<commit_before>#!/usr/bin/python3
#
# Checks that the upstream DNS has been set correctly and that
# SSL certificates have been signed, etc., and if not tells the user
# what to do next.

__ALL__ = ['check_certificate']

import os, os.path, re, subprocess, datetime

import dns.reversename, dns.resolver
import dateutil.parser, dateutil.tz

from dns_update import get_dns_zones, build_tlsa_record, get_custom_dns_config
from web_update import get_web_domains, get_domain_ssl_files
from mailconfig import get_mail_domains, get_mail_aliases

from utils import shell, sort_domains, load_env_vars_from_file

def run_checks(env, output):
	env["out"] = output
	run_system_checks(env)
	run_network_checks(env)
	run_domain_checks(env)

def run_system_checks(env):
	env["out"].add_heading("System")

	# Check that SSH login with password is disabled.
	sshd = open("/etc/ssh/sshd_config").read()
	if re.search("\nPasswordAuthentication\s+yes", sshd) \
		or not re.search("\nPasswordAuthentication\s+no", sshd):
		env['out'].print_error("""The SSH server on this machine permits password-based login. A more secure
			way to log in is using a public key. Add your SSH public key to $HOME/.ssh/authorized_keys, check
			that you can log in without a password, set the option 'PasswordAuthentication no' in
			/etc/ssh/sshd_config, and then restart the openssh via 'sudo service ssh restart'.""")
	else:
		env['out'].print_ok("SSH disallows password-based login.")

	# Check for any software package updates.
	pkgs = list_apt_updates(apt_update=False)
	if os.path.exists("/var/run/reboot-required"):
		env['out'].print_error("System updates have been installed and a reboot of the machine is required.")
	elif len(pkgs) == 0:
		env['out'].print_ok("System software is up to date.")
	else:
		env['out'].print_error("There are %d software packages that can be updated." % len(pkgs))
		for p in pkgs:
			env['out'].print_line("%s (%s)" % (p["package"], p["version"]))

	# Check that the administrator alias exists since that's where all
	# admin email is automatically directed.
	check_alias_exists("administrator@" + env['PRIMARY_HOSTNAME'], env)

def run_network_checks(env):
	# Also see setup/network-checks.sh.

	env["out"].add_heading("Network")

	# Stop if we cannot make an outbound connection on port 25. Many residential
	# networks block outbound port 25 to prevent their network from sending spam.
	# See if we can reach one of Google's MTAs with a 5-second timeout.
	code, ret = shell("check_call", ["/bin/nc", "-z", "-w5", "aspmx.l.google.com", "25"], trap=True)
	if ret == 0:
		env['out'].print_ok("Outbound mail (SMTP port 25) is not blocked.")
	else:
		env['out'].print_error("""Outbound mail (SMTP port 25) seems to be blocked by your network. You
			will not be able to send any mail. Many residential networks block port 25 to prevent hijacked
			machines from being able to send spam. A quick connection test to Google's mail server on port 25<commit_msg>report free disk space in the admin<commit_after>#!/usr/bin/python3
#
# Checks that the upstream DNS has been set correctly and that
# SSL certificates have been signed, etc., and if not tells the user
# what to do next.

__ALL__ = ['check_certificate']

import os, os.path, re, subprocess, datetime

import dns.reversename, dns.resolver
import dateutil.parser, dateutil.tz

from dns_update import get_dns_zones, build_tlsa_record, get_custom_dns_config
from web_update import get_web_domains, get_domain_ssl_files
from mailconfig import get_mail_domains, get_mail_aliases

from utils import shell, sort_domains, load_env_vars_from_file

def run_checks(env, output):
	env["out"] = output
	run_system_checks(env)
	run_network_checks(env)
	run_domain_checks(env)

def run_system_checks(env):
	env["out"].add_heading("System")

	# Check that SSH login with password is disabled.
	sshd = open("/etc/ssh/sshd_config").read()
	if re.search("\nPasswordAuthentication\s+yes", sshd) \
		or not re.search("\nPasswordAuthentication\s+no", sshd):
		env['out'].print_error("""The SSH server on this machine permits password-based login. A more secure
			way to log in is using a public key. Add your SSH public key to $HOME/.ssh/authorized_keys, check
			that you can log in without a password, set the option 'PasswordAuthentication no' in
			/etc/ssh/sshd_config, and then restart the openssh via 'sudo service ssh restart'.""")
	else:
		env['out'].print_ok("SSH disallows password-based login.")

	# Check for any software package updates.
	pkgs = list_apt_updates(apt_update=False)
	if os.path.exists("/var/run/reboot-required"):
		env['out'].print_error("System updates have been installed and a reboot of the machine is required.")
	elif len(pkgs) == 0:
		env['out'].print_ok("System software is up to date.")
	else:
		env['out'].print_error("There are %d software packages that can be updated." % len(pkgs))
		for p in pkgs:
			env['out'].print_line("%s (%s)" % (p["package"], p["version"]))

	# Check that the administrator alias exists since that's where all
	# admin email is automatically directed.
	check_alias_exists("administrator@" + env['PRIMARY_HOSTNAME'], env)

	# Check free disk space.
	st = os.statvfs(env['STORAGE_ROOT'])
	bytes_total = st.f_blocks * st.f_frsize
	bytes_free = st.f_bavail * st.f_frsize
	disk_msg = "The disk has %s GB space remaining." % str(round(bytes_free/1024.0/1024.0/1024.0*10.0)/10.0)
	if bytes_free > .3 * bytes_total:
		env['out'].print_ok(disk_msg)
	elif bytes_free > .15 * bytes_total:
		env['out'].print_warning(disk_msg)
	else:
		env['out'].print_error(disk_msg)


def run_network_checks(env):
	# Also see setup/network-checks.sh.

	env["out"].add_heading("Network")

	# Stop if we cannot make an outbound connection on port 25. Many residential
	# networks block outbound port 25 to prevent their network from sending spam.
	# See if we can reach one of Google's MTAs with a 5-second timeout.
	code, ret = shell("check_call", ["/bin/nc", "-z", "-w5", "aspmx.l.google.com", "25"], trap=True)
	if ret == 0:
		env['out'].print_ok("Outbound mail (SMTP port 25) is not blocked.")
	else:
		env['out'].print_error("""Outbound mail (SMTP port 25) seems to be blocked by your network. You
			will not be able to send any mail. Many residential networks block port 25 to prevent hijacked
			machines from being able to send spam. A quick connection test to Google's mail server on port 25
{'fraction_non_alphanumeric': 0.11321938215461816, 'fraction_numerical': 0.009722440018817625, 'mean_word_length': 4.824657534246575, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4092578', 'n_tokens_mistral': 2189, 'n_tokens_neox': 2009, 'n_words': 706}