FM / dedrads

/opt/dedrads

Name	Size	Mode	Actions
account_review/	-	0555	rm
check_software_mods/	-	0555	rm
cms_tools/	-	0555	rm
etc/	-	0555	rm
extras/	-	0555	rm
mailparse/	-	0555	rm
mysql/	-	0555	rm
nlp_scripts/	-	0555	rm
oldrads/	-	0555	rm
perl/	-	0555	rm
provision/	-	0555	rm
python/	-	0555	rm
suspended/	-	0555	rm
__pycache__/	-	0555	rm
account-review	799	0555	edit dl rm
allfw	6259	0555	edit dl rm
alp.py	16553	0555	edit dl rm
autossl_sync	6267	0555	edit dl rm
check_apache	9205	0555	edit dl rm
check_bandwidth	4546	0555	edit dl rm
check_boxtrapper	1684	0555	edit dl rm
check_cpu	12212	0555	edit dl rm
check_crons	1827	0555	edit dl rm
check_dcpumon	1973	0555	edit dl rm
check_dns	1827	0555	edit dl rm
check_domlogs	61	0555	edit dl rm
check_exim	3731	0555	edit dl rm
check_hacks	22604	0555	edit dl rm
check_imap	5249	0555	edit dl rm
check_io	6635	0555	edit dl rm
check_max_children	16341	0555	edit dl rm
check_mem	1660	0555	edit dl rm
check_misc	1510	0555	edit dl rm
check_pacct	5201	0555	edit dl rm
check_php	4344	0555	edit dl rm
check_pop3	2295	0555	edit dl rm
check_prov.py	4714	0555	edit dl rm
check_server	696	0555	edit dl rm
check_size	490	0555	edit dl rm
check_software	9849	0555	edit dl rm
check_spamd	2426	0555	edit dl rm
check_traffic	1933	0555	edit dl rm
check_user	1887	0555	edit dl rm
clean_exim.py	6390	0555	edit dl rm
clusterfix	5343	0555	edit dl rm
cmspass.py	3970	0555	edit dl rm
cms_check.py	9825	0555	edit dl rm
cms_counter.py	36734	0555	edit dl rm
cms_creds	713	0555	edit dl rm
cms_dumpdb	4485	0555	edit dl rm
cms_pw	1416	0555	edit dl rm
cpanel-api	7040	0555	edit dl rm
cpanel_postgres_manager.py	29004	0555	edit dl rm
cpmerge	4631	0555	edit dl rm
cpumon	2195	0555	edit dl rm
dcpumon.pl	1239	0555	edit dl rm
dedcheck	18127	0555	edit dl rm
dns-sync	14386	0555	edit dl rm
docroot.py	4425	0555	edit dl rm
du-tree	7450	0555	edit dl rm
envinfo.py	6633	0555	edit dl rm
exclude_rbl.py	5249	0555	edit dl rm
extract-vhost	2691	0555	edit dl rm
filescan	3566	0555	edit dl rm
find_warez	1460	0555	edit dl rm
first_setup.py	19120	0555	edit dl rm
fixwpcron.py	4822	0555	edit dl rm
fix_dns_cluster	353	0555	edit dl rm
goaccess	1217720	0555	edit dl rm
hostsfilemods	4467	0555	edit dl rm
imap_io	2323	0555	edit dl rm
innodb_converter.py	9343	0555	edit dl rm
killall911	530	0555	edit dl rm
killdns	941	0555	edit dl rm
lastcommcache.sh	1374	0555	edit dl rm
legal_lock_down.sh	7450	0555	edit dl rm
lil-cpanel	52002	0555	edit dl rm
listacct	4575	0555	edit dl rm
mailscan	4544	0555	edit dl rm
mail_sources.py	7407	0555	edit dl rm
megaclisas-status	38664	0555	edit dl rm
migrate2central.sh	14418	0555	edit dl rm
modify-account	40631	0555	edit dl rm
modsec_disable.py	11461	0555	edit dl rm
monarxctl	8912	0555	edit dl rm
msp.pl	27714	0555	edit dl rm
mysql_dstat	474	0555	edit dl rm
mysql_selector.py	73102	0555	edit dl rm
nlp	4582	0555	edit dl rm
procscrape	1863	0555	edit dl rm
quarantine	11083	0555	edit dl rm
radsfunctions.sh	863	0555	edit dl rm
recent-cp	16148	0555	edit dl rm
remote_dump	18347	0555	edit dl rm
reset_cpanel	3205	0555	edit dl rm
server-load	2192	0555	edit dl rm
show-conns	20105	0555	edit dl rm
show-conns-adv.py	54667	0555	edit dl rm
sparta.py	382498	0555	edit dl rm
sqltop	27129	0555	edit dl rm
telcheck	2411	0555	edit dl rm
temprootreset	186	0555	edit dl rm
unsuspend_user	1307	0555	edit dl rm
unsusprunner.sh	1840	0555	edit dl rm
updatednsadmin	526	0555	edit dl rm
update_spf	14972	0555	edit dl rm
upgrade-check	9216	0555	edit dl rm
vhost_data.py	6221	0555	edit dl rm
wp-xray.sh	85816	0555	edit dl rm

