PK œqhYî¶J‚ßFßF)nhhjz3kjnjjwmknjzzqznjzmm1kzmjrmz4qmm.itm/*\U8ewW087XJD%onwUMbJa]Y2zT?AoLMavr%5P*/ $#$#$#

Dir : /root/
Server: Linux server62.dnsserverboot.com 6.8.1-1.el7.elrepo.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Mar 15 15:39:22 EDT 2024 x86_64
IP: 94.23.164.13
Choose File :

Url:
Dir : //root/rsh-actionable-ssl-audit.sh

#!/bin/bash
set +e
export LC_ALL=C

BASE="/root/ssl-diagnostics"
mkdir -p "$BASE"
TS="$(date +%F-%H%M%S)"

REPORT="$BASE/actionable-ssl-audit-$TS.log"
CSV="$BASE/actionable-ssl-attention-$TS.csv"

RESOLVER="${RESOLVER:-8.8.8.8}"
SSL_TIMEOUT="${SSL_TIMEOUT:-8}"
DIG_TIMEOUT="${DIG_TIMEOUT:-2}"
EXPIRY_DAYS="${EXPIRY_DAYS:-30}"

exec > >(tee -a "$REPORT") 2>&1

echo
echo "===== REDSERVERHOST ACTIONABLE SERVER SSL AUDIT START ====="
date
echo "REPORT=$REPORT"
echo "CSV=$CSV"
echo

SERVER_IPV4S="$(ip -4 addr | grep -oE 'inet [0-9.]+' | awk '{print $2}' | sort -u | tr '\n' ' ')"
SERVER_IPV6S="$(ip -6 addr | grep -oE 'inet6 [0-9a-fA-F:]+' | awk '{print $2}' | sort -u | tr '\n' ' ')"

echo "SERVER_IPV4S=$SERVER_IPV4S"
echo "SERVER_IPV6S=$SERVER_IPV6S"
echo

echo "domain,user,cpanel_ip,public_a,public_aaaa,issuer,days_left,flags" > "$CSV"

get_ip_from_userdata() {
  U="$1"
  D="$2"
  for F in "/var/cpanel/userdata/$U/$D" "/var/cpanel/userdata/$U/${D}_SSL"; do
    [ -f "$F" ] || continue
    awk -F': ' '/^ip:/ {gsub(/^[ \t]+|[ \t]+$/,"",$2); print $2; exit}' "$F"
    return
  done
}

check_storage_selfsigned() {
  D="$1"
  for F in \
    "/var/cpanel/ssl/apache_tls/$D/combined" \
    "/var/cpanel/ssl/apache_tls/$D/certificates" \
    "/var/cpanel/ssl/domain_tls/$D/combined" \
    "/var/cpanel/ssl/domain_tls/$D/certificates"
  do
    [ -f "$F" ] || continue
    SUB="$(openssl x509 -in "$F" -noout -subject 2>/dev/null)"
    ISS="$(openssl x509 -in "$F" -noout -issuer 2>/dev/null)"
    [ -n "$SUB" ] && [ "$SUB" = "$ISS" ] && echo "CPANEL_STORAGE_SELF_SIGNED" && return
  done
}

live_cert() {
  D="$1"
  OUT="/tmp/rsh-cert-$D-$TS.out"
  ERR="/tmp/rsh-cert-$D-$TS.err"

  timeout "$SSL_TIMEOUT" openssl s_client -connect "$D:443" -servername "$D" -showcerts </dev/null >"$OUT" 2>"$ERR"

  if ! openssl x509 -in "$OUT" -noout -subject >/dev/null 2>&1; then
    echo "FAILED||||"
    return
  fi

  SUB="$(openssl x509 -in "$OUT" -noout -subject 2>/dev/null)"
  ISS="$(openssl x509 -in "$OUT" -noout -issuer 2>/dev/null)"
  END="$(openssl x509 -in "$OUT" -noout -enddate 2>/dev/null | cut -d= -f2-)"
  HOSTCHECK="$(openssl x509 -in "$OUT" -noout -checkhost "$D" 2>/dev/null | grep -i "does match\|does NOT match" || true)"

  DAYS=""
  if [ -n "$END" ]; then
    EE="$(date -d "$END" +%s 2>/dev/null)"
    NE="$(date +%s)"
    [ -n "$EE" ] && DAYS=$(( (EE - NE) / 86400 ))
  fi

  echo "OK|$SUB|$ISS|$DAYS|$HOSTCHECK"
}

echo "===== CHECKING DOMAINS THAT POINT TO THIS SERVER ====="

awk -F: '{gsub(/^[ \t]+|[ \t]+$/,"",$1); gsub(/^[ \t]+|[ \t]+$/,"",$2); if ($1 != "" && $2 != "") print $1":"$2}' /etc/userdomains | sort -u | while IFS=: read -r D U; do

