scan_bad_signature.sh: warn if encryption is NOT enabled.

scan_bad_signature.sh

@@ -406,6 +406,29 @@ if [[ ! -x "$PHP_BIN" ]]; then
 fi
 
 
+# =============
+# --- Check Server-Side Encryption status
+# =============
+
+blank_line
+echononl "   Check Server-Side Encryption status.."
+
+_encryption_status_out="$(su -c "$PHP_BIN $INSTALL_DIR/occ encryption:status" -s /bin/bash $HTTP_USER 2> "$log_file")"
+
+ENCRYPTION_ENABLED="unknown"
+
+if [[ -s "$log_file" ]] ; then
+   echo_failed
+   error "$(cat "$log_file")"
+elif echo "$_encryption_status_out" | grep -qiE 'enabled:[[:space:]]*true' ; then
+   echo_ok
+   ENCRYPTION_ENABLED="yes"
+else
+   echo_warning
+   ENCRYPTION_ENABLED="no"
+fi
+
+
 # =============
 # --- Determine existing accounts
 # =============
@@ -732,6 +755,10 @@ if $terminal ; then
    echo -e   "   Report file...........................: $report_file"
    echo ""
 
+   if [[ "$ENCRYPTION_ENABLED" = "no" ]] ; then
+      warn "Server-Side Encryption is NOT enabled on ${WEBSITE} - this scan only makes sense on instances with encryption switched on, so it will most likely find nothing."
+   fi
+
    echo ""
    echo -n "   Type upper case 'YES' to continue executing with this parameters: "
    read OK