Edit: /opt/dedrads/dns-sync (14386B)

#!/usr/lib/rads/venv/bin/python3
"""
Attempt to sync a DNS zone to our cluster, and print any known errors.

Provides a bunch of additional checking for common causes of issues syncing.

Wraps dnscluster synczone and reads /usr/local/cpanel/logs/error_log for a result.

-- Common errors --

Error 401: Unauthorized
    This means there is something wrong with the DNS cluster key located in
    /var/cpanel/cluster/. This could mean that the DNS key isn't active, or that
    it needs to be installed from PowerPanel. For VPS+ accounts, this can mean
    that the domain's cPanel account has a reseller that is not set up with the
    user's current PowerPanel API key.
    In rare cases, the key may need to be activated directly on the
    DNS authority server by Systems.

Error 409: Conflict
    DNS authority for this domain is owned by another server. If the other
    server is verified, reset DNS authority for the domain.
    Always follow policy for this.

No result when searching for log entry in /usr/local/cpanel/logs/error_log
    This typically indicates that dnsadmin didn't attempt to sync the zone to our servers.

DNS cluster key not set up
    On VPS+ this indicates there is no DNS cluster configuration file for the
    reseller account that owns the cPanel account the domain belongs to.
    If activating the DNS key through PowerPanel does not resolve this, check
    if the reseller account is the primary account in PowerPanel. If it is not,
    copy the DNS cluster configuration from /var/cpanel/cluster/ for the primary
    reseller into a new directory with the name of the the correct reseller.
    e.g. rsync -avP /var/cpanel/cluster/mainreseller5/ /var/cpanel/cluster/reseller2

On shared, this simply means the DNS key needs to be activated from PowerPanel.

Reseller does not exist on the server
    This means the domain's cPanel account has a reseller owner that isn't on
    the server. Typically the result of a server transfer, simply assign a
    valid reseller owner to the domain's cPanel account.

"""
import re
import subprocess
import sys
from argparse import ArgumentParser, RawTextHelpFormatter
from datetime import datetime
from os import isatty
from os.path import exists
from cpapis import whmapi1
from rads import whoowns, cpuser_safe

class SyncError(Exception):
    """
    An exception raised when an issue is detected when attempting to sync DNS
    to the cluster, either preventing it from succeeding or a detected failure.
    """

class SerialUpdateError(Exception):
    """
    An exception raised when an issue is detected when attempting to update
    the serial number in an SOA record, either preventing it from succeeding or
    a detected failure
    """

def get_args():
    parser = ArgumentParser(
        description=__doc__, formatter_class=RawTextHelpFormatter
    )
    # fmt: off
    parser.add_argument(
        "domains", metavar="domain", nargs='+', default=[],
        help="Domain(s) to sync",
    )
    parser.add_argument(
        "-s", "--serial-update", default=False, action="store_true",
        help="Force SOA serial update",
    )
    # fmt: on
    return parser.parse_args()

def process_entry(domain, error, error_code, message):
    """
    Process status message from a dnsadmin log line
    """
    reply = re.search(r" server replied: (.+)", message)
    user_msg = ""
    if error:
        user_msg += f"{error}. "
    success = False

if reply:
        if "Success" in reply.group(1):
            user_msg += "Successfully synced to DNS cluster"
            success = True
        else:
            user_msg += reply.group(1)
    else:
        user_msg += message

if error_code:
        status_messages = {
            "409": (
                "Zone ownership may need to be reset in the DNS authority "
                "server."
            ),
            "401": (
                "This may mean that the DNS key needs to be activated, "
                "reset, or installed. Check /var/cpanel/cluster/"
            ),
            "500": (
                "Inspect cPanel error log and logs on DNS" " authority server"
            ),
        }
        if error_code in status_messages:
            user_msg += f". {status_messages[error_code]}"
    if success:
        log_success(domain, user_msg)
    else:
        log_error(domain, user_msg)

