[&
F d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl m
Z
d dlmZ d dlmZmZmZ d dlZd dlmZ d dlmZmZ d dlm Z m Z d d l m Z m Z d d
l!m"Z"m#Z# d d l$m%Z%m&Z& d d l'm(Z( d d
l)m*Z*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 d dl m4Z4 d dl5m6Z6 d dl7m8Z8 dZ9dZ:dZ;dZdZ?dZ@de@ ZAdZBd ZCd ZDd ZE e d d d!g ZFd"d#d#d#d#d#d#d#d#d$ ZGd%d&d'd&d&d&d&d&d&d$ ZHi ZId(d)eHd*eId+< d,d-eGd*eId.< d/ZJd0ZKd1 ZLdd3ZMdd5ZNd6 ZOd7 ZPd8 ZQ eLd9 d: ZRd;eeSeeT f fd<ZUd= ZV eLd> d? ZWd@eTd;eFfdAZX eLdB ePeVdC ZY eLdD ePeVdE ZZ eLdF ePeVdG Z[ eLdH ePeVdI Z\ eLdJ dK Z] eLdL eQdM Z^dN Z_ eLdO dP Z` eLdQ dR Za eLdS dT Zb eLdU eQdV Zc eLdW dX Zd eLdY eQdZ Ze eLd[ ePd\ Zf eLd] ePd^ Zgd_Zhd`Zig daZjg dbZkdc Zldd Zmde Zn eLdf dg Zo eLdh di Zp eLdj dk Zqdl ZrdmeTd;eeT fdnZsd;etfdoZud;etfdpZvdqeTd;etfdrZwd;eeT fdsZxdt Zydu Zz eLdv ePdw Z{ddyZ|d;eSfdzZ}d{e j~ d;eeeT fd|Zd;eeeT fd}Zd~eeeT d;dfdZ eLd eQd Z eLd eQd;eFfd Z eLd d;eFfd ZdS ) N)
namedtuplewraps)Path)ListOptionalTuple) get_hidepid_typing_from_mounts)ClPwddrop_privileges)Featureis_panel_feature_supported)CLEditionDetectionErroris_cl_solo_edition)is_client_enabledis_cmt_disabled)DEFAULT_JWT_ES_TOKEN_PATHDISABLE_CMT_FILE)jwt_token_check) WhmApiError
WhmApiRequest)ExternalProgramFaileddemoteis_litespeed_running is_ubuntuprocess_is_running run_command service_is_enabled_and_present) is_container)LimitsValidator)get_pkg_versionOKFAILEDSKIPPEDINTERNAL_TEST_ERRORz.decorators s * )r@ rB s ` rA r> r> r s$ rC Fc d}d}|r%d | D }||d< t j | S g }| D ]?\ }}}| d|j d|j } || d| d | d
| d } | | @d |d
| dgz }|S )z2
Formatter of output from all of checkers
z)Command for disabling this cron checker: z cldiag --disable-cron-checkersc @ i | ]\ }}}|| S rD )_asdict).0checker_pretty_name_
chk_results rA
z _formatter.. s1 hhh=_=PRSU_"J$6$6$8$8hhhrC total_errorsz:
: N
z " "z
z
There are z errors found.)jsondumpsr) r* appendjoin)
data error_countto_jsonr* cmd_tmpr) rI checker_public_namerK checker_results
rA
_formatterr\ z s
6C.G hhcghhh )Nz#
C@D # #< 0* /^^
^^jn^^ * . ] ]c ] ]W ] ]GZ ] ] ]N
>""""
++c E+ E E E FF
G
GC JrC Tc t | r| g} g }d}| D ]} | }n9# t $ r,}t t t | }Y d }~nd }~ww xY w|j t t fv r|dz
}| |j t |d r|j
nd |f t ||| }|r#t | t j | ||fS )Nr public_name)callable Exceptionr( r% reprr) r# rT r> hasattrr_ r\ printsysexit) checkersrX do_exitresultserrorsfrK er) s rA runnerrm s- :G
F
AJJ A A A"#6Q@@JJJJJJ A >
aKF
!(M!:!:D
Wfg
.
