Messages

31

Updates / Re: Unable to load dynamic library 'intl'

« on: June 24, 2026, 02:35:21 AM »

Usual advice:
Follow Sandeep's guide to install INtl and also update Roundcube to the last 1.5.15 LTS version (update all paths and references from 1.5.8 to 1.5.15):
https://www.alphagnu.com/topic/33-update-cwp-roundcube-mail-version-158-%E2%80%93-control-web-panel/

32

CentOS 7 Problems / Re: Roundcube Mail - Server Error! (Internal Server Error)

« on: June 22, 2026, 02:30:47 PM »

Roundcube requires the INTL extension. See these directions:
https://www.alphagnu.com/topic/33-update-cwp-roundcube-mail-version-158-%E2%80%93-control-web-panel/
(And consider updating to the last LTS version: 1.5.15 (you can follow the directions from AlphaGNU, but update the version number from 1.5.8 to 1.5.15 in all cases.)

33

E-Mail / Re: Webmail list mails error

« on: June 22, 2026, 01:34:41 PM »

Roundcube's spoofchecker depends on intl, which needs to be installed (or you can workaround by commenting out the relevant function in the RC code). Are you running the 1.5.15 LTS version of Roundcube?
https://www.alphagnu.com/topic/33-update-cwp-roundcube-mail-version-158-%E2%80%93-control-web-panel/

34

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 20, 2026, 10:43:02 PM »

FYI, the named default shell assignment is /bin/false.

All of my users don't have shell access, so they too are /sbin/nologin. root, sync, shutdown, halt, and apache are some of the few that have a valid shell assignment. Even cbpolicyd has the /sbin/nologin shell assignment.

35

E-Mail / Re: New Roundcube 1.6 version failed

« on: June 20, 2026, 10:35:52 PM »

You need the 1.5.15 LTS version for compatibility with CWP (unfortunately, the 1.5.x branch is EOL as of the end of March of this year):
https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-roundcube-webmail-to-version-1-5-15-in-cwp-on-almalinux-8-9/

Hopefully the dev team will update the PHP backend from 7.2 to enable further updates on Roundcube and other services.

36

CentOS-WebPanel GUI / Re: Bug in GUI for New Backup (beta)

« on: June 19, 2026, 10:43:42 PM »

Is your IP address whitelisted on their firewalls?

37

Backup / Re: Critical Backup Bug After Latest Update (new backup)

« on: June 19, 2026, 11:54:56 AM »

There is a beta vs stable track if you prefer the immediate security benefits or the 2 weeks of testing before the updates get pushed out to all users. Your choice of which track.

38

E-Mail / Updated directions for AlmaLinux 8/9

« on: June 18, 2026, 12:54:41 AM »

An update on this, since I noticed SpamAssassin's status shows a Razor error on the default CWP install. Plus, many users are crying out due to the deluge of spam they are facing. So I gave these instructions a whirl. Just a few updates to note:

With AlmaLinux 8, you only need to install pyzor:

Code: [Select]

dnf install pyzorAdd 2703 to TCP_OUT in

Code: [Select]

/etc/csf/csf.conf, then issue

Code: [Select]

csf -r to restart the firewall.

You don't need to enable the Pyzor plugin in

Code: [Select]

/etc/mail/spamassassin/v310.pre -- it is already enabled.

The only other change in the directions is that you should create the razor-agent.conf file BEFORE restarting SpamAssassin

Code: [Select]

/etc/mail/spamassassin/.razor/razor-agent.conf
To test Razor with the GTUBE (Generic Test for Unsolicited Bulk Email) test:

Code: [Select]

spamassassin -t -D razor2 < /usr/share/doc/spamassassin/sample-spam.txt

39

Updates / Re: [SECURITY ALERT] Unauthorized port / [SECURITY ALERT] Unknown/Untrusted file..

« on: June 17, 2026, 10:44:37 PM »

You can use a patched version of the security audit script that doesn't flag false positives:
https://www.alphagnu.com/topic/625-fixing-false-positive-cwp-security-audit-alerts-on-almalinux-9x/

40

Updates / Re: Roundcube vulnerability

« on: June 14, 2026, 01:31:48 PM »

You should be running the LTS 1.5.x branch for CWP compatibility. Can you verify that is your current (and only) version installed? 1.6.x won't work.

41

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 12:44:07 PM »

IOC? Symptoms?

42

Apache / Re: HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare

« on: June 08, 2026, 11:56:09 AM »

I wouldn't run the GitHub version in production; I prefer the version from the Apache Foundation for stable, production use:

It [GitHub version] servers as early access to features and fixes before being shipped in the next Apache release. Both modules can be considered production ready and stable as shipped by the Apache project.

43

Apache / Re: HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare

« on: June 08, 2026, 01:56:07 AM »

Should be tied to the main Apache version; so in this case:
https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-apache-http-2-to-2-4-67-in-cwp-on-almalinux-8-9/
It should be 2.4.67.

44

Apache / Re: HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare

« on: June 07, 2026, 02:29:02 PM »

Between https://starburst.help and https://www.alphagnu.com, all the instructions are there to update.

45

Apache / Re: HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare

« on: June 05, 2026, 01:32:05 PM »

Update: Apache, Nginx, MariaDB, Roundcube, Mod Security, OWASP ruleset, CSF (Aetherinox).