ggsession="" #!/bin/bash #Global Variables version="1.3 \"GGVPS Troubleautomagic\"" G="\e[30;48;5;82m" CYAN="$(tput setaf 6)" M="$(tput setaf 5)" B="\e[48;5;196m" CLEAR="\033[0m" NC=$(tput sgr0) if [[ -f mrun ]]; then alias ggexit="kill -1 $$" rm -rf mrun else alias ggexit="kill -1 $ggsession" fi PATH=$PATH:/scripts/ #Setting Hostname Variables if [[ -f /usr/bin/hostname ]];then HOSTNAMEBIN=/usr/bin/hostname elif [[ -f /bin/hostname ]];then HOSTNAMEBIN=/bin/hostname else HOSTNAMEBIN=hostname fi #Set Variables for node/container vzCTID=`awk '{print $1}' /proc/vz/veinfo` #vzNODE=`traceroute -T -N1 -m1 -q1 -w0 8.8.8.8|grep -v traceroute|head -n1|tail -n1|awk '{print $2}'| awk -F'.' '{print $1}'` OS=$(rpm -E %{rhel}) #PS1 Fix for Dual Bash PS1="[\u@\h \W]\$ " #Display/CTA Functions function good() { GREEN='\033[0;32m' echo -e "${GREEN}\xE2\x9C\x94 $1${NC} " } function good2() { echo "$G $1 $CLEAR" } function bad() { RED='\033[0;31m' echo -e "${RED}X $1${NC}" } function bad2() { echo "$B $1 $CLEAR" } function SOUT(){ printf "[$1]\n" printf "$2\n" } #Script Functions alias sushell='whmapi1 modifyacct user=$(stat -c %U .) HASSHELL=1 && su $(stat -c %U .)' alias summary='wget -O summary.php https://dl.websitehostserver.net/vps-files/summary.txt;php summary.php' alias ll='ls -lAh --color' alias ls='ls --color' alias fixlicense='/usr/local/cpanel/cpkeyclt' alias exit='echo "You must use ggexit to close this session."' alias logout='echo "You must use ggexit to close this session."' alias install-softaculous='curl https://dl.websitehostserver.net/vps-files/softaculous_install.sh.txt | bash' alias exim-security="cat /etc/exim.conf | grep -E 'openssl_options|tls_require_ciphers'" function enable-root(){ sed -i s/"PasswordAuthentication no"/"PasswordAuthentication yes"/g /etc/ssh/sshd_config sed -i s/"PermitRootLogin without-password"/"PermitRootLogin yes"/g /etc/ssh/sshd_config service sshd restart echo "Root access has been enabled." } function disable-root(){ sed -i s/"PasswordAuthentication yes"/"PasswordAuthentication no"/g /etc/ssh/sshd_config sed -i s/"PermitRootLogin yes"/"PermitRootLogin without-password"/g /etc/ssh/sshd_config service sshd restart echo "Root access has been disabled." } function finddiskspace() { if [ "$(df -h | awk 'FNR == 2 {print $5}' | sed 's/%$//')" -gt "25" ]; then echo "" echo -n "Warning! Disk space usage is higher than 25%!" echo "" echo "" df -h | awk '$NF=="/"{printf "Disk Usage: %d/%dGB (%s)\n", $3,$2,$5}' echo "" echo "" echo -n "Searching for backups or files larger than 250M on $(hostname -f): " echo "" echo "" echo -n "Backups: " echo "" echo "" du -shc /backup/// echo "" echo "" echo -n "File Usage: " echo "" echo "" du -shc $(find /home/ -size +250M -print 2>/dev/null) | grep total echo "" echo "" echo "Total Usage (Files + Backup): " && echo "" && du -shc $(find /home/ /backup -size +250M -print 2>/dev/null) echo "" echo "" else echo "" echo "" echo -n "Disk space check is less than 25%" echo "" echo "" df -h | awk '$NF=="/"{printf "Disk Usage: %d/%dGB (%s)\n", $3,$2,$5}' echo "" echo "" fi } function pass-security(){ username=$(awk -F'@' '{print $1}' <<< $1) domain=$(awk -F'@' '{print $2}' <<< $1) cPuser=$(/scripts/whoowns $domain) enctype="{SHA512-CRYPT}" hash=$(cat /home/$cPuser/etc/$domain/shadow | grep $username | awk -F':' '{print $2}') encpass="{SHA512-CRYPT}$hash" doveadm pw -t $encpass -p $2 } function listfunctions() { echo -e "${CYAN}apache-stats ${NC}-- Provides a comprehensive listing of all current