.C
c
3;s
'
A "AA c j t | S # t $ r t d| d Y dS w xY w)NzWARNING
missing z function in cldetectlib.F)evalAttributeErrorrd )r? s rA wrapperrq sO Dzz
B4BBBCCCuus 22c < t fd }|S )Nc t d }n# t $ r d}Y nw xY w|rt t t S | i |S )NTskip_jwt_checkF)r r r( r$ SKIPPED_ON_SOLO_MSG)argskwargsis_solo_editionrk s rA checkerz(skip_checker_on_cl_solo..checker sl $ 0 E E EOO& $ $ $ #OOO $ ; W&9:: :q$!&!!!s ##r rk rz s ` rA skip_checker_on_cl_solor| s3
1XX" " " " X" NrC c < t fd }|S )Nc z t t j st t t
S | i |S r= )r r
LVEr( r$ SKIPPED_WITHOUT_LVE_MSG)rw rx rk s rA rz z'skip_check_without_lve..checker s; )'+66 ? W&=>> >q$!&!!!rC r r{ s ` rA skip_check_without_lver s3
1XX" " " " X"
NrC z Check cagefsc , t t d S )NzuCagefs version is too old. Please run cagefsctl --sanity-check directly or upgrade it to have full cldiag integration)r( r$ rD rC rA fake_cagefs_checkerr s 8 rC returnc t d} dt dt d}d}ddlm} | }| |d sd
|fS |t \ }}}|s||fS t rd
|fS t
sd
| fS d S ) am
Check that a server is cl+, enabled and CM isn't disabled locally
The function returns True if the client has CL+ license, didn't disable CM
localy and activated CM on https://cm.cloudlinux.com. The function also
returns True if we can't read or parse JWT token, because
we want to continue and show to client CM related errors
z. is not activated on https://cm.cloudlinux.comzThe z& is disabled localy by creating file "rQ The server has no CL+ licenser get_client_data_from_jwt_tokenNcl_plusF)TN) cm_full_namer clsummary.utilsr r r r )cm_is_not_activated_msgcm_is_disabled_localy_msgno_cl_plus_license_msgr jwt_tokenis_validmessagerJ s rA _is_cmt_allowed_for_serverr s ". ` ` ` r| r r_o r r r <>>>>>>..00I Yy%9 ,,, . 0 0 '1 %W$ $ 0/// .--- :rC c < t fd }|S )zi
Decorator: Skip check if a server isn't cl+, disabled and
CM is disabled locally
c d t \ }}|r | i |S t t | S )z$
Decorated function
)r r( r$ )rw rx resultr rk s rA decorated_functionz@skip_if_cmt_not_used_enabled_allowed..decorated_function sI
566 &1d%f%% %
rC r )rk r s ` rA $skip_if_cmt_not_used_enabled_allowedr s6 1XX
X
rC zCheck existing JWT tokenc d} dt dt dt dt }d}ddlm} t j t st t || z S t \ }}}|r# | }t t d | d
S ||k rt t d S |d z }t t | d| S )
z%
Check an existing JWT token
zJ The absence of JWT tokens is normal for the clients with volume license. z$Please check for JWT token in path "zr". %sTry running "rhn_check" for getting a new token if it is absent. Server can't collect and send statistics to z( if you don't have a correct JWT token. . z"JWT token doesn't have CL+ servicer r zJWT token is valid: "rQ r )r r cl_plus_doc_msgwrite_to_support_msgr r ospathexistsr( r$ r r" r# )token_is_absent_msgmain_msgtoken_is_not_cl_plusr r r rJ r s rA check_jwt_tokenr s3
g " % " " +7 " " ,; " "
" "
@>>>>>>
7>>3 4 4
* *
)**FGQ
C2244 AY A A ABBB&&& +
"}H V 5 58 5 5 6 66rC service_namec t | \ }}t |t r|gn|}d}|D ]'} t |d rd} n# t $ r Y $w xY w|r |r|rt t d| d S g }|s| d |s| d |s| d t t d | d t d
| d t d t S )
a;
Check that a service is present, enabled and active
:param service_name: name of a service
:param process_file_path: path (or list of paths) to a file which is run
by a service. When a list is given, the service is considered active
if *any* of the paths matches a running process.
FTz Service "z " is present, enabled and activezService is not present.zService is not enabled.zService is not active.rP z1 The server can't collect and send statistics to z if service z$ isn't present, enabled and active. r )
r
isinstancestrr FileNotFoundErrorr( r" rT r# rU r r r )r process_file_path
is_present
is_enabledpaths is_activer messagess rA _check_service_stater 9 s cl_node_exporter
let`s handle both cases:
- old `node_exporter` service
- renamed `cl_node_exporter` service
r z&/usr/share/cloudlinux/cl_plus/service/z+/usr/share/cloudlinux/cl_plus/node_exportercl_node_exporterzcl_node_exporter.service
node_exporter)r r( r$ r r r rU r )base_service_pathr r s rA check_node_exporter_servicer s s ~~ \"Z[[[@E w~~bgll#46HIIJJ 'bgnn
&(BCCO O ' * & .? @ @@rC z7Check service `lvestats` is present, enabled and activec . d} ddg}t | | S )zF
Check that service `lvestats` is present, enabled and active
lvestatsz'/usr/share/lve-stats/lvestats-server.pyz/usr/sbin/lvestats-server)r )r process_file_pathss rA check_lvestats_servicer s* L1# .@ A AArC zeCheck that the server has the minimal required packages for correct working of Centralized Monitoringc dD ]C} t | 2t t d| dt dt dt
c S Dt t d S )zD
Check that the server has minimal required packages for CM
)zcl-end-server-toolszcl-node-exporterNz!System doesn't have the package "z". It's required for zA feature to work and it usually installed automatically by cron. r zVSystem has the minimal required packages for correct working of Centralized Monitoring)r! r( r# r r r r" ) package_names rA check_cmt_packagesr s D < ( ( 0 * * *8D* * +:* * ( * *
1 Rq r rrrC zACheck control panel and it's configuration (for DirectAdmin only)c dt dz } t j t j }|dk rt t
d S d| dt j d}t d sL|d
k rFt j rt t |d z S t t |d z | z S t t | S )
NzW Fixing the issue will provide CloudLinux support on your control panel.
