xXx

Hexid M1n1 5h3ll MobiLe

opt/cpinst/jacky_script/_[ Not.Writable ]

File://opt/cpinst/jacky_script/cpanel_account_intranet_reject.sh

#!/bin/bash

# 取得外網網卡名稱
INTERNET=`ip addr show | grep 'inet ' | grep -v 'host lo\|scope global secondary' | grep -E 'inet (10\.|192\.168)' -v | awk '{print $NF}' | grep -v 'idrac'`

# 取得內網網卡名稱
INTRANET=`ip addr show | grep -E 'inet (10\.|192\.168)' | awk '{print $NF}'`

# MailGateway IP Range
MG_IP_RANGE=(43.254.16.240/28 103.17.10.224/27)

# 檢查是否有輸入參數
if [ -z "$1" ]; then
  echo ''
  echo '使用說明：'
  echo "/opt/cpinst/jacky_script/cpanel_account_intranet_reject.sh --check [ 確認取得相關參數是否有誤 ]"
  echo "/opt/cpinst/jacky_script/cpanel_account_intranet_reject.sh --run [ 將 iptables 規則寫入 /etc/csf/csfpre.sh 並重啟防火牆 ]"
  echo "/opt/cpinst/jacky_script/cpanel_account_intranet_reject.sh --check 1227,1228 [如果需要排外特定帳號，請使用此方式，數值為UID]"
  echo "/opt/cpinst/jacky_script/cpanel_account_intranet_reject.sh --run 1227,1228 [如果需要排外特定帳號，請使用此方式，數值為UID]"
  echo ''
  exit 1
fi

# 取得 cPanel Account UID 列表
mapfile -t cpanel < <(whmapi1 --output=jsonpretty listaccts | jq -r '.data.acct[] | .uid' | sort)

# 取得 cPanel Account start & end UID
start="${cpanel[0]}"
end="${cpanel[${#cpanel[@]}-1]}"

# 找出 cPanel 帳號 start UID 至 end UID 範圍內有匹配的帳號資訊，輸出至 cpanel_check 陣列
for ((i=start; i<=end; i++)); do
  while IFS= read -r line; do
    cpanel_check+=("$line")
  done < <(grep "x:$i:" /etc/passwd | awk -F\: '{print $3}')
done

#cpanel_check=(1005 1003 1006 1008 1008 1010)

# 產生 diff_array 空陣列
diff_array=()

# 進行比對，將多出來的 Account UID 輸出至 diff_array 陣列
for element in "${cpanel_check[@]}"; do
  if [[ ! " ${cpanel[@]} " =~ " ${element} " ]]; then
    diff_array+=("$element")
  fi
done

# 增加手動排外帳號
if [ -n "$2" ]; then
  IFS=',' read -r -a new_values <<< "$2"
  diff_array+=("${new_values[@]}")
fi

if [ "$1" == "--check" ]; then

  echo ""
  echo "cPanel 帳號起始 UID: $start"
  echo "cPanel 帳號結束 UID: $end"
  echo ""

  # 輸出多出來的 Account UID 與 帳號名稱
  echo 'cPanel UID 範圍內多出來非 cPanel 的帳號如下:'
  if [ ${#diff_array[@]} -ne 0 ]; then
    for elem in "${diff_array[@]}"; do
      grep "x:$elem:" /etc/passwd | awk -F: '{print $1, $3}'
    done
  else
    echo '沒有多出來的 Account'
  fi
  echo ""

  # 輸出 iptables 指令
  echo '自動產生 iptables 的指令如下(如果主機有內網，才會設定cPanel帳號限制存取內網):'
  for MG_IP in "${MG_IP_RANGE[@]}"; do
    # Exim 寄信使用 mailnull 帳號 uid 固定為 47
    echo "iptables -A OUTPUT -o ${INTERNET} -m owner --uid-owner 47 -d $MG_IP -p tcp -m tcp --dport 26 -j ACCEPT"
    echo "iptables -A OUTPUT -o ${INTERNET} -d $MG_IP -p tcp -m tcp --dport 26 -j REJECT"
  done

  if [ -n "$INTRANET" ]; then

    # 輸出 iptables 指令
    if [ ${#diff_array[@]} -ne 0 ]; then
      for elem in "${diff_array[@]}"; do
        elem2=$(grep "x:$elem:" /etc/passwd | awk -F: '{print $3}')
        echo "iptables -A OUTPUT -o ${INTRANET} -m owner --uid-owner ${elem2} -d 0.0.0.0/0 -j ACCEPT"
      done
    fi
    echo "iptables -A OUTPUT -o ${INTRANET} -m owner --uid-owner ${start}:${end} -d 0.0.0.0/0 -j REJECT"
    echo ""

  fi

  exit

fi

if [ "$1" == "--run" ]; then

  # 確認排外帳號列表是否有差異
  ######################

  # 如果 /mnt/other_uid_list.txt 檔案不存在則建立
  ofile='/mnt/other_uid_list.txt'
  if [ ! -f "$ofile" ]; then
      touch "$ofile"
  fi