Apache Workers across all domains hosted on the VPS. Useful for troubleshooting limits with MaxRequestWorkers as well as identifying DDoS attack targets." echo -e "${CYAN}zone ${NC}-- Displays all zone entries for given domain, usage: zone domain.tld" echo -e "${CYAN}blocks ${NC}-- Displays all blocks in lfd.log for today's date." echo -e "${CYAN}bots ${NC}-- This function performs a search across all of the domlogs for entries marked for the current date related to bot activity and outputs information useful to determining if perhaps a robots.txt is needed." echo -e "${CYAN}cfallow ${NC}-- Automatically downloads and adds all of CloudFlare's IPv4 Addresses into CSF." echo -e "${CYAN}docroot ${NC}-- Usage: docroot domain.tld, provides document root" echo -e "${CYAN}ddos ${NC}-- DDoS log analyzer, usage: ddog /home/user/accesslogs/log_file" echo -e "$(bad2 "enable-root -- CAUTION: This will enable root access over SSH with password authentication. Advise clients of the pros/cons of this feature before enabling.")" echo -e "${CYAN}errors ${NC}-- This is an easy to use tool that provides all error output from error_log files for the current day run in public_html for best effectiveness." echo -e "${CYAN}exim-security ${NC}-- Provides exim security protocols allowed and cipher suite." echo -e "${CYAN}hack ${NC}-- Searches the domlogs for signs of brute force via xmlrpc.php, wp-login.php, and admin-ajax.php" echo -e "${CYAN}install-softaculous ${NC}-- Auto-launches Will C.'s Softaculous installation script." echo -e "${CYAN}findbigdirs ${NC}-- Reports any big directories within /home/*/public_html and /home/*/mail/" echo -e "${CYAN}fixlicense ${NC}-- Fixes issues with cpanel licensces" echo -e "${CYAN}ggnull ${NC}-- Usage: ggnull IP_Address, null routes IP Address provided." echo -e "${CYAN}ggpaste ${NC}-- Provides a URL of the output data, used either in | or >" echo -e "$(good2 "ggexit -- Closes the session properly as the utility creates a dual bash session environment.")" echo -e "${CYAN}lsdomains ${NC}-- Lists all domain names hosted on the VPS." echo -e "${CYAN}lsforwards ${NC}-- Lists all mail forwarders on the VPS" echo -e "${CYAN}phpusers ${NC}-- Provides information regarding each cPanel user and which PHP version they are configured to use." echo -e "${CYAN}robotstxt ${NC}-- Searches throughout all the user public_html for robots.txt and reports directives." echo -e "$(bad2 "sec-disable -- CAUTION: This disables Security Questions and MUST be re-enabled once you complete your work.")" echo -e "${CYAN}sec-enable ${NC}-- CAUTION: Do not enable this unless the client had it enabled previously and you disabled to service the server." echo -e "${CYAN}summary ${NC}-- This run's the GG Summary Script for quoting server migrations." echo -e "${CYAN}wpfunctions ${NC}-- This provides a comprehensive list of functions pertaining to WordPress." } function spamcheck(){ # Email Report #By Robert J echo "" echo -n "==================EMAIL REPORT=====================" echo "" echo "" echo -n "===========$(date)============" echo "" echo "" echo -n "Total emails in exim queue: " && exim -bpc echo "" echo -n "Total frozen emails in exim queue: " && exiqgrep -iz | wc -l echo "" exim -bp | exiqsumm | egrep -v "\-\-|Volume|^$" | sort -bg | awk '{print "Volume: " $1 " \t Domain: " $5}' echo "" echo "" if [ -d /usr/local/cpanel ];then echo "Checking for relay entries within LFD log files." echo "" echo "$(grep -i relay /var/log/lfd.log)" echo "" echo "Checking for high volume dovecot logins for potential compromised accounts." echo "" echo "$(grep -Po '(?