SWAMPy

✎ CARVE FLESH

EDITING: imunify-doctor.sh

#!/bin/bash
VERSION="8.5.9"
LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8
LANGUAGE=en_US.UTF-8
DEST=/root/cl-report
UPLOAD_URL=https://doctor.cloudlinux.com/doctor/upload
CAT=`command -v cat`
UNAME=`command -v uname`
CP="Unknown"
SERVER_ID=
main_ip='NA'
scriptname="imunify-doctor"
IMUNIFY360_PIDFILE=/var/run/imunify360.pid
IMUNIFY360_AGENT_PIDFILE=/var/run/imunify360-agent.pid
# custom tmp dir provisioned by imunify360.spec
tmpdir=/var/imunify360/tmp
sqlite_path=/opt/alt/sqlite/usr/bin/sqlite3
IMUNIFY360_DB=/var/imunify360/imunify360.db
IMUNIFY360_RESIDENT_DB=/var/imunify360/imunify360-resident.db
IMUNIFY360_IPLIST_DB=/var/imunify360/imunify360-ipsetlists.db
db_command="$sqlite_path $IMUNIFY360_DB"
db_command_resident="$sqlite_path $IMUNIFY360_RESIDENT_DB"
db_command_iplist="$sqlite_path $IMUNIFY360_IPLIST_DB"

cleanup() {
  # Set _skip_cleanup=1 before report_error_and_exit so a partially-built
  # report can be kept on disk for offline inspection (e.g. redaction
  # failure path). Defaults to deleting so the success path doesn't leak
  # the blob.
  [ "${_skip_cleanup:-0}" = "1" ] && return 0
  rm -f $DEST $DEST.wget
}

test_curl() {
    command -v curl >/dev/null 2>&1
    return $?
}

test_wget() {
  command -v wget >/dev/null 2>&1
  if [ 0 -eq $? ]; then
    if [ -x `command -v wget` ]; then
	return 0
    fi
  fi
  return 1
}

curl_upload() {
 curl -s -H "serverid: $SERVER_ID" -F reportfile=@"$DEST" $UPLOAD_URL
}

wget_upload() {

echo -e "--FILEUPLOAD\r\n" > $DEST.wget
    echo -e "--FILEUPLOAD\r\n" > $DEST.wget
    echo -e "Content-Disposition: form-data; name=\"reportfile\"; filename=\"$DEST\"\r\n" >> $DEST.wget
    echo -e "Content-Type: application/octet-stream\r\n" >> $DEST.wget
    echo -e "Media Type: application/octet-stream\r\n\r\n" >> $DEST.wget
    cat $DEST >> $DEST.wget
    echo -e "--FILEUPLOAD--\r\n" >> $DEST.wget
    wget -O - -qq -t 1 --header="serverid: $SERVER_ID" --header="Content-type: multipart/form-data; boundary=FILEUPLOAD" --post-file $DEST.wget $UPLOAD_URL
}

get_server_id() {
  SERVER_ID=$(/opt/imunify360/venv/bin/python -c 'import json; import sys; print(json.load(sys.stdin)["id"])' < /var/imunify360/license.json)
  if [[ -z "$SERVER_ID" ]]; then
    SERVER_ID="${main_ip//./_}"
  fi
  # CWE-93: $SERVER_ID is interpolated into curl/wget `--header` args on
  # upload. Strip everything but the safe alphabet so a poisoned source
  # (license.json or the ${main_ip//./_} fallback whose dots-only filter
  # lets CR/LF through) cannot inject extra HTTP headers.
  SERVER_ID="$(printf '%s' "$SERVER_ID" | LC_ALL=C tr -cd 'A-Za-z0-9._-')"
  if [[ -z "$SERVER_ID" ]]; then
    SERVER_ID="unknown"
  fi
}

init_main_ip() {
 # HTTPS and no `-L` redirect-follow: this value flows into $SERVER_ID when
 # the license-file lookup fails, and then into an HTTP request header on
 # upload — an on-path attacker who controls a plain-HTTP response could
 # inject CRLF and forge headers (CWE-93). Pin to TLS at the source.
 #
 # `curl --max-time 10` is a true total cap. `wget --timeout=10` is
 # per-phase (DNS+connect+TLS+read can each take 10s = up to ~40s wall),
 # so wrap wget in coreutils `timeout` to enforce the same total wall
 # budget the doctor advertises.
 if test_curl
 then
    main_ip=`curl -s --max-time 10 https://cloudlinux.com/showip.php` 2>/dev/null
 else
    main_ip=`timeout 10 wget -qq --timeout=10 --max-redirect=0 -O - https://cloudlinux.com/showip.php` 2>/dev/null
 fi
}

