###############################################################################
# Copyright 2006-2023, Way to the Web Limited
# URL: http://www.configserver.com
# Email: sales@waytotheweb.com
###############################################################################
## no critic (RequireUseWarnings, ProhibitExplicitReturnUndef, ProhibitMixedBooleanOperators, RequireBriefOpen)
package ConfigServer::DisplayUI;
use strict;
use lib '/usr/local/csf/lib';
use Fcntl qw(:DEFAULT :flock);
use File::Basename;
use File::Copy;
use Net::CIDR::Lite;
use IPC::Open3;
use ConfigServer::Config;
use ConfigServer::CheckIP qw(checkip);
use ConfigServer::Ports;
use ConfigServer::URLGet;
use ConfigServer::Sanity qw(sanity);;
use ConfigServer::ServerCheck;
use ConfigServer::ServerStats;
use ConfigServer::Service;
use ConfigServer::RBLCheck;
use ConfigServer::GetEthDev;
use ConfigServer::Slurp qw(slurp);
use Exporter qw(import);
our $VERSION = 1.01;
our @ISA = qw(Exporter);
our @EXPORT_OK = qw();
umask(0177);
our ($chart, $ipscidr6, $ipv6reg, $ipv4reg, %config, %ips, $mobile,
$urlget, %FORM, $script, $script_da, $images, $myv);
my $slurpreg = ConfigServer::Slurp->slurpreg;
my $cleanreg = ConfigServer::Slurp->cleanreg;
#
###############################################################################
# start main
sub main {
my $form_ref = shift;
%FORM = %{$form_ref};
$script = shift;
$script_da = shift;
$images = shift;
$myv = shift;
$config{THIS_UI} = shift;
$| = 1;
$ipscidr6 = Net::CIDR::Lite->new;
my $thisui = $config{THIS_UI};
my $config = ConfigServer::Config->loadconfig();
%config = $config->config;
$config{THIS_UI} = $thisui;
$ipv4reg = $config->ipv4reg;
$ipv6reg = $config->ipv6reg;
if ($config{CF_ENABLE}) {
require ConfigServer::CloudFlare;
import ConfigServer::CloudFlare;
}
$mobile = 0;
if ($FORM{mobi}) {$mobile = 1}
$chart = 1;
if ($config{ST_ENABLE}) {
if (!defined ConfigServer::ServerStats::init()) {$chart = 0}
}
$urlget = ConfigServer::URLGet->new($config{URLGET}, "csf/$myv", $config{URLPROXY});
unless (defined $urlget) {
$config{URLGET} = 1;
$urlget = ConfigServer::URLGet->new($config{URLGET}, "csf/$myv", $config{URLPROXY});
print "
*WARNING* URLGET set to use LWP but perl module is not installed, reverting to HTTP::Tiny
\n";
}
if ($config{RESTRICT_UI} == 2) {
print "
\n";
print "
csf UI Disabled via the RESTRICT_UI option in /etc/csf/csf.conf
\n";
print "
\n";
exit;
}
if ($FORM{ip} ne "") {$FORM{ip} =~ s/(^\s+)|(\s+$)//g}
if (($FORM{ip} ne "") and ($FORM{ip} ne "all") and (!checkip(\$FORM{ip}))) {
print "[$FORM{ip}] is not a valid IP/CIDR";
}
elsif (($FORM{ignorefile} ne "") and ($FORM{ignorefile} =~ /[^\w\.]/)) {
print "[$FORM{ignorefile}] is not a valid file";
}
elsif (($FORM{template} ne "") and ($FORM{template} =~ /[^\w\.]/)) {
print "[$FORM{template}] is not a valid file";
}
elsif ($FORM{action} eq "manualcheck") {
print "
Checking version...
\n\n";
my ($upgrade, $actv) = &manualversion($myv);
if ($upgrade) {
print "\n";
} else {
if ($actv ne "") {
print "
$actv
\n";
}
else {
print "
You are running the latest version of csf (v$myv). An Upgrade button will appear here if a new version becomes available
You must login to the root shell to enable csf using:\n
csf -e
\n";
} else {
print "
Enabling csf...
\n";
&resize("top");
print "
\n";
&printcmd("/usr/sbin/csf","-e");
print "
";
&resize("bot",1);
}
print "
...Done.
