File: //usr/local/CyberCP/plogical/__pycache__/modSec.cpython-310.pyc
o
��h�j � @ s� d dl Z e j�d� d dlmZ d dlZd dlZd dlZd dl m
Z
d dl Z d dl Z d dl
Z
d dlmZ d dlmZ d dlmZ G dd � d �Zd
d � Zed krTe� dS dS )
� Nz/usr/local/CyberCP)�CyberCPLogFileWriter)�virtualHostUtilities)�
mailUtilities)�ProcessUtilities)�installUtilitiesc @ s� e Zd ZdZdZdZedd� �Zedd� �Zedd � �Z ed
d � �Z
ed d
� �Z edd� �Z edd� �Z
edd� �Zedd� �Zedd� �Zedd� �Zedd� �Zd S ) �modSecz!/home/cyberpanel/modSecInstallLogz /home/cyberpanel/tempModSecRuleszcyberpanel.netc
C s
zgt �� t�� tjkst�� tjkrd} nd} t�| �}tt j
d��}t j ||d�}W d � n1 s5w Y |dkrVtt j
d�}|�
d� |�� tj�d� W d S tt j
d�}|�
d
� |�� W dS ty� } ztj�t|�d � W Y d }~d S d }~ww ) Nz#sudo yum install ols-modsecurity -yzFsudo DEBIAN_FRONTEND=noninteractive apt-get install ols-modsecurity -y�w)�stdout� �azCan not be installed.[404]
z[Could not Install]r z ModSecurity Installed.[200]
z[installModSec])r � checkHomer � decideDistro�centos�cent8�shlex�split�openr �installLogPath�
subprocess�call�
writelines�close�loggingr � writeToFile�
BaseException�str)�command�cmd�f�resr �msg� r! �%/usr/local/CyberCP/plogical/modSec.py�
installModSec s.
�
"��zmodSec.installModSecc
C s: zwt j�tjd�} zt �| � W n
tj�d� Y d}t j�tjd�}t |��
� }|� � d}|D ]
}|� d�dkr@d} nq3|dkrSt |d �}|�
|� |�� t j�tjd
�}t j�|�sqd }t |d �} | �
|� | �� td � W d S ty� }
ztj�t|
�d
� tdt|
� � W Y d }
~
d S d }
~
ww )N� conf/modseczCModSecurity rules directory already exists. [installModSecConfigs]ag
module mod_security {
modsecurity on
modsecurity_rules `
SecDebugLogLevel 0
SecDebugLog /usr/local/lsws/logs/modsec.log
SecAuditEngine on
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts AFH
SecAuditLogType Serial
SecAuditLog /usr/local/lsws/logs/auditmodsec.log
SecRuleEngine On
`
modsecurity_rules_file /usr/local/lsws/conf/modsec/rules.conf
}
�conf/httpd_config.confFzmodule mod_security���Tza+�conf/modsec/rules.confzdSecRule ARGS "\.\./" "t:normalisePathWin,id:99999,severity:4,msg:'Drive Access' ,log,auditlog,deny"
�1,Nonez [installModSecConfigs]�0,)�os�path�joinr � Server_root�mkdirr r r r � readlines�reverse�find�writer �exists�printr r ) r+ �initialConfigs�confFile�confData�modSecConfigFlag�items�conf�
rulesFilePath� initialRules�ruler r! r! r" �installModSecConfigs4 sJ � �
� ��zmodSec.installModSecConfigsc
C s� �z/t | ��� }t�| � t�� tjkr�tj�t j
d�}t |��� }t |d�}|D ]p}|� d�dkr:|� |d � q)|� d�dkrI|� |d � q)|� d�dkrX|� |d � q)|� d
�dkrg|� |d � q)|� d �dkrv|� |d
� q)|� d�dkr�|� |d � q)|� d�dkr�|� |d � q)|� |� q)|�
� t�� td� W d S tj�t j
d�}t |��� }t |d�}|D ]c}|� d�dkr�|� |d � q�|� d�dkr�|� |d � q�|� d
�dkr�|� |d � q�|� d �dkr�|� |d � q�|� d�dk�r |� |d � q�|� d�dk�r |� |d
� q�|� |� q�|�
� t�� td� W d S t�yV } ztj�t|�d � tdt|� � W Y d }~d S d }~ww )Nr% r z modsecurity r& r zSecAuditEngine r
zSecRuleEngine � �SecDebugLogLevel� zSecAuditLogRelevantStatus � zSecAuditLogParts � zSecAuditLogType � r( zconf/modsec.confz [saveModSecConfigs]r) )r r/ r* �remover � decideServer�OLSr+ r, r r- r1 r r r �reStartLiteSpeedr4 r r r r r )�tempConfigPath�datar6 r7 r: r9 r r! r! r" �saveModSecConfigsr s�
� ��zmodSec.saveModSecConfigsc
C s� z?t tjd�} | �� }| �� t�� tjkr tj �
t j d�}ntj �
t j d�}t |d�} | �
|� | �� t�� td� W d S tyd } ztj�t|�d � tdt|� � W Y d }~d S d }~ww )N�rr' zconf/rules.confr r( z [saveModSecRules]r) )r r �
tempRulesFile�readr r rF rG r* r+ r, r r- r2 r rH r4 r r r r r )� rulesFilerJ r; r r! r! r" �saveModSecRules� s(
� ��zmodSec.saveModSecRulesc
C s` z�t �� t jkrUtj�tjd�} tj�tjd�}tj�| �r#t �
| � tj�d�r.t� d� dt j
d }t�t�|��}|dkrDW dS t�d�}|�|� |�� W dS tj�d�r`t �
d� tj�tjd �}tj�d
�rst� d
� d }t�t�|��}|dkr�W dS d | }t�t�|�� W dS ty� } ztj�t|�d
� W Y d }~dS d }~ww )Nzconf/modsec/comodor$ z
comodo.tar.gzz
wget https://z/modsec/comodo.tar.gzr
r �%/usr/local/lsws/conf/comodo_litespeedr: �cpanel_litespeed_vendorz7wget https://waf.comodo.com/api/cpanel_litespeed_vendor�!unzip cpanel_litespeed_vendor -d z [setupComodoRules])r rF rG r* r+ r, r r- r3 �shutil�rmtreerE r �
mirrorPathr r r r �tarfiler �
extractallr r r r r r )�pathTOOWASPFolder�extractLocationr �result�tarr r! r! r" �setupComodoRules� sF
���zmodSec.setupComodoRulesc
C s� z�t �� t jkrUt�� dkrtd� W d S d} tj�t j
d�}t |�� � }t |d�}|D ]}|�
d�dkr@|�| � |�|� q,|�|� q,|�� t�� td� W d S tj�d �r`t�d � tj�t j
d
�}tj�d �rst�d � d }t�t�|��}|d
kr�W dS d| }t�t�|��}d}t�t�|�� t�� td� W d S ty� } zt j � t |�d � tdt |� � W Y d }~d S d }~ww )Nr z#0, Unable to download Comodo Rules.a
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/modsecurity.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/00_Init_Initialization.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/01_Init_AppsInitialization.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/02_Global_Generic.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/03_Global_Agents.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/04_Global_Domains.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/05_Global_Backdoor.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/06_XSS_XSS.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/07_Global_Other.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/08_Bruteforce_Bruteforce.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/09_HTTP_HTTP.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/10_HTTP_HTTPDoS.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/11_HTTP_Protocol.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/12_HTTP_Request.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/13_Outgoing_FilterGen.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/14_Outgoing_FilterASP.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/15_Outgoing_FilterPHP.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/16_Outgoing_FilterSQL.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/17_Outgoing_FilterOther.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/18_Outgoing_FilterInFrame.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/19_Outgoing_FiltersEnd.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/20_PHP_PHPGen.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/21_SQL_SQLi.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/22_Apps_Joomla.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/23_Apps_JComponent.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/24_Apps_WordPress.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/25_Apps_WPPlugin.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/26_Apps_WHMCS.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/27_Apps_Drupal.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/28_Apps_OtherApps.conf
r% r �&/usr/local/lsws/conf/modsec/rules.confr& r( rQ r: rR zNwget --no-check-certificate https://waf.comodo.com/api/cpanel_litespeed_vendorr
rS z.sudo chown -R lsadm:lsadm /usr/local/lsws/confz [installComodo]r) ) r rF rG r r] r4 r* r+ r, r r- r r/ r1 r2 r r r rH r3 rT rU rE r r r r r r r r r ) �owaspRulesConfr6 r7 r: r9 rZ r r[ r r! r! r" �
installComodo sT
� ��zmodSec.installComodoc
C s zjt �� t jkr<tj�tjd�} t| �� � }t| d�}|D ]}|�
d�dkr'q |� |� q |� � t
�� td� W d S zt�d� W n ty_ } ztj�t|�d � W Y d }~nd }~ww t
�� td� W d S ty� } ztj�t|�d � td t|� � W Y d }~d S d }~ww )
Nr% r z
modsec/comodor& r( rQ z [disableComodo]z [disableComodo]r) )r rF rG r* r+ r, r r- r r/ r1 r r r rH r4 rT rU r r r r r �r6 r7 r: r9 r r! r! r" �
disableComodol s6
��
� ��zmodSec.disableComodoc
C s� z�t j�tjd�} dtj }d}t�t� |��}|dkr W dS t j�
|�r*t � |� t j�
| �r5t � | � t j�
d�r@t �
d� d}t�t� |��}|dkrQW dS d}t�t� |��}|dkrbW dS d}t�t� |��}|dkrsW dS d ||f }t�t� |��}|dkr�W dS d
||f }t�t� |��}|dkr�W dS d ||f }t�t� |��}|dkr�W dS d }td
| d�}|�|�d|�� |�� W dS ty� } ztt|�� tj�t|�d � W Y d }~dS d }~ww )Nzconf/modsec/owaspz*%s/modsec/owasp-modsecurity-crs-3.0-masterz$mkdir -p /usr/local/lsws/conf/modsecr z owasp.tar.gzzrwget https://github.com/coreruleset/coreruleset/archive/v3.3.2/master.zip -O /usr/local/lsws/conf/modsec/owasp.zipzNunzip -o /usr/local/lsws/conf/modsec/owasp.zip -d /usr/local/lsws/conf/modsec/zmmv /usr/local/lsws/conf/modsec/coreruleset-3.3.2 /usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-masterz.mv %s/crs-setup.conf.example %s/crs-setup.confztmv %s/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example %s/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.confztmv %s/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example %s/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.confaY include {pathToOWASFolderNew}/crs-setup.conf
include {pathToOWASFolderNew}/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
include {pathToOWASFolderNew}/rules/REQUEST-901-INITIALIZATION.conf
include {pathToOWASFolderNew}/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
include {pathToOWASFolderNew}/rules/REQUEST-910-IP-REPUTATION.conf
include {pathToOWASFolderNew}/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
include {pathToOWASFolderNew}/rules/REQUEST-912-DOS-PROTECTION.conf
include {pathToOWASFolderNew}/rules/REQUEST-913-SCANNER-DETECTION.conf
include {pathToOWASFolderNew}/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
include {pathToOWASFolderNew}/rules/REQUEST-921-PROTOCOL-ATTACK.conf
include {pathToOWASFolderNew}/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf
include {pathToOWASFolderNew}/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
include {pathToOWASFolderNew}/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
include {pathToOWASFolderNew}/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
include {pathToOWASFolderNew}/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
include {pathToOWASFolderNew}/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
include {pathToOWASFolderNew}/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
include {pathToOWASFolderNew}/rules/REQUEST-949-BLOCKING-EVALUATION.conf
include {pathToOWASFolderNew}/rules/RESPONSE-950-DATA-LEAKAGES.conf
include {pathToOWASFolderNew}/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
include {pathToOWASFolderNew}/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
include {pathToOWASFolderNew}/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf
include {pathToOWASFolderNew}/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf
include {pathToOWASFolderNew}/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
include {pathToOWASFolderNew}/rules/RESPONSE-980-CORRELATION.conf
include {pathToOWASFolderNew}/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
z%s/owasp-master.confr z{pathToOWASFolderNew}r
z [setupOWASPRules])r* r+ r, r r- �
vhostConfPathr r r r r3 rT rU rE r r2 �replacer r r4 r r r r )rY �pathToOWASFolderNewr r[ �contentr r r! r! r" �setupOWASPRules� sh
�
���zmodSec.setupOWASPRulesc
C sX z�t �� dkrtd� W d S t�� tjkrKd} tj�t j
d�}t |�� � }t |d�}|D ]}|�
d�dkr@|�|� |�| � q,|�|� q,|�� n1tj�d�}t |�� � }t |d�}|D ]}|�
d �dkrr|�|� |�d
� q^|�|� q^|�� t�� td � W d S ty� } ztj�t|�d � td
t|� � W Y d }~d S d }~ww )Nr z"0, Unable to download OWASP Rules.zg
modsecurity_rules_file /usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/owasp-master.conf
r% r r^ r& � /usr/local/lsws/conf/modsec.confz/conf/comodo_litespeed/zLInclude /usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/*.conf
r( z [installOWASP]r) )r rg r4 r rF rG r* r+ r, r r- r r/ r1 r r2 r r rH r r r r r )r_ r6 r7 r: r9 r r! r! r" � installOWASP� sF
� ��zmodSec.installOWASPc
C s& zmt �� t jkr<tj�tjd�} t| �� � }t| d�}|D ]}|�
d�dkr'q |� |� q |� � t
�� td� W d S tj�d�} t| �� � }t| d�}|D ]}|�
d�dkrYqO|� |� qO|� � t
�� td� W d S ty� } ztj�t|�d � tdt|� � W Y d }~d S d }~ww ) Nr% r z modsec/owaspr& r( rh z [disableOWASP]r) )r rF rG r* r+ r, r r- r r/ r1 r r r rH r4 r r r r r ra r! r! r" � disableOWASP# s:
� ��zmodSec.disableOWASPc
C s� zBt j�d�}t|��� }t|d�}|D ] }|�d| �dkr.|�| �dkr.|�d| � q|�|� q|�� t �
� t d� W d S t yg } zt
j�t|�d � t dt|� � W Y d }~d S d }~ww ) N�N/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/owasp-master.confr �modsec/r& �#r( z [disableRuleFile]r) )r* r+ r, r r/ r1 r2 r r r rH r4 r r r r r ��fileName�packNamer6 r7 r: r9 r r! r! r" �disableRuleFileJ s$
� ��zmodSec.disableRuleFilec
C s� zCt j�d�}t|��� }t|d�}|D ] }|�d| �dkr/|�| �dkr/|�|�d�� q|�|� q|� � t
� � t d� W d S t
yh } ztj�t|�d � t dt|� � W Y d }~d S d }~ww ) Nrk r rl r& rm r( z [enableRuleFile]r) )r* r+ r, r r/ r1 r2 �lstripr r r rH r4 r r r r r rn r! r! r" �enableRuleFilec s$
� ��zmodSec.enableRuleFileN)�__name__�
__module__� __qualname__r rM rV � staticmethodr# r> rK rP r] r` rb rg ri rj rq rs r! r! r! r" r s8
=
T
0
Y
"
_
3
&
r c C sl t jdd�} | jddd� | jddd� | jdd d� | jd
d d� | �� }|jd kr1t�� d S |jd
kr<t�� d S |jdkrIt�|j � d S |jdkrTt�
� d S |jdkr_t� � d S |jdkrjt� � d S |jdkrut�
� d S |jdkr�t�� d S |jdkr�t�� d S |jdkr�t�� d S |jdkr�t�|j|j� d S |jdkr�t�|j|j� d S d S )NzCyberPanel Installer)� description�functionz Specific a function to call!)�helpz--tempConfigPathz&Temporary path to configurations data!z
--packNamezModSecurity supplier name!z
--fileNamez Filename to enable or disable!r> r# rK rP rg ri rj r] r` rb rq rs )�argparse�ArgumentParser� add_argument�
parse_argsry r r> r# rK rI rP rg ri rj r] r` rb rq ro rp rs )�parser�argsr! r! r" �main� s>
�r� �__main__)�sysr+ �append�plogicalr r r r r{ � plogical.virtualHostUtilitiesr r* rW rT �plogical.mailUtilitiesr �plogical.processUtilitiesr �plogical.installUtilitiesr r r� rt r! r! r! r" �<module> s. $
