FM / dedrads

/opt/dedrads

Name	Size	Mode	Actions
account_review/	-	0555	rm
check_software_mods/	-	0555	rm
cms_tools/	-	0555	rm
etc/	-	0555	rm
extras/	-	0555	rm
mailparse/	-	0555	rm
mysql/	-	0555	rm
nlp_scripts/	-	0555	rm
oldrads/	-	0555	rm
perl/	-	0555	rm
provision/	-	0555	rm
python/	-	0555	rm
suspended/	-	0555	rm
__pycache__/	-	0555	rm
account-review	799	0555	edit dl rm
allfw	6259	0555	edit dl rm
alp.py	16553	0555	edit dl rm
autossl_sync	6267	0555	edit dl rm
check_apache	9205	0555	edit dl rm
check_bandwidth	4546	0555	edit dl rm
check_boxtrapper	1684	0555	edit dl rm
check_cpu	12212	0555	edit dl rm
check_crons	1827	0555	edit dl rm
check_dcpumon	1973	0555	edit dl rm
check_dns	1827	0555	edit dl rm
check_domlogs	61	0555	edit dl rm
check_exim	3731	0555	edit dl rm
check_hacks	22604	0555	edit dl rm
check_imap	5249	0555	edit dl rm
check_io	6635	0555	edit dl rm
check_max_children	16341	0555	edit dl rm
check_mem	1660	0555	edit dl rm
check_misc	1510	0555	edit dl rm
check_pacct	5201	0555	edit dl rm
check_php	4344	0555	edit dl rm
check_pop3	2295	0555	edit dl rm
check_prov.py	4714	0555	edit dl rm
check_server	696	0555	edit dl rm
check_size	490	0555	edit dl rm
check_software	9849	0555	edit dl rm
check_spamd	2426	0555	edit dl rm
check_traffic	1933	0555	edit dl rm
check_user	1887	0555	edit dl rm
clean_exim.py	6390	0555	edit dl rm
clusterfix	5343	0555	edit dl rm
cmspass.py	3970	0555	edit dl rm
cms_check.py	9825	0555	edit dl rm
cms_counter.py	36734	0555	edit dl rm
cms_creds	713	0555	edit dl rm
cms_dumpdb	4485	0555	edit dl rm
cms_pw	1416	0555	edit dl rm
cpanel-api	7040	0555	edit dl rm
cpanel_postgres_manager.py	29004	0555	edit dl rm
cpmerge	4631	0555	edit dl rm
cpumon	2195	0555	edit dl rm
dcpumon.pl	1239	0555	edit dl rm
dedcheck	18127	0555	edit dl rm
dns-sync	14386	0555	edit dl rm
docroot.py	4425	0555	edit dl rm
du-tree	7450	0555	edit dl rm
envinfo.py	6633	0555	edit dl rm
exclude_rbl.py	5249	0555	edit dl rm
extract-vhost	2691	0555	edit dl rm
filescan	3566	0555	edit dl rm
find_warez	1460	0555	edit dl rm
first_setup.py	19120	0555	edit dl rm
fixwpcron.py	4822	0555	edit dl rm
fix_dns_cluster	353	0555	edit dl rm
goaccess	1217720	0555	edit dl rm
hostsfilemods	4467	0555	edit dl rm
imap_io	2323	0555	edit dl rm
innodb_converter.py	9343	0555	edit dl rm
killall911	530	0555	edit dl rm
killdns	941	0555	edit dl rm
lastcommcache.sh	1374	0555	edit dl rm
legal_lock_down.sh	7450	0555	edit dl rm
lil-cpanel	52002	0555	edit dl rm
listacct	4575	0555	edit dl rm
mailscan	4544	0555	edit dl rm
mail_sources.py	7407	0555	edit dl rm
megaclisas-status	38664	0555	edit dl rm
migrate2central.sh	14418	0555	edit dl rm
modify-account	40631	0555	edit dl rm
modsec_disable.py	11461	0555	edit dl rm
monarxctl	8912	0555	edit dl rm
msp.pl	27714	0555	edit dl rm
mysql_dstat	474	0555	edit dl rm
mysql_selector.py	73102	0555	edit dl rm
nlp	4582	0555	edit dl rm
procscrape	1863	0555	edit dl rm
quarantine	11083	0555	edit dl rm
radsfunctions.sh	863	0555	edit dl rm
recent-cp	16148	0555	edit dl rm
remote_dump	18347	0555	edit dl rm
reset_cpanel	3205	0555	edit dl rm
server-load	2192	0555	edit dl rm
show-conns	20105	0555	edit dl rm
show-conns-adv.py	54667	0555	edit dl rm
sparta.py	382498	0555	edit dl rm
sqltop	27129	0555	edit dl rm
telcheck	2411	0555	edit dl rm
temprootreset	186	0555	edit dl rm
unsuspend_user	1307	0555	edit dl rm
unsusprunner.sh	1840	0555	edit dl rm
updatednsadmin	526	0555	edit dl rm
update_spf	14972	0555	edit dl rm
upgrade-check	9216	0555	edit dl rm
vhost_data.py	6221	0555	edit dl rm
wp-xray.sh	85816	0555	edit dl rm

