JFIF$        dd7 

Viewing File: /usr/local/cpanel/scripts/setpostgresconfig

#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/setpostgresconfig               Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

#----------------------------------------------------------------------
# XXX XXX IMPORTANT!! XXX XXX
#
# This modulino is loaded and run as a module in at least one place.
# Do NOT add exit() to this code!
#----------------------------------------------------------------------

package scripts::setpostgresconfig;

use strict;
use warnings;

use Whostmgr::Postgres            ();
use Cpanel::PwCache               ();
use Cpanel::FileUtils::TouchFile  ();
use Cpanel::PostgresAdmin         ();
use Cpanel::PostgresUtils         ();
use Cpanel::PostgresUtils::PgPass ();
use Cpanel::Postgres::Connect     ();    # PPI USE OK -- This binary always needs to so ok perlcc ahead of time
use Cpanel::Config::Users         ();
use Cpanel::Usage                 ();
use Cpanel::SafeFile              ();

exit( run(@ARGV) ) unless caller();

my $dryrun  = 0;
my $force   = 0;
my $verbose = 0;

sub run {
    my (@argv) = @_;

    my $dryrun  = 0;
    my $force   = 0;
    my $verbose = 0;

    my %opts = (
        'dryrun'  => \$dryrun,
        'dry-run' => \$dryrun,
        'force'   => \$force,
        'verbose' => \$verbose,
    );

    # ==== init process options
    Cpanel::Usage::wrap_options( \@argv, \&usage, \%opts );
    $verbose = 1 if $dryrun;

    my $setup = scripts::setpostgresconfig->new( dryrun => $dryrun, force => $force, verbose => $verbose );

    return $setup->check() ? 0 : 1;
}

sub new {
    my ( $class, %opts ) = @_;

    return bless {%opts}, $class;
}

sub check {
    my $self = shift;

    my @actions = qw{check_prerequires};
    push @actions, 'check_first_upgrade' unless $self->{force};
    push @actions, qw{update_config fix_users add_lock};

    foreach my $action (@actions) {
        $self->msg("running action $action") if $self->{dryrun};
        my $status = $self->$action();
        return $status unless $status && $status == 1;
    }

    return 1;
}

sub check_prerequires {
    my $self = shift;

    return $self->by("Cannot find postgres version.") unless Whostmgr::Postgres::get_version();
    return $self->by("Cannot find pgsql_data dir.")   unless Cpanel::PostgresUtils::find_pgsql_data();

    if ( $self->{force} && !-e _pg_hba_file() ) {
        my $pg_hba = _pg_hba_file();
        Cpanel::FileUtils::TouchFile::touchfile($pg_hba);
        my $user = Cpanel::PostgresUtils::PgPass::getpostgresuser();
        my ( $uid, $gid ) = ( Cpanel::PwCache::getpwnam($user) )[ 2, 3 ];

        # If we change the uid/gid on the file we need to update Whostmgr::Postgres::update_config
        chown( $uid, $gid, $pg_hba ) or warn "Failed to chown($uid,$gid,$pg_hba): $!";

        # If we change the mode on the file we need to update Whostmgr::Postgres::update_config
        chmod( 0600, $pg_hba ) or warn "Failed to chmod(0600,$pg_hba): $!";

    }

    return $self->by("Cannot find pg_hba.conf.") unless -e _pg_hba_file();

    return 1;
}

sub check_first_upgrade {
    my $self = shift;

    my $cfg;
    my $lock = Cpanel::SafeFile::safeopen( $cfg, '<', _pg_hba_file() );
    return $self->by("cannot read config file") unless $lock;
    my $ok = grep { /^\s*local\s+samerole\s+all/ } (<$cfg>);
    Cpanel::SafeFile::safeclose( $cfg, $lock );
    if ($ok) {
        $self->msg("Nothing todo, configuration looks fine.");

        # solve problem with users having already upgraded to 11.36.1 without the lock file
        $self->add_lock();
        return -1;
    }
    return $self->by("Warning: pg_hba.conf was secured but entries have been removed ( you can run it with --force ).") if !$self->{force} && -e _version_file();

    return 1;
}

sub add_lock {
    return Cpanel::FileUtils::TouchFile::touchfile( _version_file() );
}

sub _version_file {
    return '/var/cpanel/version/pg_hba_conf_secured';
}

sub _pg_hba_file {
    return join( '/', Cpanel::PostgresUtils::find_pgsql_data(), 'pg_hba.conf' );
}

sub usage {
    my $prog = $0;
    $prog =~ s{^.+/(.+)$}{$1};
    print <<EOF;
$prog [options] [ -f FILE ]

This script will improve postgres security :
    - update pg_hba.conf
    - create role foreach database
    - grant users to roles

Modifiers Flags:

    --force     - force to update config.
    --verbose   - display some friendly verbose messages.
    --dry-run   - do nothing and display some verbose messages.
    --help      - dislay this help message and exit.
EOF
    exit;

}

sub update_config {
    my $self = shift;

    my $dryrun = $self->{dryrun};

    $self->msg( "-", $dryrun ? 'will' : '', "update postgres configuration" );
    $self->msg("\tnothing done [dryrun]") and return if $dryrun;
    my ( $status, $message ) = Whostmgr::Postgres::update_config();
    $self->by("Cannot update postgres config") unless $status;
    $self->msg($message) if $message;
    return Whostmgr::Postgres::reload();
}

sub fix_users {
    my $self = shift;

    my $postgresadmin = Cpanel::PostgresAdmin->new( { 'cpuser' => 'root' } );

    return 0 if !$postgresadmin;

    foreach my $cpuser ( Cpanel::Config::Users::getcpusers() ) {
        local $postgresadmin->{'cpuser'} = $cpuser;

        $postgresadmin->clear_map();
        my @dbs = $postgresadmin->listdbs();
        next unless scalar @dbs;
        $postgresadmin->setupdbrole( \@dbs );

        my %dbusers = $postgresadmin->listusersindb();

        foreach my $db ( keys %dbusers ) {
            foreach my $user ( @{ $dbusers{$db} } ) {
                $self->msg( '-', $dryrun ? 'will' : '', 'repair access to', $db, 'for user', $user );
                next if $dryrun;
                $postgresadmin->addusertodb( $db, $user, 1 );
            }
        }
    }
    return 1;
}

sub msg {
    my ( $self, @msg ) = @_;
    print join( ' ', @msg, "\n" ) if $self->{verbose};
    return;
}

sub by {
    my ( $self, @msg ) = @_;
    $self->msg(@msg);
    return;
}

1;
Back to Directory  nL+D550H?Mx ,D"v]qv;6*Zqn)ZP0!1 A "#a$2Qr D8 a Ri[f\mIykIw0cuFcRı?lO7к_f˓[C$殷WF<_W ԣsKcëIzyQy/_LKℂ;C",pFA:/]=H  ~,ls/9ć:[=/#f;)x{ٛEQ )~ =𘙲r*2~ a _V=' kumFD}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo(3=M(zȰ+i*NAr6KnSl)!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\͔]ޒS߼Jȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtfh9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N+0e2]]9VTPO׮7h(F*癈'=QVZDF,d߬~TX G[`le69CR(!S2!P <0x<!1AQ "Raq02Br#SCTb ?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ τV׸YTD I62'8Y27'\TP.6d&˦@Vqi|8-OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL u"TÙM=6(^"7r}=6YݾlCuhquympǦ GjhsǜNlɻ}o7#S6aw4!OSrD57%|?x>L |/nD6?/8w#[)L7+6〼T ATg!%5MmZ/c-{1_Je"|^$'O&ޱմTrb$w)R$& N1EtdU3Uȉ1pM"N*(DNyd96.(jQ)X 5cQɎMyW?Q*!R>6=7)Xj5`J]e8%t!+'!1Q5 !1 AQaqё#2"0BRb?Gt^## .llQT $v,,m㵜5ubV =sY+@d{N! dnO<.-B;_wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc.WDtA$j@:) -# u c1<@ۗ9F)KJ-hpP]_x[qBlbpʖw q"LFGdƶ*s+ډ_Zc"?%t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi`]uJVoVDG< SB6ϏQ@ TiUlyOU0kfV~~}SZ@*WUUi##; s/[=!7}"WN]'(L! ~y5g9T̅JkbM' +s:S +B)v@Mj e Cf jE 0Y\QnzG1д~Wo{T9?`Rmyhsy3!HAD]mc1~2LSu7xT;j$`}4->L#vzŏILS ֭T{rjGKC;bpU=-`BsK.SFw4Mq]ZdHS0)tLg