From 746ee1646c1a316fdc90419570c376ae260cfaa3 Mon Sep 17 00:00:00 2001 From: cschantz Date: Wed, 19 Nov 2025 19:45:07 -0500 Subject: [PATCH] DEEP AUDIT UPDATE: Found hidden cPanel API dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CRITICAL NEW FINDINGS: 1. WordPress Cron Manager - CATASTROPHIC - 33 references to /var/cpanel/userdata - 9 references to public_html - Completely relies on cPanel userdata for domain→user lookups - Will be 100% broken on InterWorx without major refactor 2. cPanel API Dependencies - SILENT FAILURES - whmapi1/uapi calls found in 3 modules - These commands DON'T EXIST on InterWorx! - Will fail silently without proper error handling Affected modules: - live-attack-monitor.sh: whmapi1 cphulkd_list_blocks/add_whitelist - enable-cphulk.sh: Multiple whmapi1 calls - system-health-check.sh: whmapi1 in help messages 3. 500-error-tracker.sh - PHP Handler Issues - Reads php_admin_value from /var/cpanel/userdata - InterWorx uses different PHP configuration method UPDATED TOTALS: - Was: 14 modules need fixes - Now: 16 modules need fixes - 3 with critical API dependencies - 1 requires complete refactor (wordpress-cron-manager) SOLUTION DOCUMENTED: - Wrap ALL whmapi1/uapi calls in SYS_CONTROL_PANEL checks - InterWorx has ModSecurity + fail2ban (no CPHulk equivalent) - Must fail gracefully with warnings UPDATED IMPLEMENTATION PLAN: - Phase 3: Security modules + API wrapping - Phase 4: WordPress + website diagnostics (MAJOR REFACTOR) - Phase 5: Monitoring tools - Phase 6: System health conditional checks This audit is now COMPLETE and accurate. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- INTERWORX_COMPATIBILITY_AUDIT.md | 86 ++++++++++++++++++++++++++------ 1 file changed, 72 insertions(+), 14 deletions(-) diff --git a/INTERWORX_COMPATIBILITY_AUDIT.md b/INTERWORX_COMPATIBILITY_AUDIT.md index 35ec867..2b8b2b1 100644 --- a/INTERWORX_COMPATIBILITY_AUDIT.md +++ b/INTERWORX_COMPATIBILITY_AUDIT.md @@ -4,13 +4,23 @@ ## Executive Summary -Out of **38 total modules**, **14 modules** have hardcoded cPanel-specific paths that will break on InterWorx servers. +Out of **38 total modules**, **16 modules** have cPanel-specific dependencies that will break on InterWorx servers. ### Compatibility Status: - ✅ **3 modules** - Already InterWorx compatible (using SYS_LOG_DIR) -- ⚠️ **14 modules** - Need InterWorx fixes (hardcoded paths) -- ✓ **21 modules** - Control panel agnostic (no paths) +- ⚠️ **16 modules** - Need InterWorx fixes (hardcoded paths + API calls) +- ✓ **19 modules** - Control panel agnostic (no paths) + +### CRITICAL NEW FINDINGS (Deep Audit): + +**whmapi1/uapi API Dependencies Found:** +- These cPanel APIs will FAIL silently on InterWorx! +- Found in: live-attack-monitor.sh, enable-cphulk.sh, system-health-check.sh + +**WordPress Module Crisis:** +- wordpress-cron-manager.sh: 33 userdata references, 9 public_html references +- Completely broken on InterWorx without major refactor --- @@ -32,20 +42,23 @@ Out of **38 total modules**, **14 modules** have hardcoded cPanel-specific paths ### PRIORITY 1: Critical Security Modules -#### 1. **live-attack-monitor.sh** ⚠️ HIGH PRIORITY +#### 1. **live-attack-monitor.sh** ⚠️ CRITICAL PRIORITY **Issues:** - Line 1256: `LOG_DIR="${SYS_LOG_DIR:-/var/log/apache2/domlogs}"` - Line 1261-1262: Hardcoded `/var/log/httpd/access_log` - Line 1267: Comment mentions "cPanel domlogs" - Line 1537: CPHulk detection (cPanel-only feature) +- **NEW:** Uses `whmapi1 cphulkd_list_blocks` - cPanel API call! +- **NEW:** Uses `whmapi1 cphulkd_add_whitelist` - cPanel API call! **Fix Required:** - Already uses `SYS_LOG_DIR` (GOOD!) - But fallback is wrong - should use system-detect.sh - Add InterWorx log discovery like bot-analyzer -- CPHulk detection should be cPanel-only conditional +- Wrap ALL whmapi1 calls in `if [ "$SYS_CONTROL_PANEL" = "cpanel" ]` +- CPHulk features should be cPanel-only conditional -**Impact:** Real-time attack monitoring won't see attacks on InterWorx +**Impact:** Real-time attack monitoring won't see attacks on InterWorx + API calls will fail --- @@ -122,9 +135,28 @@ Out of **38 total modules**, **14 modules** have hardcoded cPanel-specific paths --- +#### 6. **wordpress-cron-manager.sh** ⚠️ CRITICAL PRIORITY +**Issues:** +- **33 references to `/var/cpanel/userdata`** - HEAVY dependency! +- **9 references to `public_html`** - Wrong document root +- Domain→user lookup completely relies on userdata files +- Checks userdata for servername, main_domain, etc. +- WordPress detection searches in `/home/*/public_html` + +**Fix Required:** +- Complete refactor required! +- Replace ALL userdata reads with `get_user_info()` and `get_user_domains()` +- Support InterWorx document roots: `/home/user/domain.com/html` +- WordPress detection must search both public_html AND domain.com/html +- Domain→user mapping must use user-manager.sh functions + +**Impact:** WordPress cron management completely broken on InterWorx + +--- + ### PRIORITY 3: Live Monitoring Tools -#### 6. **web-traffic-monitor.sh** ⚠️ MEDIUM PRIORITY +#### 7. **web-traffic-monitor.sh** ⚠️ MEDIUM PRIORITY **Issues:** - Line 12-13: Hardcoded `/var/log/apache2/domlogs` - Line 32: Error message mentions "domlogs" @@ -247,14 +279,15 @@ These modules don't use control panel-specific paths (21 total): ## Recommended Implementation Plan -### Phase 3: Critical Security Modules (THIS PHASE) -1. **malware-scanner.sh** - Fix document root discovery -2. **live-attack-monitor.sh** - Fix log discovery +### Phase 3: Critical Security Modules (NEXT) +1. **malware-scanner.sh** - Fix document root discovery + cPanel path assumptions +2. **live-attack-monitor.sh** - Fix log discovery + wrap whmapi1 calls 3. **optimize-ct-limit.sh** - Remove hardcoded fallback -### Phase 4: Website Diagnostic Modules -1. **website-error-analyzer.sh** - Full InterWorx support -2. **500-error-tracker.sh** - Full InterWorx support +### Phase 4: Critical Website Modules +1. **wordpress-cron-manager.sh** - MAJOR REFACTOR (33 userdata refs, 9 public_html refs) +2. **website-error-analyzer.sh** - Full InterWorx support +3. **500-error-tracker.sh** - Full InterWorx support + PHP handler detection ### Phase 5: Monitoring Tools 1. **web-traffic-monitor.sh** @@ -263,7 +296,32 @@ These modules don't use control panel-specific paths (21 total): 4. **tail-apache-error.sh** ### Phase 6: System Tools -1. **system-health-check.sh** - Make cPanel checks conditional +1. **system-health-check.sh** - Make cPanel checks conditional + wrap whmapi1 references + +--- + +## cPanel API Compatibility Issue + +### The Problem: +Several modules use cPanel's whmapi1/uapi commands that **do not exist on InterWorx**. + +### Affected Modules: +1. **live-attack-monitor.sh** - `whmapi1 cphulkd_list_blocks`, `whmapi1 cphulkd_add_whitelist` +2. **enable-cphulk.sh** - Multiple whmapi1 calls (cPanel-only module, expected) +3. **system-health-check.sh** - whmapi1 references in help messages + +### Solution: +Wrap ALL API calls in control panel detection: +```bash +if [ "$SYS_CONTROL_PANEL" = "cpanel" ]; then + whmapi1 cphulkd_list_blocks +fi +``` + +### InterWorx Alternatives: +- CPHulk equivalent: InterWorx has ModSecurity + fail2ban (different approach) +- No direct API equivalent for CPHulk features +- Should detect and skip gracefully with warning ---