Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
1
Updates / CWP7 Version 1.2
« on: Today at 11:34:22 AM »
The numbering has undergone a major change—is this the start of a new era?
Version 1.2 (released 27/07/2026)
Admin Panel
FIXED ADMIN UPDATED
– Improved security for login and session
– Improved security on file system functions
– Improved security for API
– New script for cleaning server logs /scripts/clean_logs
– New script for checking disk quota status /scripts/quota_check_status
Version 1.2 (released 27/07/2026)
Admin Panel
FIXED ADMIN UPDATED
– Improved security for login and session
– Improved security on file system functions
– Improved security for API
– New script for cleaning server logs /scripts/clean_logs
– New script for checking disk quota status /scripts/quota_check_status
2
Information / CWP: What is the future of the project? Is it still the right choice?
« on: Today at 08:42:17 AM »Hello everyone,
I have been using CWP Pro for several years, and overall it has served me well. However, over the past year I have become increasingly concerned about the future of the project, and I would really like to hear the opinions of other users.
As a system administrator, I need a control panel that is actively maintained, secure, and able to keep pace with modern hosting requirements. Unfortunately, I have the feeling that CWP is falling further behind compared to other control panels.
Some of my main concerns are:
New PHP versions seem to take a long time before becoming available.
Some updates appear to fix issues but also introduce new bugs or regressions.
The backup and restore system has caused me several problems. In my opinion, backups are one of the most critical features of any hosting panel, and reliability is absolutely essential.
Development seems slower than it used to be, and new features are released less frequently.
Communication regarding the project's roadmap and future plans is quite limited.
Technical support has also become a concern for me. Although I pay for a support plan, I have experienced response times of 5 to 10 days for some tickets. For production servers, such delays can be difficult to accept when an issue requires prompt attention.
This leads me to a simple question:
What is the long-term vision for CWP?
Many competing panels such as Webuzo, DirectAdmin, and Plesk seem to be evolving much faster, with quicker PHP support, frequent updates, and more modern backup solutions.
I am not trying to criticize CWP or start an argument. I genuinely want to understand whether other administrators share the same concerns or if my experience is unusual.
I would really appreciate hearing your thoughts:
Are you still confident in CWP's future?
Do you trust it for production environments?
Have you experienced issues with backups or restore operations?
How has your experience with technical support been?
Are you satisfied with the current development pace?
Are you planning to stay with CWP, or are you considering moving to another control panel?
Personally, I am at an important decision point. I am preparing to deploy a new production server and must decide whether to continue investing in the CWP ecosystem or migrate to another platform.
I sincerely hope CWP continues to grow and improve because it has many strengths. However, I believe the project needs to demonstrate a stronger development roadmap, faster adoption of new technologies, more reliable backup and restore features, and more responsive technical support if it wants to remain competitive in today's hosting market.
I look forward to reading your experiences and opinions.
Thank you.
3
Information / End of life for CWP6
« on: Today at 08:31:06 AM »
Hello, it seems there have been changes to the changelog page; here is what is currently displayed:
Current Version: CWP7: 0.9.8.1244
CWP for EL9 Latest
CWP for CentOS 8/AlmaLinux 8 is the recommended version.
CWP7+ compatible with CentOS Stream, AlmaLinux, Rocky Linux, and Oracle Linux.
Previously, CWP6 was also mentioned.
They have also removed support for CentOS 7 and 8.
Current Version: CWP7: 0.9.8.1244
CWP for EL9 Latest
CWP for CentOS 8/AlmaLinux 8 is the recommended version.
CWP7+ compatible with CentOS Stream, AlmaLinux, Rocky Linux, and Oracle Linux.
Previously, CWP6 was also mentioned.
They have also removed support for CentOS 7 and 8.
4
Other / Forum improvement
« on: Today at 08:28:39 AM »
Hello, I don't know if it's just me, but there seem to have been some improvements to the forum; member access is available again, and there don't seem to be any issues anymore.
