name : check_security_advice_changes #!/usr/local/cpanel/3rdparty/bin/perl # cpanel - scripts/check_security_advice_changes Copyright 2022 cPanel L.L.C. # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited package scripts::check_security_advice_changes; use strict; use Cpanel::Transaction::File::JSON (); use Cpanel::Hash (); use Cpanel::Locale (); use Cpanel::Usage (); use Cpanel::Alarm (); use Capture::Tiny (); my $WANT_TYPE = 'mod_advice'; my $CHANNEL = 'securityadvisor'; our $HISTORY_FILE = '/var/cpanel/security_advisor_history.json'; _run_from_command_line(@ARGV) if !caller(); sub _run_from_command_line { my (@args) = @_; if ( grep { index( $_, '-background' ) > -1 } @args ) { @args = grep { index( $_, '-background' ) == -1 } @args; # CPANEL-41626: we want to keep elements of @args which DON'T match '-background', so we should check for equality to -1, not non-equality. require Cpanel::Daemonizer::Tiny; require Cpanel::FileUtils::Open; require Cpanel::ConfigFiles; my $pid = Cpanel::Daemonizer::Tiny::run_as_daemon( sub { #### # The next two calls are unchecked because it cannot be captured when running as a daemon no warnings 'once'; Cpanel::FileUtils::Open::sysopen_with_real_perms( \*STDERR, $Cpanel::ConfigFiles::CPANEL_ROOT . '/logs/error_log', 'O_WRONLY|O_APPEND|O_CREAT', 0600 ); open( STDOUT, '>&', \*STDERR ) || warn "Failed to redirect STDOUT to STDERR"; return _exit( __PACKAGE__->script( \@args ) ); } ); return _exit(0); } return _exit( __PACKAGE__->script( \@args ) ); } sub _exit { my ($code) = @_; return exit($code); } sub script { my ( $class, $argv ) = @_; my %opts = ( notify => 0, quiet => 0, ); my $self = bless {}, $class; Cpanel::Usage::wrap_options( $argv, sub { my (@args) = @_; $self->usage(@args); }, { 'notify' => \$opts{'notify'}, 'quiet' => \$opts{'quiet'} }, ); $self->{'notify'} = $opts{'notify'}; $self->{'quiet'} = $opts{'quiet'}; local $Cpanel::Locale::Context::DEFAULT_OUTPUT_CONTEXT = 'html'; # Make sure Cpanel::Locale->get_handle() is invoked before being invoked # by the security advisor modules; otherwise Net::SMTP will throw warnings. $self->_locale(); # The yum calls can take a while if yum is in use so we now # wait up to 30m. Since v78+ does the security advisor # checks in the background this should be ok now. my $main_alarm = Cpanel::Alarm->new( 1800, sub { die "$0 timed out because it was running for longer than 30 minutes."; } ); #max 30m my $trans_obj = Cpanel::Transaction::File::JSON->new( 'path' => $HISTORY_FILE ); my $previous_run = $trans_obj->get_data(); my %prev_hashes = ( ref $previous_run eq 'HASH' and $previous_run->{'hashes'} ) ? %{ $previous_run->{'hashes'} } : (); my %prev_message_keys = ( ref $previous_run eq 'HASH' and $previous_run->{'message_keys'} ) ? %{ $previous_run->{'message_keys'} } : (); my ( %hashes, %message_keys ); require Cpanel::Security::Advisor; require Cpanel::Security::AdvisorFetch; my $msgs = Cpanel::Security::AdvisorFetch::fetch_security_advice(); my $highest_notice_type = 0; my %notices; foreach my $data ( @{$msgs} ) { my $block = ( $data->{'advice'}{'block_notify'} ) ? $data->{'advice'}{'block_notify'} : 0; if ( $data->{'type'} eq $WANT_TYPE && !$block ) { my $module = $data->{'module'}; my $text = $data->{'advice'}{'text'} . ( $data->{'advice'}{'suggestion'} ? " " . $data->{'advice'}{'suggestion'} : '' ); my $hash = Cpanel::Hash::get_fastest_hash($text); my $message_key = ( $data->{'advice'}{'key'} ) ? $data->{'advice'}{'key'} : $data->{'module'}; # NOTE: Condition description: # NOTE: True If advice type is INFO/WARN/BAD && (advice not seen before (via static key or hash) or advise type is greater [i.e., worse] then seen type) my $good = Cpanel::Security::Advisor::_lookup_advise_type_by_value(q{ADVISE_GOOD}); if ( $data->{'advice'}{'type'} > $good && ( !( $prev_hashes{$hash} || $prev_message_keys{$message_key} ) || $prev_hashes{$hash} < $data->{'advice'}{'type'} ) ) { push @{ $notices{$module} }, $data->{'advice'}; if ( $highest_notice_type < $data->{'advice'}{'type'} ) { $highest_notice_type = $data->{'advice'}{'type'}; } } # maintain the augmented datastructure $hashes{$hash} = $data->{'advice'}{'type'}; # message key hash will store advise type as string $message_keys{$message_key}{$hash} = Cpanel::Security::Advisor::_lookup_advise_type( $data->{'advice'}{'type'} ); } } $trans_obj->set_data( { 'hashes' => \%hashes, 'message_keys' => \%message_keys } ); my ( $status, $statusmsg ) = $trans_obj->save_and_close(); # Need to notify { no warnings 'once'; if ( $highest_notice_type && # case CPANEL-6053: Only generate an iContact notification if there # are changes to WARN or higher. $highest_notice_type >= $Cpanel::Security::Advisor::ADVISE_WARN ) { $self->notify( $highest_notice_type, \%notices ); } else { print $self->_locale()->maketext("There are no changes to the Security Advisor state that require notification.") . "\n"; } } return 0; } sub usage { my ($self) = @_; print $self->_locale()->maketext(q{This tool monitors the state of the Security Advisor and can send a notification when the state changes.}), "\n\n"; print $self->_locale()->maketext( q{Usage: [_1][comment,a program name] ~[options~]}, $0 ), "\n\n"; print $self->_locale()->maketext(q{Options:}), "\n"; print "\t--help ", $self->_locale()->maketext(q{Display this help message.}), "\n"; print "\t--notify ", $self->_locale()->maketext(q{Send a notification to the system administrator.}), "\n"; print "\t--quiet ", $self->_locale()->maketext(q{Do not display output, and instead set the [output,asis,UNIX] exit code.}), "\n\n"; exit 0; } sub notify { my ( $self, $highest_notice_type, $notices ) = @_; require Cpanel::Locale; my $old = $self->_locale()->set_context_plain(); require Cpanel::Notify; my $ic_obj = Cpanel::Notify::notification_class( 'class' => 'Check::SecurityAdvisorStateChange', 'application' => 'Check::SecurityAdvisorStateChange', 'status' => 'changes', 'interval' => 1, 'constructor_args' => [ 'origin' => 'check_for_security_advise_changes', 'notices' => $notices, 'highest_notice_type' => $highest_notice_type, 'skip_send' => 1, ] ); unless ( $self->{'quiet'} ) { print $ic_obj->render_template_include_as_text( 'template' => 'subject', 'type' => 'text' ) . "\n\n" . $ic_obj->render_template_include_as_text( 'template' => 'body', 'type' => 'html' ); } if ( $self->{'notify'} ) { $ic_obj->send(); } $self->_locale()->set_context($old); return 1; } sub _locale { my ($self) = @_; require Cpanel::Locale; return ( $self->{'_locale'} ||= Cpanel::Locale->get_handle() ); } 1;