Admin

name	type	size	perms	modified	actions
[parent directory]
include/	dir	-	0755	2026-08-06 17:56:08
didyouknow	file	4,649 B	0644	2026-08-06 17:55:18	edit
ssp	file	12,324 B	0775	2026-08-06 17:56:33	edit

editing: ssp

#!/usr/bin/env bash

# Flow chart:
# 1. Call /admin/tests/include/detectos
# 2. If cpanel call https://ssp.cpanel.net/ssp (unless run with fast) and /admin/configs/ssp
# 3. If kvm call /scripts/check_common_problems
# 4. If directadmin call /admin/storage/tests/ssp
# 5. All systems then call quicksecurityscan, forwardreverse, disk
# 6. If mailbaby call /admin/mb/restart_rspamd
# 7. If webuzo call /admin/webuzo/ssp

echo

if [[ -f /admin/includes/common_bash_functions ]]; then
    source /admin/includes/common_bash_functions
fi

if ! command -v dosleep >/dev/null 2>&1; then
    dosleep() { sleep 1; }
fi

if [[ -z "${COLORS:-}" ]]; then
    cyan=$(tput setaf 6 2>/dev/null || echo '')
    normal=$(tput sgr0 2>/dev/null || echo '')
    green=$(tput setaf 2 2>/dev/null || echo '')
    red=$(tput setaf 1 2>/dev/null || echo '')
fi

if [[ -x /usr/bin/shuf ]] && [[ -f /admin/tests/didyouknow ]]; then
    echo "Random lesson:"
    shuf -n 1 /admin/tests/didyouknow
    echo
    sleep 1
fi

# ==========================================
# Mailbaby / FreeBSD Early Exit
# ==========================================
if [[ -f /etc/master.passwd ]]; then
    if [[ -x /usr/bin/uname ]]; then
        uname -npr
    else
        echo "  * NOTE: missing /usr/bin/uname"
        dosleep
    fi

# Get the total amount of RAM in bytes
    total_ram=$(sysctl -n hw.physmem 2>/dev/null || echo 0)

if [[ -x /usr/bin/bc && "$total_ram" -gt 0 ]]; then
        human_readable_ram=$(echo "$total_ram / 1024^3" | bc)
        echo "Total RAM: ${human_readable_ram} GB"
    else
        echo "Total RAM: ${total_ram}"
        echo "  * NOTE: missing /usr/bin/bc or invalid RAM"
        sleep 1
    fi

virt=$(sysctl -n hw.hv_vendor 2>/dev/null || true)
    echo -n "System is"

if [[ "$virt" == "KVMKVMKVM" ]]; then
        echo " KVM"
        echo
    else
        echo " Bare metal"
        echo

if [[ -x /sbin/zpool ]]; then
            zpool status -x
        fi

if [[ -f /var/run/dmesg.boot ]]; then
            fuckqvo=$(grep -E 'ada[0-9]|da[0-9]' /var/run/dmesg.boot | grep QVO || true)
            if [[ -n "$fuckqvo" ]]; then
                echo "  * DUDE QVO DRIVES DETECTED"
                printf "%s\n" "$fuckqvo"
                echo
                sleep 1
            fi
        else
            echo "  * Note: FreeBSD missing /var/run/dmesg.boot"
        fi
    fi
    sleep 1

checkataerrors=$(dmesg | grep -E "ATA Status Error|I/O error" | tail -n 5 || true)
    if [[ -n "$checkataerrors" ]]; then
        echo "  * ATA/IO ERRORS detected"
        printf "%s\n" "$checkataerrors"
        echo
        sleep 1
    fi

if [[ -d /var/service/zone-mta ]] && [[ -x /admin/mb/restart_rspamd ]]; then
        /admin/mb/restart_rspamd c
    fi

# No further tests for FreeBSD
    echo
    exit 0
fi

# ==========================================
# Generic OS & Control Panel Handling
# ==========================================
if [[ -x /admin/tests/include/detectos ]]; then
    /admin/tests/include/detectos
fi

# cPanel
if [[ -d /usr/local/cpanel ]]; then
    if [[ "${1:-}" != "cpanelssp" ]]; then
        echo "Skipping cpanel: to run call /admin/tests/ssp cpanelssp"
    else
        echo "Call /admin/tests/ssp fast - to skip cpanel ssp script"
        sleep 1
        
        # Security Note: Piping external curl directly to perl is an RCE risk if DNS/TLS is compromised.
        REQUEST='curl -s --connect-timeout 10 --max-time 30 https://ssp.cpanel.net/ssp'

if [[ -x /usr/local/cpanel/3rdparty/bin/perl ]]; then
            $REQUEST | /usr/local/cpanel/3rdparty/bin/perl - "$@"
        elif [[ -x /usr/bin/perl ]]; then
            $REQUEST | /usr/bin/perl - "$@"
        elif [[ -x /usr/local/bin/perl ]]; then
            $REQUEST | /usr/local/bin/perl - "$@"
        else
            echo "Error: Could not find a working perl interpreter"
        fi
    fi
    [[ -x /admin/configs/ssp ]] && /admin/configs/ssp