See details: z#diag-cpr2 zCan't detect contol panelzControl Panel - z
; Version ;Trt r- z File "options.conf" is finez1 File "options.conf" has no line "cloudlinux=yes") cldiag_doc_linkdetectgetCP getCPNamer( r$
CP_VERSIONr da_check_optionsr" r# )fix_motivationcp_nameres_msgs rA
check_cp_diagr s 7'*4 7 7 LNNN G)"=>>>HHHF4EHHHG T 2 2 2 qw-7O7O " $ $ K R+I!IJJ J+^!^ao!oppp R ! !!rC zDCheck fs.enforce_symlinksifowner is correctly enabled in sysctl confc
dt dz } t j rt t d S t j }nM# t $ r@}d}t t dt t | | d cY d }~S d }~ww xY w|dk rt t d| z S t t d | S )
Nz Fixing that issue makes server more secure against symlink attacks and enables protection of PHP configs or other sensitive files.
See details: z#symlinksifowner$Not supported for OpenVZ environmentz+To see full error run /sbin/sysctl --systemz@Some parameter in sysctl config has wrong configuration. Error: z* It`s recommended to fix it and try again z fs.enforce_symlinksifowner = 2z fs.enforce_symlinksifowner = ) r r is_openvzr( r$ get_symlinksifownerr r# get_short_error_messager r" )r symlinks_if_ownerrl detailed_outs rA check_symlinksifownerr s [4CFX4X [ [ J"HIII
" 6 8 8
D
p-c!fflCC
p
p
p
A !AN!RSSS RL9JLL M MMs A
B5B
BBc | d }t dz |z }d| d| }t j d st t d S t | d s t t | d d S t j | d }| t t d
| d d S |st t d |z S t t d
S )Nr4 z#check-z{ Fix that issue to be sure that users run their sites inside CageFS and provide stable work of sites that are using apache z7 module. This may improve server security
See details: /usr/sbin/cagefsctlCagefs is not installedr5 z is not enabledr6 zUnable to check zU module binary for custom control panel. This feature may be added in future updates.zBinary without CageFS jail zbinary has jail) lowerr r r r r( r$ rq r check_binary_has_jailr# r" )params module_namelinkr has_jails rA binary_checkr s( .&&((K Y & 4D !/: ! ! ! !
7>>/ 0 0 =";<<< 6+, - - FVF^"D"D"DEEE+F:,>??H
Qvf~
Q
Q
Q
Q!> !OPPP R* + ++rC z Check suexec has cagefs jailc t j r#t rt t d S t t d S )NzUCurrent PHP selector uses LiteSpeed, which doesn't require the patches in suEXEC bin.r9 )r detect_litespeedr r( r$ r BINARY_CHECK_PARAMETERSrD rC rA check_suexecr sQ
%9%;%;
l
/9 : ::rC zCheck suphp has cagefs jailc 6 t t d S )Nr7 )r r rD rC rA check_suphpr s /8 9 99rC zCheck usepam in sshd configc dt dz } t j }|t t d S |rt t
d S t t d| z S )NzgFix the issue to provide correct work of pam_lve module with sshd and CageFS ssh sessions
See details: z
#check-usepamz!Unable to run "/usr/sbin/sshd -T"zConfig is finez3There is "usepam no" in "/usr/sbin/sshd -T" output )r r check_SSHd_UsePAMr( r$ r" r# )r check_results rA
check_use_pamr sx Q-<-N Q Q +--L"EFFF / -... V RUc c d ddrC z*Check the validity of LVE limits on serverc d} d| z }d}t }| }|t t | S t t |dz |z S )z
Validate lve limits
z6https://docs.cloudlinux.com/lve-limits-validation.htmlz'Invalid LVE limits on server. See doc: zValid LVE limits on server.NrO )r validate_existing_limitsr( r" r# )doc_linkfailed_messagepassed_messagelimits_validatorr s rA check_lve_limitsr se HH>IN2N&((
6
6
8
8F
~^,,, V^d 2V ; < <z%check_phpselector..O s 5554$**,,555rC z
Can not read z ()zdefault::r^ z+ config should have the default PHP version)cgifcgir7 r zdoesn't support z handler in ea4/php.conf ruid2_modulea It looks like you use mod_ruid. CloudLinux PHP Selector doesn't work properly with it. How to delete mod_ruid and install mod_suexec in cPanel: https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/#installing-on-cpanel-servers-with-easyapache-4-1 suphp_moduler7 lsapi_moduler
suexec_moduler9 zyIt looks like you do not have mod_suphp or mod_suexec installed. CloudLinux PHP Selector doesn't work properly without it)r7 r r r z php.conf:z with z, c 3 $ K | ] \ }}||V d S r= rD rH module is_installeds rA z$check_phpselector..x s- 0s0s.~ s- (k(k4HFL^j(k(k(k(k(k(k(krC ])r r r r r( r$ r r r r" openIOErrorr#
startswithsplitr get_apache_modulesanyrU items)
ok_prefix fail_prefixstatushandler conf_pathrk configrl errr default_vermodulescurrents
rA check_phpselectorr - s+ #I q),@@ q q q 7>>2 3 3 T"RSSS 6%9%;%; 6Y 4555
>
>FG*I w~~i 8 8iw777
61551555
6
6
6
6
6
6
6
6
6
6
6
6
6
6
6 8 8 83)33q333C V[3%677 7 7 7 7 7 7 8 8 8Dz**
#zz#q 1 8 8 : :
KKKC V[3%677 7 7 7D+ 0 0 011
7 ::c??1-4466 ; ; ;FWFFFC V[3%677 7'))G W $ $ @ @
)G3w(G3w*g5x w!12 3 3
G
G
g 2&* 2w:[/[/[ u u utyy0s0sTZT`T`TbTb0s0s0s's's u u Y 0111 o")/33w o o #yy(k(kFLLNN(k(k(k k k o o o
V[3 . / //sB )C ;
C C CC C C
D* D
DDzCheck fs.symlinkown_gidc ` dt dz } t t d }d| z }d}t j rt t
d S t j t j } t j | n)# t $ r t t
d| d cY S w xY w t |d
5 }t |
}d d d n # 1 swxY w Y n2# t $ r%}t t d | d | cY d }~S d }~ww xY wt j |k r|S t% j | j }n# t $ r g }Y nw xY w|r||v r|S t t | || S )
Nz|Fix the issue to provide symlink protection for apache user and as a result make your Web Server more secure.
