#! /bin/bash # Afrihost: cPanel List Tool # Author: P # Modified: Juan.vz # Last Update: 2026-06-02 # Run env: local cpanel server ################################################################### ([ -f /usr/bin/id ] && [ "$(/usr/bin/id -u)" -eq "0" ]) || { echo Permission_Denied ; exit ; } # cpanel check if ! [ -f "/usr/local/cpanel/cpanel" ]; then echo "No cpanel" exit fi ######################################################################### # VARS for clouring # ######################################################################### if hostname | grep -E -q "aserv\." ; then yelcolouru=$(head -n1 /usr/local/share/store) yelcolourp=$(tail -n1 /usr/local/share/store) fi txtgrn='\e[0;32m' # Normal green txtund=$(tput sgr 0 1) # Underline txtbld=$(tput bold) # Bold txtrst='\e[0m' # Text reset txtblink='\e[5m' # Text blink txtbreset='\e[25m' # Text blink reset bldgrn='\e[1;32m' # Green bldblu='\e[1;34m' # Blue bldlblu='\e[1;94m' # Light blue bldwht='\e[1;37m' # White bldred='\e[1;31m' # Red bldylw='\e[1;33m' # Yellow bldcyan='\e[1;36m' # Cyan (Bright blue) bldmag='\e[1;35m' # Magenta (purple) ierr="2>/dev/null" USAGE=" ░█▀▀█ ░█▀▀█ ░█─── 　 ░█─░█ ░█▀▀▀ ░█─── ░█▀▀█ 　 █ █ █ ░█─── ░█▄▄█ ░█─── 　 ░█▀▀█ ░█▀▀▀ ░█─── ░█▄▄█ 　 ▀ ▀ ▀ ░█▄▄█ ░█─── ░█▄▄█ 　 ░█─░█ ░█▄▄▄ ░█▄▄█ ░█─── 　 ▄ ▄ ▄ ########################################### USAGE of cpl ######################################### # cpl DOMAIN [ List all info for domain ] # # cpl -u [ List users from /etc/trueuserdomains ] # # cpl -d [ List domains from /etc/trueuserdomains ] # # cpl -a [ Runs: 'cat /etc/trueuserdomains' ] # # cpl -o [ Runs: 'cat /etc/trueuserowners' ] # # cpl -i [ Show domains cPanel assigned IP ] # # cpl -ql [ List users by used disk quota ] # # cpl -q [ List disk quota and usage report of highest dirs ] # # cpl -dr [ List directory root from Apache config ] # # cpl -fa DOMAIN [ Run compromised domain filter/forwarders audit and create report directory ] # # cpl -fl DOMAIN [ List current filters/forwarders/aliases for domain ] # # cpl cps cPuser [ Get cpanel session ] # # cpl whm [ Get whm access link as reseller ] # ################################################################################################## " HEADSPACER=" === " INDENT=$(echo -e ${bldcyan}"==>"${txtrst}) INFO=$(echo -e ${bldcyan}"-== INFO ==-"${txtrst}) ENDSPACER=" === END === " # cpl -a [ Runs: 'cat /etc/trueuserdomains' ] if [ "$1" == "-a" ];then awk -F ": " '{print $1,$2}' /etc/trueuserdomains | while read pdom puname ; do echo "$(awk -F ":" '{print $1,$2}' /etc/trueuserdomains | grep ^"$pdom" || echo "-") $(grep "ip:" /var/cpanel/userdata/"$puname"/"$pdom"|awk '{print $2}') $( grep "owner:" /var/cpanel/userdata/"$puname"/"$pdom"|awk '{print $2}') $(DNSSERVER=$(dig +short $pdom ns |head -1) ; if echo $DNSSERVER | grep -E -q "ns.otherdns.net|ns.otherdns.com|ns.dns2.co.za|ns.dns1.co.za|dns1.co.za|dns2.co.za" ; then echo DNS_AfriManaged ; elif [[ -z "$DNSSERVER" ]] ;then echo "NODNS" ; elif echo $DNSSERVER | grep -E -qv "ns.otherdns.net|ns.otherdns.com|ns.dns2.co.za|ns.dns1.co.za|dns1.co.za|dns2.co.za|ns.