#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - scripts/suspendmysqlusers Copyright 2022 cPanel, L.L.C.
# All rights reserved.
# copyright@cpanel.net http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited
package scripts::suspendmysqlusers;
use strict;
use warnings;
use Cpanel::DB::Map::Reader ();
use Cpanel::DB::Utils ();
use Cpanel::Mysql::Passwd ();
use Cpanel::MysqlUtils::Command ();
use Cpanel::MysqlUtils::Quote ();
use Cpanel::MysqlUtils::Compat ();
use Cpanel::Logger ();
use Cpanel::MysqlUtils::Connect ();
use Cpanel::MysqlUtils::Version ();
if ( !caller() ) {
my $user = shift @ARGV;
if ( !$user ) {
print "USAGE: $0 <user>\n";
exit 1;
}
suspend($user);
}
sub suspend {
my ($cpuser) = @_;
my $logger = Cpanel::Logger->new();
my $map = Cpanel::DB::Map::Reader->new( 'cpuser' => $cpuser, engine => 'mysql' );
my @user_list = $map->get_dbusers_plus_cpses();
# Case48428 - Need to include the parent user associated with the database and not just virtual users
# when suspending accounts in MySQL.
# Also, the DB map datastore might have a different owner name associated with the user
# account which the databases are tied to.
my @db_owner = (
$cpuser,
Cpanel::DB::Utils::username_to_dbowner($cpuser),
);
push @user_list, @db_owner;
my $user_list = join ',', map { Cpanel::MysqlUtils::Quote::quote($_) } @user_list;
Cpanel::MysqlUtils::Connect::connect();
my $row_name = Cpanel::MysqlUtils::Compat::get_mysql_user_auth_field();
my $result = Cpanel::MysqlUtils::Command::sqlcmd("SELECT User, Host, $row_name from mysql.user WHERE user IN ($user_list)") || '';
my @lines = split /\n/, $result;
my %result;
foreach my $line (@lines) {
my ( $user, $host, $pass ) = split /\s+/, $line, 3;
if ( !$pass ) {
$logger->info("MySQL user $user\@$host has a blank password!");
$result{$user}{$host} = '*' x 41;
}
else {
$result{$user}{$host} = $pass;
}
}
foreach my $user ( keys %result ) {
foreach my $host ( keys %{ $result{$user} } ) {
if ( $result{$user}{$host} =~ m/^\*/ ) {
$result{$user}{$host} =~ s/^\*//;
$result{$user}{$host} = reverse $result{$user}{$host};
$result{$user}{$host} = '-' . $result{$user}{$host};
}
else { # Case 76857
$result{$user}{$host} =~ s/^([0-9a-f]{16})$/ ( '!' x 25 ) . reverse($1) /e;
}
}
}
my $mysql = Cpanel::Mysql::Passwd->new( { cpuser => $cpuser } );
my @sql_cmds;
foreach my $user ( keys %result ) {
foreach my $host ( keys %{ $result{$user} } ) {
my $pass = $result{$user}{$host};
my $mysql_version = _long_mysql_version_or_default();
# Per docs on MySQL 5.7.6 - https://dev.mysql.com/doc/refman/5.7/en/grant.html
# We can no longer use GRANT statements to change the password.
# However, since 5.7 ships with Account Locking capabilities, we will utilize that instead to lock the accounts.
if ( Cpanel::MysqlUtils::Version::is_at_least( $mysql_version, '5.7.6' )
&& !Cpanel::MysqlUtils::Version::is_at_least( $mysql_version, '10.0.0' ) ) {
push @sql_cmds, 'ALTER USER ' . Cpanel::MysqlUtils::Quote::quote($user) . '@' . Cpanel::MysqlUtils::Quote::quote($host) . ' ACCOUNT LOCK;';
}
else {
# Passing in 1 to specify a password change
$mysql->passwduser_hash( $user => $pass, 1 );
}
}
}
# This must be done in the foreground or pkgacct will break.
push @sql_cmds, 'FLUSH PRIVILEGES';
Cpanel::MysqlUtils::Command::sqlcmd( \@sql_cmds );
return 1;
}
sub _long_mysql_version_or_default {
local $@;
my $long_version = eval { Cpanel::MysqlUtils::Version::current_mysql_version()->{'long'} };
if ($@) {
# current_mysql_version has extensive logic to determine the current
# version. If it fails, MySQL is likely beyond repair and we need to reinstall.
return $Cpanel::MysqlUtils::Version::DEFAULT_MYSQL_RELEASE_TO_ASSUME_IS_INSTALLED;
}
return $long_version;
}
1;
Mini Shell