See details: z#check-symlinkowngidz>Web-server user is protected by Symlink Owner Match Protectionz@Web-server user '{}' is not in protected group specified in {}. z/proc/sys/fs/symlinkown_gidr z There is no web-server user [z!] on the system. Nothing to checkr r zCan't read GID from z
with error: )r r( r" r r r$ get_apache_gid APACHE_UNAMEpwdgetpwnamKeyErrorr
intreadr ra r#
APACHE_GIDgrpgetgrgidgr_memformat) r ok_res warn_msg_tplsymlinkown_gid_file apache_unamerk current_symlinkown_gidrl grp_memberss rA check_symlinkowngidr2 sH E),BB E E
r[
\
\FX[iiL7
J"HIII
&Ls \"""" s s s"q,"q"q"qrrrrrs_
%
8
8
8 ;A%( )9)9%:%: " ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; _ _ _!]8K!]!]Z[!]!]^^^^^^^^_ 222
l#9::A ; & &M V\ 0 0 ?R S S T TTsf 2B #B-,B-1D 4D6 D DD D
D
D=D82D=8D=E- - E<;E<z&Check existence of all user's packagesc
d
d} d}g d g d}g t j dk rt t d S t j | st t d S t j | rt j | t j |t j
t j
| d
5 }| \ }}|j }d d d n # 1 swxY w Y |d k rd
| }t t | S d | d D }fd|D }n1# t $ r$} d| }t t | cY d } ~ S d } ~ ww xY w
fdt j
D fd|D }
|
r.dd |
d}t t | S t t$ d S )zL
Return user's packages that do not exist in /var/cpanel/packages/
z/var/cpanel/packages/z/var/cpanel/users/z/var/cpanel/suspended/) undefineddefaultz#cPanel Ticket System temporary userCustom)z /bin/grepz-ezPLAN=z-rr+ should be run on cPanel onlyzno users on this serverT)stdoutstderrcwdtextNr z error getting user's packages: c g | ]c}| d d d d | d d fdS )=r r r^ )r r )rH plans rA r z9check_existence_of_all_users_packages.. sg
OSTZZ__Q
%
%c
*
*1
-tzz#q/A/G/G/I/I J
rC rO c & g | ]
\ }}|v ||fS rD rD )rH userpkgsuspended_userss rA r z9check_existence_of_all_users_packages.. s- m m midCQU]lQlQltSkQlQlQlrC z"error processing user's packages: c g | ]A}t j t j | ?|BS rD )r r isfilerU )rH packagepackages_dir_paths rA r z9check_existence_of_all_users_packages.. sN rw||\movOwOw@x@x rC c 4 g | ]\ }}|v |v
| d | S )rN rD )rH r@ rE excluded_packages_namesexists_packagess rA r z9check_existence_of_all_users_packages.. sK ! ! ! D' 1 1 1g_6T6T 7 6T6T6TrC zXFound some nonexistent user's packages. List of "user: package" separated by semicolon: z; z. If you want to apply package limits for those users - assign existing packages to them, otherwise limits will be applied incorrectly or not applied at all.z(nonexistent user's packages aren't found)r r r( r$ r listdirr r
subprocessPopenPIPE communicate
returncoder# r r ra rU r" )users_dir_pathsuspended_dir_path
user_plan_cmdprocstd_outstd_errret_coder* all_users_packagesrl not_exists_users_packagesrH rI rF rB s @@@@rA %check_existence_of_all_users_packagesrY s 0)N1 g g g666MO
X%%"@AAA
:n % % =";<<< w~~()) 9 *%788
#
++--?# # # # # # # # # # # # # # # 1}}999%%% &
W^WdWdWfWfWlWlmqWrWr
n m m m;M m m m & & &6166%%%%%%%%&
!z*; < < O! ! ! ! ! /! ! !