\n";
&printreturn;
}
elsif ($FORM{action} eq "logtail") {
$FORM{lines} =~ s/\D//g;
if ($FORM{lines} eq "" or $FORM{lines} == 0) {$FORM{lines} = 30}
my $script_safe = $script;
my $CSFfrombot = 120;
my $CSFfromright = 10;
if ($config{DIRECTADMIN}) {
$script = $script_da;
$CSFfrombot = 400;
$CSFfromright = 150;
}
my @data = slurp("/etc/csf/csf.syslogs");
foreach my $line (@data) {
if ($line =~ /^Include\s*(.*)$/) {
my @incfile = slurp($1);
push @data,@incfile;
}
}
@data = sort @data;
my $options = "
Refresh in 0
EOF
if ($config{DIRECTADMIN}) {$script = $script_safe}
&printreturn;
}
elsif ($FORM{action} eq "logtailcmd") {
$FORM{lines} =~ s/\D//g;
if ($FORM{lines} eq "" or $FORM{lines} == 0) {$FORM{lines} = 30}
my @data = slurp("/etc/csf/csf.syslogs");
foreach my $line (@data) {
if ($line =~ /^Include\s*(.*)$/) {
my @incfile = slurp($1);
push @data,@incfile;
}
}
@data = sort @data;
my $cnt = 0;
my $logfile = "/var/log/lfd.log";
my $hit = 0;
foreach my $file (@data) {
$file =~ s/$cleanreg//g;
if ($file eq "") {next}
if ($file =~ /^\s*\#|Include/) {next}
my @globfiles;
if ($file =~ /\*|\?|\[/) {
foreach my $log (glob $file) {push @globfiles, $log}
} else {push @globfiles, $file}
foreach my $globfile (@globfiles) {
if (-f $globfile) {
if ($FORM{lognum} == $cnt) {
$logfile = $globfile;
$hit = 1;
last;
}
$cnt++;
}
}
if ($hit) {last}
}
if (-z $logfile) {
print "<---- $logfile is currently empty ---->";
} else {
if (-x $config{TAIL}) {
my $timeout = 30;
eval {
local $SIG{__DIE__} = undef;
local $SIG{'ALRM'} = sub {die};
alarm($timeout);
my ($childin, $childout);
my $pid = open3($childin, $childout, $childout,$config{TAIL},"-$FORM{lines}",$logfile);
while (<$childout>) {
my $line = $_;
$line =~ s/&/&/g;
$line =~ s//>/g;
print $line;
}
waitpid ($pid, 0);
alarm(0);
};
alarm(0);
if ($@) {print "TIMEOUT: tail command took too long. Timed out after $timeout seconds\n"}
} else {
print "Executable [$config{TAIL}] invalid";
}
}
}
elsif ($FORM{action} eq "loggrep") {
$FORM{lines} =~ s/\D//g;
if ($FORM{lines} eq "" or $FORM{lines} == 0) {$FORM{lines} = 30}
my $script_safe = $script;
my $CSFfrombot = 120;
my $CSFfromright = 10;
if ($config{DIRECTADMIN}) {
$script = $script_da;
$CSFfrombot = 400;
$CSFfromright = 150;
}
my @data = slurp("/etc/csf/csf.syslogs");
foreach my $line (@data) {
if ($line =~ /^Include\s*(.*)$/) {
my @incfile = slurp($1);
push @data,@incfile;
}
}
@data = sort @data;
my $options = "
Text:
-i
-E
wildcard
Please Note:
1. Searches use $config{GREP}/$config{ZGREP} if wildcard is used), so the search text/regex must be syntactically correct
2. Use the "-i" option to ignore case
3. Use the "-E" option to perform an extended regular expression search
4. Searching large log files can take a long time. This feature has a 30 second timeout
5. The searched for text will usually be highlighted but may not always be successful
6. Only log files listed in /etc/csf/csf.syslogs can be searched. You can add to this file
7. The wildcard option will use $config{ZGREP} and search logs with a wildcard suffix, e.g. /var/log/lfd.log*
EOF
if ($config{DIRECTADMIN}) {$script = $script_safe}
&printreturn;
}
elsif ($FORM{action} eq "loggrepcmd") {
my @data = slurp("/etc/csf/csf.syslogs");
foreach my $line (@data) {
if ($line =~ /^Include\s*(.*)$/) {
my @incfile = slurp($1);
push @data,@incfile;
}
}
@data = sort @data;
my $cnt = 0;
my $logfile = "/var/log/lfd.log";
my $hit = 0;
foreach my $file (@data) {
$file =~ s/$cleanreg//g;
if ($file eq "") {next}
if ($file =~ /^\s*\#|Include/) {next}
my @globfiles;
if ($file =~ /\*|\?|\[/) {
foreach my $log (glob $file) {push @globfiles, $log}
} else {push @globfiles, $file}
foreach my $globfile (@globfiles) {
if (-f $globfile) {
