#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - bin/rsync-user-homedir.pl Copyright 2022 cPanel, L.L.C.
# All rights reserved.
# copyright@cpanel.net http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited
package scripts::rsync_user_homedir;
use strict;
use warnings;
use Cpanel::BinCheck::Lite ();
use autodie;
=encoding utf-8
=head1 DESCRIPTION
This script exemplifies the client-side functionality of
end classes of L<Cpanel::Server::CpXfer::Base::acctxferrsync>.
=head1 USAGE (INTERNAL TO L<rsync(1)>)
B<IMPORTANT:> You aren’t meant to call this script directly; L<rsync(1)>
calls it via its C<--rsh> parameter.
For the sake of completeness, though, this script’s arguments are:
For cPanel:
rsync-user-homedir.pl --cpanel [--insecure] <--apitoken-fd=# | --apitoken=...> <hostname> <username> <rsyncargs..>
For WHM:
rsync-user-homedir.pl --whm [--insecure] <--apitoken-fd=# | --apitoken=...> --homedir-user=<username> <hostname> <token_username> <rsyncargs..>
Note that the API token, for security purposes, B<MUST> be passed via
file descriptor in production code.
Also note that, in both cases, all positional parameters other than
C<E<lt>hostnameE<gt>> will come from rsync.
=head1 REAL-USAGE EXAMPLES
Below are examples of how you’ll actually give this script to L<rsync(1)>.
The following …
rsync --archive --rsh '/usr/local/cpanel/scripts/rsync-user-homedir.pl --cpanel --apitoken=OF24KGWQS9Q8SWI6Y5PNJJHLMBY3UX6Z localhost' theusername: /where/to
… will back up C<theusername>’s home directory contents to F</where/to>.
It will authenticate to C<localhost> via the given cPanel API token.
Here is an example of WHM usage:
rsync --archive --rsh '/usr/local/cpanel/scripts/rsync-user-homedir.pl --whm --homedir-user=theuser --apitoken-fd=5 example.com' superman: /where/to
Note the additional C<--homedir-user>; this is the user whose home directory
will be backed up. C<superman>’s given WHM API token is how we will
authenticate to WHM on the remote server C<example.com>.
The C<--insecure> flag tolerates TLS handshake errors (e.g., from
self-signed or invalid certificates). As in L<curl(1)>, you may alias
this flag as C<-k>.
=head1 SEE ALSO
F<t/support/rsync_cpsrvd_client.pl> exemplifies how to do this via the
WHM endpoint exclusively and assumes that there is a root WHM access hash.
(WHM access hashes were a forerunner to API tokens.)
=cut
#----------------------------------------------------------------------
use parent qw( Cpanel::HelpfulScript );
use IO::Socket::SSL ();
use Cpanel::JSON::XS ();
use Cpanel::HTTP::QueryString ();
use Cpanel::Services::Ports ();
# It’s curious that CPAN doesn’t seem to have anything to do this.
use Cpanel::Interconnect ();
use constant _OPTIONS => (
'cpanel',
'whm|whostmgr',
'insecure|k',
'homedir-user=s',
'apitoken-fd=i',
'apitoken=s',
);
use constant _ACCEPT_UNNAMED => 1;
Cpanel::BinCheck::Lite::check_argv();
__PACKAGE__->new(@ARGV)->run() if !caller;
sub run {
my ($self) = @_;
my ( $hostname, $username, @rsync_cmd ) = $self->getopt_unnamed();
if ( !$hostname ) {
die $self->help('Need a hostname and a username!');
}
elsif ( !$username ) {
die $self->help('Need a username for the API token!');
}
elsif ( !@rsync_cmd ) {
die $self->help('Need an rsync command/arguments!');
}
my ( $app, $port, $remote_user );
if ( $self->getopt('cpanel') ) {
if ( $self->getopt('whm') ) {
die $self->help('Give either --cpanel or --whm, not both.');
}
$app = 'cpanel';
$port = $Cpanel::Services::Ports::SERVICE{'cpanels'};
}
elsif ( $self->getopt('whm') ) {
$app = 'whm';
$port = $Cpanel::Services::Ports::SERVICE{'whostmgrs'};
$remote_user = $self->getopt('homedir-user') // do {
die $self->help('WHM requires a --homedir-user.');
};
}
else {
die $self->help('Give --cpanel or --whm.');
}
my $token;
if ( my $fd = $self->getopt('apitoken-fd') ) {
if ( length $self->getopt('apitoken') ) {
die $self->help('Do not give --apitoken with --apitoken-fd.');
}
open my $rfh, '<&=', $fd or die "open(<&=$fd): $!";
local $/;
$token = readline $rfh;
}
else {
$token = $self->getopt('apitoken');
if ( length $token ) {
warn "XXX SECURITY ALERT: Using API token from the command line.\n";
}
}
if ( !length $token ) {
die $self->help('Give an API token.');
}
my $query = Cpanel::HTTP::QueryString::make_query_string(
( $remote_user ? ( username => $remote_user ) : () ),
rsync_arguments => Cpanel::JSON::XS::encode_json( \@rsync_cmd ),
);
my $path_query = "/cpxfer/acctxferrsync?$query";
my $req = join(
"\r\n",
"GET $path_query HTTP/1.0",
"Authorization: $app $username:$token",
q<>,
q<>,
);
my $cl = _get_socket(
$hostname, $port,
( $self->getopt('insecure') ? ( SSL_verify_mode => 0 ) : () ),
);
syswrite( $cl, $req );
my $response = do { local $/ = "\r\n\r\n"; <$cl> };
if ( $response !~ m{^HTTP.*? 2} ) {
print STDERR "*** ERROR ***:\n$response";
local $/;
die readline($cl);
}
Cpanel::Interconnect->new( 'handles' => [ $cl, [ \*STDIN, \*STDOUT ] ] )->connect();
return;
}
sub _get_socket {
my ( $hostname, $port, @extra_args ) = @_;
return IO::Socket::SSL->new(
PeerHost => $hostname,
PeerPort => $port,
@extra_args,
) || die "cannot connect: $IO::Socket::SSL::SSL_ERROR: $! ($@)";
}
1;
Mini Shell