! &
R?CyyIb?c?c
R
R
R %%% RC D DDs0
C55C9<C9!?E! !
F+F
F
Fz$Check all resellers's packages filesc t j dk rt t d S G d d } ddlm} | 5 | ddd n # 1 swxY w Y t t d S # t $ r,}t t t | cY d}~S d}~ww xY w) zT
Check reseller packages files reading on any errors
Caused by LU-2374
r- z!should be run on DirectAdmin onlyc e Zd ZdZd Zd ZdS )7check_da_resellers_packages_files..HiddenPrintsz=
Redirect stdout to /dev/null to hide output
c t t j | _ t t j dd t _ d S )Nwr r )re r8 _original_stdoutr
r devnull)selfs rA __enter__zAcheck_da_resellers_packages_files..HiddenPrints.__enter__ s( $'JD ! bj#@@@CJJJrC c d t j | j t _ d S r= )re r8 closer_ )ra exc_typeexc_valexc_tbs rA __exit__z@check_da_resellers_packages_files..HiddenPrints.__exit__ s$ J .CJJJrC N)__name__
__module__ __qualname____doc__rb rh rD rC rA HiddenPrintsr\ s? A A A / / / / /rC rm r )r- Nz6all resellers packages are written in correct encoding) r r r( r$ clcontrollibr- list_resellers_packagesr" ra r# r )rm r- rl s rA !check_da_resellers_packages_filesrp s8 ]**"EFFF / / / / / / / / )((((()
\^^ 4 4 KMM 1 1 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 UVVV ) ) )Q(((((((()sB
B A4( B 4A88B ;A8<B
C
!C?C
C
z /etc/cl.selector/defaults.cfgz/etc/cl.selector/php.conf) DirectiveDefaultTypeCommentRangeRemark)valuelistboolc g } d}d}t t dd 5 }| }ddd n # 1 swxY w Y |D ]}| d rt | dk r_d} | | n%# t $ r | g Y nw xY w| | | |sd}|d z
}| S )
zL
Parse php.conf and split it into blocks by empty line
:return:
r Tr r r N#Fr^ )r
PHP_CONF_PATH readlinesr lenr ra rT ) line_blocks block_index new_blockconfrV r s rA parse_php_confr s_
KK
I
mS7 3 3 3 t~~ ??3 tzz|| q I
'K(((
'
'
'""2&&&&&
' $ + +DJJLL 9 9 9 9 I 1 K s! ?AA B B76B7c f d}d}| D ]}| d }|d t vrd}|dt | dz }|d dk r9|d t vrd}|dt | d
z }||gS ) NTr r= r Fz
Block z has wrong param
rs r^ z has wrong directive
)r r PARAM_NAME_LISTblock_to_stringTYPES)blockr r* r
line_partss rA check_blockr A s
F
C W WZZ__
a= 7 7FN?5#9#9NNNNC a= F * *!}""$$E11 Vu'='= V V VV C=rC c > d}| D ]}|t | z dz }|S )NrO )r )r
res_stringr s rA r r P s3 J 3 3 #d))+d2
rC z"Checking /etc/cl.selector/php.confc ` d} d| }d}d}t j t s t t
dt d S t
}|D ]"}t | \ }}|o|}|r|dz |z }#|st t ||z S t t d S ) Nz7https://docs.cloudlinux.com/custom_php_ini_options.htmlzTo fix the issue provide valid format for /etc/cl.selector/php.conf file. It is used for PHP Selector and invalid format lead to directives misconfiguration and as a result misconfiguration of selector
Please, read more about php.conf file in Tr zFile z does not exist
rO Ok)
r r r r| r( r$ r r r# r" )php_ini_doc_linkr r r* blocksr r1msg1s rA check_php_confr W s P I 7G I I F
C
7>>- ( ( L"J-"J"J"JKKK
F $ $ u%%D B $*t#C 7~!5666 R rC z&Checking /etc/cl.selector/defaults.cfgc D dt dz } t j t s t t t d S t j d d }| t n9# t $ r,}t t t | cY d }~S d }~ww xY w |
dd }n9# t j t j f$ r t t d| z cY S w xY w| D ]}| d r|d d } |
|d
}n# t j $ r d }Y nw xY w |
|d }n# t j $ r d
}Y nw xY w||k r#|dk r t t d| d| c S |rCd|v r?| d }|D ]'} | s#t& j d| d (t t, d S )NzDetails: this config file is used by the CL PHP selector and stores its global options, so it is important to keep needed configurations and valid syntax for PHP modules' settings to avoid selector's misconfiguration
See details: z#cldiagz does not existF
interpolationstrictversionsphpz!Default php version is undefined
stateenabler r disabledzDefault php version z
is disabled
,z"Warning: Modules list for version z is strange
r" )r r r r DEFAULTS_CFG_PATHr( r$ configparser ConfigParserr& ra r# r get
NoOptionErrorNoSectionErrorsectionsr r re r9 writer" )
r defaults_cfgrl default_php_versionsection php_versionr r module_namesr4 s
rA check_defaults_cfgr o s 8 *I5 8 8 7>>+ , , I%6"G"G"GHHH)#0tERRR +,,,, ) ) )Q(((((((()X * . .z5 A A & (C D X X X!E!VWWWWWX ((** n n e $ $ n!!""+K
!$((':: -
!