5
Other / Re: New CVEs in Linux Kernel: CVE-2026-53359, CVE-2026-46242, CVE-2026-43499
« on: July 12, 2026, 01:54:38 PM »
Distro Name: AlmaLinux release 8.10 (Cerulean Leopard)
Kernel Version: 4.18.0-553.92.1.el8_10.x86_64
Platform: x86_64
Kernel Version: 4.18.0-553.92.1.el8_10.x86_64
Platform: x86_64
6
Other / Re: New CVEs in Linux Kernel: CVE-2026-53359, CVE-2026-46242, CVE-2026-43499
« on: July 11, 2026, 06:21:45 PM »
In my case, when I update the server, it prevents startup with the CWP secure kernel.
7
Backup / Re: problem with the local beta backup
« on: July 08, 2026, 01:49:29 PM »
Bug Report – CWP SFTP Backup Compatibility with SFTPGo
Hello,
I would like to report what appears to be a compatibility issue between the CWP SFTP backup feature and SFTPGo.
Environment
CWP: Latest available version
Backup Server: SFTPGo (latest Docker image)
Protocol: SFTP / SSH
Port: 22
Authentication: Username + Password
Issue Description
When configuring an SFTP backup destination in CWP, the connection always fails with the following error:
Login Failed:
Permission denied, please try again.
Received disconnect from xxx.xxx.xxx.xxx port 22:2:
too many authentication failures
At first glance, this appears to be an authentication problem, but after analyzing the SFTPGo server logs, the issue is actually different.
Investigation
The SFTPGo logs show that CWP performs several authentication attempts in the following order:
Public Key authentication
Keyboard-Interactive authentication (without credentials)
Password authentication (without credentials)
Finally, a successful login using keyboard-interactive authentication.
Immediately after the successful authentication, CWP executes the following remote command:
mkdir -p ~/.ssh &&
chmod 700 ~/.ssh &&
echo <public_key> >> ~/.ssh/authorized_keys &&
chmod 600 ~/.ssh/authorized_keys
However, SFTPGo is a pure SFTP server and does not provide an interactive shell.
As a result, SFTPGo returns:
ssh command not enabled/supported: "mkdir"
and the session is terminated.
Root Cause
The current implementation appears to assume that every SFTP server also provides a full SSH shell.
This assumption is not always valid.
Modern SFTP servers such as:
SFTPGo
AWS Transfer Family
Azure SFTP
Google Cloud SFTP
may expose only the SFTP subsystem without allowing remote shell commands.
Because CWP automatically attempts to execute shell commands in order to install an SSH public key, the connection fails even though SFTP authentication itself succeeds.
Expected Behaviour
The SFTP backup feature should support standard RFC-compliant SFTP servers without requiring shell access.
Ideally, CWP should:
perform a standard SFTP login;
verify read/write access using SFTP operations only;
avoid executing remote shell commands unless explicitly requested;
provide an option to disable automatic SSH key installation.
Why this matters
Many hosting providers and secure backup appliances intentionally disable shell access while still offering fully functional SFTP services.
Currently, these servers cannot be used with CWP backups even though they fully support the SFTP protocol.
Supporting pure SFTP servers would improve compatibility with modern backup infrastructures and managed storage services.
Thank you for investigating this issue.
Hello,
I would like to report what appears to be a compatibility issue between the CWP SFTP backup feature and SFTPGo.
Environment
CWP: Latest available version
Backup Server: SFTPGo (latest Docker image)
Protocol: SFTP / SSH
Port: 22
Authentication: Username + Password
Issue Description
When configuring an SFTP backup destination in CWP, the connection always fails with the following error:
Login Failed:
Permission denied, please try again.
Received disconnect from xxx.xxx.xxx.xxx port 22:2:
too many authentication failures
At first glance, this appears to be an authentication problem, but after analyzing the SFTPGo server logs, the issue is actually different.
Investigation
The SFTPGo logs show that CWP performs several authentication attempts in the following order:
Public Key authentication
Keyboard-Interactive authentication (without credentials)
Password authentication (without credentials)
Finally, a successful login using keyboard-interactive authentication.
Immediately after the successful authentication, CWP executes the following remote command:
mkdir -p ~/.ssh &&
chmod 700 ~/.ssh &&
echo <public_key> >> ~/.ssh/authorized_keys &&
chmod 600 ~/.ssh/authorized_keys
However, SFTPGo is a pure SFTP server and does not provide an interactive shell.