get_main_ip() {
  sep "Main IP"
  echo "$main_ip" >> $DEST
  echo >>$DEST
}

redact_sensitive() {
 # Best-effort scrub of common credential shapes from the collected report
 # before it leaves the host. Runs over $DEST in place. Bypass with
 # `IMUNIFY_DOCTOR_REDACT=0` (e.g. when a Cloudlinux engineer explicitly
 # asks for the raw blob over a trusted channel).
 #
 # On sed failure we DO NOT emit the success footer and we return non-zero,
 # so upload() can refuse to ship a half-scrubbed blob with a misleading
 # "everything was redacted" notice.
 [ "${IMUNIFY_DOCTOR_REDACT:-1}" = "0" ] && return 0
 [ -s "$DEST" ] || return 0

# Case-insensitive key shapes (matches both JSON keys and shell vars).
 local ci='([Aa][Pp][Ii][_-]?[Kk][Ee][Yy]|[Aa][Pp][Ii][_-]?[Tt][Oo][Kk][Ee][Nn]|[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]|[Pp][Aa][Ss][Ss][Ww][Dd]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Cc][Ll][Ii][Ee][Nn][Tt][_-]?[Ss][Ee][Cc][Rr][Ee][Tt]|[Aa][Ww][Ss][_-]?[Ss][Ee][Cc][Rr][Ee][Tt][_-]?[Aa][Cc][Cc][Ee][Ss][Ss][_-]?[Kk][Ee][Yy]|[Pp][Rr][Ii][Vv][Aa][Tt][Ee][_-]?[Kk][Ee][Yy]|[Bb][Ee][Aa][Rr][Ee][Rr])'
 # Case-sensitive uppercase-only — CSF's actual config-variable name. The
 # csf.conf format is `CLUSTER_KEY = "..."`; the previous `csf_cluster_key`
 # pattern never matched because the real variable has no `csf` prefix.
 local cs='CLUSTER_KEY'
 # Separate patterns for JSON-quoted (terminates at closing `"`) and shell
 # unquoted-or-quoted (terminates at end of line / closing `"`). The
 # previous `[^",[:space:]]+` tail stopped at the first whitespace, so
 # values with spaces (e.g. `DB_PASSWORD=my secret` or `"password":"my secret"`)
 # were only partially scrubbed.
 # Use `#` as the sed delimiter so the `|` alternation in $ci doesn't
 # collide. The captures: \1 = prefix incl. opening quote/`=`, \2 = the
 # matched key name (inner group of $ci/$cs), \3 = closing quote (when
 # present).
 # `[A-Za-z0-9_]*` before $ci allows a common-prefix `DB_PASSWORD`,
 # `MY_API_KEY`, `OAUTH2_CLIENT_SECRET`, `V2_API_KEY` etc. to still match.
 # Digits in the prefix character class matter — `[A-Za-z_]*` would silently
 # skip credential vars whose prefix contains a digit. The trailing value
 # matcher requires a non-quote, non-space starting char so the unquoted
 # rule doesn't backtrack-match a quoted value (the [[:space:]]* before
 # the quote would otherwise be willing to leave the space for [^"]).
 if ! sed -E -i \
      -e "s#(\"[A-Za-z0-9_]*$ci\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")#\1<REDACTED>\3#g" \
      -e "s#(\"[A-Za-z0-9_]*$cs\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")#\1<REDACTED>\2#g" \
      -e "s#(^[[:space:]]*[A-Za-z0-9_]*$ci[[:space:]]*=[[:space:]]*\")[^\"]*(\")#\1<REDACTED>\3#g" \
      -e "s#(^[[:space:]]*[A-Za-z0-9_]*$cs[[:space:]]*=[[:space:]]*\")[^\"]*(\")#\1<REDACTED>\2#g" \
      -e "s#(^[[:space:]]*[A-Za-z0-9_]*$ci[[:space:]]*=[[:space:]]*)[^\"[:space:]].*\$#\1<REDACTED>#g" \
      -e "s#(^[[:space:]]*[A-Za-z0-9_]*$cs[[:space:]]*=[[:space:]]*)[^\"[:space:]].*\$#\1<REDACTED>#g" \
      -e 's#(Authorization:[[:space:]]*Bearer[[:space:]]+)\S+#\1<REDACTED>#gI' \
      "$DEST"; then
   echo "------ REDACTION FAILED ---" >> "$DEST"
   echo "sed -i exited non-zero; the upload will be aborted to avoid shipping" >> "$DEST"
   echo "partially-redacted data alongside a misleading footer. Raw report" >> "$DEST"
   echo "retained at $DEST for offline inspection." >> "$DEST"
   time_stamp
   return 1
 fi