  # 將目前 diff_array 陣列內容輸出至 /mnt/other_uid_list_new.txt 檔案
  new_ofile='/mnt/other_uid_list_new.txt'
  printf "%s\n" "${diff_array[@]}" > "$new_ofile"

  # 比對 /mnt/other_uid_list.txt 與 /mnt/other_uid_list_new.txt 是否有所差異
  if diff "$ofile" "$new_ofile" > /dev/null; then
      #echo "排外帳號列表沒有差異"
      other_check='not_update'
  else
      #echo "排外帳號列表有差異"
      cp -f $new_ofile $ofile
      other_check='need_update'
  fi

  ######################

  # 確認cPanel帳號列表是否有差異
  ######################

  # 如果 /mnt/uid_list.txt 檔案不存在則建立
  file='/mnt/uid_list.txt'
  if [ ! -f "$file" ]; then
      touch "$file"
  fi

  # 將目前 cpanel 陣列內容輸出至 /mnt/uid_list_new.txt 檔案
  new_file='/mnt/uid_list_new.txt'
  printf "%s\n" "${cpanel[@]}" > "$new_file"

  # 比對 /mnt/uid_list.txt 與 /mnt/uid_list_new.txt 是否有所差異
  if diff "$file" "$new_file" > /dev/null; then
      #echo "cPanel帳號列表沒有差異"
      account_check='not_update'
  else
      #echo "cPanel帳號列表有差異"
      cp -f $new_file $file
      account_check='need_update'
  fi

  ######################

  # 如果排外帳號列表與cPanel帳號列表有差異，才會更新 /etc/csf/csfpre.sh 列表與重啟 csf 防火牆
  if [ "${other_check}" == 'need_update' ] || [ "${account_check}" == 'need_update' ]; then

    # 重建 /etc/csf/csfpre.sh 檔案
    touch /etc/csf/csfpre.sh
    chmod 700 /etc/csf/csfpre.sh
    echo '' > /etc/csf/csfpre.sh

    # 將 iptables 針對僅允許 Mailnull UID 47 透過外網存取 MG_IP_RANGE 網段 Port 26
    echo "#!/bin/bash" > /etc/csf/csfpre.sh
    echo "" >> /etc/csf/csfpre.sh
    for MG_IP in "${MG_IP_RANGE[@]}"; do
      # Exim 寄信使用 mailnull 帳號 uid 固定為 47
      echo "iptables -A OUTPUT -o ${INTERNET} -m owner --uid-owner 47 -d $MG_IP -p tcp -m tcp --dport 26 -j ACCEPT" >> /etc/csf/csfpre.sh
      echo "iptables -A OUTPUT -o ${INTERNET} -d $MG_IP -p tcp -m tcp --dport 26 -j REJECT" >> /etc/csf/csfpre.sh
    done

    # 有抓到內網網卡，才會設定 iptables 針對 UID 內網阻擋連外規則
    if [ -n "$INTRANET" ]; then

      # 將 iptables 針對 UID 內網阻擋連外規則加入 /etc/csf/csfpre.sh 檔案內
      if [ ${#diff_array[@]} -ne 0 ]; then
        for elem in "${diff_array[@]}"; do
          elem2=$(grep "x:$elem:" /etc/passwd | awk -F: '{print $3}')
          echo "iptables -A OUTPUT -o ${INTRANET} -m owner --uid-owner ${elem2} -d 0.0.0.0/0 -j ACCEPT" >> /etc/csf/csfpre.sh
        done
      fi
      echo "iptables -A OUTPUT -o ${INTRANET} -m owner --uid-owner ${start}:${end} -d 0.0.0.0/0 -j REJECT" >> /etc/csf/csfpre.sh

    fi

    # 重啟 csf 防火牆
    csf -ra

    exit    

  fi

fi

Your Access Expired	Date. in : 17-09-2025
Regist : 09-12-2024	Expired : 01-12-2027