\.yourdomain.co.za" ; then echo DNS_SelfManaged ; fi )" ; done |sed -e's/ */ /g' | column -s" " -t | sort -k4 # No option supplied, only 'cpl' - so printing all + owners elif ! [ "$1" ] ; then awk -F ":" '{print $1,$2}' /etc/trueuserdomains | column -s" " -t #awk -F ":" '{print $1,$2}' /etc/trueuserdomains | grep -v magicreg | while read pdomm puname ; do echo "$pdomm $puname $(awk -F "OWNER=" '/OWNER=/ {print $2}' /var/cpanel/users/$puname)" ; done | column -s" " -t |awk '{if ($3) print $0;}' # cpl -u [ List users from /etc/trueuserdomains ] elif [ "$1" == "-u" ] ; then awk -F ": " '{print $2}' /etc/trueuserdomains | column -s" " -t # cpl -d [ List domains from /etc/trueuserdomains ] elif [ "$1" == "-d" ] ; then awk -F ":" '{print $1}' /etc/trueuserdomains | column -s" " -t # cpl -o [ Runs: 'cat /etc/trueuserowners' ] elif [ "$1" == "-o" ] ; then cat /etc/trueuserowners |awk -F ":" '{print $1,$2}' | column -s" " -t | while read puname powner ; do echo "$puname $powner $(awk -F= '/^DNS=/ { print $2 }' /var/cpanel/users/$puname)" ; done # cpl -i [ Show domains cPanel assigned IP ] elif [ "$1" == "-i" ] ; then awk -F ": " '{print $1,$2}' /etc/trueuserdomains | while read pdom puname ; do echo ""$(grep "ip:" /var/cpanel/userdata/"$puname"/"$pdom"|awk '{print $2}')" $puname $pdom" | column -s" " -t ; done # cpl cps elif [ "$1" == "cps" ] ; then if [ -n "$2" ]; then cPuser=$2 PCPUSER=$(awk -F ": " -v domain="$cPuser" '$1 == domain {print $2; exit}' /etc/trueuserdomains) if [ -n "$PCPUSER" ]; then grep -w "\ $PCPUSER" /etc/trueuserdomains || { echo -e "\n$INFO\n${bldred}-== $cPuser not domain/user in /etc/trueuserdomains ==-\n"${txtrst} ; exit ;} echo -e "\n-==[ Getting cpsess link $cPuser ]==-\n" echo -e " - Running: whmapi1 create_user_session user="$cPuser" service=cpaneld locale=en | grep url\n" whmapi1 create_user_session user="$PCPUSER" service=cpaneld locale=en | grep url echo -e "\n" else PCPUSER=$(awk -F ": " -v domain="$cPuser" '$2 == domain {print $2; exit}' /etc/trueuserdomains) grep -w "\ $PCPUSER" /etc/trueuserdomains || { echo -e "\n$INFO\n${bldred}-== $cPuser not domain/user in /etc/trueuserdomains ==-\n"${txtrst} ; exit ;} echo -e "\n-==[ Getting cpsess link $cPuser ]==-\n" echo -e " - Running: whmapi1 create_user_session user="$cPuser" service=cpaneld locale=en | grep url\n" whmapi1 create_user_session user="$PCPUSER" service=cpaneld locale=en | grep url echo -e "\n" fi fi # cpl whm elif [ "$1" == "whm" ] ; then if [[ `hostname` != *\.aserv\.co\.za ]]; then if [ -n "$2" ]; then whmuser=$2 whmuserP=$(awk -F ":" -v domain="$whmuser" '$1 == domain {print $1; exit}' /var/cpanel/resellers) grep -w -q "$whmuserP" /var/cpanel/resellers || { echo -e "\n$INFO\n${bldred}-== $whmuserP not domain/user in /var/cpanel/resellers ==-\n"${txtrst} ; exit ;} echo -e "\n-==[ Getting whm link $cPuser ]==-\n" echo -e " - Running: whmapi1 create_user_session user="$whmuserP" service=whostmgrd locale=en | grep url\n" whmapi1 create_user_session user="$whmuserP" service=whostmgrd locale=en | grep url echo -e "\n" else whmuserP=$(cpl -o | awk '{print $2}' | sort | uniq -c | awk '( $1 > 3)' | awk '{print $2}') echo -e "\n-==[ Getting whm link based on owner count $whmuserP ]==-\n" echo -e " - Running: whmapi1 create_user_session user="$whmuserP" service=whostmgrd locale=en | grep url\n" whmapi1 create_user_session user="$whmuserP" service=whostmgrd locale=en | grep url echo -e "\n" fi else echo -e "\n=== Getting root whm link ===" whmlogin fi # cpl addssh elif [ "$1" == "allowssh" ] ; then if [ -n "$2" ]; then cPuser=$2 PCPUSER=$(awk -F ": " -v domain="$cPuser" '$2 == domain {print $2; exit}' /etc/trueuserdomains) if [ -n "$PCPUSER" ]; then grep -w "\ $PCPUSER" /etc/trueuserdomains || { echo -e "\n$INFO\n${bldred}-== $PCPUSER not domain/user in /etc/trueuserdomains ==-\n"${txtrst} ; exit ;} echo -e "\n-==[ Generating sshconfig $PCPUSER ]==-\n" SSHD_DIR="/etc/ssh/sshd_config.d" FILE="${SSHD_DIR}/99-${PCPUSER}_clients.conf" [[ -z "$PCPUSER" ]] && { echo "Usage: /scripts/cpl allowssh " exit } if ! id "$PCPUSER" &>/dev/null; then echo "ERROR: '$PCPUSER' is not a valid cPanel user." exit fi cat > "$FILE" </dev/null | while read psize pdir ; do if echo "$psize $pdir" | grep -E 'M|G' ; then find "$pdir"/* -maxdepth 10 -type d 2>/dev/null | while read pfile ; do du -sh $pfile 2>/dev/null | grep -E 'M|G' | grep -v "[0-9]\.[0-9]K" | sort -k1h ; done ; fi ; done | sort -k1n | grep -E '^.G|^..G|^...G|^.M|^..M|^...M' | sort -k1h | tail -n20 uapi --output=jsonpretty --user=$cPuser Quota get_quota_info # cpl -f [ Run a filter or forwarders audit and create report directory ] elif [ "$1" == "-f" ] ; then [ "$2" ] || { echo -e "\n$INFO\n${bldred}-== Need a cPanel username or domain... Please try again. ==-\n"${txtrst} ; exit 1 ; } cPuser=$2 awk -F ":" '{print $1,$2}' /etc/trueuserdomains | grep -w "$cPuser" || { echo -e "\n$INFO\n${bldred}-== $cPuser not found in /etc/trueuserdomains ==-\n"${txtrst} ; exit ;} #grep -w "\ $cPuser" /etc/trueuserdomains || { echo "$cPuser not found in /etc/trueuserdomains" ; exit ;} awk -F ":" '{print $1,$2}' /etc/trueuserdomains | grep -v magicreg | grep $cPuser | column -s" " -t | while read pdomm puname ; do freportdir="/home/"$puname"/.forwarders_audit_report" mkdir $freportdir [ -d /home/"$puname" ] || { echo -e "\n$INFO\n${bldred}-== $cPuser home direcotry doesn't exist /home/$puname ==-\n"${txtrst} ; exit ;} find /var/log/forwarders_audit/ | grep --text $pdomm | xargs -i rsync -aq {} $freportdir echo -e "\n$INFO Getting access logs related to filters or forwarders from cPanel access logs for "$cPuser" " zgrep -E "$pdomm|$puname" /usr/local/cpanel/logs/archive/access_log-*.gz | grep -E --text 'filter|forward' | geoip > "$freportdir"/archive_access_logs_filters_mod_only.log grep -E --text '$pdomm|$puname' /usr/local/cpanel/logs/access_log | grep -E -text -i 'filter|forward' | geoip > "$freportdir"/current_access_logs_filters_mod_only.log zgrep -E "$pdomm|$puname" /usr/local/cpanel/logs/archive/access_log-*.gz | geoip > "$freportdir"/archive_cpanel_access_logs_all.log grep -E --text "$pdomm|$puname" /usr/local/cpanel/logs/access_log | geoip > "$freportdir"/cpanel_current_access_logs_all.log echo -e ${bldgrn}"\n-== cPanel filter/forwarder report + logs ==-\n"${txtrst} echo -e "==================================== SEND TO CLIENT - START ==================================== Good day, I hope you are well! We have placed the following logs for your reference, downloadable via cPanel > File Manager > "$freportdir". These logs contain all and any instances where IPs have accessed webmail and modified filters. We also included logs of any webmail interactions related to the domain using the webmail/cPanel ports/URLs. An audit system is running on all managed and shared servers that records events when filters are created/modified, that includes dates and IPs and filter information regarding the create/modification event. The audit systems incident data files end in *_cur.txt. If the IPs that have accessed your mailbox are not known to you, we suggest you immediately update all passwords, including any other sites you might have used the same password for. -== Ways in which your password could have been attained: 1. A phishing incident, where you clicked on an email that asked you to update your password, or something similar. 2. Your password is a very weak one, and someone guessed it. - The server does have protection for this type of behavior/attack and blocks IPs after 15 login failures. However, a persistent person could eventually guess your password if it's very weak. 3. The password being used was used on another site/app/email account and that system was compromised. - You can verify this by checking possible email accounts that could have potentially used the same password at https://haveibeenpwned.com/ 4. Your local devices that access your email accounts are compromised, in which you should then scan these devices with reputable virus scanners. 5. Someone who knows you and knows your password, has targeted you. 6. Someone on the network between your email client and server is tapped onto the network and capturing packets, and if you don't use SSL for email connections they could get plain text passwords and sell them or use them for fraud purposes. - Please make sure you're using SSL server settings and ports for email authentication in your email client configurations. -== Please note that passwords on the server are one-way encrypted and no one can decrypt them due to the encryption algorithm still not having been broken or known in the computer world. We suggest you immediately report this to the police. Unfortunately, there isn't much more we can do from our end to secure your account as the fraudsters used a valid password of yours. We have provided as much information as possible and all files can be downloaded using cPanel > File Manager > "$freportdir". If there's anything else we can do in terms of information, please let us know. Kind regards, Afrihost Hosting Support ==================================== SEND TO CLIENT - END ==================================== " echo -e "\n$INFO Report located at $freportdir"${txtrst} echo -e "$INFO Server audit files with dates and times relating to forwarder/filter modifications: $freportdir - downloadable via cPanel > File Manager"${txtrst} echo -e "$INFO All archived/OLD filter/forwarder edit/modification logs showing IP that accessed webmail or cPanel: "$freportdir"/archive_access_filter.log"${txtrst} echo -e "$INFO Current week/month filter/forwarder edit logs showing IP that accessed webmail or cPanel: "$freportdir"/current_access.log \n"${txtrst} echo -e "$INFO The following users had filters/forwarders created/modified within the last month:"${txtrst} echo -e "$INFO We suggest updating all their password ASAP if this was not done by the client."${txtrst} #echo -e "$(grep MAILADDR "$freportdir"/*)"${txtrst} #echo -e ${bldred}"$(grep "MAILADDR" "$freportdir"/* | grep "date +%Y-%m" | awk -F":" '{print $2," in "$1}' | sed 's#MAILADDR=#MAIL_ADDRESS: #g')"${txtrst} echo -e ${bldred}"$(if grep "`date +%Y-%m`" "$freportdir"/* >/dev/null ; then grep "MAILADDR" "$freportdir"/* | grep "`date +%Y-%m`" | awk -F":" {'print $2," in "$1'} | sed 's#MAILADDR=#MAIL_ADDRESS: #g' ; else echo "No filter/forwarder changes in the last month." ; fi)\n"${txtrst} #echo -e "$INFO We suggest updating all their password ASAP if this was not done by the client. \n"${txtrst} echo -e "$INFO Here is a list of 15 or less EXAMPLES OF IPs that have accessed your domain using a valid username and password:"${txtrst} ${bldred} ; ls -altrh "$freportdir" | grep ".*:.*\.yaml" | awk -F "_" '{print $NF}' | awk -F "-" '{print $1,$2,$3}' | while read pyear pmonth pday ; do tac "$freportdir"/*_access_logs_filters_mod_only.log | grep "/"$pmonth"/"$pyeara"" | grep -v 197.242.158.140 ; done | tail -n15 | awk {'print $1,$2,$4,$5'} | sed 's#\[##g' | column -t | geoip #[ -d "$freportdir" ] && chown -R "$puname":$puname $freportdir && chmod 600 $freportdir || { echo "$freportdir doesnt exist - contact server admin" ; exit ; } done 2>/dev/null ; echo -e ${bldgrn}"\n-== Report Complete ==-\n"${txtrst} # cpl -h elif [ "$1" == "-h" ] ; then echo -e ${bldmag}"$USAGE"${txtrst} # cpl DOMAIN [ List all info for domain ] - Print general cPanel/server report on supplied user or domain elif ! echo $1 | grep -q "^-" ; then awk -F ":" '{print $1,$2}' /etc/trueuserdomains | grep -v magicreg |grep $1 | column -s" " -t | while read pdomm puname ; do echo -e ${bldylw}"\n$HEADSPACER Generating report for $1 $HEADSPACER"${txtrst} owner=$(grep $puname /etc/trueuserowners | awk '{print $2}'| head -n1) quota_used=$(/usr/bin/quota -v -s -u $puname | grep -A1 home| tail -n1 | awk '{print $1}'| grep [0-9] || /usr/bin/quota -v -s -u $puname | tail -n1 | awk '{print $1}' ) quota_total=$(/usr/bin/quota -v -s -u $puname | grep -A1 home| tail -n1 | awk '{print $3}'| grep [0-9] || /usr/bin/quota -v -s -u $puname | tail -n1 | awk '{print $3}' ) package=$(awk -F "=" '/PLAN/ {print $2}' /var/cpanel/users/$puname) apache_ip=$(grep IP= /var/cpanel/users/$puname| sed 's/IP=//') if find /var/cpanel/userdata/$puname/ | grep -q fpm.yaml ; then phphandler=php-fpm ; else phphandler=php-cgi ; fi phperrorlog=$(find /home/$puname/logs | grep "php.error.log$") docroot=$(grep 'documentroot:' /var/cpanel/userdata/$puname/*SSL | awk -F": " {'print $2'}) docrootsites="$(echo "$docroot" | while read pdocs ; do echo "$(grep -wl "$pdocs" /var/cpanel/userdata/$puname/*SSL 2>/dev/null | awk -F "/" '{print $NF}' |sed 's/_SSL//') "$pdocs"" 2>/dev/null | grep /home | column -t ; done| column -t)" phpversion=$(cd $docroot ; php -v | head -n1 | awk '{print $2}') if grep -q $pdomm /etc/localdomains ; then mail_route="Local" ; elif grep -q $pdomm /etc/remotedomains ; then mail_route="Remote" ; fi email_acc_inshadow=$(wc -l /home/$puname/etc/$pdomm/shadow 2>/dev/null) email_acc_indir=$(ls -1 /home/$puname/mail/$pdomm/ | wc -l) if grep -q "SUSPENDED=1" /var/cpanel/users/$puname ; then suspended="Yes" ; else suspended="No" ; fi if ! ls -altrh /opt/cpanel/ea-php*/root/usr/var/log/php-fpm/error.log | grep -q error.log 2>/dev/null ; then phpfpmlimithit="N/A" else if grep "`date "+%d-%b-%Y"`" /opt/cpanel/ea-php*/root/usr/var/log/php-fpm/error.log 2>/dev/null | grep $pdomm | tail -n5 | grep "server reached max_children setting" > /dev/null ; then phpfpmlimithit="Yes - check PHP_ERROR_LOGS:" ; else phpfpmlimithit="No" ; limit_out="" fi fi if grep -E -q "$puname|$pdomm" /root/.spamnuke 2> /dev/null ; then prev_spam="Yes, check in /root/.spamnuke" else prev_spam="No, not in /root/.spamnuke" fi if grep -E -q "$puname|$pdomm" /etc/exim_deny* 2> /dev/null ; then exim_denied="Yes" # $(grep -E "$puname|$pdomm" /etc/exim_deny*)\nIf in exim_deny file then check # senderstats --today |geoip | grep sender@address | geoip \n# Or manually check the logs for sending incidints. else exim_denied="No" fi if dig +short mx @1.1.1.1 $pdomm | grep -E "ucebox|spmbox" > /dev/null; then inmailviaspe="Yes" # \nSPE_MAIL_DEST: $(curl -s "https://XXXXX:1@spe1.ucebox.co.za/cgi-bin/api?call=api_get_destination&domain=$pdomm"| awk '{print $NF}')" else inmailviaspe="No" fi outbound_mail=$(/usr/local/afribin/mrcheck | sed 's/INFO: //') mx_record=$(dig $pdomm mx +short | awk '{print $2}' | head -n1) www_record=$(dig www.$pdomm +short | head -n1) if grep "`date --date="today" +%b\ %e`" /var/log/maillog | grep -E "$pdomm" | grep "auth failed" > /dev/null ; then mailauthfailurestoday="Yes" #CHECK_MAILOG: grep -E '$pdomm|$puname' /var/log/maillog" else mailauthfailurestoday="No" fi phpfpmvhost=$(find /var/cpanel/userdata/"$puname" | grep -E "$pdomm" | grep -v cache | grep -v "/$" | sort) apacheCONFDIR=$(find /usr/local/apache/conf/userdata/s*/2*/"$puname"/* -type f 2>/dev/null) apacheUSERDATA=$( find /var/cpanel/userdata/"$puname"/ -type f ! -name \*cache\*| grep -v ":"| grep -v yaml | grep -v "/main") cpanelvhostuserdata=/var/cpanel/userdata/"$puname"/"$pdomm" cpanelUSERDATA=/var/cpanel/users/"$puname" # SSL checker option autoSSL_status=$(uapi --output=jsonpretty --user=$puname SSL get_autossl_excluded_domains | grep 'You do not have the feature') if [[ `hostname` = *\.aserv\.site ]]; then combFILE="/var/cpanel/ssl/domain_tls/www.${pdomm}/combined" else combFILE="/var/cpanel/ssl/domain_tls/mail.${pdomm}/combined" fi if [ -f "$combFILE" ] 2>/dev/null ; then ssl_stat="Yes" naked_SSL=$(/scripts/ssl_crt_status --domain="$pdomm" --verbose=long | grep 'crt verified') mail_SSL=$(/scripts/ssl_crt_status --domain=mail."$pdomm" --verbose=long | grep 'crt verified') cpanel_SSL=$(/scripts/ssl_crt_status --domain=cpanel."$pdomm" --verbose=long | grep 'crt verified') else ssl_stat="No" #find /var/cpanel/ssl/domain_tls/*"$pdomm"/combined fi echo -e " ${bldcyan}"====== CPANEL INFO ======"${txtrst} $INDENT DOMAIN: $pdomm $INDENT USER: $puname $INDENT OWNER: $owner $INDENT QUOTA_USED: $quota_used $INDENT QUOTA_TOTAL: $quota_total $INDENT PACKAGE: $package $INDENT CPANEL_CONFIG_FILE: $cpanelUSERDATA ${bldcyan}"====== APACHE/WEB/PHP INFO ======"${txtrst} $INDENT APACHE_SET_IP: $apache_ip $INDENT www_RECORD_IP: $www_record $INDENT PHP_HANDLER: $phphandler $INDENT PHP_VERSION: $phpversion $INDENT PHP_ERROR_LOGS: $phperrorlog $INDENT DOCUMENT_ROOTS: $docrootsites $INDENT PHP-FPM_VHOST CONFIGS $phpfpmvhost $INDENT SUSPENDED_IN_WHM: $suspended $INDENT PHP-FPM_LIMITS_HIT: $phpfpmlimithit $INDENT LIMIT_HIT_OUTPUT: ${bldred}$(if [[ "$phpfpmlimithit" == "Yes" ]] ; then grep -irl $pdomm /opt/cpanel/ea-php*/root/usr/var/log/php-fpm/error.log 2>/dev/null ; else echo "---" ; fi )${txtrst} ${bldcyan}"====== MAIL INFO ======"${txtrst} $INDENT MAIL_ROUTING (local/remote): $mail_route $INDENT INCOMING_MAIL_VIA_SPE: $inmailviaspe $INDENT MAIL_DEST (SPE/NON-SPE): $(if [[ "$inmailviaspe" == "Yes" ]] ; then curl -s "https://"$yelcolouru":"$yelcolourp"@spe1.ucebox.co.za/cgi-bin/api?call=api_get_destination&domain=$pdomm"| grep -q "ERROR: No such domain." && echo "PROBLEM --- DOMAIN MX UCEBOX, BUT DOMAIN NOT IN UCEBOX" || curl -s "https://"$yelcolouru":"$yelcolourp"@spe1.ucebox.co.za/cgi-bin/api?call=api_get_destination&domain=$pdomm" | awk '{print $NF}' ; else dig +short mx @1.1.1.1 $pdomm ; fi) $INDENT OUTBOUND_MAIL: $outbound_mail $INDENT MX_RECORD: $mx_record $INDENT EMAIL_ACC_IN_SHADOW: $email_acc_inshadow $INDENT EMAIL_ACC_IN_DIRs: $email_acc_indir $(ls -d /home/$puname/mail/$pdomm/) $INDENT PREVIOUS_SPAMMING_INCIDENT: $prev_spam $INDENT PREVIOUS_SPAMMING_OUTPUT: ${bldred}$(if [[ "$prev_spam" == "Yes, check in /root/.spamnuke" ]] ; then grep -E "$pdomm|$puname" /root/.spamnuke |tail -n5 ; else echo "---" ; fi )${txtrst} $INDENT EXIM_DENIED_ON_SERVER: $exim_denied ${bldred}$(if [[ "$exim_denied" == "Yes" ]] ; then grep -E "$puname|$pdomm" /etc/exim_deny* ; echo -e "\n- If in exim_deny file then check:${txtrst} # senderstats --today | geoip | grep sender@address | geoip \n${bldred}- Or manually check the logs for sending incidints" ; else echo "---" ; fi )${txtrst} $INDENT MAIL_AUTH_FAILURES_TODAY: $mailauthfailurestoday $INDENT MAIL_AUTH_FAILURES_TODAY_RESULTS (5 most recent): ${bldred}$(if [[ "$mailauthfailurestoday" == "Yes" ]] ; then grep "`date --date="today" +%b\ %e`" /var/log/maillog | grep "$pdomm" | grep "auth failed" | sed 's#,##'g | tail -n5 ; echo -e "\n${bldwht}For more general auth info, run: # grep \"`date --date=\"today\" +%b\ %e`\" /var/log/maillog | grep \"$pdomm\"${txtrst}\n" ; else echo -e "---" ; fi)${txtrst} ${bldcyan}"====== SSL INFO ======"${txtrst} $INDENT AUTOSSL_STATUS: $(if echo "$autoSSL_status" | grep "You do not have the feature" >/dev/null ; then echo "AutoSSL not enabled, enable it and run SSL generating commnads" ; elif ! echo "$autoSSL_status" | grep "You do not have the feature" >/dev/null ; then echo "AutoSSL enabled" ; fi) $INDENT SSL_EXIST_ON_SERVER: $ssl_stat $(if [[ "$ssl_stat" == "Yes" ]] ; then echo -e "Naked SSL: $naked_SSL ${txtrst} Mail SSL: $mail_SSL ${txtrst} cPanel SSL: $cpanel_SSL ${txtrst}" ; elif [[ "$ssl_stat" == "No" ]] ; then find /var/cpanel/ssl/domain_tls/*/combined | grep $pdomm ; echo -e "Run the following to generate AutoSSL (assuming DNS is pointing to this server): /usr/local/cpanel/bin/autossl_check --user=$puname /usr/local/cpanel/bin/autossl_check_cpstore_queue --force" ; fi) " ; done echo -e ${bldylw}"$ENDSPACER\n"${txtrst} elif [ "$1" == "--help" ] ; then echo -e ${bldmag}"$USAGE"${txtrst} fi