echo "------ REDACTION ---" >> "$DEST"
 echo "Common credential shapes (api[_-]?key/token, password, secret, client_secret," >> "$DEST"
 echo "aws_secret_access_key, private_key, bearer, CLUSTER_KEY, Authorization:" >> "$DEST"
 echo "Bearer ...) were replaced with <REDACTED>. Set IMUNIFY_DOCTOR_REDACT=0 to" >> "$DEST"
 echo "disable when sending a raw blob over a trusted channel." >> "$DEST"
 time_stamp
 return 0
}

upload() {
 if ! redact_sensitive; then
     # Suspend cleanup so the operator can inspect $DEST (the failure
     # footer in redact_sensitive points at this file).
     _skip_cleanup=1
     report_error_and_exit "redaction failed; refusing to upload. Raw report retained at $DEST."
 fi
 if test_curl
 then
     curl_upload
 else
     wget_upload
 fi
}

report_error_and_exit() {
 echo "$1"
 exit 1
}

mecho(){
 echo $1 >> $DEST
}
start(){
 if ! test_wget; then
     if ! test_curl; then
	 echo "Cannot find wget or curl"
     fi
     #echo "Using curl"
 fi
 echo "------ CL INFO ---" > $DEST
}

time_stamp(){
 echo "" >> $DEST
 echo "TS: $(date)" >> $DEST
}

sep(){
 echo "------ $1 ---" >> $DEST
}

run(){
 sep "$1"
 sh -c "$1" >> $DEST 2>&1
 time_stamp
}

run_cb(){
 sep "$1"
 $1 >> $DEST 2>&1
 result=$?
 time_stamp
 return $result
}

dump() {
 sep "cat $1"
 $CAT $1  >> $DEST 2>&1
 echo >> $DEST 2>&1
 time_stamp
}

detect_cp() {
    CP_VERSION="Unknown"
    SOFTACULOUS=0
    if [ -d "/usr/local/psa/admin/" ]; then
	    CP="Plesk"
        CP_VERSION=`cat /usr/local/psa/version`
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/cpanel/whostmgr/docroot/" ]; then
	    CP="cPanel"
        CP_VERSION=`/usr/local/cpanel/cpanel -V`
	    if [ -e "/usr/local/cpanel/whostmgr/cgi/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/interworx/" ]; then
	    CP="InterWorx"
        CP_VERSION=`cat /usr/local/interworx/iworx.ini|grep version`
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/ispmgr/" ]; then
	    CP="ISPmanager"
        CP_VERSION=`/usr/local/ispmgr/bin/ispmgr -v`
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/directadmin/plugins/" ]; then
	    CP="DirectAdmin"
        CP_VERSION=`/usr/local/directadmin/custombuild/build versions|sed -n 2p|cut -d":" -f2`
	    if [ -e "/usr/local/directadmin/plugins/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/usr/local/hostingcontroller/" ]; then
	    CP="Hosting Controller"
	    if [ -e "/usr/local/softaculous" ]; then SOFTACULOUS=1; fi
    fi
    if [ -d "/hsphere/shared" ]; then
        CP="H-Sphere"
    fi
    sep "Control Panel"
    mecho "CP: $CP"
    mecho "VERSION: $CP_VERSION"
    mecho "SOFTACULOUS: $SOFTACULOUS"
}

detect_httpd() {

PERL_BIN=$(which perl 2>>/dev/null)

echo
    echo "HTTP Server Running Processes: "
    echo

# Filter to euid==0 only — same threat model as the http_bins block
    # below (DEF-38151): an unprivileged local user can `exec -a httpd`
    # any binary they like, which would have caused us to dump their
    # /proc/<pid>/environ into a report later uploaded to the cloud.
    IFS=$(echo -en "\n\b")
    for proc in $(ps -eo euid,pid,user,group,cmd 2>>/dev/null | awk '$1 == 0 {$1=""; sub(/^ +/,""); print}' | egrep "\b(httpd|apache2|litespeed|lshttpd)\b" | grep -v "egrep"); do
        echo "[$proc]"
        proc_pid=$(echo "$proc" | awk '{print$1}')
        echo "Bin:" $(readlink "/proc/${proc_pid}/exe" 2>>/dev/null)
        echo "Environment:"
        cat "/proc/${proc_pid}/environ"  2>>/dev/null | tr '\0' '\n' | head -30
        echo
    done
    unset IFS
    echo

# Only consider httpd/apache2 processes running as root (euid 0) to
    # prevent local privilege escalation via attacker-controlled binaries
    # that match the "httpd"/"apache2" process name (DEF-38151).
    http_bins=$(ps -eo euid,pid,comm 2>>/dev/null | awk '$1 == 0' | egrep "\b(httpd|apache2)\b" | awk '{print "/proc/"$2"/exe"}' | xargs -n 1 readlink 2>/dev/null | sort -u | egrep "\b(httpd|apache2)\b")

for http_bin in $http_bins; do

if [ -z "$http_bin" ]; then
            continue
        fi

echo "HTTP Binary Info: "
        echo -e "$http_bin\n"
        $http_bin -V 2>&1
        echo
        $http_bin -M 2>&1
        echo

if [ -z "$PERL_BIN" ]; then
            continue
        fi

if [ -z "$httpd_config" ]; then
            continue
        fi

if [ ! ${httpd_config:0:1} = "/" ]; then
            httpd_config="$httpd_root/$httpd_config"
        fi

pl_script_path="$(dirname $(readlink -e "$0"))/mk_apache_conf_digest.pl"
        if [ -e "$pl_script_path" ]; then
            echo "Server Configs:"
            $PERL_BIN "$pl_script_path" "$httpd_config" "$httpd_root" 2>>/dev/null
        fi

done

}

http_server_info() {
    detect_httpd 2>>/dev/null | head -5000
}

backup_systems_info() {
    if [ ! -f /var/restore_infected/acronis_api_token.json ]; then
        echo "/var/restore_infected/acronis_api_token.json: no such file."
    else
        echo "/var/restore_infected/acronis_api_token.json: "
        # "username": "AB-99658-51"
        /opt/imunify360/venv/bin/python -m json.tool < /var/restore_infected/acronis_api_token.json
    fi

echo
    echo "imunify360-agent backup-systems extended-status: "
    mkdir -p -m 0700 "$tmpdir" 2>/dev/null
    local _bsi
    _bsi="$(mktemp -p "$tmpdir" backup_systems_info.XXXXXX)" || return 1
    if [ -L "$_bsi" ] || [ ! -O "$_bsi" ] || [ ! -f "$_bsi" ]; then
        rm -f "$_bsi"
        return 1
    fi
    imunify360-agent backup-systems extended-status -v --json | tee "$_bsi"
    /opt/imunify360/venv/bin/python <<ENDPY
import json
print(json.load(open("$_bsi"))["items"]["backup_system"])
ENDPY

rm -f "$_bsi"
}

webshield_selfcheck() {
    /usr/share/imunify360-webshield/self_check.py
}

pam_db_size() {
    mod_db_path=$(awk -F= '$1 == "mod_db_path" {print $2}' /etc/pam_imunify/i360.ini)
    du --human-readable --summarize "$mod_db_path"
}

version() {
    sep "Version of doctor script"
    echo "Version: $VERSION" >> $DEST
}

trap cleanup EXIT

start
version
init_main_ip
get_main_ip
get_server_id
detect_cp
run "date"
run "$CAT /proc/cpuinfo"
run "$UNAME -a"
run "$UNAME -r"
run "$UNAME -m"
run "$UNAME -p"
run "$UNAME -o"
dump "/etc/redhat-release"
dump "/etc/os-release"
dump "/var/imunify360/license.json"
dump "/etc/sysconfig/imunify360/imunify360.config"
dump "/etc/sysconfig/imunify360/imunify360-merged.config"
run "tail -n +1 /etc/sysconfig/imunify360/imunify360.config.d/*"
dump "/etc/sysconfig/imunify360/cpanel/imunify360.conf"
run "ls -lhaR /var/lib/unified-access-logger"
run "du -hs0 /var/lib/unified-access-logger"
run "tail -n3000 /var/log/imunify360/console.log"
run "tail -n3000 /var/log/imunify360/debug.log"
run "tail -n3000 /var/log/imunify360/network.log"
run "tail -n3000 /var/log/imunify360/acronis-installer.log"
run "tail -n3000 /var/log/imunify360/error.log"
run "tail -n3000 /var/log/imunify360/imunify-agent-proxy.log"
run "tail -n3000 /var/log/imunify360-webshield/access.log"
run "tail -n3000 /var/log/imunify360-webshield/error.log"
run "tail -n3000 /var/ossec/logs/alerts/alerts.log"
run "tail -n3000 /usr/local/directadmin/custombuild/custombuild.log"
run "tail -n3000 /var/log/patchman/patchman.log"
dump "/etc/issue"
dump "/etc/sysconfig/kernel"
dump "/etc/sysconfig/kcare/systemid"
dump "/proc/uptime"
dump "/proc/loadavg"
dump "/proc/vmstat"
dump "/proc/devices"
dump "/proc/diskstats"
dump "/proc/cmdline"
dump "/proc/mdstat"
dump "/proc/meminfo"
dump "/proc/swaps"
dump "/proc/filesystems"
dump "/proc/mounts"
dump "/proc/interrupts"
dump "/boot/grub/grub.conf"
dump "/proc/version"
dump "/etc/passwd"

run "ls -la /etc/apt/sources.list.d/"
run "tail -n 50 /etc/apt/sources.list.d/*imunify*"
run "ls -la /etc/apt/preferences.d/"
run "tail -n 50 /etc/apt/preferences.d/*"

run "zgrep -C 5 imunify /var/log/apt/history.log*"
run "zgrep -C 5 imunify /var/log/apt/term.log*"
run "apt policy imunify360-firewall"

run "ls -la /etc/yum.repos.d/"
run "tail -n 50 /etc/yum.repos.d/{*imunify360*,*sensor*}"
run "grep DEFAULT /etc/default/grub"
run "grep vmlinuz /boot/grub2/grub.cfg| sed 's/root=.*//'"
dump "/boot/grub2/grub.cfg"
dump "/proc/zoneinfo"
run "ls /etc/grub.conf /boot/grub/grub.conf /boot/grub/menu.lst"
run "ls -l /boot"
run "grep Port /etc/ssh/sshd_config"
run "dmidecode"
run "systemd-detect-virt"
run "virt-what"
run "ipcs -m|sed -e s/-/=/g"
run "sysctl -a"
dump "/etc/sysctl.conf"
run 'rpm -q -a --queryformat="%{N}|%{V}-%{R}|%{arch}\n"'
# Package integrity check — prefer a freshly-downloaded copy whose detached
# signature verifies against the CloudLinux GPG pubkey already installed by
# imunify-release; fall back to the copy shipped in imunify-core on any
# error. Only a verified copy is allowed to execute.
_integrity_local=""
for _p in /opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integrity \
          /usr/share/imunify360/scripts/imunify-check-pkg-integrity; do
    [ -x "$_p" ] && { _integrity_local="$_p"; break; }
done

_integrity_remote=""
_integrity_workdir=""
_integrity_url="https://repo.imunify360.cloudlinux.com/defence360/imunify-check-pkg-integrity.sh"

_integrity_pubkey=""
for _k in /etc/pki/rpm-gpg/RPM-GPG-KEY-CloudLinux-Imunify \
          /etc/apt/trusted.gpg.d/RPM-GPG-KEY-CloudLinux.gpg; do
    [ -r "$_k" ] && { _integrity_pubkey="$_k"; break; }
done

if [ -n "$_integrity_pubkey" ] && command -v gpg >/dev/null 2>&1; then
    mkdir -p -m 0700 "$tmpdir" 2>/dev/null
    _integrity_workdir="$(mktemp -d -p "$tmpdir" imunify-check-pkg-integrity.XXXXXX 2>/dev/null)"
    if [ -n "$_integrity_workdir" ] && [ -d "$_integrity_workdir" ] \
       && [ ! -L "$_integrity_workdir" ] && [ -O "$_integrity_workdir" ]; then
        _dl_script="$_integrity_workdir/imunify-check-pkg-integrity.sh"
        _dl_sig="$_integrity_workdir/imunify-check-pkg-integrity.sh.sig"
        _gpg_home="$_integrity_workdir/gnupg"
        mkdir -m 0700 "$_gpg_home"
        _ok=1
        if test_curl; then
            curl -sf -o "$_dl_script" "$_integrity_url"     2>/dev/null && \
            curl -sf -o "$_dl_sig"    "${_integrity_url}.sig" 2>/dev/null || _ok=0
        elif test_wget; then
            wget -q -O "$_dl_script" "$_integrity_url"     2>/dev/null && \
            wget -q -O "$_dl_sig"    "${_integrity_url}.sig" 2>/dev/null || _ok=0
        else
            _ok=0
        fi
        # gpg --import handles both ASCII-armored and binary pubkey files.
        if [ $_ok -eq 1 ] \
            && GNUPGHOME="$_gpg_home" gpg --batch --quiet --import "$_integrity_pubkey" 2>/dev/null \
            && GNUPGHOME="$_gpg_home" gpg --batch --quiet --verify "$_dl_sig" "$_dl_script" 2>/dev/null; then
            chmod +x "$_dl_script"
            _integrity_remote="$_dl_script"
        fi
    fi
fi

if [ -n "$_integrity_remote" ]; then
    run "$_integrity_remote"
elif [ -n "$_integrity_local" ]; then
    run "$_integrity_local"
else
    sep "imunify-check-pkg-integrity"
    echo "SKIPPED: signed remote copy unavailable and imunify-check-pkg-integrity not installed locally." >> $DEST
    echo "Install/repair the imunify-core package to enable this check." >> $DEST
    time_stamp
fi

[ -n "$_integrity_workdir" ] && rm -rf "$_integrity_workdir"

run "dpkg -l"
run "tail -n10000 /var/log/messages"
run "ls -lR /var/cache/kcare/"
dump "/etc/sysconfig/kcare/kcare.conf"
dump "/etc/kdump.conf"
run "/opt/imunify360/venv/bin/python -m pip freeze"
# Read the pidfile into a numeric-only var FIRST (no `sh -c "$(cat ...)"`
# expansion at run time — the previous form was a TOCTOU/symlink hazard:
# the pidfile is read inside the `sh -c` body, after the [[ -f ]] check,
# so a swap between check and use would inject shell bytes. Sanitize to
# digits before re-using.
_dump_pidfile_fds() {
  local pidfile="$1"
  [[ -f "$pidfile" ]] || return
  local pid
  pid="$(tr -cd '0-9' < "$pidfile")"
  [[ -n "$pid" && -d "/proc/$pid" ]] || return
  sep "$pidfile"
  echo "$pidfile" >> "$DEST"
  ls -l "/proc/$pid/fd" >> "$DEST" 2>&1
  time_stamp
}
_dump_pidfile_fds "$IMUNIFY360_PIDFILE"
_dump_pidfile_fds "$IMUNIFY360_AGENT_PIDFILE"

run "df -h"
dump "/etc/userdomains"

run "ps aux --sort=-%mem | head -20"
run "ps aux --sort=-%cpu | head -20"
run "ps aux | grep -i imunify"

run "crontab -l"
run "service imunify360 status"
run "service imunify-antivirus status"
run "service imunify360-webshield status"
run "service wsshdict status"
run "service firewalld status"
run "service ossec-hids status"
run "service fail2ban status"
run "service httpd status"
run "service lshttpd status"
run "service patchman-client status"

run_cb "webshield_selfcheck"

run_cb "pam_db_size"
run "imunify360-pam status --yaml"
run "ls -la /etc/pam.d/"
run "cat /etc/pam_imunify/i360.ini"

if [ -e "/usr/sbin/csf" ]; then
  run "csf --status"
  run "lfd --status ; echo $?"
  run "service lfd status"
  run "service csf status"
  run "csf -V"
  dump "/etc/csf/csf.conf"
  dump "/etc/csf/csf.deny"
  dump "/etc/csf/csf.allow"
  dump "/etc/csf/csf.ignore"
  run "tail -n3000 /var/log/lfd.log"
fi
run "cxs --version"

if [ -e "/usr/bin/firewall-cmd" ]; then
    run "timeout 5 firewall-cmd -V"
    run "timeout 5 firewall-cmd --state"
    run "tail -n3000 /var/log/firewalld"
fi

run "service cpanel status"
dump "/var/cpanel/dnsonly"
run "service mysql status"
run "ps aux | grep -i cphulk"

run "ipset -V"
run "ipset save | head -n3000"
run "ipset list -t | head -n3000"
run "iptables -V"
run "iptables-save | head -n3000"
dump "/proc/sys/net/ipv6/conf/all/disable_ipv6"

run "ifconfig"
run "echo .tables | $db_command"
run "echo \"select plugin, count(*) from incident;\" | $db_command_resident"
run "echo \"select listname, count(*) from iplist;\" | $db_command_resident"
run "echo \"select iplist_id, count(*) from iplistrecord;\" | $db_command_iplist"
run "echo \"select * from iplist order by ctime desc limit 1000;\" | $db_command_resident"
run "echo \"select * from incident order by timestamp desc limit 1000;\" | $db_command_resident"
run "echo \"select * from country limit 1000;\" | $db_command"
run "echo \"select * from country_list order by ctime desc limit 1000;\" | $db_command"
run "echo \"select * from last_synclist limit 1000;\" | $db_command_resident"
run "echo \"select * from migratehistory limit 1000;\" | $db_command"
run "echo \"select * from malware_hits limit 1000;\" | $db_command"
run "echo \"select * from malware_ignore_path limit 1000;\" | $db_command"
run "echo \"select * from malware_scans limit 1000;\" | $db_command"
run "du --human-readable /var/imunify360/imunify360.db"
run "imunify360-agent blacklist country list --json --limit 2000"
run "imunify360-agent ip-list local list --purpose drop --limit 2000"
run "imunify360-agent graylist ip list --json --limit 2000"
run "imunify360-agent whitelist country list --json --limit 2000"
run "imunify360-agent ip-list local list --purpose white --limit 2000"
run "imunify360-agent blocked-port list"

run "imunify360-agent rstatus"
run "imunify360-agent rstatus --json -v"
run "imunify360-agent version"
run "imunify360-agent 3rdparty conflicts --json | /opt/imunify360/venv/bin/python -m json.tool"
run "imunify360-agent config show --json -v"
run "imunify360-agent notifications-config show --json -v"
run "grep License /var/log/imunify360/console.log | tail -n 1000"
run "grep 'Server is offline' /var/log/imunify360/console.log | tail -n 1000"
run "grep 'SensorAlert' /var/log/imunify360/console.log | tail -n 3000"
run "grep 'modsec' /var/log/imunify360/console.log | tail -n 3000"
run "ls -la /etc/sysconfig/imunify360/"
run_cb "backup_systems_info"

run "tail -n3000 /var/log/i360deploy.log"
run "tail -n3000 /var/log/imav-deploy.log"
run "tail -n3000 /var/ossec/logs/active-responses.log"
run "tail -n3000 /var/ossec/logs/alerts/alerts.log"
run "tail -n3000 /var/log/yum.log"
run "tail -n3000 /var/log/minidaemon.log"

# cPanel
run "tail -3000 /usr/local/apache/logs/error_log"
run "tail -3000 /usr/local/apache/logs/access_log"
run "tail -3000 /usr/local/apache/logs/modsec_audit.log"
# EA4
run "tail -3000 /etc/apache2/logs/modsec_audit.log"
# plesk
run "tail -3000 /usr/local/apache/logs/modsec_audit.log"
# DA
run "tail -3000 /var/log/httpd/modsec_audit.log"

run "tail -3000 /var/log/trueimage-setup.log"

run "/usr/local/cpanel/scripts/modsec_vendor list"
run "whmapi1 modsec_get_configs"
run "whmapi1 modsec_get_settings"
run "cat /etc/apache2/conf.d/modsec2.imunify.conf"
run "cat /usr/local/apache/conf/includes/modsec2.imunify.conf"
run "ls /var/cpanel/cwaf"

# prepend each particular log with ==> logfilename <== string
run "tail --lines +0 /var/log/imunify360/register_unregister_post_error_*.log"

# prepend each particular log with ==> logfilename <== string
run "tail --lines +0 /var/log/imunify360/*hardenedphp.log.*"
run "tail --lines +0 /var/log/imunify360/*kernelcare.log*"
run "tail --lines +0 /var/log/imunify360/*ea_php.log*"
run "ls /opt/alt/php*/usr/bin/php"
run "ls /opt/cpanel/ea-php*/root/usr/bin/php"
run 'rpm -qa --queryformat "%{NAME} %{RELEASE}\n" "ea-php*"'

run "getenforce"
run "sestatus"
run "ss -u -a"
run "ss -x -a | grep defence360agent"
run "timeout 10 nc -v -w 5 -i 1 imunify360.cloudlinux.com 443"
run "timeout 10 nc -v -w 5 -i 1 148.251.142.83 443"
dump "/usr/local/cpanel/version"
run "ls /etc/rc.d/init.d/"
run "systemctl list-units --all"
run "systemctl status aibolit-resident.socket"
run "curl ipinfo.io"
run "netstat -tulpan | tail -n 3000"
run "netstat -tulpan | wc -l"
# only tcp listening sockets & program
run "netstat -tlpn"
run "lsmod | grep ip_set"
dump "/etc/cagefs/cagefs.mp"
for f in /var/log/imunify360/native_da.hook_log.*
do dump $f
done

### PLESK
run "/usr/local/psa/admin/sbin/modsecurity_ctl --list-rules"
run "/usr/local/psa/admin/sbin/modsecurity_ctl --list-rules --enabled"
run "/usr/local/psa/admin/sbin/modsecurity_ctl --status"
run "/usr/local/psa/bin/server_pref --show-web-app-firewall"

run_cb "http_server_info"
# collect info on how huge /var/cpanel/secdatadir/ip.pag is
run "ls -lh /var/cpanel/secdatadir/*"
run "printenv"

run "/usr/libexec/run-with-intensity show"

# colect webshield  info
run "tail -3000 /var/log/wsshdict/wsshdict.log"
run "tail -3000 /var/log/imunify360/imunify360-wafd.log"
run "imunify360-wsctl status"

# collect UAL log
run "tail -3000 /var/log/imunify360/imunify360-unified-access-logger/log.rotate"

if [ -e "/etc/kdump.conf" ]; then
  KDUMP_PATH=`grep ^path /etc/kdump.conf|cut -d' ' -f2`
  if [ -z "$KDUMP_PATH" ] ; then
    run "ls -lR /var/crash"
  else
    run "ls -lR $KDUMP_PATH"
  fi
fi
run dmesg

run "ls -la /var/ossec/etc/VERSIONS/"
run "ls --lcontext /var/ossec"
run "ls --lcontext /var/ossec/bin"
run "ls --lcontext /var/ossec/logs"

run "ls -la /etc/httpd/conf/modsecurity.d/rules/"
run "ls -la /etc/apache2/conf.d/modsec_vendor_configs/"

run "cat /etc/httpd/conf/modsecurity.d/rules/custom/VERSION"
run "cat /usr/local/directadmin/custombuild/custom/modsecurity/conf/VERSION"
run "cat /etc/apache2/conf.d/modsec_vendor_configs/imunify*/VERSION;echo"
run "cat /var/cpanel/modsec_cpanel_conf_datastore"

run "journalctl --no-pager -u imunify360 --since -1d"
run "journalctl --no-pager -u imunify360-agent --since -1d"
run "journalctl --no-pager -u imunify360-unified-access-logger --since -1d"

# Imunify Email
run "ie-config status"

upload && echo || report_error_and_exit "Report file upload failed. Please try again."

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 __pycache__/	DIR	—	2026-08-14 05:35
📁 migrate_csf/	DIR	—	2026-08-14 05:35
📄 check-detached.py	PY	1.1 KB	2026-08-05 11:19	EDIT
📄 check_recurrent.py	PY	2.1 KB	2026-08-11 10:41	EDIT
📄 cluster_integration.py	PY	15.2 KB	2026-08-11 10:41	EDIT
📄 create_default_config	?	1.2 KB	2026-08-05 11:19	EDIT
📄 csf_tool	?	6.8 KB	2026-08-11 10:41	EDIT
📄 delay_on_cron_call.py	PY	1.1 KB	2026-08-03 21:44	EDIT
📄 disable_3rd_party_ids	?	1 KB	2026-08-11 10:41	EDIT
📄 imunify-check-pkg-integrity	?	6 KB	2026-08-03 21:44	EDIT
📄 imunify-core-release	?	415 B	2026-08-03 21:44	EDIT
📄 imunify-disable-cpu-accounting.sh	SH	1020 B	2026-08-05 11:19	EDIT
📄 imunify-doctor.sh	SH	26.3 KB	2026-08-05 11:19	EDIT
📄 imunify-force-update.sh	SH	8.1 KB	2026-08-05 11:19	EDIT
📄 imunify_core_release.py	PY	21.8 KB	2026-08-03 21:44	EDIT
📄 ipset_sync.py	PY	929 B	2026-08-11 10:41	EDIT
📄 lfd_block.py	PY	3 KB	2026-08-11 10:41	EDIT
📄 mk_apache_conf_digest.pl	PL	3.5 KB	2026-08-11 10:41	EDIT
📄 purge-clamav	?	535 B	2026-08-05 11:19	EDIT
📄 remove_hardened_php.py	PY	3.9 KB	2026-08-11 10:41	EDIT
📄 rules_checker.py	PY	15.8 KB	2026-08-11 10:41	EDIT
📄 send-notifications	?	7.7 KB	2026-08-05 11:19	EDIT
📄 setup_cagefs.py	PY	4.5 KB	2026-08-03 21:44	EDIT
📄 track-fpfn-submissions.sh	SH	3.8 KB	2026-08-05 11:19	EDIT
📄 update_components_versions.py	PY	4.1 KB	2026-08-05 11:19	EDIT
📄 whitelist_cache.py	PY	1.5 KB	2026-08-11 10:41	EDIT