Server IP : 162.241.126.129 / Your IP : 3.148.104.103 Web Server : Apache System : Linux 162-241-126-129.cprapid.com 4.18.0-477.27.2.el8_8.x86_64 #1 SMP Fri Sep 29 08:21:01 EDT 2023 x86_64 User : rvway5nu4 ( 1018) PHP Version : 7.4.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /scripts/ |
Upload File : |
#!/usr/local/cpanel/3rdparty/bin/perl # cpanel - scripts/setpostgresconfig Copyright 2022 cPanel, L.L.C. # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited #---------------------------------------------------------------------- # XXX XXX IMPORTANT!! XXX XXX # # This modulino is loaded and run as a module in at least one place. # Do NOT add exit() to this code! #---------------------------------------------------------------------- package scripts::setpostgresconfig; use strict; use warnings; use Whostmgr::Postgres (); use Cpanel::PwCache (); use Cpanel::FileUtils::TouchFile (); use Cpanel::PostgresAdmin (); use Cpanel::PostgresUtils (); use Cpanel::PostgresUtils::PgPass (); use Cpanel::Postgres::Connect (); # PPI USE OK -- This binary always needs to so ok perlcc ahead of time use Cpanel::Config::Users (); use Cpanel::Usage (); use Cpanel::SafeFile (); exit( run(@ARGV) ) unless caller(); my $dryrun = 0; my $force = 0; my $verbose = 0; sub run { my (@argv) = @_; my $dryrun = 0; my $force = 0; my $verbose = 0; my %opts = ( 'dryrun' => \$dryrun, 'dry-run' => \$dryrun, 'force' => \$force, 'verbose' => \$verbose, ); # ==== init process options Cpanel::Usage::wrap_options( \@argv, \&usage, \%opts ); $verbose = 1 if $dryrun; my $setup = scripts::setpostgresconfig->new( dryrun => $dryrun, force => $force, verbose => $verbose ); return $setup->check() ? 0 : 1; } sub new { my ( $class, %opts ) = @_; return bless {%opts}, $class; } sub check { my $self = shift; my @actions = qw{check_prerequires}; push @actions, 'check_first_upgrade' unless $self->{force}; push @actions, qw{update_config fix_users add_lock}; foreach my $action (@actions) { $self->msg("running action $action") if $self->{dryrun}; my $status = $self->$action(); return $status unless $status && $status == 1; } return 1; } sub check_prerequires { my $self = shift; return $self->by("Cannot find postgres version.") unless Whostmgr::Postgres::get_version(); return $self->by("Cannot find pgsql_data dir.") unless Cpanel::PostgresUtils::find_pgsql_data(); if ( $self->{force} && !-e _pg_hba_file() ) { my $pg_hba = _pg_hba_file(); Cpanel::FileUtils::TouchFile::touchfile($pg_hba); my $user = Cpanel::PostgresUtils::PgPass::getpostgresuser(); my ( $uid, $gid ) = ( Cpanel::PwCache::getpwnam($user) )[ 2, 3 ]; # If we change the uid/gid on the file we need to update Whostmgr::Postgres::update_config chown( $uid, $gid, $pg_hba ) or warn "Failed to chown($uid,$gid,$pg_hba): $!"; # If we change the mode on the file we need to update Whostmgr::Postgres::update_config chmod( 0600, $pg_hba ) or warn "Failed to chmod(0600,$pg_hba): $!"; } return $self->by("Cannot find pg_hba.conf.") unless -e _pg_hba_file(); return 1; } sub check_first_upgrade { my $self = shift; my $cfg; my $lock = Cpanel::SafeFile::safeopen( $cfg, '<', _pg_hba_file() ); return $self->by("cannot read config file") unless $lock; my $ok = grep { /^\s*local\s+samerole\s+all/ } (<$cfg>); Cpanel::SafeFile::safeclose( $cfg, $lock ); if ($ok) { $self->msg("Nothing todo, configuration looks fine."); # solve problem with users having already upgraded to 11.36.1 without the lock file $self->add_lock(); return -1; } return $self->by("Warning: pg_hba.conf was secured but entries have been removed ( you can run it with --force ).") if !$self->{force} && -e _version_file(); return 1; } sub add_lock { return Cpanel::FileUtils::TouchFile::touchfile( _version_file() ); } sub _version_file { return '/var/cpanel/version/pg_hba_conf_secured'; } sub _pg_hba_file { return join( '/', Cpanel::PostgresUtils::find_pgsql_data(), 'pg_hba.conf' ); } sub usage { my $prog = $0; $prog =~ s{^.+/(.+)$}{$1}; print <<EOF; $prog [options] [ -f FILE ] This script will improve postgres security : - update pg_hba.conf - create role foreach database - grant users to roles Modifiers Flags: --force - force to update config. --verbose - display some friendly verbose messages. --dry-run - do nothing and display some verbose messages. --help - dislay this help message and exit. EOF exit; } sub update_config { my $self = shift; my $dryrun = $self->{dryrun}; $self->msg( "-", $dryrun ? 'will' : '', "update postgres configuration" ); $self->msg("\tnothing done [dryrun]") and return if $dryrun; my ( $status, $message ) = Whostmgr::Postgres::update_config(); $self->by("Cannot update postgres config") unless $status; $self->msg($message) if $message; return Whostmgr::Postgres::reload(); } sub fix_users { my $self = shift; my $postgresadmin = Cpanel::PostgresAdmin->new( { 'cpuser' => 'root' } ); return 0 if !$postgresadmin; foreach my $cpuser ( Cpanel::Config::Users::getcpusers() ) { local $postgresadmin->{'cpuser'} = $cpuser; $postgresadmin->clear_map(); my @dbs = $postgresadmin->listdbs(); next unless scalar @dbs; $postgresadmin->setupdbrole( \@dbs ); my %dbusers = $postgresadmin->listusersindb(); foreach my $db ( keys %dbusers ) { foreach my $user ( @{ $dbusers{$db} } ) { $self->msg( '-', $dryrun ? 'will' : '', 'repair access to', $db, 'for user', $user ); next if $dryrun; $postgresadmin->addusertodb( $db, $user, 1 ); } } } return 1; } sub msg { my ( $self, @msg ) = @_; print join( ' ', @msg, "\n" ) if $self->{verbose}; return; } sub by { my ( $self, @msg ) = @_; $self->msg(@msg); return; } 1;