#!/bin/bash

[0] Fix | Delete

# This Script checks /etc/userdomains for per user domain count and generates STRs if a user contains more than the threshold set in $DOMCOUNT Domains

[1] Fix | Delete

# Debug mode (set to true for logging to file, false for sending email)

[2] Fix | Delete

debug=true

[3] Fix | Delete

[4] Fix | Delete

# Log file path for debug mode

[5] Fix | Delete

LOG_FILE="/var/log/domcount_checker.log"

[6] Fix | Delete

[7] Fix | Delete

# Domain Count Threshold

[8] Fix | Delete

DOMCOUNT=$1

[9] Fix | Delete

[10] Fix | Delete

HOSTNAME=$(hostname | cut -d '.' -f1)

[11] Fix | Delete

[12] Fix | Delete

if ! [[ "$DOMCOUNT" =~ ^[0-9]+$ ]]; then

[13] Fix | Delete

echo "Error: DOMCOUNT argument is missing or not a number."

[14] Fix | Delete

exit 1

[15] Fix | Delete

fi

[16] Fix | Delete

[17] Fix | Delete

# Check for --send flag to disable debug mode

[18] Fix | Delete

if [[ "$2" == "--send" ]]; then

[19] Fix | Delete

debug=false

[20] Fix | Delete

fi

[21] Fix | Delete

[22] Fix | Delete

# Email settings

[23] Fix | Delete

EMAIL_RECIPIENT="str@imhadmin.net"

[24] Fix | Delete

EMAIL_SUBJECT="User with High Domain Count Detected"

[25] Fix | Delete

[26] Fix | Delete

# Function to check if a user is suspended

[27] Fix | Delete

function check_suspended() {

[28] Fix | Delete

local suspended=""

[29] Fix | Delete

if [ -f /var/cpanel/suspended/$1 ]; then

[30] Fix | Delete

local AGE=$(stat --format=%Y /var/cpanel/suspended/$1)

[31] Fix | Delete

AGE=$(($(date +%s)-AGE))

[32] Fix | Delete

AGE=$(($AGE/86400))

[33] Fix | Delete

suspended="SUSPENDED $AGE DAYS $(cat /var/cpanel/suspended/$1)"

[34] Fix | Delete

fi

[35] Fix | Delete

echo "$suspended"

[36] Fix | Delete

}

[37] Fix | Delete

[38] Fix | Delete

# Log users with over $DOMCOUNT domains or send an email

[39] Fix | Delete

process_user() {

[40] Fix | Delete

local user=$1

[41] Fix | Delete

local domain_count=$2

[42] Fix | Delete

local suspended_status=$(check_suspended "$user")

[43] Fix | Delete

[44] Fix | Delete

if [ "$debug" = true ]; then

[45] Fix | Delete

# Generate Log

[46] Fix | Delete

echo "User $user with $domain_count domains detected. $suspended_status Logged for review." >> "$LOG_FILE"

[47] Fix | Delete

else

[48] Fix | Delete

# Send email

[49] Fix | Delete

echo "A user with more than $DOMCOUNT domains has been detected: $user with $domain_count domains on $HOSTNAME - $suspended_status Please review. You may run 'touch /home/$user/.imh/domcount' to exclude this user from future checks." | mail -s "$EMAIL_SUBJECT: $user" $EMAIL_RECIPIENT

[50] Fix | Delete

[51] Fix | Delete

fi

[52] Fix | Delete

}

[53] Fix | Delete

[54] Fix | Delete

# Check domain count and skip user if excluded

[55] Fix | Delete

check_and_notify() {

[56] Fix | Delete

local user=$1

[57] Fix | Delete

local domain_count=$2

[58] Fix | Delete

local exclusion_file="/home/$user/.imh/domcount"

[59] Fix | Delete

[60] Fix | Delete

# Skip if user is excluded

[61] Fix | Delete

if [ -f "$exclusion_file" ]; then

[62] Fix | Delete

echo "Skipping user $user due to exclusion file."

[63] Fix | Delete

return

[64] Fix | Delete

else

[65] Fix | Delete

echo "$exclusion_file No exclusion file found for user $user. Proceeding with domain count check..."

[66] Fix | Delete

# Act if domain count is greater than or equal to $DOMCOUNT

[67] Fix | Delete

if [ "$domain_count" -ge $DOMCOUNT ]; then

[68] Fix | Delete

process_user "$user" "$domain_count"

[69] Fix | Delete

fi

[70] Fix | Delete

fi

[71] Fix | Delete

}

[72] Fix | Delete

[73] Fix | Delete

# Process /etc/userdomains to count domains per user

[74] Fix | Delete

declare -A userdomains

[75] Fix | Delete

while IFS=: read -r domain user; do

[76] Fix | Delete

user=$(echo "$user" | xargs)

[77] Fix | Delete

((userdomains["$user"]++))

[78] Fix | Delete

done < /etc/userdomains

[79] Fix | Delete

[80] Fix | Delete

# Check each user and manage notification

[81] Fix | Delete

for user in "${!userdomains[@]}"; do

[82] Fix | Delete

check_and_notify "$user" "${userdomains[$user]}"

[83] Fix | Delete

done

[84] Fix | Delete