# KVM
elif [[ -x /scripts/check_common_problems ]]; then
    if [[ -d /root/cpaneldirect ]]; then
        if [[ -d /usr/local/directadmin ]]; then
            echo " * ${cyan}WARNING${normal} /usr/local/directadmin exists on a kvm server"
            sleep 2
        fi
        /scripts/check_common_problems fast
    fi

# DirectAdmin
elif [[ -d /usr/local/directadmin ]]; then
    if [[ -x /admin/storage/tests/ssp ]]; then
        /admin/storage/tests/ssp
    fi
else
    echo "Generic server detected"
fi

# ==========================================
# Global Security & Infrastructure Checks
# ==========================================

[[ -x /admin/tests/include/quicksecurityscan ]] && /admin/tests/include/quicksecurityscan
[[ -x /admin/tests/include/forwardreverse ]] && /admin/tests/include/forwardreverse

if [[ ! -d /usr/local/directadmin ]] && [[ -x /admin/tests/include/disk ]]; then
    /admin/tests/include/disk
fi

# MySQL Issues
if [[ -f /var/lib/mysql/mysql.sock.lock && ! -S /var/lib/mysql/mysql.sock ]]; then
    echo "  ${cyan}NOTE${normal} /var/lib/mysql/mysql.sock.lock exists without mysql.sock. This lock file can prevent MySQL from starting (usually caused by a full disk)."
    echo
    sleep 2
fi

if [[ -d /var/lib/mysql ]]; then
    if ls /var/lib/mysql/binlog.* >/dev/null 2>&1; then
        echo "  ${cyan}NOTE${normal} /var/lib/mysql has binlogs."
        echo "To fix add skip-log-bin to /etc/my.cnf"
        echo
        sleep 2
    fi

mcheck=$(stat -c %a /var/lib/mysql 2>/dev/null)
    if [[ "$mcheck" == "700" ]]; then
        echo "  ${cyan}NOTE${normal} /var/lib/mysql has permissions of 700 which may cause db connection errors (seen on webuzo)."
        echo
        sleep 2
    fi
fi

# Litespeed Recaptcha Flood Check
if [[ -e /usr/local/lsws/lsrecaptcha/_recaptcha ]]; then
    captchacheck=$(ps auxw | grep -c "[/]usr/local/lsws/lsrecaptcha/_recaptcha")
    if (( captchacheck > 40 )); then
        echo "  ${cyan}NOTE${normal} There are over 40 litespeed _recaptcha processes. Potential flood detected."
        echo
        sleep 2
    fi
fi

# Webuzo
if [[ -d /usr/local/webuzo ]] && [[ -x /admin/webuzo/ssp ]]; then
    /admin/webuzo/ssp
fi

# CSF ICMP Ratelimit Check
if [[ -f /etc/csf/csf.conf ]]; then
    icmprate=$(awk -F'"' '/^ICMP_IN_RATE/ {print $2}' /etc/csf/csf.conf)
    if [[ -n "$icmprate" && "$icmprate" != "0" ]]; then
        echo "CSF firewall is installed and ICMP_IN_RATE is not set to zero. ICMP/ping is rate limited."
        echo "If the system is paging down and dmesg shows ICMP_IN_BLOCKED, that is the likely cause."
        echo
        sleep 2
    fi
fi

# DNS Resolver Checks
if command -v dig >/dev/null 2>&1; then
    echo "Testing root server lookup with: dig -4 +short a.root-servers.net @a.root-servers.net"
    dig -4 +short a.root-servers.net @a.root-servers.net
    echo

echo "Testing lookup of wordpress.org with: dig -4 +short wordpress.org"
    dig -4 +short wordpress.org
    echo

echo "Testing lookup of interserver.net with: dig -4 +short interserver.net @66.45.251.218"
    dig -4 +short interserver.net @66.45.251.218
    echo
    sleep 2
fi

# Screen Installation Check
if [[ -f /etc/master.passwd ]]; then
    if [[ ! -x /usr/local/bin/screen ]]; then
        echo " * ${cyan}NOTE${normal} Missing the very useful /usr/local/bin/screen."
        echo "To install use: pkg_add -r screen"
        dosleep
    fi
else
    if [[ ! -x /usr/bin/screen ]]; then
        echo -n " * ${cyan}NOTE${normal} Missing the very useful /usr/bin/screen. To install use:"
        if [[ -f /etc/debian_version ]]; then
            echo " apt install screen"
        else
            echo " yum install screen"
        fi
        dosleep
    fi
fi

# Dmesg Error Checks
if [[ -x /usr/bin/dmesg ]]; then
    segcheck=$(dmesg | grep segfault | tail -n 10 || true)
    if [[ -n "$segcheck" ]]; then
        echo " * ${cyan}WARNING${normal} Segfaults reported in dmesg (check i360.so or ioncube.so):"
        printf "%s\n" "$segcheck"
        dosleep
    fi

conntrack=$(dmesg | grep "nf_conntrack: table full, dropping packet" | tail -n 10 || true)
    if [[ -n "$conntrack" ]]; then
        echo " * ${cyan}WARNING${normal} conntrack max errors detected in dmesg. Raise conntrackmax or investigate DoS."
        printf "%s\n" "$conntrack"
        echo
        echo -n "Current setting is: "
        sysctl net.nf_conntrack_max
        echo
        echo "Example fix: sysctl net.nf_conntrack_max=1024001"
        echo "You can add net.nf_conntrack_max=1024000 to /etc/sysctl.conf and run sysctl -p"
        dosleep
    fi
fi

# OpenLiteSpeed / CyberPanel Max Children Check
if [[ -f /usr/local/lsws/logs/stderr.log ]]; then
    lswsmaxcheck=$(tac /usr/local/lsws/logs/stderr.log 2>/dev/null | grep -m 1 "please increase LSAPI_CHILDREN" || true)
    if [[ -n "$lswsmaxcheck" ]]; then
        echo " * ${cyan}WARNING${normal} /usr/local/lsws/logs/stderr.log shows PHP MAXCHILDREN has been hit (causes slowness)."
        dosleep
    fi
fi

# Malicious / Rogue Script Checks
if [[ -f /etc/cron.daily/imav-deploy.sh ]]; then
    echo " * ${cyan}WARNING${normal} /etc/cron.daily/imav-deploy.sh is an installer and should not exist in cron."
    dosleep
fi

if [[ -f /usr/bin/imunify360-agent ]]; then
    if grep -q "files.imunify360.com" /etc/hosts; then
        echo " * ${cyan}WARNING${normal} imunify360 is installed but a hardcoded /etc/hosts entry exists for files.imunify360.com."
        dosleep
    fi
fi

# CloudLinux / CageFS Checks
if [[ -e /usr/sbin/cagefsctl ]]; then
    if [[ ! -f /usr/share/lve/dbgovernor/mysqlgovernor.py ]]; then
        echo " * ${cyan}NOTE${normal} mysql governor is not installed on this cloudlinux system. Useful for killing long queries."
        dosleep
    fi

if [[ -f /etc/redhat-release ]] && [[ ! -e /usr/share/cagefs-skeleton/usr/bin/rsync ]]; then
        echo " * ${cyan}NOTE${normal} Missing rsync in cagefs."
        echo "To fix: cagefsctl --addrpm rsync; cagefsctl --force-update"
        dosleep
    fi
fi

# Fstrim Check
fstrimcheck=$(ps auxw | grep "[f]strim" || true)
if [[ -n "$fstrimcheck" ]]; then
    echo " * ${cyan}NOTE${normal} fstrim may be running. If debugging slow disk IO, this may be a cause."
    printf "%s\n" "$fstrimcheck"
    dosleep
fi

# Multiple Yum Processes
if [[ -x /usr/bin/yum ]]; then
    yumcheck=$(ps auxw | grep -c "^root.*[y]um.*up")
    if (( yumcheck > 1 )); then
        echo "  * ${cyan}WARN${normal} Multiple yum updates running simultaneously; RPM database may corrupt."
        dosleep
    fi
fi

# UFW/CSF Conflict
if [[ -f /etc/debian_version && -x /usr/sbin/csf && -x /usr/sbin/ufw ]]; then
    echo "  ${cyan}NOTE${normal} csf and ufw are both installed. This can cause odd network routing issues."
    dosleep
fi

# Plesk Checks
if [[ -d /usr/local/psa ]]; then
    if [[ -f /var/log/nginx/error.log ]]; then
        ofilescheck=$(tac /var/log/nginx/error.log 2>/dev/null | grep -m 2 -i "too many open files" || true)
        if [[ -n "$ofilescheck" ]]; then
            echo "  ${cyan}WARN${normal} /var/log/nginx/error.log shows 'too many open files'."
            echo "To fix: https://www.plesk.com/kb/support/nginx-fails-to-start-reload-on-a-plesk-server-too-many-open-files/"
            echo "/usr/local/psa/admin/sbin/websrv_ulimits --set 4096"
            echo 'grep "Max open files" /proc/$(cat /var/run/nginx.pid)/limits'
            echo
            dosleep
        fi
    fi
    echo "Checking for any plesk max php connections hit in php-fpm..."
    grep -r "server reached max_children setting" /var/log/*php*-fpm/error.log 2>/dev/null | cut -d' ' -f5 | tr -d ']' | sort | uniq -c | sort -nr
    dosleep
fi

# Crash Dump Check
if [[ -d /var/crash && ! -f /etc/master.passwd ]]; then
    if [[ -n "$(find /var/crash -mindepth 1 -print -quit 2>/dev/null)" ]]; then
        echo " * ${cyan}WARNING${normal} /var/crash is not empty. Check for potential crashes or clear old data."
    fi
fi

# Network Outbound Test
if command -v ping >/dev/null 2>&1; then
    echo "Testing network connection to mynew.interserver.net..."
    if ping -c 2 -W 5 mynew.interserver.net >/dev/null 2>&1; then
        echo " * ${green}OK${normal} Network is reachable"
    else
        echo " * ${red}CRIT${normal} Network is unreachable"
    fi
fi

exit 0

cancel