Messages

1

Updates / Re: update 0.9.8.1239 remove all users database + postfix acc

« on: July 04, 2026, 04:59:46 PM »

So they released a new version and fixed this script? Has anyone tried updating?

2

Updates / Re: Did 0.9.8.1239 remove extra DB users?

« on: July 01, 2026, 07:50:32 PM »

What if I block the script until better times? How will the system react to this during an update?

chmod 400
chown root:root
chattr +i

3

Updates / Re: Did 0.9.8.1239 remove extra DB users?

« on: July 01, 2026, 11:12:23 AM »

While analyzing the script, I couldn't find any reason for it to delete the entire `/root/.ssh` folder. The script uses `sed` to remove a specific key, so this behavior looks strange.

Part of the script appears to be overly aggressive:
SELECT User, Host FROM mysql.user WHERE Host='%' AND User NOT IN ('root', 'mariadb.sys', 'debian-sys-maint');

It removes all users where `HOST = %`.
In my setup, all users have `HOST = %`, because database access is controlled by a whitelist at the provider level.

Will this script be fixed?

4

Updates / Re: Did 0.9.8.1239 remove extra DB users?

« on: July 01, 2026, 10:11:10 AM »

Hi,

The same update (0.9.8.1239) pushed a new script today at /usr/local/cwpsrv/htdocs/resources/scripts/temp_hacker_check.

Be careful if you are on AWS or other cloud providers: the script contains a hardcoded list of users to lock down, and centos is included.

Even if your server is completely clean, the script automatically:

Deletes the entire /home/centos/.ssh folder (wiping legitimate keys).

Sets the shell to /sbin/nologin.

Thanks for the information! Could you clarify whether this means the script detected malicious code or backdoors in the SSH keys?

Is there a risk that it will delete the users and keys again after I re-add them?

The logs only contain an entry about a successful cleanup.

5

Updates / Re: Did 0.9.8.1239 remove extra DB users?

« on: July 01, 2026, 09:25:32 AM »

Hi. I've run into the same problems. All additional database users were deleted, and the `/root/.ssh` directory was removed as well.

Is there any information available about this incident? Could it be caused by an update error?

6

PHP / Re: PHP File cache

« on: August 29, 2023, 11:53:39 AM »

I have the same problem. Did you manage to solve it?

Update

I guess disabling the cache should help.
/opt/alt/php-fpm74/usr/php/php.d/opcache.ini

7

Migration from other control panels / Re: cwp-cwp migration Connection not reached The following error occurred

« on: August 12, 2022, 09:09:02 PM »

Hi! I see that the error appeared not so long ago, if I found the same question I wanted to ask.

Were you able to find the cause of the error? I have the exact same problem. I did a migration before and there was no problem.

Now I see the same error in the log files and in the last line there is also no "true" or "false"

At the same time, if I run the script manually

Code: [Select]

sshpass -p PASSWORD /usr/bin/ssh -p PORT -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=quiet root@HOST test -d /usr/local/cwp/ && echo 'true' || echo 'false' 2>&1
The server will answer "true".

I would like to understand where the error could be.

8

CentOS 7 Problems / Re: Crontab only works manually by clicking on the 'Run'

« on: April 11, 2022, 07:36:36 PM »

Hi all.
Faced with the same problem. If it helps anyone, changing the "Process limit" and "Open files" settings helped me. They were originally set to "-1". Setting it to 500 and 1000, helped to run cron for users.
Also the inode was set to 0.

Also check the cron files in /var/spool/cron/
Maybe they have errors or extra spaces in them, like mine.

9

Installation / Re: Jailkit problems

« on: April 03, 2022, 05:59:30 PM »

Hi!

How did you solve the problem?