Nemcio/CyberPanel
1
0
Fork 0
mirror of https://github.com/usmannasir/cyberpanel.git synced 2025-11-07 13:56:01 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
b77c87a2d1228a3417e58a934f84a170c86368bd
CyberPanel/plogical/sslUtilities.py

694 lines
33 KiB
Python
Raw Normal View History

prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
import requests
bug fix: encodings and imports
2019-12-15 13:30:40 +05:00
from plogical import CyberCPLogFileWriter as logging
Initial Commit
2017-10-24 19:16:36 +05:00
import os
import shlex
import subprocess
suExec, Filemanager and bug Fixes.
2017-12-09 22:30:10 +05:00
import socket
lsws switch
2018-11-09 22:01:28 +05:00
from plogical.processUtilities import ProcessUtilities
bug fix to backups and manage services
2019-07-18 14:08:00 +05:00
try:
from websiteFunctions.models import ChildDomains, Websites
except:
pass
dynamically detect php version in ref to: https://community.cyberpanel.net/t/php-8-2-in-cyberpanel/49703
2023-11-26 14:32:35 +04:00
from plogical.acl import ACLManager
Initial Commit
2017-10-24 19:16:36 +05:00
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
Initial Commit
2017-10-24 19:16:36 +05:00
class sslUtilities:
suExec, Filemanager and bug Fixes.
2017-12-09 22:30:10 +05:00
Server_root = "/usr/local/lsws"
vhost create: redis
2020-01-12 13:50:20 +05:00
redisConf = '/usr/local/lsws/conf/dvhost_redis.conf'
suExec, Filemanager and bug Fixes.
2017-12-09 22:30:10 +05:00
add improvments for ssl
2024-01-24 10:50:52 +05:00
DONT_ISSUE = 0
ISSUE_SELFSIGNED = 1
ISSUE_SSL = 2
@staticmethod
def getDomainsCovered(cert_path):
try:
from cryptography import x509
from cryptography.hazmat.backends import default_backend
with open(cert_path, 'rb') as cert_file:
cert_data = cert_file.read()
cert = x509.load_pem_x509_certificate(cert_data, default_backend())
# Check for the Subject Alternative Name (SAN) extension
san_extension = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
if san_extension:
# Extract and print the domains from SAN
san_domains = san_extension.value.get_values_for_type(x509.DNSName)
bug fix: alias domains, php fetch and domain with sudo
2024-02-09 17:58:28 +05:00
try:
logging.CyberCPLogFileWriter.writeToFile(f'Covered domains: {str(san_domains)}')
except:
pass
add improvments for ssl
2024-01-24 10:50:52 +05:00
return 1, san_domains
else:
# If SAN is not present, return the Common Name as a fallback
return 0, None
except BaseException as msg:
return 0, str(msg)
@staticmethod
def CheckIfSSLNeedsToBeIssued(virtualHostName):
#### if website already have an SSL, better not issue again - need to check for wild-card
filePath = '/etc/letsencrypt/live/%s/fullchain.pem' % (virtualHostName)
if os.path.exists(filePath):
import OpenSSL
x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, open(filePath, 'r').read())
SSLProvider = x509.get_issuer().get_components()[1][1].decode('utf-8')
bug fix: alias domains, php fetch and domain with sudo
2024-02-09 17:58:28 +05:00
#### totally seprate check to see if both non-www and www are covered
if SSLProvider == "Let's Encrypt":
status, domains = sslUtilities.getDomainsCovered(filePath)
add improvments for ssl
2024-01-24 10:50:52 +05:00
if status:
if len(domains) > 1:
bug fix: alias domains, php fetch and domain with sudo
2024-02-09 17:58:28 +05:00
### need further checks here to see if ssl is valid for less then 15 days etc
logging.CyberCPLogFileWriter.writeToFile(
'[CheckIfSSLNeedsToBeIssued] SSL exists for %s and both versions are covered, just need to ensure if SSL is valid for less then 15 days.' % (virtualHostName), 0)
pass
add improvments for ssl
2024-01-24 10:50:52 +05:00
else:
return sslUtilities.ISSUE_SSL
bug fix: alias domains, php fetch and domain with sudo
2024-02-09 17:58:28 +05:00
#####
expireData = x509.get_notAfter().decode('ascii')
from datetime import datetime
finalDate = datetime.strptime(expireData, '%Y%m%d%H%M%SZ')
now = datetime.now()
diff = finalDate - now
if int(diff.days) >= 15 and SSLProvider!='Denial':
logging.CyberCPLogFileWriter.writeToFile(
'[CheckIfSSLNeedsToBeIssued] SSL exists for %s and is not ready to fetch new SSL., skipping..' % (
virtualHostName), 0)
return sslUtilities.DONT_ISSUE
elif SSLProvider == 'Denial':
logging.CyberCPLogFileWriter.writeToFile(
f'[CheckIfSSLNeedsToBeIssued] Self-signed SSL found, lets issue new SSL for {virtualHostName}', 0)
return sslUtilities.ISSUE_SSL
elif SSLProvider != "Let's Encrypt":
logging.CyberCPLogFileWriter.writeToFile(
f'[CheckIfSSLNeedsToBeIssued] Custom SSL found for {virtualHostName}', 0)
return sslUtilities.DONT_ISSUE
else:
logging.CyberCPLogFileWriter.writeToFile(
f'[CheckIfSSLNeedsToBeIssued] We will issue SSL for {virtualHostName}', 0)
return sslUtilities.ISSUE_SSL
add improvments for ssl
2024-01-24 11:13:35 +05:00
else:
bug fix: alias domains, php fetch and domain with sudo
2024-02-09 17:58:28 +05:00
logging.CyberCPLogFileWriter.writeToFile(
f'[CheckIfSSLNeedsToBeIssued] We will issue SSL for {virtualHostName}', 0)
add improvments for ssl
2024-01-24 11:13:35 +05:00
return sslUtilities.ISSUE_SSL
add improvments for ssl
2024-01-24 10:50:52 +05:00
Alias Manager.