As a result, SFTPGo returns:
ssh command not enabled/supported: "mkdir"
and the session is terminated.
Root Cause
The current implementation appears to assume that every SFTP server also provides a full SSH shell.
This assumption is not always valid.
Modern SFTP servers such as:
SFTPGo
AWS Transfer Family
Azure SFTP
Google Cloud SFTP
may expose only the SFTP subsystem without allowing remote shell commands.
Because CWP automatically attempts to execute shell commands in order to install an SSH public key, the connection fails even though SFTP authentication itself succeeds.
Expected Behaviour
The SFTP backup feature should support standard RFC-compliant SFTP servers without requiring shell access.
Ideally, CWP should:
perform a standard SFTP login;
verify read/write access using SFTP operations only;
avoid executing remote shell commands unless explicitly requested;
provide an option to disable automatic SSH key installation.
Why this matters
Many hosting providers and secure backup appliances intentionally disable shell access while still offering fully functional SFTP services.
Currently, these servers cannot be used with CWP backups even though they fully support the SFTP protocol.
Supporting pure SFTP servers would improve compatibility with modern backup infrastructures and managed storage services.
Thank you for investigating this issue.
8
Backup / problem with the local beta backup
« on: July 08, 2026, 01:37:42 PM »
I notice this problem with the local beta backup
I am encountering an issue with the local backup restore feature (beta version).
Hello,
We are experiencing a problem with the new local backup restore feature on our server.
The backup files are present on the server and appear to be complete and intact. However, the restore process does not start correctly.
Whenever we attempt to restore an account, the process consistently gets stuck at the "Detecting files" stage and makes no further progress.
The restore log repeatedly shows the following information:
2026-07-07 14:14:06 UPDATE restore SET ST='20260707201406' WHERE ST='1'
2026-07-07 14:14:06 >>>>>>>>> [1,1,1,1,1,1,1,1,1,grizzy,2026-06-27_17-15-04,0,,1,1,1,1,1]
2026-07-07 14:14:06 Detecting files
We have verified that the backup directory exists and that all backup archives are available.
Based on our investigation, it appears that the restore utility is generating an incorrect path and attempting to locate a non-existent backup archive, even though the backup data is available at the correct location.
Could you please check if this is a known issue with this new local backup restore feature?
If so, is there a fix, a workaround, or an updated restore procedure available to successfully restore the accounts?
I am encountering an issue with the local backup restore feature (beta version).
Hello,
We are experiencing a problem with the new local backup restore feature on our server.
The backup files are present on the server and appear to be complete and intact. However, the restore process does not start correctly.
Whenever we attempt to restore an account, the process consistently gets stuck at the "Detecting files" stage and makes no further progress.
The restore log repeatedly shows the following information:
2026-07-07 14:14:06 UPDATE restore SET ST='20260707201406' WHERE ST='1'
2026-07-07 14:14:06 >>>>>>>>> [1,1,1,1,1,1,1,1,1,grizzy,2026-06-27_17-15-04,0,,1,1,1,1,1]
2026-07-07 14:14:06 Detecting files
We have verified that the backup directory exists and that all backup archives are available.
Based on our investigation, it appears that the restore utility is generating an incorrect path and attempting to locate a non-existent backup archive, even though the backup data is available at the correct location.
Could you please check if this is a known issue with this new local backup restore feature?
If so, is there a fix, a workaround, or an updated restore procedure available to successfully restore the accounts?
9
Other / Yanz Webshell! - PRIV8 WEB SHELL ORB YANZ BYPASS! V3.0
« on: July 06, 2026, 02:58:58 PM »
Hello, I think my server has been compromised by a backdoor.
Yanz Webshell! - PRIV8 WEB SHELL ORB YANZ BYPASS! V3.0
The file READ-THIS-TO-RECOVER-YOUR-FILE.TXT
along with many other files—how do I fix these backdoors?
Yanz Webshell! - PRIV8 WEB SHELL ORB YANZ BYPASS! V3.0
The file READ-THIS-TO-RECOVER-YOUR-FILE.TXT
along with many other files—how do I fix these backdoors?
10
Updates / Re: Dev Team went rogue ?
« on: July 06, 2026, 06:32:16 AM »
I urgently passed the information on to José and shared this post with him; I think he will respond to this matter quickly—he has always stepped up, and he always will.
11
Updates / CWP7: 0.9.8.1243
« on: July 05, 2026, 08:03:57 AM »
CWP7: 0.9.8.1243
It appears that CWP has rolled out numerous updates—both minor and major—over the past few weeks, suggesting renewed interest in the control panel.
It appears that CWP has rolled out numerous updates—both minor and major—over the past few weeks, suggesting renewed interest in the control panel.
12
Backup / SFTP test: ALL FAILED
« on: June 22, 2026, 09:39:15 AM »
Hello,
I'm experiencing an issue when trying to configure SFTP backups from CWP to Infomaniak Swiss Backup.
Environment
CWP Pro (latest updates installed)
Destination: Infomaniak Swiss Backup (SFTP)
Authentication: Username + Password
Port: 22
CWP Test Output
2026-06-22 11:32:57 SFTP
2026-06-22 11:32:57 SFTP
2026-06-22 11:32:58 SFTP test step1 (key): result=[
Warning: Permanently added 'sftp.swiss-backup04.infomaniak.com,185.125.24.38' (RSA) to the list of known hosts.
Permission denied, please try again.
Permission denied, please try again.
SBI-CG720469@sftp.swiss-backup04.infomaniak.com: Permission denied (password).
]
2026-06-22 11:32:58 SFTP test step2 (manual key copy): result=[
Warning: Permanently added 'sftp.swiss-backup04.infomaniak.com,185.125.24.38' (RSA) to the list of known hosts.
exec request failed on channel 0
]
2026-06-22 11:32:58 SFTP test: ALL FAILED
I'm experiencing an issue when trying to configure SFTP backups from CWP to Infomaniak Swiss Backup.
Environment
CWP Pro (latest updates installed)
Destination: Infomaniak Swiss Backup (SFTP)
Authentication: Username + Password
Port: 22
CWP Test Output
2026-06-22 11:32:57 SFTP
2026-06-22 11:32:57 SFTP
2026-06-22 11:32:58 SFTP test step1 (key): result=[
Warning: Permanently added 'sftp.swiss-backup04.infomaniak.com,185.125.24.38' (RSA) to the list of known hosts.
Permission denied, please try again.
Permission denied, please try again.
SBI-CG720469@sftp.swiss-backup04.infomaniak.com: Permission denied (password).
]
2026-06-22 11:32:58 SFTP test step2 (manual key copy): result=[
Warning: Permanently added 'sftp.swiss-backup04.infomaniak.com,185.125.24.38' (RSA) to the list of known hosts.
exec request failed on channel 0
]
2026-06-22 11:32:58 SFTP test: ALL FAILED
13
CentOS-WebPanel GUI / Re: Bug in GUI for New Backup (beta)
« on: June 20, 2026, 04:14:35 PM »
I keep getting an SFTP error when I try to connect. Here it is:
Something went wrong. Login Failed: Warning: Permanently added 'rs14.cloudlws.com,91.234.194.115' (ECDSA) to the list of known hosts. Permission denied, please try again. Permission denied, please try again. cd7697@rs14.cloudlws.com: Permission denied (publickey,password).
I don't understand how to resolve it.
Something went wrong. Login Failed: Warning: Permanently added 'rs14.cloudlws.com,91.234.194.115' (ECDSA) to the list of known hosts. Permission denied, please try again. Permission denied, please try again. cd7697@rs14.cloudlws.com: Permission denied (publickey,password).
I don't understand how to resolve it.
14
Updates / Re: CWP7: 0.9.8.1233
« on: June 18, 2026, 05:10:29 PM »
FIXED ADMIN
– Backup module
– General security settingx
– Change Root Password
– Backup module
– General security settingx
– Change Root Password
15
Updates / CWP7: 0.9.8.1233
« on: June 18, 2026, 08:15:04 AM »
Fixed the issue with backing up temporary folders.
I don't have any further information on the other changes.
I don't have any further information on the other changes.