Edit: /opt/dedrads/allfw (6259B)

#!/bin/bash
#created by tylern
#todo factor in iptables-legacy for g4 and newer dedis.
set -euo pipefail

# Colors
GREEN='\033[0;32m'
NC='\033[0m' # No Color
RED='\033[0;31m'
YELLOW='\033[0;33m'

# Verify this is a cPanel server (allow help to run regardless)
if [[ ! -d /usr/local/cpanel ]]; then
    if [[ "${1:-}" != "-h" && "${1:-}" != "--help" && "${1:-}" != "help" ]]; then
        echo -e "${RED}Error: This script requires cPanel. /usr/local/cpanel not found.${NC}" >&2
        exit 1
    fi
fi

is_valid_ip() {
    local ip="$1"
    # IPv4 or IPv4/CIDR
    if [[ "$ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?$ ]]; then
        return 0
    fi
    return 1
}

allow_ip() {
    if [[ -z "${1:-}" ]]; then
        echo -e "${RED}Error: No IP address provided${NC}"
        return 1
    fi

if ! is_valid_ip "$1"; then
        echo -e "${RED}Error: Invalid IP address format: $1${NC}"
        return 1
    fi

echo -e "\n${GREEN}Whitelisting $1 in.....${NC}"
    #see https://api.docs.cpanel.net/openapi/whm/operation/flush_cphulk_login_history_for_ips/

echo -e "\n${GREEN}...Cphulk Firewall${NC}"
    whmapi1 flush_cphulk_login_history_for_ips ip="$1" 2>/dev/null || true
    /scripts/cphulkdwhitelist "$1" 2>/dev/null || true

if [[ -f /etc/csf/csf.conf ]]; then
        echo -e "\n${GREEN}...CSF${NC}"
        csf -a "$1" 2>/dev/null || true
    else
        echo -e "\n${GREEN}...APF${NC}"
        apf -a "$1" 2>/dev/null || true
    fi

#imunify blocks
    #https://docs.imunify360.com/command_line_interface/#whitelist
    if [[ -d /etc/imunify360/ ]]; then
        echo -e "\n${GREEN}...Imunify360${NC}"
        imunify360-agent whitelist ip add "$1" 2>/dev/null || true
    fi
}

deny_ip() {
    if [[ -z "${1:-}" ]]; then
        echo -e "${RED}Error: No IP address provided${NC}"
        return 1
    fi

if ! is_valid_ip "$1"; then
        echo -e "${RED}Error: Invalid IP address format: $1${NC}"
        return 1
    fi

echo -e "\n${RED}Blacklisting $1 in.....${NC}"
    #see https://api.docs.cpanel.net/openapi/whm/operation/flush_cphulk_login_history_for_ips/

echo -e "\n${RED}...Cphulk Firewall${NC}"
    whmapi1 flush_cphulk_login_history_for_ips ip="$1" 2>/dev/null || true
    /scripts/cphulkdblacklist "$1" 2>/dev/null | grep -F "$1" || true

if [[ -f /etc/csf/csf.conf ]]; then
        echo -e "\n${RED}...CSF${NC}"
        csf -d "$1" 2>/dev/null || true
    else
        echo -e "\n${RED}...APF${NC}"
        apf -d "$1" 2>/dev/null || true
    fi