2018-05-08 21:25:37 +05:00
@staticmethod
def checkIfSSLMap(virtualHostName):
try:
data = open("/usr/local/lsws/conf/httpd_config.conf").readlines()
sslCheck = 0
for items in data:
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
if items.find("listener") > - 1 and items.find("SSL") > -1:
Alias Manager.
2018-05-08 21:25:37 +05:00
sslCheck = 1
continue
if sslCheck == 1:
if items.find("}") > -1:
return 0
if items.find(virtualHostName) > -1 and sslCheck == 1:
p3
2019-12-10 15:09:10 +05:00
data = [_f for _f in items.split(" ") if _f]
Alias Manager.
2018-05-08 21:25:37 +05:00
if data[1] == virtualHostName:
return 1
p3
2019-12-10 15:09:10 +05:00
except BaseException as msg:
Alias Manager.
2018-05-08 21:25:37 +05:00
logging.CyberCPLogFileWriter.writeToFile(str(msg) + " [IO Error with main config file [checkIfSSLMap]]")
return 0
bug fix to tuning
2018-08-23 15:39:28 +05:00
@staticmethod
def checkSSLListener():
try:
data = open("/usr/local/lsws/conf/httpd_config.conf").readlines()
for items in data:
if items.find("listener SSL") > -1:
return 1
p3
2019-12-10 15:09:10 +05:00
except BaseException as msg:
bug fix to tuning
2018-08-23 15:39:28 +05:00
logging.CyberCPLogFileWriter.writeToFile(str(msg) + " [IO Error with main config file [checkSSLListener]]")
return str(msg)
return 0
Adding preliminary IPv6 SSL functions Very likely needs testing and reworking
2022-09-14 18:44:58 -04:00
@staticmethod
def checkSSLIPv6Listener():
try:
data = open("/usr/local/lsws/conf/httpd_config.conf").readlines()
for items in data:
if items.find("listener SSL IPv6") > -1:
return 1
except BaseException as msg:
logging.CyberCPLogFileWriter.writeToFile(str(msg) + " [IO Error with main config file [checkSSLIPv6Listener]]")
return str(msg)
return 0
bug fix to tuning
2018-08-23 15:39:28 +05:00
@staticmethod
def getDNSRecords(virtualHostName):
try:
withoutWWW = socket.gethostbyname(virtualHostName)
withWWW = socket.gethostbyname('www.' + virtualHostName)
return [1, withWWW, withoutWWW]
p3
2019-12-10 15:09:10 +05:00
except BaseException as msg:
bug fix to tuning
2018-08-23 15:39:28 +05:00
return [0, "347 " + str(msg) + " [issueSSLForDomain]"]
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 00:48:12 +05:00
@staticmethod
def PatchVhostConf(virtualHostName):
try:
confPath = sslUtilities.Server_root + "/conf/vhosts/" + virtualHostName
completePathToConfigFile = confPath + "/vhost.conf"
DataVhost = open(completePathToConfigFile, 'r').read()
if DataVhost.find('/.well-known/acme-challenge') == -1:
if ProcessUtilities.decideServer() == ProcessUtilities.OLS:
WriteToFile = open(completePathToConfigFile, 'a')
content = '''
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 01:06:35 +05:00
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 00:48:12 +05:00
context /.well-known/acme-challenge {
location /usr/local/lsws/Example/html/.well-known/acme-challenge
allowBrowse 1
rewrite {
enable 0
}
addDefaultCharset off
phpIniOverride {
}
}
'''
WriteToFile.write(content)
WriteToFile.close()
else:
data = open(completePathToConfigFile, 'r').readlines()
WriteToFile = open(completePathToConfigFile, 'w')
Check = 0
for items in data:
if items.find('DocumentRoot /home/')> -1:
if Check == 0:
WriteToFile.write(items)
WriteToFile.write(' Alias /.well-known/acme-challenge /usr/local/lsws/Example/html/.well-known/acme-challenge\n')
Check = 1
else:
WriteToFile.write(items)
else:
WriteToFile.write(items)
WriteToFile.close()
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 02:01:01 +05:00
from plogical import installUtilities
installUtilities.installUtilities.reStartLiteSpeed()
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 00:48:12 +05:00
except BaseException as msg:
return 0, str(msg)
bug fix to tuning
2018-08-23 15:39:28 +05:00
Initial Commit
2017-10-24 19:16:36 +05:00
@staticmethod
bug fix: https://github.com/usmannasir/cyberpanel/issues/790
2022-02-05 14:50:02 +05:00
def installSSLForDomain(virtualHostName, adminEmail='example@example.org'):
bug fix: add website owner email for vhost ssl config
2021-02-18 14:46:15 +05:00
try:
website = Websites.objects.get(domain=virtualHostName)
adminEmail = website.adminEmail
except BaseException as msg:
logging.CyberCPLogFileWriter.writeToFile('%s [installSSLForDomain:72]' % (str(msg)))
lsws switch
2018-11-09 22:01:28 +05:00
if ProcessUtilities.decideServer() == ProcessUtilities.OLS:
confPath = sslUtilities.Server_root + "/conf/vhosts/" + virtualHostName
completePathToConfigFile = confPath + "/vhost.conf"
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
try:
map = " map " + virtualHostName + " " + virtualHostName + "\n"
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
if sslUtilities.checkSSLListener() != 1:
writeDataToFile = open("/usr/local/lsws/conf/httpd_config.conf", 'a')
listener = "listener SSL {" + "\n"
address = " address *:443" + "\n"
secure = " secure 1" + "\n"
keyFile = " keyFile /etc/letsencrypt/live/" + virtualHostName + "/privkey.pem\n"
Adding preliminary IPv6 SSL functions Very likely needs testing and reworking
2022-09-14 18:44:58 -04:00
certFile = " certFile /etc/letsencrypt/live/" + virtualHostName + "/fullchain.pem\n"
certChain = " certChain 1" + "\n"
sslProtocol = " sslProtocol 24" + "\n"
enableECDHE = " enableECDHE 1" + "\n"
renegProtection = " renegProtection 1" + "\n"
sslSessionCache = " sslSessionCache 1" + "\n"
enableSpdy = " enableSpdy 15" + "\n"
enableStapling = " enableStapling 1" + "\n"
ocspRespMaxAge = " ocspRespMaxAge 86400" + "\n"
map = " map " + virtualHostName + " " + virtualHostName + "\n"
final = "}" + "\n" + "\n"
writeDataToFile.writelines("\n")
writeDataToFile.writelines(listener)
writeDataToFile.writelines(address)
writeDataToFile.writelines(secure)
writeDataToFile.writelines(keyFile)
writeDataToFile.writelines(certFile)
writeDataToFile.writelines(certChain)
writeDataToFile.writelines(sslProtocol)
writeDataToFile.writelines(enableECDHE)
writeDataToFile.writelines(renegProtection)
writeDataToFile.writelines(sslSessionCache)
writeDataToFile.writelines(enableSpdy)
writeDataToFile.writelines(enableStapling)
writeDataToFile.writelines(ocspRespMaxAge)
writeDataToFile.writelines(map)
writeDataToFile.writelines(final)
writeDataToFile.writelines("\n")
writeDataToFile.close()
elif sslUtilities.checkSSLIPv6Listener() != 1:
writeDataToFile = open("/usr/local/lsws/conf/httpd_config.conf", 'a')
listener = "listener SSL IPv6 {" + "\n"
address = " address [ANY]:443" + "\n"
secure = " secure 1" + "\n"
keyFile = " keyFile /etc/letsencrypt/live/" + virtualHostName + "/privkey.pem\n"
Update sslUtilities.py error correction
2019-11-08 21:29:38 +00:00
certFile = " certFile /etc/letsencrypt/live/" + virtualHostName + "/fullchain.pem\n"
lsws switch
2018-11-09 22:01:28 +05:00
certChain = " certChain 1" + "\n"
improved ssl configs
2019-11-08 19:28:00 +00:00
sslProtocol = " sslProtocol 24" + "\n"
enableECDHE = " enableECDHE 1" + "\n"
renegProtection = " renegProtection 1" + "\n"
sslSessionCache = " sslSessionCache 1" + "\n"
enableSpdy = " enableSpdy 15" + "\n"
enableStapling = " enableStapling 1" + "\n"
ocspRespMaxAge = " ocspRespMaxAge 86400" + "\n"
lsws switch
2018-11-09 22:01:28 +05:00
map = " map " + virtualHostName + " " + virtualHostName + "\n"
final = "}" + "\n" + "\n"
writeDataToFile.writelines("\n")
writeDataToFile.writelines(listener)
writeDataToFile.writelines(address)
writeDataToFile.writelines(secure)
writeDataToFile.writelines(keyFile)
writeDataToFile.writelines(certFile)
writeDataToFile.writelines(certChain)
writeDataToFile.writelines(sslProtocol)
improved ssl configs
2019-11-08 19:28:00 +00:00
writeDataToFile.writelines(enableECDHE)
writeDataToFile.writelines(renegProtection)
writeDataToFile.writelines(sslSessionCache)
writeDataToFile.writelines(enableSpdy)
writeDataToFile.writelines(enableStapling)
writeDataToFile.writelines(ocspRespMaxAge)
lsws switch
2018-11-09 22:01:28 +05:00
writeDataToFile.writelines(map)
writeDataToFile.writelines(final)
writeDataToFile.writelines("\n")
writeDataToFile.close()
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
else:
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
if sslUtilities.checkIfSSLMap(virtualHostName) == 0:
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
data = open("/usr/local/lsws/conf/httpd_config.conf").readlines()
writeDataToFile = open("/usr/local/lsws/conf/httpd_config.conf", 'w')
sslCheck = 0
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
for items in data:
if items.find("listener") > -1 and items.find("SSL") > -1:
sslCheck = 1
if (sslCheck == 1):
writeDataToFile.writelines(items)
writeDataToFile.writelines(map)
sslCheck = 0
else:
writeDataToFile.writelines(items)
writeDataToFile.close()
Updates to Remote Backup Transfer
2017-10-26 23:50:59 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
###################### Write per host Configs for SSL ###################
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
data = open(completePathToConfigFile, "r").readlines()
## check if vhssl is already in vhconf file
vhsslPresense = 0
Initial Commit
2017-10-24 19:16:36 +05:00
Alias Manager.
2018-05-08 21:25:37 +05:00
for items in data:
lsws switch
2018-11-09 22:01:28 +05:00
if items.find("vhssl") > -1:
vhsslPresense = 1
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
if vhsslPresense == 0:
writeSSLConfig = open(completePathToConfigFile, "a")
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
vhssl = "vhssl {" + "\n"
keyFile = " keyFile /etc/letsencrypt/live/" + virtualHostName + "/privkey.pem\n"
certFile = " certFile /etc/letsencrypt/live/" + virtualHostName + "/fullchain.pem\n"
certChain = " certChain 1" + "\n"
improved ssl configs
2019-11-08 19:28:00 +00:00
sslProtocol = " sslProtocol 24" + "\n"
enableECDHE = " enableECDHE 1" + "\n"
renegProtection = " renegProtection 1" + "\n"
sslSessionCache = " sslSessionCache 1" + "\n"
enableSpdy = " enableSpdy 15" + "\n"
enableStapling = " enableStapling 1" + "\n"
ocspRespMaxAge = " ocspRespMaxAge 86400" + "\n"
lsws switch
2018-11-09 22:01:28 +05:00
final = "}"
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
writeSSLConfig.writelines("\n")
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
writeSSLConfig.writelines(vhssl)
writeSSLConfig.writelines(keyFile)
writeSSLConfig.writelines(certFile)
writeSSLConfig.writelines(certChain)
writeSSLConfig.writelines(sslProtocol)
improved ssl configs
2019-11-08 19:28:00 +00:00
writeSSLConfig.writelines(enableECDHE)
writeSSLConfig.writelines(renegProtection)
writeSSLConfig.writelines(sslSessionCache)
writeSSLConfig.writelines(enableSpdy)
writeSSLConfig.writelines(enableStapling)
writeSSLConfig.writelines(ocspRespMaxAge)
lsws switch
2018-11-09 22:01:28 +05:00
writeSSLConfig.writelines(final)
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
writeSSLConfig.writelines("\n")
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
writeSSLConfig.close()
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
return 1
p3
2019-12-10 15:09:10 +05:00
except BaseException as msg:
lsws switch
2018-11-09 22:01:28 +05:00
logging.CyberCPLogFileWriter.writeToFile(str(msg) + " [installSSLForDomain]]")
return 0
else:
vhost create: redis
2020-01-12 13:50:20 +05:00
if not os.path.exists(sslUtilities.redisConf):
confPath = sslUtilities.Server_root + "/conf/vhosts/" + virtualHostName
completePathToConfigFile = confPath + "/vhost.conf"
Initial Commit
2017-10-24 19:16:36 +05:00
vhost create: redis
2020-01-12 13:50:20 +05:00
## Check if SSL VirtualHost already exists
Initial Commit
2017-10-24 19:16:36 +05:00
vhost create: redis
2020-01-12 13:50:20 +05:00
data = open(completePathToConfigFile, 'r').readlines()
Initial Commit
2017-10-24 19:16:36 +05:00
vhost create: redis
2020-01-12 13:50:20 +05:00
for items in data:
if items.find('*:443') > -1:
return 1
Initial Commit
2017-10-24 19:16:36 +05:00
lsws switch
2018-11-09 22:01:28 +05:00
try:
vhost create: redis
2020-01-12 13:50:20 +05:00
try:
chilDomain = ChildDomains.objects.get(domain=virtualHostName)
externalApp = chilDomain.master.externalApp
DocumentRoot = ' DocumentRoot ' + chilDomain.path + '\n'
except BaseException as msg:
website = Websites.objects.get(domain=virtualHostName)
externalApp = website.externalApp
dynamically detect php version in ref to: https://community.cyberpanel.net/t/php-8-2-in-cyberpanel/49703
2023-11-26 14:32:35 +04:00
docRoot = ACLManager.FindDocRootOfSite(None, virtualHostName)
DocumentRoot = f' DocumentRoot {docRoot}\n'
lsws switch
2018-11-09 22:01:28 +05:00
vhost create: redis
2020-01-12 13:50:20 +05:00
data = open(completePathToConfigFile, 'r').readlines()
phpHandler = ''
for items in data:
if items.find('AddHandler') > -1 and items.find('php') > -1:
phpHandler = items
break
confFile = open(completePathToConfigFile, 'a')
cacheRoot = """ <IfModule LiteSpeed>
CacheRoot lscache
enable cache look for ssl port
2020-11-20 10:57:12 +05:00
CacheLookup on
vhost create: redis
2020-01-12 13:50:20 +05:00
</IfModule>
"""
VirtualHost = '\n<VirtualHost *:443>\n\n'
ServerName = ' ServerName ' + virtualHostName + '\n'
ServerAlias = ' ServerAlias www.' + virtualHostName + '\n'
ServerAdmin = ' ServerAdmin ' + adminEmail + '\n'
SeexecUserGroup = ' SuexecUserGroup ' + externalApp + ' ' + externalApp + '\n'
CustomLogCombined = ' CustomLog /home/' + virtualHostName + '/logs/' + virtualHostName + '.access_log combined\n'
confFile.writelines(VirtualHost)
confFile.writelines(ServerName)
confFile.writelines(ServerAlias)
confFile.writelines(ServerAdmin)
confFile.writelines(SeexecUserGroup)
confFile.writelines(DocumentRoot)
confFile.writelines(CustomLogCombined)
confFile.writelines(cacheRoot)
SSLEngine = ' SSLEngine on\n'
SSLVerifyClient = ' SSLVerifyClient none\n'
SSLCertificateFile = ' SSLCertificateFile /etc/letsencrypt/live/' + virtualHostName + '/fullchain.pem\n'
SSLCertificateKeyFile = ' SSLCertificateKeyFile /etc/letsencrypt/live/' + virtualHostName + '/privkey.pem\n'
confFile.writelines(SSLEngine)
confFile.writelines(SSLVerifyClient)
confFile.writelines(SSLCertificateFile)
confFile.writelines(SSLCertificateKeyFile)
confFile.writelines(phpHandler)
VirtualHostEnd = '</VirtualHost>\n'
confFile.writelines(VirtualHostEnd)
confFile.close()
return 1
except BaseException as msg:
logging.CyberCPLogFileWriter.writeToFile(str(msg) + " [installSSLForDomain]")
return 0
else:
ssl
2020-01-14 23:13:52 +05:00
cert = open('/etc/letsencrypt/live/' + virtualHostName + '/fullchain.pem').read().rstrip('\n')
key = open('/etc/letsencrypt/live/' + virtualHostName + '/privkey.pem', 'r').read().rstrip('\n')
command = 'redis-cli hmset "ssl:%s" crt "%s" key "%s"' % (virtualHostName, cert, key)
logging.CyberCPLogFileWriter.writeToFile('hello world aaa')
logging.CyberCPLogFileWriter.writeToFile(command)
vhost create: redis
2020-01-12 13:50:20 +05:00
ProcessUtilities.executioner(command)
ssl
2020-01-14 23:13:52 +05:00
return 1
lsws switch
2018-11-09 22:01:28 +05:00
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
@staticmethod
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
def obtainSSLForADomain(virtualHostName, adminEmail, sslpath, aliasDomain=None):
bug fix: alias domains, php fetch and domain with sudo
2024-02-09 17:58:28 +05:00
bug fix: backups to rustic
2023-04-01 23:37:08 +05:00
from plogical.acl import ACLManager
from plogical.sslv2 import sslUtilities as sslv2
import json
ssl obtain
2023-04-07 14:26:09 +05:00
#
# url = "https://platform.cyberpersons.com/CyberpanelAdOns/Adonpermission"
# data = {
# "name": "all",
# "IP": ACLManager.GetServerIP()
# }
#
# import requests
# response = requests.post(url, data=json.dumps(data))
#Status = response.json()['status']
Status = 1
bug fix: backups to rustic
2023-04-01 23:37:08 +05:00
ssl improvement
2024-01-26 09:39:05 +05:00
# if (Status == 1) or ProcessUtilities.decideServer() == ProcessUtilities.ent:
# retStatus, message = sslv2.obtainSSLForADomain(virtualHostName, adminEmail, sslpath, aliasDomain)
# if retStatus == 1:
# return retStatus
bug fix: backups to rustic
2023-04-01 23:37:08 +05:00
add improvments for ssl
2024-01-24 10:50:52 +05:00
if sslUtilities.CheckIfSSLNeedsToBeIssued(virtualHostName) == sslUtilities.ISSUE_SSL:
pass
else:
return 1
feature: add onboarding function for server and mail hostname
2024-01-18 13:04:47 +05:00
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
sender_email = 'root@%s' % (socket.gethostname())
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 01:02:36 +05:00
sslUtilities.PatchVhostConf(virtualHostName)
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 00:48:12 +05:00
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
if not os.path.exists('/usr/local/lsws/Example/html/.well-known/acme-challenge'):
command = f'mkdir -p /usr/local/lsws/Example/html/.well-known/acme-challenge'
ProcessUtilities.normalExecutioner(command)
bug fix https://app.clickup.com/t/86eng46e7
2024-01-21 11:47:35 +05:00
command = f'chmod -R 755 /usr/local/lsws/Example/html'
ProcessUtilities.executioner(command)
bug fix https://app.clickup.com/t/86eng46e7
2024-01-21 11:47:10 +05:00
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
CustomVerificationFile = f'/usr/local/lsws/Example/html/.well-known/acme-challenge/{virtualHostName}'
command = f'touch {CustomVerificationFile}'
ProcessUtilities.normalExecutioner(command)
URLFetchPathWWW = f'http://www.{virtualHostName}/.well-known/acme-challenge/{virtualHostName}'
URLFetchPathNONWWW = f'http://{virtualHostName}/.well-known/acme-challenge/{virtualHostName}'
try:
resp = requests.get(URLFetchPathWWW, timeout=5)
if resp.status_code == 200:
logging.CyberCPLogFileWriter.writeToFile(f'Status Code: 200 for: {URLFetchPathWWW}')
WWWStatus = 1
else:
logging.CyberCPLogFileWriter.writeToFile(
f'Status Code: {str(resp.status_code)} for: {URLFetchPathWWW}. Error: {resp.text}')
except BaseException as msg:
logging.CyberCPLogFileWriter.writeToFile(
bug fix in cp
2022-09-06 14:12:28 +05:00
f'Status Code: Unknown for: {URLFetchPathWWW}. Error: {str(msg)}')
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
try:
resp = requests.get(URLFetchPathNONWWW, timeout=5)
if resp.status_code == 200:
logging.CyberCPLogFileWriter.writeToFile(f'Status Code: 200 for: {URLFetchPathNONWWW}')
NONWWWStatus = 1
else:
logging.CyberCPLogFileWriter.writeToFile(f'Status Code: {str(resp.status_code)} for: {URLFetchPathNONWWW}. Error: {resp.text}')
except BaseException as msg:
logging.CyberCPLogFileWriter.writeToFile(
f'Status Code: Unkown for: {URLFetchPathNONWWW}. Error: {str(msg)}')
attempt 1 to fix: https://github.com/usmannasir/cyberpanel/issues/1044
2023-04-13 01:06:35 +05:00
WWWStatus = 1
NONWWWStatus = 1
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
try:
dovecot for ubuntu
2018-11-06 13:03:12 +05:00
acmePath = '/root/.acme.sh/acme.sh'
Initial Commit
2017-10-24 19:16:36 +05:00
zero ssl account registration
2021-09-21 15:35:04 +05:00
### register account for zero ssl
command = '%s --register-account -m %s' % (acmePath, adminEmail)
subprocess.call(shlex.split(command))
centralized execution ph3
2019-03-30 14:21:52 +05:00
# if ProcessUtilities.decideDistro() == ProcessUtilities.ubuntu:
# acmePath = '/home/cyberpanel/.acme.sh/acme.sh'
Initial Commit
2017-10-24 19:16:36 +05:00
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
if aliasDomain is None:
Initial Commit
2017-10-24 19:16:36 +05:00
drop certbot
2018-10-29 21:36:03 +05:00
existingCertPath = '/etc/letsencrypt/live/' + virtualHostName
if not os.path.exists(existingCertPath):
command = 'mkdir -p ' + existingCertPath
centralized execution ph2
2019-03-26 16:19:03 +05:00
subprocess.call(shlex.split(command))
code refactoring
2018-08-22 00:37:43 +05:00
Improvments to Manage SSL, Hostname SSL and MailServer SSL.
2018-05-21 16:51:28 +05:00
try:
dovecot for ubuntu
2018-11-06 13:03:12 +05:00
command = acmePath + " --issue -d " + virtualHostName + " -d www." + virtualHostName \
drop certbot
2018-10-29 21:36:03 +05:00
+ ' --cert-file ' + existingCertPath + '/cert.pem' + ' --key-file ' + existingCertPath + '/privkey.pem' \
bug fix: ssl
2022-02-12 20:04:30 +05:00
+ ' --fullchain-file ' + existingCertPath + '/fullchain.pem' + ' -w /usr/local/lsws/Example/html -k ec-256 --force --server letsencrypt'
some changes
2023-03-17 13:58:10 +05:00
#ResultText = open(logging.CyberCPLogFileWriter.fileName, 'r').read()
#CurrentMessage = "Trying to obtain SSL for: " + virtualHostName + " and: www." + virtualHostName
if (WWWStatus and NONWWWStatus):
drop certbot
2018-10-29 21:36:03 +05:00
bug fix in cp
2022-09-06 14:12:28 +05:00
#logging.CyberCPLogFileWriter.writeToFile(CurrentMessage, 0)
detached mode: instantly change php version
2019-09-29 12:55:58 +05:00
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
logging.CyberCPLogFileWriter.writeToFile(command, 0)
add ssl notifications
2020-03-18 09:30:41 +05:00
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
output = subprocess.check_output(shlex.split(command)).decode("utf-8")
logging.CyberCPLogFileWriter.writeToFile("Successfully obtained SSL for: " + virtualHostName + " and: www." + virtualHostName, 0)
logging.CyberCPLogFileWriter.SendEmail(sender_email, adminEmail, output, 'SSL Notification for %s.' % (virtualHostName))
else:
logging.CyberCPLogFileWriter.writeToFile(command, 0)
raise subprocess.CalledProcessError(0, '', '')
bug fix to tuning
2018-08-23 15:39:28 +05:00
except subprocess.CalledProcessError:
Improvments to Manage SSL, Hostname SSL and MailServer SSL.