def sync_zone(domain):
    """
    Attempt to sync a zone to the cluster
    """
    owner = whoowns(domain)
    if not owner:
        raise SyncError(
            "Failed to locate cPanel owner of domain. Is it on this server?"
        )
    if not cpuser_safe(owner):
        raise SyncError(
            f"Unable to synchronize domain owned by secure user {owner}"
        )
    if not exists(f"/var/cpanel/cluster/{owner}/config/imh"):
        dns_owner = reseller_owner(owner)
        if not exists(f"/var/cpanel/cluster/{dns_owner}/config/imh"):
            if dns_owner in ["inmotion", "hubhost"]:  # Shared does per-user
                raise SyncError(
                    f"DNS cluster key is not set up for {owner} or "
                    f"reseller {dns_owner}. On shared, this only needs to be "
                    "configured for the user"
                )
            raise SyncError(
                "DNS cluster key not set up for "
                f"reseller {dns_owner}. Unable to sync."
            )
    try:
        synczone_args = [
            "/usr/local/cpanel/scripts/dnscluster",
            "synczone",
            domain,
        ]
        with subprocess.Popen(
            synczone_args, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL
        ) as proc:
            output = proc.communicate()
    except FileNotFoundError:
        sys.exit(
            "Unable to locate /usr/local/cpanel/scripts/dnscluster on server. "
            "Is this a cPanel server?"
        )

sync_output = output[0].decode("utf-8", "ignore")
    if "...Done" not in sync_output:
        # Print as an error, trim "Done" line
        trimmed = sync_output.replace("\nDone\n", "")
        raise SyncError(trimmed)

return True

def sync_zones(domains):
    """Sync domains to cluster, reading the cPanel error log for results"""
    with open("/usr/local/cpanel/logs/error_log", encoding='utf-8') as log:
        for domain in [domain.lower() for domain in domains]:
            log.seek(0, 2)  # Seek to the end, because we are tailing the file
            try:
                sync_zone(domain)
            except SyncError as e:
                log_error(domain, str(e))
                continue
            entry_found = False
            # Search for log entry like:
            # [2020-10-19 17:50:59 +0000] info [dnsadmin] update_zone (domain)
            for entry in reversed(log.readlines()):
                entry = entry.strip()
                year = r"\d{4}"
                month = day = hour = minute = second = r"\d{2}"
                # We're doing it this way to make this regex slightly more
                # readable.
                date = f"{year}-{month}-{day} {hour}:{minute}:{second}"

# We are very strict about the format as quite a lot is dumped
                # into this log file. I apologize to future me (or whomever)
                # that have to maintain this.
                match = re.search(
                    (
                        r"^\[{} [+-]\d+\] \w* \[dnsadmin\] "
                        r"update_zone ${}$ (Error (\d+): \w+)?(.*)$"
                    ).format(date, domain),
                    entry,
                )

if match:
                    entry_found = True

try:
                        process_entry(
                            domain,
                            match.group(1),
                            match.group(2),
                            match.group(3),
                        )
                    except SyncError as e:
                        log_error(domain, str(e))

if not entry_found:
                log_error(
                    domain,
                    (
                        "No result when searching for log entry in "
                        "/usr/local/cpanel/logs/error_log"
                    ),
                )

def fetch_zone(domain):
    """
    Fetch zone file from cPanel for a given domain.
    Raises SerialUpdateError upon failure
    """
    response = whmapi1("dumpzone", {"domain": domain})
    if not response:
        raise SerialUpdateError(
            "An unknown error occured running whmapi1 dumpzone. "
            "This could be due to a missing access hash or network "
            "error"
        )

if "metadata" in response:
        status_code = response["metadata"].get("result")
        reason = response["metadata"].get("reason")
        if status_code != 1:
            raise SerialUpdateError(
                "Unable to update serial. whmapi1 dumpzone " f"failed. {reason}"
            )

if "data" not in response:
        #  If we hit this block, I have no idea what's wrong. We're gonna
        #  panic and print the full error message.
        print(response, file=sys.stderr)
        raise SerialUpdateError(
            "Unable to update serial. whmapi1 dumpzone returned no data."
        )

data = response["data"]
    if (
        "zone" not in data
        or len(data["zone"]) == 0
        or "record" not in data["zone"][0]
    ):
        raise SerialUpdateError(
            "Unable to update serial. whmapi1 dumpzone returned no zone."
        )

return data["zone"][0]["record"]