if ($FORM{lognum} == $cnt) {
$logfile = $globfile;
$hit = 1;
last;
}
$cnt++;
}
}
if ($hit) {last}
}
my @cmd;
my $grepbin = $config{GREP};
if ($FORM{grepZ}) {$grepbin = $config{ZGREP}}
if ($FORM{grepi}) {push @cmd, "-i"}
if ($FORM{grepE}) {push @cmd, "-E"}
push @cmd, $FORM{grep};
if (-z $logfile) {
print "<---- $logfile is currently empty ---->";
} else {
if (-x $grepbin) {
my $timeout = 30;
eval {
local $SIG{__DIE__} = undef;
local $SIG{'ALRM'} = sub {die};
my $total;
if ($FORM{grepZ}) {
foreach my $file (glob $logfile."\*") {
print "\nSearching $file:\n";
alarm($timeout);
my ($childin, $childout);
my $pid = open3($childin, $childout, $childout,$grepbin,@cmd,$file);
while (<$childout>) {
my $line = $_;
$line =~ s/&/&/g;
$line =~ s//>/g;
if ($FORM{grep} ne "") {
eval {
local $SIG{__DIE__} = undef;
if ($FORM{grepi}) {
$line =~ s/$FORM{grep}/$&<\/mark>/ig;
} else {
$line =~ s/$FORM{grep}/$&<\/mark>/g;
}
};
}
print $line;
$total += length $line;
}
waitpid ($pid, 0);
unless ($total) {print "<---- No matches found for \"$FORM{grep}\" in $file ---->\n"}
alarm(0);
}
} else {
alarm($timeout);
my ($childin, $childout);
my $pid = open3($childin, $childout, $childout,$grepbin,@cmd,$logfile);
while (<$childout>) {
my $line = $_;
$line =~ s/&/&/g;
$line =~ s//>/g;
if ($FORM{grep} ne "") {
eval {
local $SIG{__DIE__} = undef;
if ($FORM{grepi}) {
$line =~ s/$FORM{grep}/$&<\/mark>/ig;
} else {
$line =~ s/$FORM{grep}/$&<\/mark>/g;
}
};
}
print $line;
$total += length $line;
}
waitpid ($pid, 0);
unless ($total) {print "<---- No matches found for \"$FORM{grep}\" in $logfile ---->\n"}
alarm(0);
}
};
alarm(0);
if ($@) {print "TIMEOUT: grep command took too long. Timed out after $timeout seconds\n"}
} else {
print "Executable [$grepbin] invalid";
}
}
}
elsif ($FORM{action} eq "readme") {
&resize("top");
print "
\n";
open (my $IN, "<", "/etc/csf/readme.txt") or die $!;
flock ($IN, LOCK_SH);
my @readme = <$IN>;
close ($IN);
chomp @readme;
foreach my $line (@readme) {
$line =~ s/\/\>\;/g;
print $line."\n";
}
print "
\n";
&resize("bot",0);
&printreturn;
}
elsif ($FORM{action} eq "servercheck") {
print ConfigServer::ServerCheck::report($FORM{verbose});
open (my $IN, "<", "/etc/cron.d/csf-cron");
flock ($IN, LOCK_SH);
my @data = <$IN>;
close ($IN);
chomp @data;
my $optionselected = "never";
my $email;
if (my @ls = grep {$_ =~ /csf \-m/} @data) {
if ($ls[0] =~ /\@(\w+)\s+root\s+\/usr\/sbin\/csf \-m (.*)/) {$optionselected = $1; $email = $2}
}
print " \n";
print " \n";
print " \n";
&printreturn;
}
elsif ($FORM{action} eq "serverchecksave") {
my $extra = "";
my $freq = "daily";
my $email;
if ($FORM{email} ne "") {$email = "root"}
if ($FORM{email} =~ /^[a-zA-Z0-9\-\_\.\@\+]+$/) {$email = $FORM{email}}
foreach my $option ("never","hourly","daily","weekly","monthly") {if ($FORM{freq} eq $option) {$freq = $option}}
unless ($email) {$freq = "never"; $extra = "(no valid email address supplied)";}
sysopen (my $CRON, "/etc/cron.d/csf-cron", O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($CRON, LOCK_EX);
my @data = <$CRON>;
chomp @data;
seek ($CRON, 0, 0);
truncate ($CRON, 0);
my $done = 0;
foreach my $line (@data) {
if ($line =~ /csf \-m/) {
if ($freq and ($freq ne "never") and !$done) {
print $CRON "\@$freq root /usr/sbin/csf -m $email\n";
$done = 1;
}
} else {
print $CRON "$line\n";
}
}
if (!$done and ($freq ne "never")) {
print $CRON "\@$freq root /usr/sbin/csf -m $email\n";
}
close ($CRON);
if ($freq and $freq ne "never") {
print "
These options can take a long time to run (several minutes) depending on the number of IP addresses to check and the response speed of the DNS requests:
\n";
print " \n";
print " \n";
print " \n";
open (my $IN, "<", "/etc/cron.d/csf-cron");
flock ($IN, LOCK_SH);
my @data = <$IN>;
close ($IN);
chomp @data;
my $optionselected = "never";
my $email;
if (my @ls = grep {$_ =~ /csf \-\-rbl/} @data) {
if ($ls[0] =~ /\@(\w+)\s+root\s+\/usr\/sbin\/csf \-\-rbl (.*)/) {$optionselected = $1; $email = $2}
}
print " \n";
&printreturn;
}
elsif ($FORM{action} eq "rblchecksave") {
my $extra = "";
my $freq = "daily";
my $email;
if ($FORM{email} ne "") {$email = "root"}
if ($FORM{email} =~ /^[a-zA-Z0-9\-\_\.\@\+]+$/) {$email = $FORM{email}}
foreach my $option ("never","hourly","daily","weekly","monthly") {if ($FORM{freq} eq $option) {$freq = $option}}
unless ($email) {$freq = "never"; $extra = "(no valid email address supplied)";}
sysopen (my $CRON, "/etc/cron.d/csf-cron", O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($CRON, LOCK_EX);
my @data = <$CRON>;
chomp @data;
seek ($CRON, 0, 0);
truncate ($CRON, 0);
my $done = 0;
foreach my $line (@data) {
if ($line =~ /csf \-\-rbl/) {
if ($freq and ($freq ne "never") and !$done) {
print $CRON "\@$freq root /usr/sbin/csf --rbl $email\n";
$done = 1;
}
} else {
print $CRON "$line\n";
}
}
if (!$done and ($freq ne "never")) {
print $CRON "\@$freq root /usr/sbin/csf --rbl $email\n";
}
close ($CRON);
if ($freq and $freq ne "never") {
print "
\n";
my ($childin, $childout);
my $pid = open3($childin, $childout, $childout, "/usr/sbin/csf","-cg",$FORM{ip});
my $unblock;
my $start = 0;
while (<$childout>) {
my $line = $_;
if ($line =~ /^====/) {
if ($start) {
print "$line
\n";
print <
var pagecontent=new virtualpaginate({
piececlass: "virtualpage", //class of container for each piece of content
piececontainer: "div", //container element type (ie: "div", "p" etc)
pieces_per_page: 1, //Pieces of content to show per page (1=1 piece, 2=2 pieces etc)
defaultpage: 0, //Default page selected (0=1st page, 1=2nd page etc). Persistence if enabled overrides this setting.
wraparound: false,
persist: false //Remember last viewed page and recall it when user returns within a browser session?
});
EOD
print "pagecontent.buildpagination(['paginatediv','paginatediv2'],[";
foreach my $line (@divnames) {print "'$line',"}
print "''])\npagecontent.showall();\n\n";
print " \n";
print "\n";
&printreturn;
}
elsif ($FORM{action} eq "saveconf") {
sysopen (my $IN, "/etc/csf/csf.conf", O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($IN, LOCK_SH);
my @confdata = <$IN>;
close ($IN);
chomp @confdata;
my %restricted;
if ($config{RESTRICT_UI}) {
sysopen (my $IN, "/usr/local/csf/lib/restricted.txt", O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($IN, LOCK_SH);
while (my $entry = <$IN>) {
chomp $entry;
$restricted{$entry} = 1;
}
close ($IN);
}
sysopen (my $OUT, "/etc/csf/csf.conf", O_WRONLY | O_CREAT) or die "Unable to open file: $!";
flock ($OUT, LOCK_EX);
seek ($OUT, 0, 0);
truncate ($OUT, 0);
for (my $x = 0; $x < @confdata;$x++) {
if (($confdata[$x] !~ /^\#/) and ($confdata[$x] =~ /=/)) {
my ($start,$end) = split (/=/,$confdata[$x],2);
if ($end =~ /\"(.*)\"/) {$end = $1}
my $name = $start;
my $sanity_name = $start;
$name =~ s/\s/\_/g;
$sanity_name =~ s/\s//g;
if ($restricted{$sanity_name}) {
print $OUT "$confdata[$x]\n";
} else {
print $OUT "$start= \"$FORM{$name}\"\n";
$end = $FORM{$name};
}
} else {
print $OUT "$confdata[$x]\n";
}
}
close ($OUT);
ConfigServer::Config::resetconfig();
my $newconfig = ConfigServer::Config->loadconfig();
my %newconfig = $config->config;
foreach my $key (keys %newconfig) {
my ($insane,$range,$default) = sanity($key,$newconfig{$key});
if ($insane) {print " WARNING: $key sanity check. $key = \"$newconfig{$key}\". Recommended range: $range (Default: $default)\n"}
}
print "
Changes saved. You should restart both csf and lfd.
\n";
print "\n";
&printreturn;
}
elsif ($FORM{action} eq "viewlogs") {
if (-e "/var/lib/csf/stats/iptables_log") {
open (my $IN, "<", "/var/lib/csf/stats/iptables_log") or die "Unable to open file: $!";
flock ($IN, LOCK_SH);
my @iptables = <$IN>;
close ($IN);
chomp @iptables;
@iptables = reverse @iptables;
my $from;
my $to;
my $divcnt = 0;
my $expcnt = @iptables;
if ($iptables[0] =~ /\|(\S+\s+\d+\s+\S+)/) {$from = $1}
if ($iptables[-1] =~ /\|(\S+\s+\d+\s+\S+)/) {$to = $1}
print "
\n";
print "
\n";
print "
Last $config{ST_IPTABLES} iptables logs*, latest:$from oldest:$to
\n";
print "
\n";
print "
Time
From
Port
I/O
To
Port
Proto
\n";
my $size = scalar @iptables;
if ($size > $config{ST_IPTABLES}) {$size = $config{ST_IPTABLES}}
for (my $x = 0 ;$x < $size ;$x++) {
my $line = $iptables[$x];
$divcnt++;
my ($text,$log) = split(/\|/,$line);
my ($time,$desc,$in,$out,$src,$dst,$spt,$dpt,$proto,$inout);
if ($log =~ /IN=(\S+)/) {$in = $1}
if ($log =~ /OUT=(\S+)/) {$out = $1}
if ($log =~ /SRC=(\S+)/) {$src = $1}
if ($log =~ /DST=(\S+)/) {$dst = $1}
if ($log =~ /SPT=(\d+)/) {$spt = $1}
if ($log =~ /DPT=(\d+)/) {$dpt = $1}
if ($log =~ /PROTO=(\S+)/) {$proto = $1}
if ($text ne "") {
$text =~ s/\(/\\(/g;
if ($in and $src) {$src = $text ; $dst .= " (server)"}
elsif ($out and $dst) {$dst = $text ; $src .= " (server)"}
}
if ($log =~ /^(\S+\s+\d+\s+\S+)/) {$time = $1}
$inout = "n/a";
if ($in) {$inout = "in"}
elsif ($out) {$inout = "out"}
print "
* These iptables logs taken from $config{IPTABLES_LOG} will not necessarily show all packets blocked by iptables. For example, ports listed in DROP_NOLOG or the settings for DROP_LOGGING/DROP_IP_LOGGING/DROP_ONLYRES/DROP_PF_LOGGING will affect what is logged. Additionally, there is rate limiting on all iptables log rules to prevent log file flooding
\n";
} else {
print "
No logs entries found
\n";
}
&printreturn;
}
elsif ($FORM{action} eq "sips") {
sysopen (my $IN, "/etc/csf/csf.sips", O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($IN, LOCK_SH);
my @confdata = <$IN>;
close ($IN);
chomp @confdata;
print "\n";
&printreturn;
}
elsif ($FORM{action} eq "sipsave") {
open (my $IN,"<","/etc/csf/csf.sips");
flock ($IN, LOCK_SH);
my @data = <$IN>;
close ($IN);
chomp @data;
open (my $OUT,">","/etc/csf/csf.sips");
flock ($OUT, LOCK_EX);
foreach my $line (@data) {
if ($line =~ /^\#/) {print $OUT "$line\n"} else {last}
}
foreach my $key (keys %FORM) {
if ($key =~ /^ip_(.*)/) {
my $ip = $1;
$ip =~ s/\_/\./g;
print $OUT "$ip\n";
}
}
close($OUT);
print "
Ports listening for external connections and the executables running behind them:
\n";
print "
\n";
print "
Port
Proto
Open
Conns
PID
User
Command Line
Executable
\n";
my %listen = ConfigServer::Ports->listening;
my %ports = ConfigServer::Ports->openports;
foreach my $protocol (sort keys %listen) {
foreach my $port (sort {$a <=> $b} keys %{$listen{$protocol}}) {
foreach my $pid (sort {$a <=> $b} keys %{$listen{$protocol}{$port}}) {
my $fopen;
if ($ports{$protocol}{$port}) {$fopen = "4"} else {$fopen = "-"}
if ($config{IPV6} and $ports{$protocol."6"}{$port}) {$fopen .= "/6"} else {$fopen .= "/-"}
my $fcmd = ($listen{$protocol}{$port}{$pid}{cmd});
$fcmd =~ s/\
$port
$protocol
$fopen
$fconn
$pid
$listen{$protocol}{$port}{$pid}{user}
$fcmd
$fexe
\n";
}
}
}
print "
\n";
&printreturn;
}
elsif ($mobile) {
print "
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
}
elsif ($FORM{action} eq "fix") {
print "
These options should only be used as a last resort as most of them will reduce the effectiveness of csf and lfd to protect the server
\n";
print "
\n";
print "
Fix Common Problems
";
if ($config{LF_SPI} == 0) {
print "
\n";
} else {
print "
\n";
}
print "
If you find that ports listed in TCP_IN/UDP_IN are being blocked by iptables (e.g. port 80) as seen in /var/log/messages and users can only connect to the server if entered in csf.allow, then it could be that the kernel (usually on virtual servers) is broken and cannot perform connection tracking. In this case, disabling the Stateful Packet Inspection functionality of csf (LF_SPI) may help\n";
if ($config{LF_SPI} == 0) {
print " Note: LF_SPI is already disabled";
}
print "
\n";
if ($config{TCP_IN} =~ /30000:35000/) {
print "
\n";
} else {
print "
\n";
}
print "
If the kernel (usually on virtual servers) is broken and cannot perform ftp connection tracking, or if you are trying to use FTP over SSL, this option will open a hole in the firewall to allow PASV connections through\n";
if ($config{TCP_IN} =~ /30000:35000/) {
print " Note: The port range 30000 to 35000 is already open in csf\n";
}
print "
\n";
if ($config{PT_USERKILL} == 0) {
print "
\n";
} else {
print "
\n";
}
print "
If lfd is killing running processes and you have PT_USERKILL enabled, then we recommend that you disable this feature\n";
if ($config{PT_USERKILL} == 0) {
print " Note: PT_USERKILL is already disabled";
}
print "
\n";
if ($config{SMTP_BLOCK} == 0) {
print "
\n";
} else {
print "
\n";
}
print "
If scripts on the server are unable to send out email via external SMTP connections and you have SMTP_BLOCK enabled then those scripts should be configured to send email either through /usr/sbin/sendmail or localhost on the server. If this is not possible then disabling SMTP_BLOCK can fix this\n";
if ($config{SMTP_BLOCK} == 0) {
print " Note: SMTP_BLOCK is already disabled";
}
print "
\n";
print "
\n";
print "
If you really want to disable all alerts in lfd you can do so here. This is not recommended in any situation - you should go through the csf configuration and only disable those you do not want. As new features are added to csf you may find that you have to go into the csf configuration and disable them manually as this procedure only disables the ones that it is aware of when applied\n";
print "
\n";
print "
\n";
print "
If all else fails this option will completely uninstall csf and install it again with completely default options (including TESTING mode). The previous configuration will be lost including all modifications\n";
print "
\n";
&printreturn;
}
else {
if (defined $ENV{WEBMIN_VAR} and defined $ENV{WEBMIN_CONFIG} and -e "module.info") {
my @data = slurp("module.info");
foreach my $line (@data) {
if ($line =~ /^name=csf$/) {
unless (-l "index.cgi") {
unlink "index.cgi";
my $status = symlink ("/usr/local/csf/lib/webmin/csf/index.cgi","index.cgi");
if ($status and -l "index.cgi") {
symlink ("/usr/local/csf/lib/webmin/csf/images","csfimages");
print "
csf updated to symlink webmin module to /usr/local/csf/lib/webmin/csf/. Click here to continue
\n";
exit;
} else {
print "
Failed to symlink to /usr/local/csf/lib/webmin/csf/
\n";
}
}
last;
}
}
}
&getethdev;
my ($childin, $childout);
my $pid = open3($childin, $childout, $childout, "$config{IPTABLES} $config{IPTABLESWAIT} -L LOCALINPUT -n");
my @iptstatus = <$childout>;
waitpid ($pid, 0);
chomp @iptstatus;
if ($iptstatus[0] =~ /# Warning: iptables-legacy tables present/) {shift @iptstatus}
my $status = "
Edit the configuration file for the csf firewall and lfd
\n";
print "
Apply pre-configured csf.conf profiles and backup/restore csf.conf
\n";
print "
Display the active iptables rules
\n";
print "
\n";
print "
Edit csf.allow, the IP address allow file $permallows
\n";
print "
Edit csf.deny, the IP address deny file $permbans
\n";
print "
Enables csf and lfd if previously Disabled
\n";
print "
Completely disables csf and lfd
\n";
print "
Restart the csf iptables firewall
\n";
print "
Have lfd restart the csf iptables firewall
\n";
print "
\n";
print "
View/Remove the temporary IP entries $tempbans
\n";
print "
Deny access to and from specific IP addresses configured on the server (csf.sips)
\n";
print "
Removes and unblocks all entries in csf.deny (excluding those marked \"do not delete\") and all temporary IP entries (blocks and allows)
\n";
print "
Redirect connections to this server to other ports/IP addresses
\n";
print "
Offers solutions to some common problems when using an SPI firewall
\n";
print "
\n";
print "\n";
print "
\n";
print "
\n";
print "
\n";
print "
lfd - Login Failure Daemon
";
print "
Display lfd status
\n";
print "
Restart lfd
\n";
print "
Edit lfd ignore file
\n";
print "
Edit the Directory File Watching file (csf.dirwatch) - all listed files and directories will be watched for changes by lfd
\n";
print "
Edit the Dynamic DNS file (csf.dyndns) - all listed domains will be resolved and allowed through the firewall
\n";
print "
Edit email alert templates. See Firewall Information for details of each file
\n";
print "
Edit the Log Scanner file (csf.logfiles) - Scan listed log files for log lines and periodically send a report
\n";
print "
Edit the Blocklists configuration file (csf.blocklists)
\n";
print "
Edit the syslog/rsyslog allowed users file (csf.syslogusers)
\n";
print "
\n";
print "
\n";
if ($config{CLUSTER_SENDTO}) {
print "
\n";
print "
\n";
print "
csf - ConfigServer lfd Cluster
";
print "
Ping each member of the cluster (logged in lfd.log)
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
print "
\n";
if ($config{CLUSTER_CONFIG}) {
if ($ips{$config{CLUSTER_MASTER}} or $ipscidr6->find($config{CLUSTER_MASTER}) or ($config{CLUSTER_MASTER} eq $config{CLUSTER_NAT})) {
my $options;
my %restricted;
if ($config{RESTRICT_UI}) {
sysopen (my $IN, "/usr/local/csf/lib/restricted.txt", O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($IN, LOCK_SH);
while (my $entry = <$IN>) {
chomp $entry;
$restricted{$entry} = 1;
}
close ($IN);
}
foreach my $key (sort keys %config) {
unless ($restricted{$key}) {$options .= ""}
}
print "
\n";
print "
Restart csf and lfd on Cluster members
\n";
}
}
print "
\n";
print "
\n";
}
print "
\n";
if ($config{CF_ENABLE}) {
print "
\n";
print "
CloudFlare Firewall
";
print "
Access CloudFlare firewall functionality
\n";
print "
Edit the CloudFlare Configuration file (csf.cloudflare)
\n";
print "
\n";
}
if ($config{SMTPAUTH_RESTRICT}) {
print "
\n";
print "
cPanel SMTP AUTH Restrictions
";
print "
Edit the file that allows SMTP AUTH to be advertised to listed IP addresses (csf.smtpauth)
\n";
print "
\n";
}
if (-e "/usr/local/cpanel/version" or $config{DIRECTADMIN} or $config{INTERWORX}) {
my $resellers = "cPanel Resellers";
if ($config{DIRECTADMIN}) {$resellers = "DirectAdmin Resellers"}
elsif ($config{INTERWORX}) {$resellers = "InterWorx Resellers"}
print "
\n";
print "
$resellers
";
print "
Privileges can be assigned to $resellers accounts by editing this file (csf.resellers)
\n";
print "
\n";
}
print "
\n";
print "
Extra
";
print "
Check that iptables has the required modules to run csf
\n";
print "
\n";
# if ($config{DIRECTADMIN} and !$config{THIS_UI}) {
# print " DirectAdmin Main Page\n";
# }
print "
\n
\n";
if ($config{STYLE_MOBILE}) {
if (-e "/usr/local/cpanel/version" and !$config{THIS_UI}) {
require Cpanel::Version::Tiny;
if ($Cpanel::Version::Tiny::major_version < 65) {
print " cPanel Main Page\n";
}
}
if (defined $ENV{WEBMIN_VAR} and defined $ENV{WEBMIN_CONFIG} and !$config{THIS_UI}) {
print " Webmin Main Page\n";
}
print "
Shows a subset of functions suitable for viewing on mobile devices
We are very happy to be able to provide this and other products for free. However, it does take time for us to develop and maintain them. If you would like to help with their development by providing a PayPal contribution, please contact us for details
\n";
print "
\n";
}
unless ($FORM{action} eq "tailcmd" or $FORM{action} =~ /^cf/ or $FORM{action} eq "logtailcmd" or $FORM{action} eq "loggrepcmd") {
print " \n";
print "
\n";
}
return;
}
# end main
###############################################################################
# start printcmd
sub printcmd {
my @command = @_;
my ($childin, $childout);
my $pid = open3($childin, $childout, $childout, @command);
while (<$childout>) {print $_}
waitpid ($pid, 0);
return;
}
# end printcmd
###############################################################################
# start getethdev
sub getethdev {
my $ethdev = ConfigServer::GetEthDev->new();
my %g_ipv4 = $ethdev->ipv4;
my %g_ipv6 = $ethdev->ipv6;
foreach my $key (keys %g_ipv4) {
$ips{$key} = 1;
}
if ($config{IPV6}) {
foreach my $key (keys %g_ipv6) {
eval {
local $SIG{__DIE__} = undef;
$ipscidr6->add($key);
};
}
}
return;
}
# end getethdev
###############################################################################
# start chart
sub chart {
my $img;
my $imgdir = "";
my $imghddir = "";
if (-e "/usr/local/cpanel/version") {
$imgdir = "/";
$imghddir = "";
}
elsif (-e "/usr/local/directadmin/conf/directadmin.conf") {
$imgdir = "/CMD_PLUGINS_ADMIN/csf/images/";
$imghddir = "plugins/csf/images/";
umask(0133);
}
elsif (-e "/usr/local/interworx") {
$imgdir = "/configserver/csf/";
$imghddir = "/usr/local/interworx/html/configserver/csf/";
umask(0133);
}
elsif (-e "/usr/local/CyberCP/") {
$imgdir = "/static/configservercsf/";
$imghddir = "/usr/local/CyberCP/public/static/configservercsf/";
umask(0133);
}
if ($config{THIS_UI}) {
$imgdir = "$images/";
$imghddir = "/etc/csf/ui/images/";
}
my $STATS;
if (-e "/var/lib/csf/stats/lfdstats") {
sysopen ($STATS,"/var/lib/csf/stats/lfdstats", O_RDWR | O_CREAT);
}
elsif (-e "/var/lib/csf/stats/lfdmain") {
