_PAM_PROFTPD], output) proftpd_enabled = ( os.path.isfile(CONFIG_PROFTPD) and "proftpd_imunify" in open(CONFIG_PROFTPD).read() ) if not proftpd_enabled: toggle_proftpd_support(True, output) if not options.dry: output.status_changed({"ftp": (proftpd_enabled, True)}) @staticmethod @cpanel_only_feature("Pure-FTPd") def enable_pureftpd(conffiles, output=None): if not output: output = Output() panel = get_cp_name() pureftpd_enabled = is_pureftpd_enabled() if not pureftpd_enabled: toggle_pureftpd_support(True, output) if not options.dry: output.status_changed({"ftp": (pureftpd_enabled, True)}) @staticmethod def disable_all(conffiles, output=None): if not output: output = Output() dovecot_enabled = dovecot_state() != DovecotState.DISABLED proftpd_enabled = ( os.path.isfile(CONFIG_PROFTPD) and "proftpd_imunify" in open(CONFIG_PROFTPD).read() ) pureftpd_enabled = is_pureftpd_enabled() sshd_enabled = any("pam_imunify.so" in open(conf).read() for conf in conffiles) if dovecot_enabled: change_dovecot_state(DovecotState.DISABLED, output) if proftpd_enabled: toggle_proftpd_support(False, output) if pureftpd_enabled: toggle_pureftpd_support(False, output) if sshd_enabled: toggle_sshd_support(conffiles, False, output) output.status_changed( { "sshd": (sshd_enabled, False), "dovecot": (dovecot_enabled, False), "ftp": (proftpd_enabled or pureftpd_enabled, False), } ) @staticmethod def disable(conffiles, output=None): if not output: output = Output() sshd_enabled = any("pam_imunify.so" in open(conf).read() for conf in conffiles) if sshd_enabled: toggle_sshd_support(conffiles, False, output) output.status_changed({"sshd": (sshd_enabled, False)}) @staticmethod def disable_proftpd(conffiles, output=None): if not output: output = Output() proftpd_enabled = ( os.path.isfile(CONFIG_PROFTPD) and "proftpd_imunify" in open(CONFIG_PROFTPD).read() ) if proftpd_enabled: toggle_proftpd_support(False, output) output.status_changed({"ftp": (proftpd_enabled, False)}) @staticmethod def disable_pureftpd(conffiles, output=None): if not output: output = Output() pureftpd_enabled = is_pureftpd_enabled() if pureftpd_enabled: toggle_pureftpd_support(False, output) output.status_changed({"ftp": (pureftpd_enabled, False)}) @staticmethod @cpanel_only_feature("FTP service") def enable_ftp(conffiles, output=None): if not output: output = Output() with open("/var/cpanel/cpanel.config", "r") as cpcfg: data = cpcfg.read() if "ftpserver=proftpd" in data: Cmd.enable_proftpd(conffiles, output) elif "ftpserver=pure-ftpd" in data: Cmd.enable_pureftpd(conffiles, output) else: service_incompatibility_panic("No supported FTP found.") @staticmethod def disable_ftp(conffiles, output=None): if not output: output = Output() proftpd_enabled = ( os.path.isfile(CONFIG_PROFTPD) and "proftpd_imunify" in open(CONFIG_PROFTPD).read() ) pureftpd_enabled = is_pureftpd_enabled() if proftpd_enabled: toggle_proftpd_support(False, output) if pureftpd_enabled: toggle_pureftpd_support(False, output) output.status_changed({"ftp": (proftpd_enabled or pureftpd_enabled, False)}) @classmethod def status(cls, conffiles, output=None): if not output: output = Output() dovecot_enabled = dovecot_state() != DovecotState.DISABLED sshd_enabled = any("pam_imunify.so" in open(conf).read() for conf in conffiles) proftpd_enabled = ( os.path.isfile(CONFIG_PROFTPD) and "proftpd_imunify" in open(CONFIG_PROFTPD).read() ) pureftpd_enabled = is_pureftpd_enabled() if dovecot_enabled or sshd_enabled or proftpd_enabled or pureftpd_enabled: cls._cphulk_check(output) output.status( { "sshd": sshd_enabled, "dovecot-pam": dovecot_state() == DovecotState.PAM, "dovecot-native": dovecot_state() == DovecotState.NATIVE, "ftp": proftpd_enabled or pureftpd_enabled, } ) @staticmethod def state_reset(*_): subprocess.check_call(["service", "imunify360-pam", "stop"]) shutil.rmtree(LEVELDB) logger.info("rm -rf %s", LEVELDB) subprocess.check_call(["service", "imunify360-pam", "start"]) @staticmethod def _cphulk_check(output=None): if not os.path.isfile("/usr/sbin/whmapi1"): return if not options.verbose and not pam_imunify_config().getboolean("verbose"): return if not output: output = Output() proc = subprocess.run( ["whmapi1", "servicestatus", "service=cphulkd"], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, ) if proc.returncode != 0: # we expect err dump is printed to stderr return try: status = yaml.safe_load(proc.stdout) if status["data"]["service"][0]["enabled"]: output.warning("cPHulk is enabled", file=sys.stderr) except (yaml.YAMLError, IndexError, KeyError) as e: output.warning("whmapi error:", e, file=sys.stderr) def sigterm_handler(signum, frame): """ generate backtrace on SIGTERM """ traceback.print_stack(frame, file=sys.stderr) print("caught SIGTERM.", file=sys.stderr) if logger is not None: logger.fatal("caught SIGTERM.") sys.exit(15) if __name__ == "__main__": def add_opt_args(parser): parser.add_argument( "-r", "--dry-run", dest="dry", action="store_true", help="Dry run the command, whithout changing of state", ) parser.add_argument( "-n", "--no-restart", dest="norestart", action="store_true", help="Don't restart dovecot and don't rebuild, just patch local dovecot template (cPanel only)", ) parser.add_argument( "--no-restart-pureftpd", dest="norestart_pureftpd", action="store_true", help="Don't restart pureftpd", ) parser.add_argument( "--yaml", dest="yaml", action="store_true", help="for YAML output" ) parser.add_argument("-v", "--verbose", dest="verbose", action="store_true") signal.signal(signal.SIGTERM, sigterm_handler) logger = logger_init(console_stream=None) parser = argparse.ArgumentParser() subparsers = parser.add_subparsers(dest="cmd") subparsers.required = True for command in sorted( (cmd.replace("_", "-") for cmd in dir(Cmd) if not cmd.startswith("_")), reverse=True, ): if command == "set-dovecot": command_parser = subparsers.add_parser(command) command_parser.add_argument( "dovecot_state", type=str, choices=["pam", "native", "disabled"] ) add_opt_args(command_parser) elif command == "dovecot-native": command_parser = subparsers.add_parser(command) command_parser.add_argument("action", choices=["symlink"]) add_opt_args(command_parser) else: command_parser = subparsers.add_parser(command) add_opt_args(command_parser) options = parser.parse_args() output = YamlOutput() if options.yaml else Output() try: cmd = getattr(Cmd, options.cmd.replace("-", "_")) if options.cmd == "dovecot-native": cmd(output) else: cmd(detect_conffiles(output), output) except Exception as e: logger.exception("unexpected error: %s", e) finally: # even if we caught an exception there is still a possibility # that stdout is still usable (at least partially) output.flush()