Edit File: webshield-watchdog
#!/opt/imunify360/venv/bin/python3 """ The watchdog script that checks the webshield and restarts it if error found """ import json import logging import logging.handlers import os import requests import subprocess import sys import time import uuid import yaml from configparser import ConfigParser from pathlib import Path import sentry_sdk from sentry_sdk import configure_scope logging.raiseExceptions = False class Watchdog: port = 52224 request_timeout = 4 subprocess_timeout = 30 config_path = '/etc/sysconfig/imunify360/imunify360-merged.config' user_agent = 'Webshield-watchdog-agent' sentry_dsn_path = '/usr/share/imunify360-webshield/sentry' package_name = 'imunify360-webshield-bundle' license_path = '/var/imunify360/license.json' flag_path = '/var/imunify360/webshield_broken' integration_path = '/etc/sysconfig/imunify360/integration.conf' services_full = ('imunify360-webshield', 'imunify360-webshield-ssl-cache') services_ws_only = ('imunify360-webshield',) mode_flag_path = '/usr/share/imunify360-webshield/modularity_mode' wafd_sock_path = "/var/run/imunify360/libiplists-daemon.sock" wafd_check_binary = "i360_wafd_check" def __init__(self): self.services = (self.services_ws_only if os.path.exists(self.integration_path) else self.services_full) self.is_enabled = self._get_config_status() self.is_running = self._get_current_status() self.sentry_dsn = self._get_dsn() self.log_level = logging.INFO self.logger = self._setup_logging() def _setup_logging(self): logger = logging.getLogger('imunify360-webshield-watchdog') logger.setLevel(self.log_level) handler = logging.handlers.SysLogHandler('/dev/log') formatter = logging.Formatter('%(name)s: %(message)s') handler.formatter = formatter logger.addHandler(handler) self._init_sentry() return logger @classmethod def _get_server_id(cls): try: with open(cls.license_path) as f: data = json.load(f) except Exception: return 'none' return data.get('id', 'none') @classmethod def _get_dsn(cls): try: with open(cls.sentry_dsn_path) as f: return f.read().strip() except Exception: return def _init_sentry(self): sentry_sdk.init(dsn=self.sentry_dsn, release=self._imunify360_version()) with configure_scope() as scope: scope.user = {'id': self._get_server_id()} @classmethod def _get_config_status(cls): with open(cls.config_path) as f: parsed_config = yaml.safe_load(f) if not 'WEBSHIELD' in parsed_config: return False return parsed_config["WEBSHIELD"].get('enable', False) def _get_current_status(self, attempts=3, wait=5): if not self.is_standalone(): return False for i in range(attempts): errors = 0 for service in self.services: try: proc = subprocess.run(['service', service, 'status'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=self.subprocess_timeout) except subprocess.TimeoutExpired: errors = 124 continue errors += proc.returncode if not errors: return True time.sleep(wait) return False def _make_http_request(self, i): url = "http://0.0.0.0:{}/selfcheck?uuid={}".format( self.port, uuid.uuid4()) curr_timeout = self.request_timeout * i try: requests.get( url, headers={'User-Agent': self.user_agent}, allow_redirects=False, timeout=curr_timeout) except Exception: return False return True def _check_http_request(self): for i in range(1, 4): if self._make_http_request(i): return True time.sleep(2) return False def _call_service(self, action='restart'): service = self.services[0] try: proc = subprocess.run( ['service', service, action], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=self.subprocess_timeout) except subprocess.TimeoutExpired: return False if proc.returncode != 0: return False return True @classmethod def _collect_output(cls, cmd): try: cp = subprocess.run( cmd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=cls.subprocess_timeout) except (OSError, subprocess.TimeoutExpired): return '' if cp.returncode != 0: return '' return cp.stdout.decode() @classmethod def _get_rpm_version(cls): cmd = ['rpm', '-q', '--queryformat=%{VERSION}-%{RELEASE}', cls.package_name] return cls._collect_output(cmd) @classmethod def _get_dpkg_version(cls): cmd = ['dpkg', '--status', cls.package_name] out = cls._collect_output(cmd) if not out: return for line in out.splitlines(): if line.startswith("Version:"): return line.strip().split()[1] @classmethod def _imunify360_version(cls): version = cls._get_rpm_version() if not version: version = cls._get_dpkg_version() return version @classmethod def _get_flag_timestamp(cls): try: with open(cls.flag_path) as o: return int(o.read().strip()) except Exception: pass @classmethod def _put_flag_timestamp(cls): tms = int(time.time()) try: with open(cls.flag_path, 'w') as w: w.write("{}".format(tms)) except Exception: pass @classmethod def _set_flag(cls): tms = cls._get_flag_timestamp() if not tms or time.time() - tms >= 86400: # 24h cls._put_flag_timestamp() return True return False @classmethod def _remove_flag_if_exists(cls): if not os.path.exists(cls.flag_path): return False try: os.unlink(cls.flag_path) return True except Exception: pass def run(self): if self.is_enabled and self.is_running: result = self._check_http_request() if not result: done = self._set_flag() if done: # File has been created or updated self.logger.error( '%s is inaccessible', self.services[0]) self._call_service('restart') else: done = self._remove_flag_if_exists() if done: # File has been deleted self.logger.info('%s is resumed.', self.services[0]) return if self.is_enabled and not self.is_running: done = self._set_flag() if done: self.logger.error( '%s is not running. Restart.', self.services[0]) self._call_service('restart') return if not self.is_enabled and self.is_running: self.logger.warning( '%s is running while being disabled. Stopping...', self.services[0]) self._call_service('stop') return self.logger.info('%s is disabled. OK', self.services[0]) def check_wafd(self): """ The wafd is expected to be running by all means because not only the webshield is dependent on it. We call small wafd utility to check wafd is responsive. Otherwise we'll try to restart wafd. """ check_ip = "93.89.215.4" cmd = [self.wafd_check_binary, "-path", self.wafd_sock_path, check_ip] try: p = subprocess.run(cmd, check=True, timeout=2, capture_output=True) except Exception: # On any exception we just fall through to restart wafd pass else: out = p.stdout.decode("utf-8") if "Response" in out and check_ip in out and "status: 0" in out: # We got a sensible response, so wafd is running and responsible. # Nothing to do, return return # If we got here it means that wafd is not responsible. Trying to restart it cmd = ["systemctl", "restart", "imunify360-wafd"] try: subprocess.run(cmd, check=True) except Exception as e: self.logger.error("Failed to restart wafd: %s", e) @classmethod def is_standalone(cls): try: with open(cls.mode_flag_path) as f: mode = f.read().strip() if mode in ('nginx', 'apache'): return False return True except Exception: # A file read error we treat as standalone mode return True @classmethod def is_apache2nginx_mode(cls): try: return Path('/var/lib/apache2nginx/state').read_text().strip() != 'off' except Exception: return False @staticmethod def is_nginx_server() -> bool: try: cfg = ConfigParser() cfg.read('/etc/sysconfig/imunify360/integration.conf') return cfg.get('web_server', 'server_type', fallback='') == 'nginx' except Exception: pass return False @staticmethod def is_cloudways() -> bool: try: hostname = subprocess.check_output(['hostname', '-f'], text=True).strip() if hostname.endswith(('.cloudwaysapps.com', '.cloudwaysstagingapps.com')): return True output = subprocess.check_output(['/usr/local/sbin/apm', 'info'], text=True) return 'Cloudways' in output except Exception: pass return False @classmethod def is_force_use_coraza(cls) -> bool: # This code is a ported copy-paste from Go agent. return cls.is_nginx_server() and cls.is_cloudways() if __name__ == '__main__': w = Watchdog() w.check_wafd() if not Watchdog.is_standalone(): sys.exit() if Watchdog.is_force_use_coraza(): sys.exit() if Watchdog.is_apache2nginx_mode(): sys.exit() w.run()