!
!
!
&**7I>> -
"k11ez6I6I )k )k)k[i)k)klllll
n'>>#*==#5#5L , n n # n J , ,-lR]-l-l-l m m m R sT 0B
B7 !B2,B72B7;C 3DDEE,+E,0FFFz Checking domains compatibilityc t j dk rt t d S d} d}t }|t t
| S t t | S )Nr+ r7 zSome domains/subdomains don't use PHP Selector because they have a non-system default version (in MultiPHP Manager) or PHP_FPM enabled. You can find their list on domains tab and pass control to PHP Selector if necessary.r )r r r( r$ domains_compatibility_checkerr" r# )r r r s rA check_domains_compatibilityr sh
X%%"@AAA 9
N
*
,
,F
~^,,, V^ , ,,rC c h t d } t d }n# t $ r Y d S w xY w| d D ]F}| d | d k s| d r dS Gd S )Nphp_get_vhost_versions php_get_system_default_versionr versionphp_fpmzIncompatible version)r callr r )domainssystem_versiondomains rA r r s 899>>@@&'GHHMMOO tt++j)) * * i ( (FJJy,A,A A AVZZPYEZEZ A))) B* *s AA
AAdirpathc t j | sdS d| }t j | d t j t j dd }|j dk rdS |j d d d d
}n# t $ r Y dS w xY w|S ) zZ
Get mountpoint for dirpath directory from output of
df -h {dirpath} utility.
Nzdf -h rP TF)r8 r9 r; checkr rO r^ )
r r isdirrK runr rM rO r8
IndexError)r get_mountpoint_cmdprocess
mounted_ons rA get_dir_mountpointr s
7== ! ! t+'++n %%
G Q t ^))$//288==bA
tt s 59B/ /
B=<B=c d} t j d rlt dd 5 }|D ]?}| d r(t | d d } @ ddd n # 1 swxY w Y | S ) z[
Returns maximum uid from /etc/login.defs
If file does not exist returns 60000
i` z/etc/login.defsr r zUID_MAX rP r N)r r rD r
r r% r )max_uidrk r s rA get_max_uidr s
G w~~'(( 7
#g
6
6
6 7!
7
7??:.. 7 !$**S//""5 6 6G
7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 Ns ABB
Bc p d} t | d d }t | }|S )z
Returns min cagefs uid
z!/usr/sbin/cagefsctl --get-min-uidrP T)convert_to_str)r r r% )get_min_uid_cmdr8 min_uids rA get_min_uidr s9 :O
..s33D
I
I
IF&kkG NrC usernamec B t }t }||k rt d| d| d| t | }| | v r| | S | s|}n1|}| }t || D ]
}||vr|} n ||k rt d| d| d d| d| }t | d d
\ }} }
|d k rt |
|S )
z
Creates user with max available uid that greater than min cagefs uid
and less than max system uid.
Does nothing if user already exists.
z
Can't create z user: min_uid z is greater than max_uid )r z user: uid z is too bigz#/usr/sbin/useradd -s /bin/false -u z -m rP T)return_full_outputr )
r r RuntimeErrorr get_user_full_dictget_uid get_uid_dictranger r ) r r r clpwd
custom_uidused_uids_dict_uid useradd_cmdrO rJ r s rA useraddr so mmGmmGs8ssssjqssttt ' " " "E5++----}}X&&&
++--'7++ D>)) !
* W W8WW
WWWXXXR
RRRRK$[%6%6s%;%;PTUUUJ3Q3 rC c t t d 5 } | cddd S # 1 swxY w Y n# t t
f$ r Y nw xY wdS )zS
Retrive cldiag username from file
:return: username from file or None
r r N)r
_CLDIAG_USERNAME_FILEr& r OSErrorr )rk s rA get_username_from_filer s
''
:
:
: $a6688>>## $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ W
4s3 A &A A AA AA A+*A+c \ t } t j d }| }| D ]`\ }}| | s d| }t
| d D# t t t f$ r Y ]w xY wdS )z3
Remove all trash cldiag users from system
z^cldiaguser_[a-f0-9]{21}$z/usr/sbin/userdel -r rP N) r recompiler r matchr r r r r )cl_pwd
re_pattern
users_dictr rJ userdel_cmds rA remove_all_trash_cldiag_usersr s WWF 788J**,,J!'')) ! )) <(<t j d r t j | st t d S t j d st t d
S t st t | S d}d }t j t rGt }|6 t j | }|j
|j }
} d }n # t $ r Y nw xY wnt! |st" d
t% j j dd }t+ | t j | }|j
|j }
} t- t dd 5 } | | ddd n # 1 swxY w Y n# t0 t2 f$ r Y nw xY w| d| } | d| d| }
| d| d| } | dz d}d| d| d}t5 t7 j }t9 || }t j | s"t; | d t; |
d t? j d |gt> j! t> j" d d |tG | |
i t j$ d d i 5 }|% \ }}ddd n # 1 swxY w Y tM | 5 |' sGd |v rCt tP | cddd t; | d S |' st1 | |) ddd n # 1 swxY w Y t; | d n'# t; | d w xY wn%# tT $ r t t | cY S w xY wt t | S )!a
Checker for check if /var/cagefs is located on partition
with disk quota enabled.
Algorithm for check: we trying to set cldiaguser's quota to 1 inode
(so that this user can't create any file if the quota activated on
this partition). Then we change uid of process to cldiaguser's uid,
and try to create file with his permissions.
If we can't create file (Disk quota exceeded) then it's alright and
disc quota enabled. Else we warn user to enable quota on that partition.
z3/var/cagefs located on partition with quota enabledzDetails: /var/cagefs located on partition with quota disabled.
Please, activate quota for /var/cagefs for better security.
See details: https://docs.cloudlinux.com/cloudlinux_os_components/#installation-and-update-2zYQuotas seems unworkable on this server. Please correctly setup quotas to run this checkerr z/usr/sbin/setquotaz /var/cagefsNr z /usr/share/cagefs-skeleton/binzCagefs is not initializedFTrJ r^ r r z --cpetc z -u z 0 0 1 1 z 0 0 0 0 d 02dz /var/cagefs//z/etc/cl.selector/rP z
/bin/touchLC_ALLC)r8 r9 r; start_new_sessionr:
preexec_fnenvzDisk quota exceeded)+r r r r rD r( r$ r r# r r r" r# pw_uidpw_gidr$ r _CLDIAG_TEST_USENAME_PREFIXuuiduuid4hexr r
r r r r randomr r r rK rL rM STDOUTr environrN r r r" unlinkr )
ok_messager quota_unworkable_message cagefsctlsetquotacagefs_mountpointr is_testuser_existsuser_pwuser_uiduser_gidrk create_cagefs_dir_cmdset_quota_limit_cmdreset_quota_limit_cmdprefix tempfile_dir
tempfile_nametempfile_full_pathrS r8 rJ s rA !check_cagefs_partition_disk_quotar : s GJ Z d &I#H*=99
m(D(D BGNN[dLeLe ";<<<
7==9 : : ?"=>>> 1 000H w~~+,, ()++
* ,x00%,^W^(
&*""
&'''
1FFDJLL4DFFssK,x(( $^W^( +S7CCC
"q!!!
"
"
"
"
"
"
"
"
"
"
"
"
"
"
"! D ( = =8 = = %QQ8QQ>OQQ ' S SX S S@Q S S ; : 3,,FN&NN8NNNL
0 0M!%lM!B!B 7== ..
> 1 7 7 < <=== +11#66 7 7 7 ! }-!!("& !(H555rz5h_5
/ , , . .
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/ !**
,
,)0022 57LPV7V7V$R44
,
,
,
,
,
,
,
-33C88 9 9 9 9 *0022 *!&//)"))+++
,
,
,
,
,
,
,
,
,
,
,
,
,
,
,
-33C88 9 9 9 9K-33C88 9 9 9 9 9 ; ; ;!9:::::; V^ , ,,s ?"D$ $
D10D1!G& 8G G& G G& !G "G& &G:9G:C3P
L1% P 1L55P 8L59P -O*8 P "Q '7O* P *O..P 1O.2P 5#Q $P<<Q Q"!Q"
c | d }t | |k r7d |d|dz dgz || dz d z |gz S | S )a.
Handles error message making it shorter, if it is bigger than max limit
:param error: error message to make shorter
:param detailed_out: way for user to get full error manually
:param max_error_lines: max lines for error
:return: initial error (less than 10 lines) short error
rO Nr z...)r r~ rU )errorr max_error_lines error_liness rA r r s ++d##K
;/))yy ./Q.. /5' 9K HX\]H]H_H_<` `dpcq q
LrC c J t j t j ddd } | S )zY
Return true if automatic cldiag email notifications
about problems enabled.
ENABLE_CLDIAGr= T) separator default_val)r get_boolean_paramCL_CONFIG_FILE)
enable_cldiags rA is_email_notification_enabledr s(
,V-BO_bptuuuM rC r c | t t d d }d |D S )zK
Get list of disabled cldiag checkers from an opened ConfigParser.
r )fallbackr c : g | ]}|| S rD r rH items rA r z;_get_disabled_cron_checkers_from_config.. s% 9 9 9TD 9DJJLL 9 9 9rC )r cron_cldiag_section_name cron_cldiag_checkers_param_namer r )r config_lists rA '_get_disabled_cron_checkers_from_configr% sS ** ' eggeeCjj : 9[ 9 9 99rC c t j ddt di } | t j n# t j $ r g cY S w xY wt | S )z]
Get list of disabled cldiag checkers that run by cron in /etc/sysconfig/cloudlinux.
