FM / dedrads

/opt/dedrads

Name	Size	Mode	Actions
account_review/	-	0555	rm
check_software_mods/	-	0555	rm
cms_tools/	-	0555	rm
etc/	-	0555	rm
extras/	-	0555	rm
mailparse/	-	0555	rm
mysql/	-	0555	rm
nlp_scripts/	-	0555	rm
oldrads/	-	0555	rm
perl/	-	0555	rm
provision/	-	0555	rm
python/	-	0555	rm
suspended/	-	0555	rm
__pycache__/	-	0555	rm
account-review	799	0555	edit dl rm
allfw	6259	0555	edit dl rm
alp.py	16553	0555	edit dl rm
autossl_sync	6267	0555	edit dl rm
check_apache	9205	0555	edit dl rm
check_bandwidth	4546	0555	edit dl rm
check_boxtrapper	1684	0555	edit dl rm
check_cpu	12212	0555	edit dl rm
check_crons	1827	0555	edit dl rm
check_dcpumon	1973	0555	edit dl rm
check_dns	1827	0555	edit dl rm
check_domlogs	61	0555	edit dl rm
check_exim	3731	0555	edit dl rm
check_hacks	22604	0555	edit dl rm
check_imap	5249	0555	edit dl rm
check_io	6635	0555	edit dl rm
check_max_children	16341	0555	edit dl rm
check_mem	1660	0555	edit dl rm
check_misc	1510	0555	edit dl rm
check_pacct	5201	0555	edit dl rm
check_php	4344	0555	edit dl rm
check_pop3	2295	0555	edit dl rm
check_prov.py	4714	0555	edit dl rm
check_server	696	0555	edit dl rm
check_size	490	0555	edit dl rm
check_software	9849	0555	edit dl rm
check_spamd	2426	0555	edit dl rm
check_traffic	1933	0555	edit dl rm
check_user	1887	0555	edit dl rm
clean_exim.py	6390	0555	edit dl rm
clusterfix	5343	0555	edit dl rm
cmspass.py	3970	0555	edit dl rm
cms_check.py	9825	0555	edit dl rm
cms_counter.py	36734	0555	edit dl rm
cms_creds	713	0555	edit dl rm
cms_dumpdb	4485	0555	edit dl rm
cms_pw	1416	0555	edit dl rm
cpanel-api	7040	0555	edit dl rm
cpanel_postgres_manager.py	29004	0555	edit dl rm
cpmerge	4631	0555	edit dl rm
cpumon	2195	0555	edit dl rm
dcpumon.pl	1239	0555	edit dl rm
dedcheck	18127	0555	edit dl rm
dns-sync	14386	0555	edit dl rm
docroot.py	4425	0555	edit dl rm
du-tree	7450	0555	edit dl rm
envinfo.py	6633	0555	edit dl rm
exclude_rbl.py	5249	0555	edit dl rm
extract-vhost	2691	0555	edit dl rm
filescan	3566	0555	edit dl rm
find_warez	1460	0555	edit dl rm
first_setup.py	19120	0555	edit dl rm
fixwpcron.py	4822	0555	edit dl rm
fix_dns_cluster	353	0555	edit dl rm
goaccess	1217720	0555	edit dl rm
hostsfilemods	4467	0555	edit dl rm
imap_io	2323	0555	edit dl rm
innodb_converter.py	9343	0555	edit dl rm
killall911	530	0555	edit dl rm
killdns	941	0555	edit dl rm
lastcommcache.sh	1374	0555	edit dl rm
legal_lock_down.sh	7450	0555	edit dl rm
lil-cpanel	52002	0555	edit dl rm
listacct	4575	0555	edit dl rm
mailscan	4544	0555	edit dl rm
mail_sources.py	7407	0555	edit dl rm
megaclisas-status	38664	0555	edit dl rm
migrate2central.sh	14418	0555	edit dl rm
modify-account	40631	0555	edit dl rm
modsec_disable.py	11461	0555	edit dl rm
monarxctl	8912	0555	edit dl rm
msp.pl	27714	0555	edit dl rm
mysql_dstat	474	0555	edit dl rm
mysql_selector.py	73102	0555	edit dl rm
nlp	4582	0555	edit dl rm
procscrape	1863	0555	edit dl rm
quarantine	11083	0555	edit dl rm
radsfunctions.sh	863	0555	edit dl rm
recent-cp	16148	0555	edit dl rm
remote_dump	18347	0555	edit dl rm
reset_cpanel	3205	0555	edit dl rm
server-load	2192	0555	edit dl rm
show-conns	20105	0555	edit dl rm
show-conns-adv.py	54667	0555	edit dl rm
sparta.py	382498	0555	edit dl rm
sqltop	27129	0555	edit dl rm
telcheck	2411	0555	edit dl rm
temprootreset	186	0555	edit dl rm
unsuspend_user	1307	0555	edit dl rm
unsusprunner.sh	1840	0555	edit dl rm
updatednsadmin	526	0555	edit dl rm
update_spf	14972	0555	edit dl rm
upgrade-check	9216	0555	edit dl rm
vhost_data.py	6221	0555	edit dl rm
wp-xray.sh	85816	0555	edit dl rm

Edit: /opt/dedrads/modsec_disable.py (11461B)

#!/usr/lib/rads/venv/bin/python3
"""Disable modsec rules for Cpanel or PlatformI users and domains."""
# Written by Quentin H

import re
import subprocess
import argparse
from pathlib import Path
import sys
import rads
from rads.color import red, green, yellow

PLATFORM_I = Path("/etc/ansible/wordpress-ultrastack")

def get_apache_version() -> str:
    """Get Apache version"""
    try:
        result = subprocess.run(
            ["apachectl", "-v"], capture_output=True, text=True, check=True
        )
    except FileNotFoundError:
        print(red("apachectl not found. Please ensure Apache is installed."))
        sys.exit(1)
    except subprocess.CalledProcessError:
        print(red("Failed to get Apache version."))
        sys.exit(1)
    if "Server version" in result.stdout:
        version_line = result.stdout.split("\n")[0]
        version = version_line.split()[2]
        return version.split("/")[1]
    print(red("Unable to parse Apache version."))
    sys.exit(1)

def update_modsec_configuration(
    modsec_file: Path,
    rule_ids: list[int],
    disable_all: bool,
    reset: bool,
    remove_rule_ids: list[int],
):
    """Update modsec.conf file based on provided arguments"""
    modsec_file.parent.mkdir(parents=True, exist_ok=True)  # Ensure the directory exists
    # Ensure the modsec.conf file exists before modifying it
    if not modsec_file.exists() or reset:
        # Create or reset the file if necessary
        modsec_file.write_text("", encoding="utf-8")

if disable_all:
        modsec_file.write_text("SecRuleEngine Off\n")
    elif rule_ids:
        for rule_id in rule_ids:
            disable_rule(modsec_file, rule_id)
    elif remove_rule_ids:
        for rule_id in remove_rule_ids:
            remove_rule(modsec_file, rule_id)

def disable_rule(modsec_file: Path, rule_id: int) -> bool:
    """Add rules to modsec.conf, checks if the rule exists and skips it if
    it does"""
    rule_text = f"SecRuleRemoveById {rule_id}"
    matcher = re.compile(rf"{re.escape(rule_text)}\b")
    try:
        with modsec_file.open("r+", encoding="utf-8") as file:
            for line in file:
                if line.startswith("SecRuleEngine Off"):
                    print(
                        red(
                            "Modsec is disabled for all rules, so not "
                            f"disabling {rule_id} in {modsec_file}."
                        )
                    )
                    return False
                if matcher.match(line):
                    print(
                        red(
                            f"Rule {rule_id} already disabled, not "
                            f"adding to {modsec_file}."
                        )
                    )
                    return False
    except FileNotFoundError:
        pass
    with modsec_file.open("a", encoding="utf-8") as file:
        file.write(f"{rule_text}\n")
    print(green(f"Rule {rule_id} added to file: {modsec_file}"))
    return True

def remove_rule(modsec_file: Path, rule_id: int) -> bool:
    """Remove a rule from the modsec file"""
    changed = False
    rule_text = f"SecRuleRemoveById {rule_id}"
    matcher = re.compile(rf"{re.escape(rule_text)}\b")
    try:
        with modsec_file.open("r+", encoding="utf-8") as file:
            contents = file.readlines()
            file.seek(0)
            file.truncate()
            for line in contents:
                if matcher.match(line):
                    changed = True
                else:
                    file.write(line)
    except FileNotFoundError:
        pass
    if changed:
        print(green(f"Rule {rule_id} removed from file: {modsec_file}"))
    else:
        print(yellow(f"Rule {rule_id} was not in file: {modsec_file}"))
    return changed

def _reset(modsec_file: Path) -> bool:
    changed = False
    with modsec_file.open("r+", encoding="utf-8") as file:
        contents = file.readlines()
        file.seek(0)
        file.truncate()
        for line in contents:
            if line.startswith("SecRuleRemoveById") or line.startswith(
                "SecRuleEngine Off"
            ):
                changed = True
            else:
                file.write(line)
    return changed

def reset_modsec_configuration(modsec_file: Path) -> bool:
    """Remove all SecRuleRemoveById and SecRuleEngine entries from the modsec
    file"""
    try:
        changed = _reset(modsec_file)
    except FileNotFoundError:
        changed = False
    if changed:
        print(
            green(
                "All SecRuleRemoveById and SecRuleEngine entries removed "
                f"from file: {modsec_file}"
            )
        )
    return changed

def cpanel_restart_apache():
    """Rebuild and restart Apache"""
    subprocess.run(
        ["/usr/local/cpanel/bin/servers_queue", "queue", "build_apache_conf"],
        check=False,
    )
    subprocess.run(
        ["/usr/local/cpanel/bin/servers_queue", "queue", "apache_restart"],
        check=False,
    )
    print(green("Apache configuration and service reload queued."))

def platform_i_restart_apache():
    try:
        subprocess.run(["apachectl", "-t"], check=True)
    except subprocess.CalledProcessError:
        print(red("Syntax failed apache check"))
        sys.exit(1)
    try:
        subprocess.run(["systemctl", "restart", "httpd"], check=True)
        print(green("Apache restarted correctly."))
    except subprocess.CalledProcessError:
        print(red("Apache failed to restart"))
        sys.exit(1)

def cpanel_run_ngxconf(user: str):
    """Run ngxconf if it exists"""
    try:
        subprocess.run(["/usr/bin/ngxconf", "-u", user, "-rd"], check=True)
    except OSError:
        pass  # not installed; probably not an ngx server
    except subprocess.CalledProcessError:
        print(red(f"/usr/bin/ngxconf -u {user} -rd failed"))

def platform_i_modsec(args):
    """Function to handle platformI check and set the modsec file path"""
    modsec_file_path = Path("/etc/httpd/modsecurity.d/activated_rules/z-mycustom.conf")
    update_modsec_configuration(
        modsec_file=modsec_file_path,
        rule_ids=args.rule,
        disable_all=args.off,
        reset=args.reset,
        remove_rule_ids=args.drop,
    )
    if args.reset:
        reset_modsec_configuration(modsec_file_path)
    platform_i_restart_apache()

def cpanel_modsec(args):
    """Cpanel function that sets the modsec.conf file based on the flags/args
    passed to the script"""
    try:
        apache_version = get_apache_version()
        if apache_version.startswith("2.4"):
            std_dir = Path("/usr/local/apache/conf/userdata/std/2_4")
            ssl_dir = Path("/usr/local/apache/conf/userdata/ssl/2_4")
        elif apache_version.startswith("2."):
            std_dir = Path("/usr/local/apache/conf/userdata/std/2")
            ssl_dir = Path("/usr/local/apache/conf/userdata/ssl/2")
        else:
            print(red(f"Unsupported Apache version {apache_version}."))
            sys.exit(1)
        # Determine the correct modsec_file path based on the presence of the
        # domain flag
        if args.domain:
            std_conf: Path = std_dir / args.user / args.domain / "modsec.conf"
            ssl_conf: Path = ssl_dir / args.user / args.domain / "modsec.conf"
        else:
            std_conf: Path = std_dir / args.user / "modsec.conf"
            ssl_conf: Path = ssl_dir / args.user / "modsec.conf"
        # Ensure the directory and files exist
        std_conf.parent.mkdir(parents=True, exist_ok=True)
        ssl_conf.parent.mkdir(parents=True, exist_ok=True)
        std_conf.touch(exist_ok=True)
        ssl_conf.touch(exist_ok=True)
        changed = False
        for rule_id in args.rule:
            changed = disable_rule(std_conf, rule_id) or changed
            changed = disable_rule(ssl_conf, rule_id) or changed
        for rule_id in args.drop:
            changed = remove_rule(std_conf, rule_id) or changed
            changed = remove_rule(ssl_conf, rule_id) or changed
        if args.reset:
            if args.domain:
                changed = reset_modsec_configuration(std_conf) or changed
                changed = reset_modsec_configuration(ssl_conf) or changed
            else:
                changed = (
                    reset_modsec_configuration(std_dir / args.user / "modsec.conf")
                    or changed
                )
                changed = (
                    reset_modsec_configuration(ssl_dir / args.user / "modsec.conf")
                    or changed
                )
        if args.off:
            changed = True
            disable_all_rules(std_conf)
            disable_all_rules(ssl_conf)
    finally:
        if changed:
            cpanel_run_ngxconf(args.user)
            cpanel_restart_apache()
        else:
            print(yellow("Skipping reload; nothing changed"))

def disable_all_rules(modsec_file: Path):
    """Function to disable all rules in modsec.conf"""
    try:
        _reset(modsec_file)
        with modsec_file.open("a", encoding="utf-8") as file:
            file.write("SecRuleEngine Off\n")
        print(green(f"All rules disabled in file: {modsec_file}"))
    except FileNotFoundError:
        pass

def parse_args():
    """Parse sys.argv"""
    # fmt: off
    parser = argparse.ArgumentParser(description=__doc__)
    if not PLATFORM_I.exists():
        parser.add_argument(
            "-u", "--user", type=str, required=True,
            help="CPanel user this is for",
        )
        parser.add_argument(
            "-d", "--domain", type=str,
            help="The domain to modify rules for",
        )
        parser.add_argument(
            "-a", "--all", action="store_true",
            help="Apply changes to all domains for the user",
        )
    parser.add_argument(
        "-o", "--off", action="store_true", help="Disable all rules"
    )
    parser.add_argument(
        "-r", "--rule", type=int, nargs='+', default=[],
        help="Specific rule IDs to disable",
    )
    parser.add_argument(
        "-R", "--reset", action="store_true",
        help="Reset the modsec configuration",
    )
    parser.add_argument(
        "-D", "--drop", nargs='+', type=int, default=[],
        help="Drop/Remove a specific rule ID from the modsec configuration"
    )
    # fmt: on
    return parser.parse_args()

def main():
    """Main function to parse arguments and run needed functions based on
    server type"""
    args = parse_args()
    try:
        with rads.lock():
            if PLATFORM_I.exists():
                platform_i_modsec(args)
            else:
                 if not args.user:
                    print(red("The --user (-u) flag is required for CPanel operations."))
                    sys.exit(1)
                 if not rads.is_cpuser(args.user):
                    print(red(f"{args.user} is not a valid cPanel user"))
                    sys.exit(1)
                 if args.domain:
                    verify_domain = rads.whoowns(args.domain)
                    if verify_domain != args.user:
                        print(red(f"The domain passed is not valid or owned by {args.user}."))
                        sys.exit(1)
                 cpanel_modsec(args)

except rads.LockError:
        print(red("Another instance of the script is currently running. Exiting."))
        sys.exit(1)

if __name__ == "__main__":
    main()

cmd: