SM0 She11

Path: / / usr / local / cwpsrv / htdocs / resources / scripts

Full Path (server): /usr/local/cwpsrv/htdocs/resources/scripts

📄 add_alert [E] [D]
📄 amavisd_fix_allowed_header_tests [E] [D]
📄 apache_mpm_calculator [E] [D]
📄 apache_server-status [E] [D]
📄 autossl_fix_tmp_path [E] [D]
📄 autossl_generate_apache_conf [E] [D]
📄 autossl_reload [E] [D]
📄 bandwidth_run [E] [D]
📄 centos7_fix_repository [E] [D]
📄 cgroups_blkio [E] [D]
📄 check_api [E] [D]
📄 check_postqueue [E] [D]
📄 checkdb [E] [D]
📄 chroot_add [E] [D]
📄 chroot_remove [E] [D]
📄 clamd_fix_100_cpu_usage [E] [D]
📄 clean_all_server_logs [E] [D]
📄 clean_goaccess_files [E] [D]
📄 clean_logs [E] [D]
📄 cpanel_addhandlers [E] [D]
📄 cron_fix_openbasedir [E] [D]
📄 cwp_api [E] [D]
📄 cwp_bruteforce_protection [E] [D]
📄 cwp_monitor [E] [D]
📄 cwp_security_audit [E] [D]
📄 cwp_set_memory_limit [E] [D]
📄 cwp_update_admin [E] [D]
📄 cwp_update_admin_design [E] [D]
📄 cwp_update_all [E] [D]
📄 cwp_update_user [E] [D]
📄 cwp_update_user_design [E] [D]
📄 cwp_version [E] [D]
📄 cwpsecure_update_rules [E] [D]
📄 cwpsrv_rebuild_user_conf [E] [D]
📄 disk_check [E] [D]
📄 disk_usage_per_user [E] [D]
📄 dns_sync_slave2 [E] [D]
📄 dso_handler_remove [E] [D]
📄 el8_stream_convert_to_cwp_stable [E] [D]
📄 fix_cwpsrv_logs [E] [D]
📄 freshclam [E] [D]
📄 generate_hostname_ssl [E] [D]
📄 hostname_ssl_restart_services [E] [D]
📄 image_rebuild_server_config [E] [D]
📄 install_acme [E] [D]
📄 install_api [E] [D]
📄 install_cbpolicyd [E] [D]
📄 install_imagick [E] [D]
📄 install_maldet [E] [D]
📄 install_net2ftp [E] [D]
📄 install_netdata [E] [D]
📄 install_phpPgAdmin [E] [D]
📄 install_pure-ftpd_tls [E] [D]
📄 install_supportKey [E] [D]
📄 install_terminal [E] [D]
📄 list_domains [E] [D]
📄 list_subdomains [E] [D]
📄 list_users [E] [D]
📄 mail_queue_stats [E] [D]
📄 mail_rebuild_sni_certs [E] [D]
📄 mail_roundcube_update [E] [D]
📄 mail_vmail_import [E] [D]
📄 mysql_fix_myisam_tables [E] [D]
📄 mysql_phpmyadmin_update [E] [D]
📄 mysql_pwd_reset [E] [D]
📄 mysql_set_max_connections [E] [D]
📄 mysql_show_max_connections [E] [D]
📄 net_show_connections [E] [D]
📄 open_basedir-suphp [E] [D]
📄 php_big_file_upload [E] [D]
📄 php_mail_log [E] [D]
📄 phpfpm_rebuild_user_conf [E] [D]
📄 phpfpm_service_manage [E] [D]
📄 quota_check_status [E] [D]
📄 reinstall_clamd_amavisd [E] [D]
📄 reinstall_pure-ftpd [E] [D]
📄 reload_cwpsrv [E] [D]
📄 reseller_list_accounts [E] [D]
📄 restart_cwpsrv [E] [D]
📄 restart_httpd [E] [D]
📄 security_is_my_server_hacked [E] [D]
📄 softaculous_fix_update [E] [D]
📄 stats_clean_domlogs [E] [D]
📄 stats_goaccess [E] [D]
📄 system_info [E] [D]
📄 temp_hacker_check [E] [D]
📄 ulimit_user_check [E] [D]
📄 update_cwp [E] [D]
📄 update_ioncube [E] [D]
📄 update_openssl [E] [D]
📄 update_roundcube [E] [D]
📄 upgrade_mysql [E] [D]
📄 user_backup [E] [D]
📄 userowner [E] [D]
📄 varnish_clear_cache [E] [D]
📄 whoowns [E] [D]

Editing: cwp_security_audit

#!/bin/bash

# --- CONFIGURATION ---
ALLOWED_LIB_PATHS=(
    "/usr/lib64/lib"
    "/usr/lib64/ld-"
    "/usr/local/ioncube/"
    "/usr/lib/locale/"
    "/usr/local/cwp/"
    "/usr/local/apache/modules/"
    "/usr/local/lib/"
    "/var/db/nscd/"
    "/usr/lib64/librwctl.so"
)

ALLOWED_BINARIES=(
    "/usr/local/cwpsrv/bin/cwpsrv"
    "/usr/local/cwp/php71/sbin/php-fpm"
    "/usr/local/apache/bin/httpd"
)

ALLOWED_PORTS=("2030" "2031" "2082" "2083" "2086" "2087" "2095" "2096" "9000" "2302" "2304" "8181" "8443" "80" "443")

# --- INITIALIZATION ---
if ! command -v lsof &> /dev/null; then
    yum install -y lsof
fi

# --- FUNCTIONS ---

check_process() {
    local PROC_NAME=$1
    local SEARCH_PATTERN=$2
    local PID=$(ps aux | grep "$SEARCH_PATTERN" | grep -v grep | awk '{print $2}' | head -n 1)

if [ -z "$PID" ]; then
        echo "[SKIP] Process '$PROC_NAME' not found."
        return
    fi

echo "------------------------------------------------------"
    echo "[INFO] Auditing $PROC_NAME (PID: $PID)"
    local GLOBAL_ERROR=0

# 1. Detect GHOST Files (DELETED or missing via stat)
    local GHOST_DATA=$(lsof -p $PID -n | grep -E "DEL|\(stat:" | grep -v "/dev/zero")
    if [ ! -z "$GHOST_DATA" ]; then
        echo "[!!! CRITICAL ALERT !!!] Ghost files (deleted but running) found:"
        echo "$GHOST_DATA"
        /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Ghost files" --message="Ghost files found for $PROC_NAME" >/dev/null 2>&1
        GLOBAL_ERROR=1
    fi

# 2. Deep Memory Audit (Čišćenje samo 9. stupca s putanjom)
    local CURRENT_MEM=$(lsof -p $PID -n | grep "mem" | awk '{print $9}' | sed 's/(stat:.*//' | xargs)
    
    for FILE in $CURRENT_MEM; do
        # Zanemari prazne unose, sistemske oznake, izbrisane reference i dev naprave
        [[ -z "$FILE" || "$FILE" == "REG" || "$FILE" == "mem" || "$FILE" == "/" || "$FILE" == "(deleted)" ]] && continue
        [[ "$FILE" == "("* || "$FILE" == "/dev/"* || "$FILE" == "anon_inode"* ]] && continue
        
        # Zanemari log datoteke
        [[ "$FILE" == *".log"* || "$FILE" == *"/logs/"* || "$FILE" == *"/domlogs/"* ]] && continue

local MATCH=0
        for ALLOWED in "${ALLOWED_LIB_PATHS[@]}"; do
            if [[ "$FILE" == "$ALLOWED"* ]]; then MATCH=1; break; fi
        done
        for ALLOWED in "${ALLOWED_BINARIES[@]}"; do
            if [[ "$FILE" == "$ALLOWED" ]]; then MATCH=1; break; fi
        done

if [ $MATCH -eq 0 ]; then
            echo "[SECURITY ALERT] Unknown/Untrusted file: $FILE"
            /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unknown file" --message="Unknown file: $FILE" >/dev/null 2>&1
            GLOBAL_ERROR=1
        else
            # Verify RPM package
            if [[ "$FILE" == "/usr/lib64/"* && "$FILE" != "/usr/lib64/librwctl.so" ]]; then
                if ! rpm -qf "$FILE" &>/dev/null; then
                    echo "[!!! DANGER !!!] File in system path but NOT owned by any package: $FILE"
                    /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unowned file" --message="Unowned file: $FILE" >/dev/null 2>&1
                    GLOBAL_ERROR=1
                fi
            fi
        fi
    done

# 3. Port Audit
    local CURRENT_PORTS=$(lsof -p $PID -nP | grep "LISTEN" | awk -F':' '{print $NF}' | awk '{print $1}')
    for PORT in $CURRENT_PORTS; do
        local PORT_MATCH=0
        for ALLOWED in "${ALLOWED_PORTS[@]}"; do
            if [ "$PORT" == "$ALLOWED" ]; then PORT_MATCH=1; break; fi
        done
        if [ $PORT_MATCH -eq 0 ]; then
            echo "[SECURITY ALERT] Unauthorized port: $PORT"
            /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unauthorized port" --message="Unauthorized port: $PORT" >/dev/null 2>&1
            GLOBAL_ERROR=1
        fi
    done

[ $GLOBAL_ERROR -eq 0 ] && echo "[OK] $PROC_NAME looks clean."
}

# --- EXECUTION ---
check_process "cwpsrv" "cwpsrv: master process"
check_process "php-fpm-cwp" "php-fpm: master process .*cwpsrv.conf"
check_process "apache" "/usr/local/apache/bin/httpd"

echo "------------------------------------------------------"
echo "[DONE] Security audit finished."