sysopen (my $OLDSTATS,"/var/lib/csf/stats/lfdmain", O_RDWR | O_CREAT);
flock ($OLDSTATS, LOCK_EX);
my @stats = <$OLDSTATS>;
chomp @stats;
my @newstats;
my $cnt = 0;
foreach my $line (@stats) {
if ($cnt == 55) {push @newstats,""}
push @newstats,$line;
$cnt++;
}
sysopen ($STATS,"/var/lib/csf/stats/lfdstats", O_RDWR | O_CREAT);
flock ($STATS, LOCK_EX);
seek ($STATS, 0, 0);
truncate ($STATS, 0);
foreach my $line (@newstats) {
print $STATS "$line\n";
}
close ($STATS);
rename "/var/lib/csf/stats/lfdmain", "/var/lib/csf/stats/lfdmain.".time;
close ($OLDSTATS);
sysopen ($STATS,"/var/lib/csf/stats/lfdstats", O_RDWR | O_CREAT);
} else {
sysopen ($STATS,"/var/lib/csf/stats/lfdstats", O_RDWR | O_CREAT);
}
flock ($STATS, LOCK_SH);
my @stats = <$STATS>;
chomp @stats;
close ($STATS);
if (@stats) {
ConfigServer::ServerStats::charts($config{CC_LOOKUPS},$imghddir);
print ConfigServer::ServerStats::charts_html($config{CC_LOOKUPS},$imgdir);
} else {
print "
\n";
print "
No statistical data has been collected yet
\n";
}
&printreturn;
return;
}
# end chart
###############################################################################
# start systemstats
sub systemstats {
my $type = shift;
if ($type eq "") {$type = "load"}
my $img;
my $imgdir = "";
my $imghddir = "";
if (-e "/usr/local/cpanel/version") {
if (-e "/usr/local/cpanel/bin/register_appconfig") {
$imgdir = "csf/";
$imghddir = "cgi/configserver/csf/";
} else {
$imgdir = "/";
$imghddir = "";
}
}
elsif (-e "/usr/local/directadmin/conf/directadmin.conf") {
$imgdir = "/CMD_PLUGINS_ADMIN/csf/images/";
$imghddir = "plugins/csf/images/";
umask(0133);
}
elsif (-e "/usr/local/interworx") {
$imgdir = "/configserver/csf/";
$imghddir = "/usr/local/interworx/html/configserver/csf/";
umask(0133);
}
elsif (-e "/usr/local/CyberCP/") {
$imgdir = "/static/configservercsf/";
$imghddir = "/usr/local/CyberCP/public/static/configservercsf/";
umask(0133);
}
if ($config{THIS_UI}) {
$imgdir = "$images/";
$imghddir = "/etc/csf/ui/images/";
}
if (defined $ENV{WEBMIN_VAR} and defined $ENV{WEBMIN_CONFIG}) {
$imgdir = "/csf/";
$imghddir = "";
}
sysopen (my $STATS,"/var/lib/csf/stats/system", O_RDWR | O_CREAT);
flock ($STATS, LOCK_SH);
my @stats = <$STATS>;
chomp @stats;
close ($STATS);
if (@stats > 1) {
ConfigServer::ServerStats::graphs($type,$config{ST_SYSTEM_MAXDAYS},$imghddir);
print " \n";
print ConfigServer::ServerStats::graphs_html($imgdir);
unless ($config{ST_MYSQL} and $config{ST_APACHE}) {
print " \n
\n";
print "
You may be able to collect more statistics by enabling ST_MYSQL or ST_APACHE in the csf configuration
\n";
}
} else {
print "
\n";
print "
No statistical data has been collected yet
\n";
}
&printreturn;
return;
}
# end systemstats
###############################################################################
# start editfile
sub editfile {
my $file = shift;
my $save = shift;
my $extra = shift;
my $ace = 0;
sysopen (my $IN, $file, O_RDWR | O_CREAT) or die "Unable to open file: $!";
flock ($IN, LOCK_SH);
my @confdata = <$IN>;
close ($IN);
chomp @confdata;
if (-e "/usr/local/cpanel/3rdparty/share/ace-editor/optimized/src-min-noconflict/ace.js") {$ace = 1}
if (-e "/usr/local/cpanel/version" and $ace and !$config{THIS_UI}) {
print "\n";
print "
Edit $file
\n";
print "\n";
print "
\n";
print "
\n";
print "\n";
print <
var myFont = 14;
var textarea = \$('#formdata');
var editordiv = \$('#editor');
var editor = ace.edit("editor");
editor.setTheme("ace/theme/tomorrow");
editor.setShowPrintMargin(false);
editor.setOptions({
fontFamily: "Courier New, Courier",
fontSize: "14px"
});
editor.getSession().setMode("ace/mode/space");
editor.getSession().on('change', function () {
textarea.val(editor.getSession().getValue());
});
textarea.on('change', function () {
editor.getSession().setValue(textarea.val());
});
editor.getSession().setValue(textarea.val());
\$('#textarea').hide();
editordiv.show();
\$("#toggletextarea-btn").on('click', function () {
\$('#textarea').toggle();
editordiv.toggle();
});
\$("#fontplus-btn").on('click', function () {
myFont++;
if (myFont > 20) {myFont = 20}
editor.setFontSize(myFont)
textarea.css("font-size",myFont+"px");
});
\$("#fontminus-btn").on('click', function () {
myFont--;
if (myFont < 12) {myFont = 12}
editor.setFontSize(myFont)
textarea.css("font-size",myFont+"px");
});
EOF
} else {
if ($config{DIRECTADMIN}) {
print "
\n/g; print "$line
\n"; } } print "