2018-05-21 16:51:28 +05:00
logging.CyberCPLogFileWriter.writeToFile(
add ssl notifications
2020-03-18 09:30:41 +05:00
"Failed to obtain SSL for: " + virtualHostName + " and: www." + virtualHostName, 0)
finalText = "Failed to obtain SSL for: " + virtualHostName + " and: www." + virtualHostName
bug fix to tuning
2018-08-23 15:39:28 +05:00
Improvments to Manage SSL, Hostname SSL and MailServer SSL.
2018-05-21 16:51:28 +05:00
try:
dovecot for ubuntu
2018-11-06 13:03:12 +05:00
command = acmePath + " --issue -d " + virtualHostName + ' --cert-file ' + existingCertPath \
drop certbot
2018-10-29 21:36:03 +05:00
+ '/cert.pem' + ' --key-file ' + existingCertPath + '/privkey.pem' \
bug fix: ssl
2022-02-12 20:04:30 +05:00
+ ' --fullchain-file ' + existingCertPath + '/fullchain.pem' + ' -w /usr/local/lsws/Example/html -k ec-256 --force --server letsencrypt'
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
some changes
2023-03-17 13:58:10 +05:00
#ResultText = open(logging.CyberCPLogFileWriter.fileName, 'r').read()
bug fix in cp
2022-09-06 14:12:28 +05:00
CurrentMessage = '%s\nTrying to obtain SSL for: %s' % (finalText, virtualHostName)
some changes
2023-03-17 13:58:10 +05:00
if NONWWWStatus:
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
finalText = '%s\nTrying to obtain SSL for: %s' % (finalText, virtualHostName)
logging.CyberCPLogFileWriter.writeToFile("Trying to obtain SSL for: " + virtualHostName, 0)
some changes
2023-03-17 13:58:10 +05:00
logging.CyberCPLogFileWriter.writeToFile(command)
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
output = subprocess.check_output(shlex.split(command)).decode("utf-8")
some changes
2023-03-17 13:58:10 +05:00
logging.CyberCPLogFileWriter.writeToFile(
"Successfully obtained SSL for: " + virtualHostName, 0)
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
finalText = '%s\nSuccessfully obtained SSL for: %s.' % (finalText, virtualHostName)
logging.CyberCPLogFileWriter.SendEmail(sender_email, adminEmail, finalText,
'SSL Notification for %s.' % (virtualHostName))
some changes
2023-03-17 13:58:10 +05:00
prevent acme command if dns not pointed to avoid rate limit
2022-06-22 14:58:13 +05:00
else:
logging.CyberCPLogFileWriter.writeToFile(command, 0)
raise subprocess.CalledProcessError(0, '', '')
bug fix to tuning
2018-08-23 15:39:28 +05:00
except subprocess.CalledProcessError:
add ssl notifications
2020-03-18 09:30:41 +05:00
logging.CyberCPLogFileWriter.writeToFile('Failed to obtain SSL, issuing self-signed SSL for: ' + virtualHostName, 0)
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
logging.CyberCPLogFileWriter.SendEmail(sender_email, adminEmail, 'Failed to obtain SSL, issuing self-signed SSL for: ' + virtualHostName,
add ssl notifications
2020-03-18 09:30:41 +05:00
'SSL Notification for %s.' % (virtualHostName))
Improvments to Manage SSL, Hostname SSL and MailServer SSL.
2018-05-21 16:51:28 +05:00
return 0
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
else:
Initial Commit
2017-10-24 19:16:36 +05:00
drop certbot
2018-10-29 21:36:03 +05:00
existingCertPath = '/etc/letsencrypt/live/' + virtualHostName
if not os.path.exists(existingCertPath):
command = 'mkdir -p ' + existingCertPath
centralized execution ph2
2019-03-26 16:19:03 +05:00
subprocess.call(shlex.split(command))
Alias Manager.
2018-05-08 21:25:37 +05:00
drop certbot
2018-10-29 21:36:03 +05:00
try:
logging.CyberCPLogFileWriter.writeToFile(
"Trying to obtain SSL for: " + virtualHostName + ", www." + virtualHostName + ", " + aliasDomain + " and www." + aliasDomain + ",")
Alias Manager.
2018-05-08 21:25:37 +05:00
dovecot for ubuntu
2018-11-06 13:03:12 +05:00
command = acmePath + " --issue -d " + virtualHostName + " -d www." + virtualHostName \
drop certbot
2018-10-29 21:36:03 +05:00
+ ' -d ' + aliasDomain + ' -d www.' + aliasDomain\
+ ' --cert-file ' + existingCertPath + '/cert.pem' + ' --key-file ' + existingCertPath + '/privkey.pem' \
bug fix: ssl
2022-02-12 20:04:30 +05:00
+ ' --fullchain-file ' + existingCertPath + '/fullchain.pem' + ' -w /usr/local/lsws/Example/html -k ec-256 --force --server letsencrypt'
Alias Manager.
2018-05-08 21:25:37 +05:00
bug fix: encodings and imports
2019-12-15 13:30:40 +05:00
output = subprocess.check_output(shlex.split(command)).decode("utf-8")
drop certbot
2018-10-29 21:36:03 +05:00
logging.CyberCPLogFileWriter.writeToFile(
"Successfully obtained SSL for: " + virtualHostName + ", www." + virtualHostName + ", " + aliasDomain + "and www." + aliasDomain + ",")
Alias Manager.
2018-05-08 21:25:37 +05:00
drop certbot
2018-10-29 21:36:03 +05:00
except subprocess.CalledProcessError:
Alias Manager.
2018-05-08 21:25:37 +05:00
logging.CyberCPLogFileWriter.writeToFile(
drop certbot
2018-10-29 21:36:03 +05:00
"Failed to obtain SSL for: " + virtualHostName + ", www." + virtualHostName + ", " + aliasDomain + "and www." + aliasDomain + ",")
Alias Manager.
2018-05-08 21:25:37 +05:00
return 0
Initial Commit
2017-10-24 19:16:36 +05:00
drop certbot
2018-10-29 21:36:03 +05:00
##
Initial Commit
2017-10-24 19:16:36 +05:00
drop certbot
2018-10-29 21:36:03 +05:00
if output.find('Cert success') > -1:
return 1
else:
return 0
Initial Commit
2017-10-24 19:16:36 +05:00
p3
2019-12-10 15:09:10 +05:00
except BaseException as msg:
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
logging.CyberCPLogFileWriter.writeToFile(str(msg) + " [Failed to obtain SSL. [obtainSSLForADomain]]")
return 0
Initial Commit
2017-10-24 19:16:36 +05:00
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
def issueSSLForDomain(domain, adminEmail, sslpath, aliasDomain=None):
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
try:
Alias Manager.
2018-05-08 21:25:37 +05:00
if sslUtilities.obtainSSLForADomain(domain, adminEmail, sslpath, aliasDomain) == 1:
lsws switch
2018-11-09 22:01:28 +05:00
if sslUtilities.installSSLForDomain(domain, adminEmail) == 1:
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
return [1, "None"]
else:
return [0, "210 Failed to install SSL for domain. [issueSSLForDomain]"]
else:
bug fix: SSL Renewer
2019-12-04 19:42:38 +05:00
pathToStoreSSLPrivKey = "/etc/letsencrypt/live/%s/privkey.pem" % (domain)
pathToStoreSSLFullChain = "/etc/letsencrypt/live/%s/fullchain.pem" % (domain)
add improvments for ssl
2024-01-24 10:50:52 +05:00
#### if in any case ssl failed to obtain and CyberPanel try to issue self-signed ssl, first check if ssl already present.
### if so, dont issue self-signed ssl, as it may override some existing ssl
if os.path.exists(pathToStoreSSLFullChain):
import OpenSSL
x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, open(pathToStoreSSLFullChain, 'r').read())
SSLProvider = x509.get_issuer().get_components()[1][1].decode('utf-8')
if SSLProvider != 'Denial':
if sslUtilities.installSSLForDomain(domain) == 1:
logging.CyberCPLogFileWriter.writeToFile("We are not able to get new SSL for " + domain + ". But there is an existing SSL, it might only be for the main domain (excluding www).")
return [1, "We are not able to get new SSL for " + domain + ". But there is an existing SSL, it might only be for the main domain (excluding www)." + " [issueSSLForDomain]"]
Create modern ECDSA certificates Fix self-signed certificate wrongly set to www.example.com Fix consistency where the certificates are issued from. if an aliasDomain was used it was issued from ZeroSSL while others where issued from Let's Encrypt. I went with ZeroSSL due to less rate-limiting Maybe choosing the CA should be an option that can be set by the user. To set a default use 'acme.sh --set-default-ca --server letsencrypt' instead Use `acme.sh --register-account -m my@example.com` to create a ZeroSSL account
2021-07-19 09:51:40 +00:00
command = 'openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=' + domain + '" -keyout ' + pathToStoreSSLPrivKey + ' -out ' + pathToStoreSSLFullChain
bug fix: SSL Renewer
2019-12-04 19:42:38 +05:00
cmd = shlex.split(command)
subprocess.call(cmd)
if sslUtilities.installSSLForDomain(domain) == 1:
logging.CyberCPLogFileWriter.writeToFile("Self signed SSL issued for " + domain + ".")
Fix #610
2021-09-29 08:48:00 +06:00
return [1, "Self signed certificate was issued. [issueSSLForDomain]"]
bug fix: SSL Renewer
2019-12-04 19:42:38 +05:00
else:
return [0, "210 Failed to install SSL for domain. [issueSSLForDomain]"]
Imrpovement to SSL Module.
2018-05-06 14:18:41 +05:00
p3
2019-12-10 15:09:10 +05:00
except BaseException as msg:
Fix #687 send ssl notification from root@hostname
2021-10-07 22:15:21 +06:00
return [0, "347 " + str(msg) + " [issueSSLForDomain]"]
Reference in New Issue Copy Permalink