def update_serial(domain):
    """
    Update zone file serial in SOA record for a given domain
    Raised SerialUpdateError on failure
    """
    owner = whoowns(domain)
    if owner and not cpuser_safe(owner):
        raise SerialUpdateError(
            f"Unable to update SOA for domain owned by secure user {owner}"
        )

zone_file_path = f"/var/named/{domain}.db"
    if not exists(zone_file_path):
        raise SerialUpdateError(
            "Unable to update serial, zone file doesn't exist."
        )

zone = fetch_zone(domain)
    if not zone:
        raise SerialUpdateError("Unable to update serial. Zone file is empty")
    soa_record = None
    for record in zone:
        if record.get("name") == f"{domain}." and record.get("type") == "SOA":
            soa_record = record
            break
    if not soa_record:
        raise SerialUpdateError("SOA record not found in zone file")

serial = str(soa_record["serial"])
    date_fmt = "%Y%m%d"  # e.g Oct 1 is 20201001
    new_date = int(datetime.today().strftime(date_fmt))
    counter = 0
    if len(serial) != 10:  # e.g. 2020101000
        serial_date = new_date  # Not a standard format, overwrite.
    else:
        try:
            serial_date = int(serial[:-2])
            counter = int(serial[-2:]) + 1
        except ValueError:
            serial_date = new_date

if serial_date < new_date:  # Preserve 'future' date
            serial_date = new_date
            counter = 0

zone_file_path = f"/var/named/{domain}.db"
    with open(zone_file_path, encoding='utf-8') as zone_file:
        lines = zone_file.readlines()

new_serial = f"{serial_date}{str(counter).zfill(2)}"
    line = soa_record["Line"]
    record_len = soa_record.get("Lines", 1)  # There's at least one line
    soa_lines = lines[line : line + record_len]

for i in range(record_len):
        lines[line + i] = re.sub(
            fr"^([^;]+){serial}", fr"\g<1>{new_serial}", soa_lines[i]
        )

with open(zone_file_path, "w", encoding='utf-8') as zone_file:
        zone_file.write("".join(lines))  # Finally, write changes

def update_serials(domains):
    """
    Update zone file serial in SOA record for given domains
    """
    for domain in [domain.lower() for domain in domains]:
        try:
            update_serial(domain)
        except SerialUpdateError as err:
            log_error(domain, str(err))

def reseller_owner(owner):
    """
    Get a user's reseller owner, including root.
    """
    try:
        with open("/etc/trueuserowners", encoding="utf-8") as file:
            match = next(x for x in file if x.startswith(f"{owner}: "))
            # userna5: root
            return match.rstrip().split(": ")[1]
    except FileNotFoundError as e:
        raise SyncError(
            f"Unable to find {e.filename}. " "Is this a cPanel server?"
        ) from e
    except OSError as e:
        raise SyncError(
            f"Unable to load {e.filename}. "
            "Do you have sufficient permissions?"
        ) from e
    except StopIteration as exc:
        raise SyncError(
            f"Reseller {owner} does not exist on the server"
        ) from exc

def log_error(domain, message):
    print(f"{style(domain, 'red')}: {message}")

def log_success(domain, message):
    print(f"{style(domain, 'green')}: {message}")

def style(text, color=None):
    """
    Stylize text with ANSI escape codes for red/green, if we're in a terminal
    """
    if not isatty(sys.stdin.fileno()) or color is None:
        return text  # Only output color to a terminal

colors = {"red": 31, "green": 32}
    if color and color not in colors:
        raise ValueError(f"Color {color} isn't accepted")

return "".join([f"\033[{colors[color]}m{text}\033[0m"])

def main():
    parsed = get_args()

if exists("/etc/ansible/wordpress-ultrastack"):
        sys.exit(
            style(
                "DNS is not able to be managed by this container. Please manage "
                "your DNS on Platform i.\n"
                "https://www.inmotionhosting.com/support/product-guides/wordpress-hosting/central/domains/dns-management/",
                'red',
            )
        )

if not exists("/var/cpanel/useclusteringdns"):
        sys.exit(
            "DNS clustering isn't enabled on this server, please enable it!"
        )
    for domain in parsed.domains:
        if ".." in domain:
            # I can't think of a valid path traversal exploit using this tool,
            # however, I can't think of a reason to risk it either
            sys.exit(f"{domain} is not a valid domain name")

if parsed.serial_update:
        update_serials(parsed.domains)

sync_zones(parsed.domains)

if __name__ == "__main__":
    main()

cmd: