Admin

name	type	size	perms	modified	actions
[parent directory]
cpanel/	dir	-	0755	2026-05-15 08:54:00
ssp	file	12,931 B	0775	2026-08-06 17:55:45	edit
upcp	file	1,351 B	0755	2026-05-15 12:28:05	edit

editing: ssp

#!/usr/bin/env bash

# Last modified 2026-06-04
# cPanel system status probe
# Checks for common config errors and problems

if [ -f /admin/includes/common_bash_functions ]; then
    source /admin/includes/common_bash_functions
fi

# Fallback for dosleep if not defined in common_bash_functions
if ! type dosleep >/dev/null 2>&1; then
    dosleep() { sleep 1; }
fi

# Color setup fallback
if [ "$COLORS" = "" ]; then
    red=$(tput setaf 1)
    blue=$(tput setaf 4)
    green=$(tput setaf 2)
    cyan=$(tput setaf 6)
    yellow=$(tput setaf 3)
    normal=$(tput sgr0)
fi

# Action items collector — printed as summary at the end
ISSUES=()
issue() { ISSUES+=("$1"); }

note()  { echo " * ${cyan}NOTE${normal}    $*"; }
warn()  { echo " * ${yellow}WARN${normal}    $*"; issue "WARN:  $*"; }
crit()  { echo " * ${red}CRIT${normal}    $*"; issue "CRIT:  $*"; }
ok()    { echo " * ${green}OK${normal}      $*"; }
info()  { echo " * ${blue}INFO${normal}    $*"; }

# -----------------------------------------------------------------------

if [ ! -d /usr/local/cpanel ]; then
    echo 'Missing /usr/local/cpanel'
    exit
fi

# Debug kernel check
kernelcheck=$(uname -r | grep debug)
if [ -n "$kernelcheck" ]; then
    warn "Running unsupported debug kernel: $kernelcheck"
    dosleep
fi

# mod_suexec (skip on litespeed)
if [ ! -d /usr/local/lsws ]; then
    if [ ! -e /usr/lib64/apache2/modules/mod_suexec.so ]; then
        warn "Missing ea-apache24-mod_suexec — may cause permission problems on sites"
        dosleep
    fi
fi

# CloudLinux / CageFS checks
if [ -e /usr/sbin/cagefsctl ]; then
    lvecheck=$(lsmod | awk '/^kmodlve/ {print $1}')
    if [ "$lvecheck" != "kmodlve" ]; then
        warn "cagefsctl detected without kmodlve loaded — PHP may show 503 errors"
        dosleep
    fi

if [ -x /usr/bin/cldiag ]; then
        if ! mphpcheck=$(/usr/bin/cldiag --check-multi-php); then
            printf "%s\n\n" "$mphpcheck"
        fi

if ! cagefsccheck=$(/usr/bin/cldiag --check-cagefs); then
            printf "%s\n\n" "$cagefsccheck"
        fi
    fi

if [ ! -f /etc/cl.selector/symlinks.rules ]; then
        note "Missing /etc/cl.selector/symlinks.rules — may cause mysqli errors with alt-php"
        echo "      See: https://wiki.interserver.net/index.php/Alt-php_modules_fix_like_pdo"
        dosleep
    fi
fi

# proftpd vs pureftpd
if [ -e /usr/sbin/imunify360-php-daemon ]; then
    if [ -e /usr/sbin/proftpd ]; then
        note "proftpd is installed — pureftpd is preferred (has Imunify360 support)"
        dosleep
    fi
fi

# iXhash spam filter
if [ ! -e /etc/mail/spamassassin/iXhash.pm ]; then
    warn "Missing /etc/mail/spamassassin/iXhash.pm"
    echo "      Fix: ${green}/admin/configs/cpanel/install_ix${normal}"
    dosleep
fi

# MySQL root config
if [ ! -f /root/.my.cnf ]; then
    note "Missing /root/.my.cnf"
else
    remotehosts=$(mysqladmin processlist 2>/dev/null | awk '$6 ~ /:/ && $6 !~ /localhost/ {split($6,a,":"); print a[1]}' | sort | uniq)
    if [ -n "$remotehosts" ]; then
        warn "Remote hosts connected to MySQL — verify these are expected:"
        echo "$remotehosts" | sed 's/^/        /'
        dosleep
    fi
fi

# MariaDB migrated config file
if [ -f /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf ]; then
    warn "MariaDB migrated-from-my.cnf-settings.conf exists with suboptimal open files limit"
    echo "      See: https://wiki.interserver.net/index.php/Mysql_openfiles"
    echo "      Fix:"
    echo "        mv /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf \\"
    echo "           /etc/systemd/system/mariadb.service.d/my.cnf-settings.conf"
    echo "        # Set LimitNOFILE=1048570 in that file, then:"
    echo "        systemctl daemon-reload && systemctl restart mysqld"
    echo "        # Verify: cat /proc/\$(pidof mysqld)/limits | grep files"
    [ -f /admin/tests/mysqltuner.pl ] && echo "      More info: /admin/tests/mysqltuner.pl"
    echo
    dosleep
fi

# Exim flood checks
if [ -f /var/log/exim_mainlog ]; then
    echo
    info "Checking Exim for connection floods..."
    eximconns=$(tail -n 100000 /var/log/exim_mainlog | tac | grep -m 5 "refused: too many connections" | tac)
    if [ -n "$eximconns" ]; then
        warn "Exim: too many connections being refused"
        echo "$eximconns" | sed 's/^/        /'
    else
        ok "Exim: no connection flood detected"
    fi

echo
    info "Checking for accounts hitting max emails per hour..."
    eximhour=$(tail -n 5000 /var/log/exim_mainlog | LC_ALL=C awk 'tolower($0) ~ /enforce_mail_permissions/ {print $6}' | LC_ALL=C cut -d$ -f2 | LC_ALL=C cut -d$ -f1 | sort | uniq -c | sort -nr | head -n 10 | sed 's/^/        /')
    if [ -n "$eximhour" ]; then
        warn "Accounts hitting hourly email limit:"
        echo "$eximhour"
    else
        ok "Exim: no hourly limit hits found"
    fi
    echo
    dosleep
fi

# JetBackup restore running
if [ -d /usr/local/jetapps ]; then
    jbrestore=$(ps auxw | grep "[j]etbackup --run restore")
    if [ -n "$jbrestore" ]; then
        warn "JetBackup restore is currently running — may explain slow disk I/O"
        echo "$jbrestore" | sed 's/^/        /'
        dosleep
    fi
fi

# cPanel PHP-FPM max children
if [ -f /usr/local/cpanel/logs/php-fpm/error.log ]; then
    maxcpanelfpm=$(tail -n 1000 /usr/local/cpanel/logs/php-fpm/error.log | tac | grep -m 1 "reached max_children" | tac)
    if [ -n "$maxcpanelfpm" ]; then
        warn "cPanel PHP-FPM hit max_children — may cause webmail login spinning"
        echo "      See: https://support.cpanel.net/hc/en-us/articles/360049982694"
        dosleep
    fi
fi

# EA PHP-FPM max children (per version)
echo
info "Checking PHP-FPM max_children per EA version..."
found_fpm_issue=0
for phpdir in /opt/cpanel/ea-php*/; do
    [ -d "$phpdir" ] || continue
    phpver=$(basename "$phpdir")
    logfile="/opt/cpanel/${phpver}/root/usr/var/log/php-fpm/error.log"
    if [ -f "$logfile" ]; then
        result=$(tac "$logfile" 2>/dev/null | grep -m 2 max_children | tac)
        if [ -n "$result" ]; then
            warn "PHP-FPM max_children hit for $phpver"
            echo "$result" | sed 's/^/        /'
            found_fpm_issue=1
        fi
    fi
done
[ "$found_fpm_issue" = "0" ] && ok "PHP-FPM: no max_children issues found"
echo

# pkgacct running
pkgacct=$(ps auxw | grep "[p]kgacct")
if [ -n "$pkgacct" ]; then
    note "pkgacct is running — may cause high disk I/O"
    echo "$pkgacct" | sed 's/^/        /'
    dosleep
fi

# rsyslog missing
if [ ! -e /usr/sbin/rsyslogd ]; then
    warn "rsyslog not installed — /var/log/maillog or similar may be empty"
    dosleep
fi

# Dovecot mmap OOM errors
if [ -f /var/log/maillog ]; then
    mmapdovecotcheck=$(tail -n 50000 /var/log/maillog | tac | grep -m 5 "mmap(size" | tac)
    if [ -n "$mmapdovecotcheck" ]; then
        warn "Dovecot out-of-memory mmap errors — large mailboxes suspected"
        echo "$mmapdovecotcheck" | sed 's/^/        /'
        echo "      Fix: WHM → Mail Server Configuration → raise Process Memory Limit"
        dosleep
    fi

if [ -e /usr/sbin/imunify360-pam ]; then
        multipasscheck=$(tail -n 10000 /var/log/maillog | tac | grep -m 1 "Multiple password values not supported" | tac)
        if [ -n "$multipasscheck" ]; then
            warn "Imunify360 PAM brute-force protection causing email login failures"
            echo "      See: https://support.cpanel.net/hc/en-us/articles/1500006551182"
            echo "      Fix: imunify360-pam set-dovecot disabled"
            echo "           imunify360-agent config update '{\"PAM\": {\"exim_dovecot_protection\": false}}'"
            dosleep
        fi
    fi
fi

# PHP opcache
opcache=$(php -v 2>/dev/null | grep -i opcache)
if [ -z "$opcache" ]; then
    phpver_short=$(php -v 2>/dev/null | awk 'NR==1 {split($2,a,"."); print a[1] a[2]}')
    warn "PHP opcache not loaded — performance impact likely"
    echo "      Fix: yum install ea-php${phpver_short}-php-opcache"
    dosleep
fi

# PDO/mysqlnd checks
for pdover in 81 82; do
    if [ ! -e "/opt/cpanel/ea-php${pdover}/root/usr/lib64/php/modules/pdo_mysql.so" ]; then
        warn "Missing ea-php${pdover} pdo_mysql / mysqlnd"
        echo "      Fix: yum -y install ea-php${pdover}-php-pdo ea-php${pdover}-php-mysqlnd"
        dosleep
    fi
done

# mod_qos
if [ -f /etc/apache2/conf.d/qos.conf ]; then
    note "mod_qos is installed — random timeouts? This may be the cause"
    echo "      Fix: yum remove ea-apache24-mod-qos"
    echo
fi

# Legacy WP toolkit
if [ -e /usr/local/cpanel/Cpanel/WordPress.pm ]; then
    note "Legacy WordPress toolkit is installed"
    echo "      Fix: yum remove cpanel-wordpress-instance-manager-plugin"
    dosleep
fi

# Cloudflare plugin
if [ -d /usr/local/cpanel/base/frontend/paper_lantern/cloudflare ]; then
    warn "Cloudflare cPanel plugin is installed and should be removed"
    dosleep
fi

# FleetSSL
if [ -f /var/cpanel/perl/Cpanel/SSL/Auto/Provider/FleetSSLProvider.pm ]; then
    warn "FleetSSL detected — may break SSL or upcp"
    echo "      Fix: unlink /var/cpanel/perl/Cpanel/SSL/Auto/Provider/FleetSSLProvider.pm"
    [ -f /etc/chkserv.d/letsencrypt-cpanel ] && echo "           unlink /etc/chkserv.d/letsencrypt-cpanel && /scripts/restartsrv_chkservd"
    [ -f /etc/systemd/system/multi-user.target.wants/letsencrypt-cpanel.service ] && \
        echo "           systemctl disable letsencrypt-cpanel.service"
    echo "      See: https://support.cpanel.net/hc/en-us/articles/9517265303831"
    echo
fi

# suphp check (slow, deprecated)
if [ -x /usr/local/cpanel/bin/rebuild_phpconf ]; then
    if [ ! -d /usr/local/lsws ]; then
        suphpcheck=$(/usr/local/cpanel/bin/rebuild_phpconf --current | grep "suphp$")
        if [ -n "$suphpcheck" ]; then
            warn "One or more PHP versions using suphp (deprecated, slow)"
            echo "$suphpcheck" | sed 's/^/        /'
            note "Consider switching to mod_lsphp for better performance"
            dosleep
        fi
    fi
fi

# Invalid files in /var/cpanel/users
if [ -d /var/cpanel/users ]; then
    dotfilecheck=$(find /var/cpanel/users -maxdepth 1 -type f -name ".*" -o -name "_*")
    if [ -n "$dotfilecheck" ]; then
        warn "Invalid filenames (dots/underscores) in /var/cpanel/users:"
        echo "$dotfilecheck" | sed 's/^/        /'
        dosleep
    fi
else
    crit "Missing /var/cpanel/users on a cPanel server"
    dosleep
fi

# FleetSSL (opt path variant)
if [ -e /opt/fleetssl-cpanel/letsencrypt.live.cgi ]; then
    warn "FleetSSL (opt path) is installed — should NOT be on webhosting servers"
    echo "      Fix: yum remove letsencrypt-cpanel"
    dosleep
fi

# PostgreSQL / cPanel calendar max connections
if [ -f /opt/cpanel-ccs/data/Logs/error.log ]; then
    pgsqlmaxcon=$(tac /opt/cpanel-ccs/data/Logs/error.log | grep -m 1 'too many clients already' | tac)
    if [ -n "$pgsqlmaxcon" ]; then
        crit "PostgreSQL (cPanel calendar) hitting max connections — will break webmail logins"
        echo "      See: https://support.cpanel.net/hc/en-us/articles/4415100519575"
        dosleep
    fi
fi

# Port 2091 in CSF
if [ -f /etc/csf/csf.conf ]; then
    checkport2091=$(grep 2091 /etc/csf/csf.conf)
    if [ -z "$checkport2091" ]; then
        warn "Port 2091 not open in /etc/csf/csf.conf — will cause calendar sync issues"
        dosleep
    fi
fi

# LiteSpeed update cron
if [ ! -e /etc/cron.daily/updatelitespeed.sh ]; then
    note "Missing /etc/cron.daily/updatelitespeed.sh (internal webhosting only)"
    echo "      Fix: ln -s /admin/updatelitespeed.sh /etc/cron.daily/updatelitespeed.sh"
    echo
    dosleep
fi

# WordPress API connectivity
if [ -x /usr/bin/ping ]; then
    echo
    info "Testing api.wordpress.org connectivity..."
    if /usr/bin/ping -c 2 -W 5 api.wordpress.org >/dev/null 2>&1; then
        ok "api.wordpress.org is reachable"
    else
        warn "api.wordpress.org is unreachable — will break WP Toolkit plugin updates"
    fi
    echo
fi

# -----------------------------------------------------------------------
# Summary
# -----------------------------------------------------------------------
echo
echo "${cyan}======================================================${normal}"
echo "${cyan}  SSP SUMMARY${normal}"
echo "${cyan}======================================================${normal}"

if [ ${#ISSUES[@]} -eq 0 ]; then
    echo " ${green}No actionable issues found.${normal}"
else
    for item in "${ISSUES[@]}"; do
        # color the prefix
        case "$item" in
            CRIT:*) echo "  ${red}${item}${normal}" ;;
            WARN:*) echo "  ${yellow}${item}${normal}" ;;
            *)      echo "  ${cyan}${item}${normal}" ;;
        esac
    done
fi

echo "${cyan}======================================================${normal}"
echo

cancel