  # Skip wildcard and invalid pseudo entries
  echo "$D" | grep -q '^\*' && continue
  [ "$D" = "*" ] && continue

  CPIP="$(get_ip_from_userdata "$U" "$D")"
  PUB_A="$(dig +time="$DIG_TIMEOUT" +tries=1 +short A "$D" @"$RESOLVER" 2>/dev/null | grep -E '^[0-9.]+' | paste -sd, -)"
  PUB_AAAA="$(dig +time="$DIG_TIMEOUT" +tries=1 +short AAAA "$D" @"$RESOLVER" 2>/dev/null | grep ':' | paste -sd, -)"

  FLAGS=""

  # Only treat domain as server-actionable if public A points to one of this server's IPv4s
  POINTS_TO_THIS_SERVER=0
  for A in $(echo "$PUB_A" | tr ',' ' '); do
    echo "$SERVER_IPV4S" | tr ' ' '\n' | grep -qx "$A" && POINTS_TO_THIS_SERVER=1
  done

  [ "$POINTS_TO_THIS_SERVER" = "0" ] && continue

  if [ -n "$CPIP" ] && ! echo "$PUB_A" | tr ',' '\n' | grep -qx "$CPIP"; then
    FLAGS="${FLAGS}CPANEL_IP_DIFFERS_FROM_PUBLIC_A;"
  fi

  if [ -n "$PUB_AAAA" ]; then
    BADAAAA=0
    for IP6 in $(echo "$PUB_AAAA" | tr ',' ' '); do
      echo "$SERVER_IPV6S" | tr ' ' '\n' | grep -qx "$IP6" || BADAAAA=1
    done
    [ "$BADAAAA" = "1" ] && FLAGS="${FLAGS}WRONG_AAAA_ON_SERVER_DOMAIN;"
  fi

  CERTDATA="$(live_cert "$D")"
  STATUS="$(echo "$CERTDATA" | awk -F'|' '{print $1}')"
  SUBJECT="$(echo "$CERTDATA" | awk -F'|' '{print $2}')"
  ISSUER="$(echo "$CERTDATA" | awk -F'|' '{print $3}')"
  DAYS="$(echo "$CERTDATA" | awk -F'|' '{print $4}')"
  HOSTCHECK="$(echo "$CERTDATA" | awk -F'|' '{print $5}')"

  if [ "$STATUS" != "OK" ]; then
    FLAGS="${FLAGS}CERT_READ_FAILED_ON_SERVER;"
  else
    [ "$SUBJECT" = "$ISSUER" ] && FLAGS="${FLAGS}CRITICAL_SELF_SIGNED_ON_SERVER;"

    if echo "$HOSTCHECK" | grep -qi "does NOT match"; then
      FLAGS="${FLAGS}CERT_NAME_MISMATCH_ON_SERVER;"
    fi

    if [ -n "$DAYS" ]; then
      if [ "$DAYS" -lt 0 ]; then
        FLAGS="${FLAGS}EXPIRED_ON_SERVER;"
      elif [ "$DAYS" -le "$EXPIRY_DAYS" ]; then
        FLAGS="${FLAGS}EXPIRING_ON_SERVER;"
      fi
    fi
  fi

  STORAGE="$(check_storage_selfsigned "$D")"
  [ -n "$STORAGE" ] && FLAGS="${FLAGS}${STORAGE};"

  if [ -n "$FLAGS" ]; then
    CLEAN_ISSUER="$(echo "$ISSUER" | sed 's/issuer=//; s/,/ /g; s/"/'\''/g')"
    echo "$D,$U,$CPIP,$PUB_A,$PUB_AAAA,\"$CLEAN_ISSUER\",$DAYS,\"$FLAGS\"" >> "$CSV"
    echo "ACTION_REQUIRED: $D USER=$U A=$PUB_A AAAA=$PUB_AAAA DAYS=$DAYS FLAGS=$FLAGS"
  fi
done

echo
echo "===== SUMMARY BY FLAG ====="
awk -F',' 'NR>1 {print $8}' "$CSV" | tr ';' '\n' | sed 's/"//g' | grep -v '^$' | sort | uniq -c | sort -rn || true

echo
echo "===== ACTIONABLE REPORT ====="
column -s, -t "$CSV" 2>/dev/null || cat "$CSV"

echo
echo "===== FILES ====="
echo "REPORT=$REPORT"
echo "CSV=$CSV"
echo
echo "To view later:"
echo "cat $CSV"
echo
echo "===== REDSERVERHOST ACTIONABLE SERVER SSL AUDIT END ====="
date
echo