NFr )r r defaults)r r r# r& r r Errorr% )r s rA "get_list_of_disabled_cron_checkersr) s
* /
F)**** 36 : ::s =A AAdisabled_cron_checkersc V t j dd }| t j t
| vr| t
t | }d}| r>t | t | z }d
d |D }| t
t | t t j dd 5 }|
| ddd dS # 1 swxY w Y dS # t j t t f$ rb}t# d
t j d | d t# d
t# t$ t' j d Y d}~dS d}~ww xY w)z]
Set list of disabled cldiag checkers that run by cron in /etc/sysconfig/cloudlinux.
NFr r r c 3 K | ]}||V d S r= rD r s rA r z5set_list_of_disabled_cron_checkers.. s' F Fd FT F F F F F FrC zw+r r z4Can't set list of disabled cron checkers to config "z " because "rQ z:Please check config's existence, integrity and permissionsr^ )r r r& r r r" r add_sectionr% setrU r# r
r r( r r rd r re rf )r* r current_disabled_checkersrw merged_checkersrk r s rA "set_list_of_disabled_cron_checkersr1 s *
F)*** #6??+<+< < < 7 8 8 8$KF$S$S! ! G !"8 9 9C@Y>/ 0 0 3/222 &''1,, 000 R ( ((rC z Check user's low PMEM limitsc d} d| z }d}t j }|rt t | S t t | S )z7
Checks low PMEM limits availability on server
z5https://docs.cloudlinux.com/limits/#limits-validationzLSome user(s) on server has low PMEM LVE limit (lower than 512 MB). See doc: z Check low PMEM limits passed)r is_low_pmem_limit_presentr( r# r" )r r r r s rA check_low_pmem_limitsr8 sP GHcfnnN3N
6
8
8F
1 000 R ( ((rC z/Check MySQL server and client versions mismatchc Z t st t d S d} t j | st t d S t
j | dgddd }d|j vrt t d S | d
g}t
j |ddd }|j d k rt t d S |j d
k r | d}t t d| S t t d|j d|j
S )z
Check for MySQL server and client version mismatch on Ubuntu systems.
Uses mysqlgovernor.py to detect and provide fix recommendations.
z(This checker only runs on Ubuntu systemsz*/usr/share/lve/dbgovernor/mysqlgovernor.pyzmysqlgovernor.py not foundz--helpTF)capture_outputr; r z--fix-version-mismatchz?--fix-version-mismatch option not supported by mysqlgovernor.pyz--check-version-mismatchr z&MySQL server and client versions matchr^ z --fix-version-mismatchzLMySQL server and client versions mismatch detected. To fix this issue, run: zUnexpected exit code z from mysqlgovernor.py. stderr: )r r( r$ r r r rK r r8 rO r" r# r% r9 r )mysqlgovernor_path help_result check_cmdr fix_cmds rA check_mysql_version_mismatchr? - sg ;; N"LMMME 7>>, - - @">??? . X&
K {'999"cddd $%?@I
^
F A EFFF
A '@@@ d[b d d
j 1jjSYS`SfSfShShjj rC )F)FT)r )r r( rR r r" r r rK re r collectionsr functoolsr pathlibr typingr r r cldetectlibr cl_proc_hidepidr
clcommon.clpwdr r clcommon.cpapir
r clcommon.lib.cleditionr r clcommon.lib.cmt_utilsr r clcommon.lib.constsr r clcommon.lib.jwt_tokenr clcommon.lib.whmapi_libr r clcommon.utilsr r r r r r r r cllimits_validatorr clsentry.utilsr! r" r# r$ r% r r# r" cl_plus_doc_linkr r r rv r r( SUEXEC_PATH
SUPHP_PATHr r r r> r\ rm rq r| r r ry r r r r r r r r r r r r r r r r r r2 rY rp r r| r r r r r r r r r r r% r r r r r r r r r r r% r) r1 r5 r8 r? rD rC rA rS sT
" " " " " " ( ( ( ( ( ( ( ( ( ( : : : : : : 1 1 1 1 1 1 1 1 > > > > > > > > N N N N N N N N L K K K K K K K 2 2 2 2 2 2 > > > > > > > > 0 / / / / / . . . . . . * * * * * *
+ P"A ( J G5EGGp ' S ]
J
-$%
$#"#!
�
#"!"
2$ $
3% % ! / * , @
^ E$
*=$> D .
'(("7 "7 )("7J%s %I % % % %P
LMM% H H &% NM H
KLL%A A &% MLA2
FGG% B B &% HG B
tuu%s s &% vus"
PQQ" " RQ"(
STTN N UTN0, , ,2
+,,; ; -,;
*++: : ,+:
*++ e e ,+ e
9::= = ;:=$
344R0 R0 54R0j
&''(U (U ('(UV
566BE BE 76BEJ
344 ) ) 54 )@ 4 +
PPP!!! D
122 32 .
566% % 76% P
-..- - /.-"* * *
8 S S c c @
$ "
VWWc- c- XWc-L
t
:L4M
:RVW_`cWdRe
:
:
:
:;D# ,? ; ; ; ;(#tHSM?R #W[ # # # #L
011) ) 21)2
+,, )y ) ) ) -, )
>??/i / / / @?/ / /rC