#imunify blocks
    #https://docs.imunify360.com/command_line_interface/#blacklist
    if [[ -d /etc/imunify360/ ]]; then
        echo -e "\n${RED}...Imunify360${NC}"
        imunify360-agent blacklist ip add "$1" 2>/dev/null || true
    fi
}

view_ip() {
    if [[ -z "${1:-}" ]]; then
        echo -e "${RED}Error: No IP address provided${NC}"
        return 1
    fi

if ! is_valid_ip "$1"; then
        echo -e "${RED}Error: Invalid IP address format: $1${NC}"
        return 1
    fi

echo -e "\n${YELLOW}Looking for $1 in.....${NC}\n"
    #https://api.docs.cpanel.net/openapi/whm/operation/read_cphulk_records/
    echo -e "\n${YELLOW}cPHulk Blacklist${NC}"
    whmapi1 read_cphulk_records list_name='black' 2>/dev/null | grep -F "$1" || true
    echo -e "\n${YELLOW}cPHulk Whitelist${NC}"
    whmapi1 read_cphulk_records list_name='white' 2>/dev/null | grep -F "$1" || true

echo -e "\n${YELLOW}Fail2ban${NC}"
    [[ -f /var/log/fail2ban.log ]] && grep -F "$1" /var/log/fail2ban.log | tail -n2 || true

echo -e "\n${YELLOW}SSH/FTP${NC}"
    [[ -f /var/log/messages ]] && grep -F "$1" /var/log/messages | tail -n2 || true
    [[ -f /var/log/secure ]] && grep -F "$1" /var/log/secure | tail -n2 || true

echo -e "\n${YELLOW}LFD${NC}"
    [[ -f /var/log/lfd.log ]] && grep -F "$1" /var/log/lfd.log | tail -n2 || true

echo -e "\n${YELLOW}Email Logins${NC}"
    [[ -f /var/log/maillog ]] && grep -F "$1" /var/log/maillog | grep 'auth failed' | tail -n2 || true

#failing exim
    [[ -f /var/log/exim_mainlog ]] && grep -F "$1" /var/log/exim_mainlog | grep 'authenticator failed' | tail -n2 || true

#Modsec blocks
    echo -e "\n${YELLOW}ModSecurity${NC}"
    [[ -f /usr/local/apache/logs/error_log ]] && grep -F "$1" /usr/local/apache/logs/error_log | grep -E 'id "(13052|13051|13504|90334)"' | tail -n2 || true

#cPanel blocks
    echo -e "\n${YELLOW}cPanel${NC}"
    for logfile in /usr/local/cpanel/logs/access_log /usr/local/cpanel/logs/login_log /usr/local/cpanel/logs/error_log; do
        [[ -f "$logfile" ]] && grep -F "$1" "$logfile" | grep "FAILED LOGIN" | tail -n2 || true
    done

#apf/csf logs, requires root
    echo -e "\n${YELLOW}CSF/APF${NC}"
    grep -F "$1" /etc/*/*allow* /etc/*/*deny* 2>/dev/null | tail -n2 || true

echo -e "\n${YELLOW}iptables${NC}"
    iptables -L -n 2>/dev/null | grep -F "$1" || true
}

show_help() {
    cat << 'EOF'
allfw - Unified firewall management for cPanel servers

USAGE
    allfw <command> <ip_address>

COMMANDS
    allow <IP>    Whitelist an IP across all firewalls (CSF/APF, cPHulk, Imunify360)
    deny  <IP>    Blacklist an IP across all firewalls
    view  <IP>    Search logs to find why an IP was blocked (read-only)

EXAMPLES
    allfw allow 192.168.1.100
    allfw deny 10.0.0.50
    allfw view 203.0.113.25

LOGS SEARCHED (view command)
    cPHulk:       whmapi1 read_cphulk_records
    Fail2Ban:     /var/log/fail2ban.log
    SSH/FTP:      /var/log/messages, /var/log/secure
    LFD:          /var/log/lfd.log
    Email:        /var/log/maillog
    Exim:         /var/log/exim_mainlog
    ModSecurity:  /usr/local/apache/logs/error_log
    cPanel:       /usr/local/cpanel/logs/login_log
    CSF/APF:      /etc/*/*allow*, /etc/*/*deny*

DOCUMENTATION
    CSF:      https://support.cpanel.net/hc/en-us/articles/360058211754
    cPHulk:   https://docs.cpanel.net/knowledge-base/security/cphulk-management-on-the-command-line/
    Imunify:  https://docs.imunify360.com/command_line_interface/#whitelist
EOF
}

case "${1:-}" in
    allow)
        allow_ip "${2:-}"
        ;;
    view)
        view_ip "${2:-}"
        ;;
    deny)
        deny_ip "${2:-}"
        ;;
    -h|--help|help|*)
        show_help
        ;;
esac

cmd: