Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
61
Nginx / Re: [proxy_fcgi:error] AH01071
« on: August 07, 2025, 06:37:00 AM »
Still unable to resolve this issue. Some sites are going down every now anfd then.
See error logs like
See error logs like
Quote
[Thu Aug 07 15:34:56.809883 2025] [proxy_fcgi:error] [pid 18297:tid 18336] (70007)The timeout specified has expired: [client IP:43748] AH01075: Error dispatching request to : (polling)
[Thu Aug 07 15:35:04.424964 2025] [proxy_fcgi:error] [pid 18297:tid 18318] (70007)The timeout specified has expired: [client IP:51650] AH01075: Error dispatching request to : (polling)
62
Nginx / Re: [proxy_fcgi:error] AH01071
« on: August 05, 2025, 11:00:56 AM »
Looks like the issue is due to infection discussed here
https://forum.centos-webpanel.com/centos-webpanel-bugs/critical-multiple-cwp-servers-infected-arbitrary-php-code-execution-via-publ/
https://forum.centos-webpanel.com/centos-webpanel-bugs/critical-multiple-cwp-servers-infected-arbitrary-php-code-execution-via-publ/
63
CentOS-WebPanel Bugs / Re: [CRITICAL] Multiple CWP Servers Infected – Arbitrary PHP Code Execution via Publ
« on: August 05, 2025, 10:59:41 AM »Are you running malware detection scans on your system?
ClamAV Maldet Scan do not detect these 2 files
I am running 3 VPS with AL8
All 3 are affected.
Have manually removed these files
Have the latest CWP
Anthing else to be done? Please suggest
64
CentOS-WebPanel Bugs / Re: [CRITICAL] Multiple CWP Servers Infected – Arbitrary PHP Code Execution via Publ
« on: August 05, 2025, 06:23:47 AM »
I also see this file in atleast one of my sites.
Now what is the proper solution to fix this?
I have AL 8 with latest CWP
Now what is the proper solution to fix this?
I have AL 8 with latest CWP
65
Nginx / [proxy_fcgi:error] AH01071
« on: August 05, 2025, 06:10:42 AM »
Mostof my sites are working fine. But one of the sites throughs this error
If I reboot server, sites works again for few hours
If I create a Custom WebServers Configuration and delete that, site works again.
Please suggest
Quote
[proxy_fcgi:error] [pid 107694:tid 107699] [client 46.243.3.42:58152] AH01071: Got error 'Primary script unknown'
If I reboot server, sites works again for few hours
If I create a Custom WebServers Configuration and delete that, site works again.
Please suggest
66
E-Mail / Re: CBPolicyD: Source 'any' is not a valid specification
« on: July 30, 2025, 11:12:32 AM »
Any help on this?
67
DNS Manager / Denied logs
« on: July 30, 2025, 11:09:51 AM »
I see lots of lines like these in logs
Websites are resolving without issue.
Should I worry about these?
Quote
Jul 30 20:00:41 my.server.name named[749]: client @0x7f261c06c220 69.171.230.130#37726 (my.client.tld): query (cache) 'my.client.tld/A/IN' denied
Jul 30 20:00:41 my.server.name named[749]: client @0x7f261c05d7a0 69.171.230.130#64160 (my.client.tld): query (cache) 'my.client.tld/AAAA/IN' denied
Jul 30 20:00:41 my.server.name named[749]: client @0x7f261c05d7a0 69.171.230.130#41172 (my.client.tld): query (cache) 'my.client.tld/A/IN' denied
Jul 30 20:00:41 my.server.name named[749]: client @0x7f261c05d7a0 69.171.230.130#50106 (my.client.tld): query (cache) 'my.client.tld/AAAA/IN' denied
Jul 30 20:00:42 my.server.name named[749]: client @0x7f261c05d7a0 69.171.230.130#17148 (my.client.tld): query (cache) 'my.client.tld/A/IN' denied
Jul 30 20:00:42 my.server.name named[749]: client @0x7f261c07aca0 69.171.230.130#23613 (my.client.tld): query (cache) 'my.client.tld/AAAA/IN' denied
Jul 30 20:00:42 my.server.name named[749]: client @0x7f261c07aca0 69.171.230.130#26920 (my.client.tld): query (cache) 'my.client.tld/A/IN' denied
Jul 30 20:00:42 my.server.name named[749]: client @0x7f261c06c220 69.171.230.130#39407 (my.client.tld): query (cache) 'my.client.tld/AAAA/IN' denied
Jul 30 20:00:42 my.server.name named[749]: client @0x7f261c06c220 69.171.230.130#55202 (my.client.tld): query (cache) 'my.client.tld/A/IN' denied
Jul 30 20:00:42 my.server.name named[749]: client @0x7f261c06c220 69.171.230.130#16243 (my.client.tld): query (cache) 'my.client.tld/AAAA/IN' denied
Websites are resolving without issue.
Should I worry about these?
68
E-Mail / Re: Mail Forwarders list - does not charge
« on: July 26, 2025, 10:33:40 AM »
I remember getting this issue long back.
Login to admin. Mail Alias Accounts
Check if there are any bad / unwanted characters (Only email id and , should be present)
Remove additional spaces etc and save
Login to admin. Mail Alias Accounts
Check if there are any bad / unwanted characters (Only email id and , should be present)
Remove additional spaces etc and save
69
E-Mail / Re: SpamHause x SpamAssassin
« on: July 26, 2025, 10:23:08 AM »
I guess yes. SPAM has reduced. Not checked specifically.
70
Mod_Security / Re: OWASP CRS v4.15.0 Just Release
« on: July 04, 2025, 11:52:26 AM »
@starburst
Installed OWASP CRS Ruleset 4.16.0 as per your guide.
Working fine.
Thank you
Installed OWASP CRS Ruleset 4.16.0 as per your guide.
Working fine.
Thank you
71
CentOS-WebPanel GUI / Varnish Conf
« on: June 27, 2025, 09:53:37 AM »
When I go to cwp - admin - select webservers
Nginx & Varnish & Apache ([Varnish Conf]) option
On clicking "Varnish Conf" link, I see the message
Should I do anything to fix this or is this okay?
Nginx & Varnish & Apache ([Varnish Conf]) option
On clicking "Varnish Conf" link, I see the message
Quote
Varnish NOT installed or conf file /etc/varnish/varnish.params does not exist
On CentOS 8 you can edit file: /usr/lib/systemd/system/varnish.service
Should I do anything to fix this or is this okay?
72
Mod_Security / Re: OWASP CRS v4.15.0 Just Release
« on: June 27, 2025, 07:05:52 AM »
I am using Comodo WAF as CWP alerts "We recommend using Comodo WAF rules as they are much simpler and easier for beginners."
Can you please highlight the difference and which option is better?
Can you please highlight the difference and which option is better?
73
E-Mail / Re: Postfix, SpamAssassin, or something else
« on: June 25, 2025, 05:31:55 AM »All 3 from LeaseWeb in the Netherlands. Consider reporting to their abuse@ address with the full headers. Also block those offending IPs, but it's 3 for 3 different messages, so likely there is a larger pool of source addresses used in this campaign.
Both from and to doesnt belong to this server.
Quote
From: "KetoProbiotix" <yvcaztn@firengerme.de>
To: <proiecte@centrade.ro>
Why is this email landing to this server?
74
MySQL / Re: MySQL - BAD CONFIGURATION DETECTED
« on: June 24, 2025, 11:26:12 AM »Check the config file (or its directories) isn't group or other writeable but also make sure the file is readable by the mysql user. The easy way to check the last bit is withCode: [Select]sudo -u mysql my_print_defaults --mariadbdso see what configuration options are read. Also runCode: [Select]journalctl -u mariadb.service -n 30-- failing to read configuration files is normally a warning.
Quote
[root@hosting ~]# sudo -u mysql my_print_defaults --mariadbd
--bind-address=127.0.0.1
Code: [Select]
journalctl -u mariadb.service -n 30
Jun 24 06:10:35 servername mariadbd[831]: 2025-06-24 6:10:35 785765 [Warning] Aborted connection 785765 to db: 'postfix' user: 'postfix' host: 'loc>
I realise that yesterday configserver suggested my to bind mysql to IP. I commented it now.
How to check if this is resolved now?
75
E-Mail / Re: Postfix, SpamAssassin, or something else
« on: June 24, 2025, 11:14:52 AM »
Had similar issue. Emails were bouncing and sitting in postfix que (in 100s)
On checking the arrival info of one these emails, I could see that sender was an user in my system.
I changed the password and informed that user.
Problem stopped.
On checking the arrival info of one these emails, I could see that sender was an user in my system.
I changed the password and informed that user.
Problem stopped.