<=dovecot_(plain|login):)\S*' /var/log/exim_mainlog | sort | uniq -c | sort -n | tail)" echo "" echo "" echo "" eximstats /var/log/exim_mainlog | head -11 && eximstats /var/log/exim_mainlog | grep -A 5 rejection | sed '/sending/d' echo "" echo "" echo -n "Blacklist Check URL: " && echo -n "https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3A$(hostname -i)" echo "" echo "" echo "" echo -n "=====EXIM LOG SAMPLES=====" echo "" echo "" tail -25 /var/log/exim_mainlog echo "" echo "" else echo "Checking for relay entries within LFD log files." echo "" echo "$(grep -i relay /var/log/lfd.log)" echo "" echo "Checking for high volume dovecot logins for potential compromised accounts." echo "" echo "$(grep -Po '(?<=dovecot_(plain|login):)\S*' /var/log/exim/main_log | sort | uniq -c | sort -n | tail)" echo "" echo "" eximstats /var/log/exim/main_log | head -11 && eximstats /var/log/exim/main_log | grep -A 5 rejection | sed '/sending/d' echo "" echo "" echo -n "Blacklist Check URL: " && echo -n "https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3A$(hostname -i)" echo "" echo "" echo "" echo -n "=====EXIM LOG SAMPLES=====" echo "" echo "" tail -25 /var/log/exim/main_log echo "" echo "" fi } function dspace() { python2 << END import os import subprocess import shlex import sys #paths to check bpath = '/backup/' hpath = '/home/' plist = list() max = 200 def run(cmd): proc=subprocess.Popen(shlex.split(cmd),stdout=subprocess.PIPE) out,err=proc.communicate() return str(out) def gsize(num): if int(num) > 1024: gbsize = num / float(1024) if str(gbsize).count('.') >= 1: gb = str(gbsize).split(".") size = gb[0] + "." + gb[1][:2] + "G" else: size = str(num) + "M" return size def filter(input): fsize,fname = input.split("\t") if fsize >= 1024: msize = int(fsize) / 1024 if msize >= max: fname = fname.lstrip() fname = fname.rstrip() if fname.count('/') >=4: hsize = gsize(msize) print hsize + " " + fname if fname.count('/') <= 3: plist.append(fname) def list_files(startpath): for root, dirs, files in os.walk(startpath): level = root.replace(startpath, '').count(os.sep) indent = ' ' * 4 * (level) tprint = '{}{}/'.format(indent, os.path.basename(root)) if tprint != '/': if tprint != 'virtfs/': if os.path.isdir(startpath + tprint): filter(run('du -s ' + startpath + tprint)) subindent = ' ' * 4 * (level + 1) def chkdir(dir): if os.listdir(dir): #print 'Output from ' + dir list_files(dir) else: print dir + ' is empty' def subdir(): for p in plist: chkdir(p) def bigf(): print "Listing of files over " + str(max) + "MB" for p in plist: #print p g = run ('find ' + p + ' -type f -size +' + str(max) + '000k -exec ls -lh {} \;') #print g gsplit = g.split('\n') #print str(len(gsplit)) dl = len(gsplit) d = 1 for r in gsplit: if d < dl: rsplit = r.split(' ') if len(rsplit) > 8: c = 0 for i in rsplit: if c == 4: lt = i if c >= 7: lt = lt + " " + i c += 1 print lt else: print rsplit[4] + " " + rsplit[7] d += 1 print "Looking for directories over " + str(max) + "MB" print "Checking for large directories within " + bpath + " " + hpath chkdir(bpath) chkdir(hpath) subdir() print "" bigf() END } function zone(){ awk '$1 ~ /[^;]/' /var/named/$@.db } function checkssl(){ certificate=$(echo | openssl s_client -showcerts -servername $1 -connect $1:443 2>/dev/null | openssl x509 -inform pem -noout -text | grep -E 'Issuer|Not After|DNS') echo "Domains: $(echo "$certificate" | awk -F'DNS:' '{print $2 $3 $4}' | grep '*')" echo "Issuer: $(echo "$certificate" | awk -F', O=' '{print $2}' | awk -F', CN' '{print $1}')" echo "Expires: $(echo "$certificate" | awk -F'Not After : ' '{print $2}' | sed -e 's/^[[:space:]]*//' | grep 'GMT')" } function wpfunctions(){ curl -s https://gist.githubusercontent.com/markjaquith/4487609/raw/a9bd6282620c7dada3cff9e8dee2bdf5cdc6b163/gistfile1.txt | tail -n +2 | head -n -2 echo -e "${M}wpaudit ${NC}-- Provides an audit of a WP install, ran as root within the installation directory includes siteurl, version, and summary of plugin and theme based on number of installed, updates pending, and inactive." echo -e "${M}wpthemelist ${NC}-- Provides standard output of wp-cli wp theme list, but as root without security risks." echo -e "${M}wpplugininfo ${NC}-- Provides a brief description of a given plugin, must use the name as provided via wp-cli or WordPress.org." echo -e "${M}wppluginlist ${NC}-- Provides standard output of wp-cli wp plugin list, but as root without security risks." echo -e "${M}wpsecurity ${NC}-- Provides a list of any/all installations detected of WordPress installs containing WordFence and WP-Cerber." } #WP Plugin info function wpplugininfo(){ content=$(curl -s https://wordpress.org/plugins/$1/) length=$(echo "$content" | wc -l) begin=$(echo "$content" | grep -n '' -m 1 | cut -f1 -d:) name=$(echo "$string" | head -n $end | grep name | awk -F': "' '{print $2}' | awk -F'",' '{print $1}') description=$(echo "$string" | head -n $end | grep description | awk -F': "' '{print $2}' | awk -F'",' '{print $1}') version=$(echo "$string" | head -n $end | grep softwareVersion | awk -F': "' '{print $2}' | awk -F'",' '{print $1}') modified=$(echo "$string" | head -n $end | grep dateModified | awk -F': "' '{print $2}' | awk -F'",' '{print $1}') echo $name | sed s/'WordPress.org'//g echo $description echo "Version: $version" echo "Last updated: $(date -d"$modified" +%B" "%d", "%Y)" } #WP Plugin List function wppluginlist(){ cpwd=$(pwd) runuser -l $(stat -c %U .) -c "cd $cpwd; wp plugin list" } #WP Thee List function wpthemelist(){ cpwd=$(pwd) runuser -l $(stat -c %U .) -c "cd $cpwd; wp theme list" } #WP Audit function wpaudit(){ cpwd=$(pwd) siteurl=$(runuser -l $(stat -c %U .) -c "cd $cpwd; wp option get siteurl") version=$(runuser -l $(stat -c %U .) -c "cd $cpwd; wp core version") plugins="$(runuser -l $(stat -c %U .) -c "cd $cpwd; wp plugin list")" themes="$(runuser -l $(stat -c %U .) -c "cd $cpwd; wp theme list")" echo "WP siteurl: $siteurl" echo "WP filepath: $cpwd" echo "WP version: $version" echo "WP themes: $(echo "$themes" | tail -n +2 | wc -l) total, $(echo "$themes" | grep available | wc -l) updates, $(echo "$themes" | grep inactive | wc -l) inactive" echo "WP plugins: $(echo "$plugins" | tail -n +2 | wc -l) total, $(echo "$plugins" | grep available | wc -l) updates, $(echo "$plugins" | grep inactive | wc -l) inactive" } #GGLoop function ggloop(){ c=0 for i in "$@" do c=$((c+1)) if [ $c != 1 ]; then cmd="$cmd $i" fi done while read p; do rcmd="$(echo $cmd | sed "s/\%v/$p/g")" $rcmd done < $1 } # ggpaste Utility # @return $paste_url function ggpaste() { if [ ! -z $2 ] then curl --header "GGAUTH: ggpaste_259gag235" --form t=$1 --form file=@$2 https://paste.websitehostserver.net else curl --header "GGAUTH: ggpaste_259gag235" --form t=$1 --form file=@- https://paste.websitehostserver.net fi } #Null Router function ggnull(){ route add -host $1 reject } #Whitelist CloudFlare function cfallow(){ IPS=`curl -s https://www.cloudflare.com/ips-v4` for ip in ${IPS}; do csf -a $ip done csf -r } #Mass CloudFlare function masscf(){ IPS=`curl -s https://www.cloudflare.com/ips-v4` for ip in ${IPS}; do csf -$1 $ip done #csf -r } #Get DDoS logs function ddos() { domain=$1 echo "Top URLs Requested:" grep "$(date +%d/%b/%Y)" $domain | awk '{print $7}' | sort | uniq -c | sort -r | awk '$1>100' echo "Top IP Addresses:" grep "$(date +%d/%b/%Y)" $domain | awk '{print $1}' | sort | uniq -c | sort -r | awk '$1>100' echo "Top User Agents:" grep "$(date +%d/%b/%Y)" $domain | awk -F'"' '{print $6}' | grep -E '^.{50,}$' | sort | uniq -c | sort -r | head -n 10 } ######### RCTMP RIPPED FUNCTIONS NEED TO REWRITE SOME AND DOCUMENT function hack() { D=$(date +%d) M=$(date +%b) Y=$(date +%Y) echo "Checking for xmlrpc.php brute force attacks.." echo "$(grep -H $D/$M/$Y /usr/local/apache/domlogs/* 2>/dev/null |grep 'POST /xmlrpc.php'|cut -d: -f1|sort|uniq -c)" echo "" echo "Checking for wp-login.php brute force attacks.." echo "$(grep -H $D/$M/$Y /usr/local/apache/domlogs/* 2>/dev/null |grep 'POST /wp-login.php'|cut -d: -f1|sort|uniq -c)" echo "" echo "Checking for admin-ajax.php abuse.." echo "$(grep -H $D/$M/$Y /usr/local/apache/domlogs/* 2>/dev/null |grep 'POST /admin-ajax.php'|cut -d: -f1|sort|uniq -c)" } function bots() { D=$(date +%d) M=$(date +%b) Y=$(date +%Y) echo "Checking for bot traffic.." echo "$(grep -H $D/$M/$Y /usr/local/apache/domlogs/* 2>/dev/null |grep 'Bot'|cut -d: -f1|sort|uniq -c)" } function blocks() { D=$(date +%d) M=$(date +%b) Y=$(date +%Y) grep "$M $D" /var/log/lfd.log | grep Blocked } function docroot(){ grep -E "^${1}: " /etc/userdatadomains|awk -F'==' '{print $5}' } function lsdomains() { grep -E "==(addon|main)==" /etc/userdatadomains|cut -d: -f1|sort | xargs -i sh -c 'echo {} " " $(/scripts/whoowns {})' } function lsforwards(){ grep "=> .*@.*@.*lookuphost" /var/log/exim_mainlog | awk '{print $6,$5}' |sed 's/(//g;s/)//g;s//g;s/>//g'|awk '$2 ~ "@"'| sort | uniq -c | sort -n } function findbigdirs() { if [[ $NCP == 0 ]];then tmpLIST="/tmp /home/*/public_html /home/*/mail" else tmpLIST="/tmp /home/*/public_html" fi find $tmpLIST -xdev -printf '%h\n' | sort | uniq -c | awk '$1 >= 800' | sort -k 1 -rn } function robotstxt() { find /home/ -name robots.txt -type f | xargs grep -n delay | head $(awk -F':' '{print $1 " -n " $2}') | grep -v "#" } function wpsecurity(){ echo "Looking for installations of WP-Cerber" find /home/ -name wp-cerber -type d echo "" echo "Looking for installations of Wordfence" find /home/ -name wordfence -type d } ######### END #Security Questions Functions function sec-enable() { case $secpol in "N") echo "Security Questions is not setup." ;; "1") echo "Security Questions already enabled." ;; "0") echo "Security Questions have been enabled." sed -i 's/SecurityPolicy::SourceIPCheck=0/SecurityPolicy::SourceIPCheck=1/g' /var/cpanel/cpanel.config /scripts/restartsrv cpanel secpol="1" ;; esac } function sec-disable() { case $secpol in "N") echo "Security Questions is not setup." ;; "0") echo "Security Questions already disabled." ;; "1") echo "Security Questions have been disabled, please ensure you re-enable them before finalizing work." sed -i 's/SecurityPolicy::SourceIPCheck=1/SecurityPolicy::SourceIPCheck=0/g' /var/cpanel/cpanel.config /scripts/restartsrv cpanel secpol="0" ;; esac } #End Security Question Functions function apache-stats(){ curl -s 'http://localhost/whm-server-status' | perl -ne 'print "$1\n" if m~