mb
{s < d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
m Z d dl m
Z
mZ d dlmZ d dlmZmZmZmZ d dlmZ d dlmZmZmZm Z m Z ej e Z d Z!e!" d
Z#e!" d Z$ G d
d Z% G d de%e Z& G d de%e Z' G d de Z( G d de( Z) G d de& Z*dZ+ G d de* Z, G d d e Z-d e.fd Z/d e e fd Z0dS )! N)abstractmethod)ListOptional)Core Packaging)
LicenseCLN)AbstractFeature FeatureError
FeatureStatusea4_only)cPanel)
OsReleaseInfo check_runrunrun_cmd_and_log
os_versionzexport PATH=/opt/imunify360/venv/bin:$PATH; _els_tmp=$(mktemp) && curl -sf -o "$_els_tmp" {url} && sh "$_els_tmp" -i; rm -f "$_els_tmp";zHhttps://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-rpm-repo.sh)urlzHhttps://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-deb-repo.shc e Zd ZdZdZdZeddee fd Z edefd Z
ed Z e ede
fd Zed
Zede
fd Zej d Zej d
ZdefdZdS )SimpleInstallerMixIna This is a mixin class implementing common case installation scenario.
Installation is supposed to be through a single command cls.INSTALL_CMD.
Removal is done through interpolating a space separated list of package
names to remove into cls.REMOVE_CMD_TMPL. List of packages to remove is
obtained by collecting all installed alt-php* packages except those we want
to keep (as returned by required_packages()).
z
/bin/falseNenabledc d S N selfr s W/opt/imunify360/venv/lib/python3.11/site-packages/im360/subsys/features/hardened_php.py
generate_repoz"SimpleInstallerMixIn.generate_repoA c
K d S r r r s r pre_install_cmdz$SimpleInstallerMixIn.pre_install_cmdE s r c d S r r r s r remove_repoz SimpleInstallerMixIn.remove_repoI r r returnc " K t S )z0Set of installed package names matching alt-php*)setr r r _list_alt_php_packagesz+SimpleInstallerMixIn._list_alt_php_packagesM s uu r c D | d p |dk p|dk S )Nzalt-php-internalzalt-php-configzalt-php-hyperscan)
startswith)clspkgs r _keep_installedz$SimpleInstallerMixIn._keep_installedS s5
NN- . .
*&&
*))
r c r K d{V }t fd|D S )z@Set of installed alt-php packages except those we keep installedNc 3 F K | ]} | |V d S r )r- ).0r, r+ s r z9SimpleInstallerMixIn._feature_packages..b s6 NN3S5H5H5M5MN3NNNNNNr )r( r' )r+ all_alt_phps ` r _feature_packagesz&SimpleInstallerMixIn._feature_packages^ sO 6 6 8 8888888 NNNN+NNNNNNr c K | d | d d {V t | j | j d {V S NTr )r r! r INSTALL_CMDINSTALL_LOG_FILE_MASKr# s r installz SimpleInstallerMixIn.installd s 4(((""4"000000000$ d 8
r c V K | | j d t t
j | d {V }| d d {V t || j
d {V S )N Fr6 ) r$ REMOVE_CMD_TMPLformatjoinmapshlexquoter3 r! r REMOVE_LOG_FILE_MASK)r cmds r removezSimpleInstallerMixIn.removel s ")) HHSD,B,B,D,D&D&D&D&D&D&DEE F F
""5"111111111$S$*CDDDDDDDDDr c T K t | d {V S r )boolr3 r# s r _check_installed_implz*SimpleInstallerMixIn._check_installed_implu s2 $0022222222333r r )__name__
__module__ __qualname____doc__r7 r< r r rF r r! r$ staticmethodr' r( classmethodr- r3 r raise_if_shouldnt_install_nowr9 raise_if_shouldnt_remove_nowrD rG r r r r r 3 sn K"O Xd^ ^ T ^ ^ # ^ \
[
O O O O [O
2
32
1E E 21E4T 4 4 4 4 4 4r r c e Zd ZdZdZdej z Zdez Zdez Z e
dz Z dZ dZ
d Ze e d
gZd Zdd
ee fdZd
efdZd Zedefd Zd S )HardenedPHPCentosz(/etc/yum.repos.d/imunify360-alt-php.repo Hardened-PHP /var/log/%s %s/install-hardenedphp.log.*%s/remove-hardenedphp.log.*z; yum group mark remove alt-php; yum -y groupinstall alt-phpz0yum group mark install alt-php; yum -y remove {}z dnf config-manager --enable crbz dnf config-manager --disable crb c t j | j d S # t $ r Y d S t $ r$ t
d| j Y d S w xY wNzCan't delete %s)osrD LEGACY_REPO_FILEFileNotFoundErrorOSErrorloggererrorr# s r _remove_legacy_repoz%HardenedPHPCentos._remove_legacy_repo sz C Id+ , , , , , DD C C C LL*D,A B B B B B B C
A)AANr c 6 |d S | d S r r_ r s r r z HardenedPHPCentos.generate_repo s& ?
F """""r c K t d sd S |r.t | j d {V d S t | j d {V d S )N9)r r* r ENABLE_CRB_CMDsplitDISABLE_CRB_CMDr s r r! z!HardenedPHPCentos.pre_install_cmd s ||&&s++ : F
:D / 5 5 7 788 8 8 8 8 8 8 8 8 8D 0 6 6 8 899 9 9 9 9 9 9 9 9 9r c . | d S r rb r# s r r$ z HardenedPHPCentos.remove_repo s """""r r% c K t g d d {V } t | S )N)rpmz-qaz
--queryformatz%{NAME}
alt-php*)r r' decoderf )
raw_outputs r r( z(HardenedPHPCentos._list_alt_php_packages sd $ D D D
:$$&&,,..///r r )rH rI rJ rZ NAMEr PRODUCTLOG_DIRr8 rB _ELS_RPM_SETUPr7 r< re rg r= _CMD_LISTr_ r rF r r! r$ rL r' r( r r r rQ rQ y s A Ddl*G :W D87B
G H IO6N8O o 4 4R 8 89IC C C# #Xd^ # # # #:T : : : :# # # 0# 0 0 0 \0 0 0r rQ c e Zd ZdZdej z Zdez Zdez Ze dz Z
dZ e
e d gZ
dd ee fd
Zd efd Zd Zed
efd ZdS )HardenedPHPUbunturR rS rT rU z apt-get install -y alt-phpzapt-get purge -y {}rV Nr c d S r r r s r r z HardenedPHPUbuntu.generate_repo r c
K d S r r r s r r! z!HardenedPHPUbuntu.pre_install_cmd s r c d S r r r# s r r$ z HardenedPHPUbuntu.remove_repo rv r r% c K t g d d {V d } t d | D S )N)z
dpkg-queryz-Wz-fz ${Package} ${db:Status-Status}
rk
c 3 T K | ]#}| \ }}|d k |V $dS ) installedN)rf )r0 liner, statuss r r1 z;HardenedPHPUbuntu._list_alt_php_packages.. sL
$
V$$
%$$$
r )r rl striprf r' )pkgs_in_dpkg_dbs r r( z(HardenedPHPUbuntu._list_alt_php_packages s VXX
UWW
U4[[
'
r r )rH rI rJ rn r ro rp r8 rB _ELS_DEB_SETUPr7 r< r= rr r rF r r! r$ rL r' r( r r r rt rt s Ddl*G :W D87B #@@K+O o 4 4R 8 89I Xd^ T
#
\
r rt c > e Zd ZdZdZdZd Zd Zd Zd Z de
fdZ d S )
HardenedPHPCloudLinuxz4HardenedPHP is managed by lvemanager in CloudLinuxOSemptyc
K | S r r r# s r initzHardenedPHPCloudLinux.init s r c r K t g d d {V \ }}}dt j |dk | j diS )N)rj z-q
lvemanageritemsr )r~
lve_installedmessage)r r MANAGED_BY_LVEMSG)r rc_s r r~ z HardenedPHPCloudLinux.status s[ 8 8 899999999Aq '6!#q 8
r c . K t | j r r
r r# s r r9 z HardenedPHPCloudLinux.install 48$$$r c . K t | j r r r# s r rD z HardenedPHPCloudLinux.remove r r r% c
K dS )NTr r# s r rG z+HardenedPHPCloudLinux._check_installed_impl s tr N) rH rI rJ r r8 rB r r~ r9 rD rF rG r r r r r s|
@C #"
% % %% % %T r r c e Zd ZdZd ZdS )HardenedPHPCloudLinuxSoloz1HardenedPHP is not supported in CloudLinuxOS Soloc 2 K dt j | j diS )Nr )r~ r )r NOT_SUPPORTED_BY_CL_SOLOr r# s r r~ z HardenedPHPCloudLinuxSolo.status s( '@ 8
r N)rH rI rJ r r~ r r r r r s(
=C
r r c j e Zd ZdZdej z Zdez Zdez ZdZ dZ
dZ e e
gZ e
d Ze
d Ze
d
efd Zdd
ee fd
Zd Zedee fd ZdefdZe fd Zee j d Z ee j d Z xZ!S ) EaPHPCentosz0/etc/yum.repos.d/imunify360-ea-php-hardened.reporS z%s/install-ea_php.log.*z%s/remove-ea_php.log.*z5yum -y groupremove ea-php; yum -y groupinstall ea-phpzD/opt/imunify360/venv/share/imunify360/scripts/remove_hardened_php.pyzimunify360-ea-php-hardenedc t j t j t j | j S r )rY pathr> r DATADIRbasename REPO_FILE)r+ s r _repo_tmpl_filepathz EaPHPCentos._repo_tmpl_filepath s- w||I -rw/?/?
/N/NOOOr c \ dd fdt j D }n$# t $ r}t d| d }~ww xY wt j d }| |z }t j | S )N:rV c 3 H K | ] }t | z V d S r )str)r0 kseptokens r r1 z-EaPHPCentos._prepare_token.. sC ()E!H
# r z*License token can not be created by error sign)
r> r VERIFY_FIELDS_V1KeyErrorr
base64 b64decodeencodeurlsafe_b64encoderl )r+ r fieldse
sign_bytesdatar s ` @r _prepare_tokenzEaPHPCentos._prepare_token s CWW -7-H FF @Q@@
%eFm44
}}+'--44666s .3
AAAr c |rdnd} | | }nV# t $ rI}|s;d}t j | }n|Y d }~nd }~ww xY wt
| d 5 }| }| || cd d d S # 1 swxY w Y d S )N10z unregister-token-placeholderr)r r )
r r
r r r rl openr readr= )r+ r r enabled_flagr token_placeholder
repo_templatetemplates r _prepare_repo_confz EaPHPCentos._prepare_repo_conf sP %.ss3 &&u--EE
$B! 0%,,.. &(( #))++S
1
1 F]$))++H?? ?EE F F F F F F F F F F F F F F F F F Fs&
A1?A,,A1+CCCNc |Xt j } | | j || j d dk }n# t
$ r d}Y nw xY wt
j }t
j }|s+|rt d t d t | j d 5 }|
| || d d d n # 1 swxY w Y t j | j t j | j d S )Nr r Tz=tried to enable repo but server_id is empty (not registered?)zDserver_id is empty (not registered?) ignoring due to removal of repow) configparser ConfigParserr r REPO_NAME Exceptionr get_token
get_server_idr
r] warningr writer rY chmodstatr st_mode)r r repor server_id repo_files r r zEaPHPCentos.generate_repo1 s ? ,..D
$.))) t~.y9S@
$&& ,..
"$
NN
$.#
&
& E) OOD 3 3E7 C C D D D E E E E E E E E E E E E E E E
)A)A)C)C!D!D!LMMMMMs# 1A AA*C99C= C=c 2 | d d S NFr6 )r r# s r r$ zEaPHPCentos.remove_repoJ s 5)))))r r% c K t dd d {V } | fdt dt d D S )Nz5rpm -qa --queryformat "%{NAME} %{RELEASE}
" "ea-php*"T)shellc 8 g | ]}| |d z dS ) )namereleaser )r0 iwordss r
z5EaPHPCentos._query_eaphp_versions..T s=
1X%A, 7 7
r r )r rl rf rangelen)rm r s @r _query_eaphp_versionsz!EaPHPCentos._query_eaphp_versionsM s $ D
!!##))++
1c%jj!,,
r c K t j d }| d {V D ]*}| |d
d|d v r dS +dS )Nz ea-php\d+r
cloudlinuxr TF)recompiler search)r versioned_rer, s r rG z!EaPHPCentos._check_installed_implY sv z,// 3355555555 C ##CK00< C N22ttur c T K t d {V S r superr~ r __class__s r r~ zEaPHPCentos.statusc - WW^^%%%%%%%%%r c r K | d t | j | j d {V S r5 )r r r7 r8 r# s r r9 zEaPHPCentos.installg sZ
4((($ d 8
r c r K | d t | j | j d {V S r )r r
REMOVE_SCRIPTrB r# s r rD zEaPHPCentos.removeo sZ
5)))$ 9
r r )"rH rI rJ r r ro rp r8 rB r7 r r rr rM r r rF r r r r$ rL r dictr rG r r~ r rN r9 rO rD
__classcell__r s @r r r s BIdl*G 5 ?3g=IKZM,I m,IP P [P 7 7 [ 7 F F F F [F"N NXd^ N N N N2* * *
d
\
T & & & & X& 2
32 X
1
21 X
r r zFor EL9/Ubuntu20 cpanel servers use cPanel Profile to configure harden php.
More info:
https://docs.cpanel.net/ea4/basics/the-ea-cpanel-tools-package-scripts/
https://docs.cpanel.net/whm/software/easyapache-4-interface/c ~ e Zd ZeZeej d Zeej d Z
de fdZ dS )EaPHPCentosEL9c F K | d d| j z S )NTr6 z+Repo imunify360-ea-php-hardened activated.
r r r# s r r9 zEaPHPCentosEL9.install s,
4(((=HHr c F K | d d| j z S )NFr6 z)Repo imunify360-ea-php-hardened removed.
r r# s r rD zEaPHPCentosEL9.remove s,
5)));dhFFr r% c K t j } | | j || j d dk }n# t
$ r d}Y nw xY w|S )Nr r F)r r r r r r )r r r s r rG z$EaPHPCentosEL9._check_installed_impl sn (** IIdn % % %4>*95 > 21 X> & & & & X&.T . . . . . . . .r r r% c @ t j d S )Nz/etc/cloudlinux-release)rY r existsr r r _is_cloudlinux_release_installedr s
7>>3 4 44r c b t j } t j sLt j s9t j s&t j st j r=| r+t t j
dk rt S | rt S t S t j r!t j rt S t" S t j st j r%| r t) rt" S t* S t, S dS )z
:return: AbstractFeature subclass: feature that implements Hardened PHP
installation for current environment.
N)r
is_installedr is_centosis_rhelis_oracle_linux is_almalinux
is_rockylinuxintdistro
major_versionr r rQ
is_cloudlinuxis_cloudlinux_solor r is_ubuntu is_debianr r rt )
has_cpanels r get_hardened_php_featurer s(
$&&J !! % " " % ( * * % % ' ' %
& ( ( % %#f 2 4 455::! !
% $ $"$$ % + - - -, ,$$ !M$;$=$= ! %/11
-,,$ $ 4r )1r r loggingrY r r@ r abcr typingr r defence360agent.contracts.configr r !defence360agent.contracts.licenser 0defence360agent.subsys.features.abstract_featurer r
r r $defence360agent.subsys.panels.cpanelr
defence360agent.utilsr r r r r getLoggerrH r] _ELS_SETUP_TMPLr= rq r r rQ rt r r r r r r rF r r r r r r# sL
! ! ! ! ! ! ! ! < < < < < < < < 8 8 8 8 8 8 8 7 7 7 7 7
8 $ $ !'' * ( !'' * ( C4 C4 C4 C4 C4 C4 C4 C4L00 00 00 00 00,o 00 00 00f)
)
)
)
)
,o )
)
)
X O :
5
t
t
t
t
t
# t
t
t
pD [ 2'. '. '. '. '. '. '. '.T5$ 5 5 5 5 (?"; r