GIF89a;
Direktori : /scripts/ |
Current File : //scripts/securemysql |
#!/usr/local/cpanel/3rdparty/bin/perl # cpanel - scripts/securemysql Copyright 2022 cPanel, L.L.C. # All rights reserved. # copyright@cpanel.net http://cpanel.net # This code is subject to the cPanel license. Unauthorized copying is prohibited use strict; use warnings; use Getopt::Std; use Cpanel::MysqlUtils::Check (); use Cpanel::MysqlUtils::Secure (); use Cpanel::SafeRun::Simple (); use Cpanel::MysqlUtils::Connect (); use Cpanel::MysqlUtils::MyCnf::Basic (); use Cpanel::AdminBin::Serializer (); # PPI USE OK - loadConfig speed use Cpanel::Config::LoadConfig (); # PPI USE OK - For MyCnf::Basic use Cpanel::PwCache (); # PPI USE OK - For MyCnf::Basic use Try::Tiny; # Only run if executed by root exit if ( $> != 0 ); # Don't run if MySQL is not used exit if ( -e '/etc/securemysqldisable' || -e '/etc/mysqldisable' ); my $version = qq{0.3}; my $verbose = 1; my $fast = 0; my $help = 0; my $actions = q{}; my %options; getopts( 'qFha:', \%options ); if ( exists $options{'q'} ) { $verbose = 0; } if ( exists $options{'F'} ) { $fast = 1; } if ( exists $options{'h'} ) { $help = 1; } if ( exists $options{'a'} ) { $actions = $options{'a'}; if ( !defined $actions || $actions eq '' ) { $actions = 'all'; } } my @actions; if ( $actions ne 'all' && $actions ne '' ) { $actions =~ s{ [^a-z0-9,]+ }{}gxms; @actions = split /,/, $actions; } my $actionsall = 0; if ( $actions eq 'all' || grep m{ \A all \z }xms, @actions ) { $actionsall = 1; } if ($actionsall) { print "Performing all actions.\n" if $verbose; } my %actions = ( 'removeanon' => $actionsall, 'removetestdb' => $actionsall, 'removelockntmp' => $actionsall, 'removeremoteroot' => $actionsall, 'removehordeallhosts' => $actionsall, 'removehordeblankpass' => $actionsall, 'chowndatadir' => $actionsall, ); foreach my $action (@actions) { if ( exists $actions{$action} || $actionsall ) { $actions{$action} = 1; } elsif ($verbose) { print "Invalid action $action ignored.\n"; } } $actions{'securemycnf'} = 1; # we always do this if ( !-t STDOUT ) { $verbose = 0; } if ( $help || ( $verbose && !$fast ) ) { print <<"EOM"; securemysql $version Options: -q - Quiet execution -F - Bypass the help message -a - Specify additional actions (comma separated list), or blank for all -h - Print this message and exit. This script attempts to secure the MySQL configuration by doing the following: (always executed) Ensure root password for MySQL is set. (always executed) Changes ownership of /var/db/mysql or /var/lib/mysql to mysql Additionally, the following actions can be specified: [optional] removeanon - Remove any anonymous users removetestdb - Remove test database removelockntmp - Remove global lock tables and create tmp table privileges from users removeremoteroot - Remove remote root login removehordeallhosts - Remove insecure horde login and privileges removehordeblankpass - Remove horde users with blank password chowndatadir - Chown the mysql data directory to mysql:mysql Examples: ./securemysql -q -F -a removeanon,removetestdb,removelockntmp,removeremoteroot ./securemysql -q -F -a "removeanon, removetestdb, removelockntmp" ./securemysql -q -F -aremovehordeallhosts EOM exit if $help; sleep 5; } if ( Cpanel::MysqlUtils::MyCnf::Basic::is_remote_mysql() ) { print "Remote MySQL configured. Exiting.\n" if $verbose; exit; } my $err; my $dbh; try { $dbh = Cpanel::MysqlUtils::Connect::get_dbi_handle(); } catch { $err = $_; }; if ( !$dbh ) { my $ret = Cpanel::SafeRun::Simple::saferun( '/usr/local/cpanel/scripts/restartsrv_mysql', '--check' ) // ''; my $check_ok = $? == 0 ? 1 : 0; if ( !$check_ok ) { # This will force a password reset if password is wrong/blank $check_ok = Cpanel::MysqlUtils::Check::check_mysql_password_works_or_reset(); if ( !$check_ok ) { # Case 169937, if I die here it will show like an error on the main # screen. print "Mysql is not running: $ret: $err\n"; exit; } } $dbh = Cpanel::MysqlUtils::Connect::get_dbi_handle(); } if ( values %actions ) { Cpanel::MysqlUtils::Secure::perform_secure_actions( $dbh, \%actions, $verbose ); }