Messages

1

CentOS-WebPanel Bugs / Re: Bug in new CWP Update: Yum Manager stuck on "Checking for updates..." due to 404

« on: July 30, 2026, 08:46:24 AM »

Update:

The issue seems to be ssh_exec() related.

2

CentOS-WebPanel Bugs / Re: Root .ssh directory disappeared (including authorized_keys) after CWP update?

« on: July 30, 2026, 08:41:10 AM »

same here. I suspected CWP but couldnt find logs indicating that.

I had to VNC to the server and readd it there, and it still got wiped next day.

I did it again, and then kept ssh open for several days.

Then started another ssh and it showed an error message indicating that the folder is gone again.
I readded it through the previously opened ssh and it worked fine since then.

3

CentOS-WebPanel Bugs / Re: Bug in new CWP Update: Yum Manager stuck on "Checking for updates..." due to 404

« on: July 30, 2026, 08:38:38 AM »

im trying to find a temp fix. A lot of modules are having problems.

4

CentOS-WebPanel GUI / Temp FIX for firewallv2

« on: July 30, 2026, 07:35:25 AM »

This will trick your panel to look at firewall.php through firewallv2.php


# Navigate to the CWP admin modules directory
cd /usr/local/cwpsrv/htdocs/resources/admin/modules

# Link firewallv2.php to the actual firewall file
ln -s firewall.php firewallv2.php

# Restart the CWP web service
/scripts/restart_cwpsrv

5

Installation / Re: New installation of CWP on Alma Linux 9. Will it work?

« on: May 17, 2023, 09:57:06 PM »

Currently the cwp team is working many hours to make everything work on el9, everything will be completed soon

I'm not familiar with the acronym of "EL9". Does this refer to RHEL 9? Meaning support for CentOS Stream 9 also?

I'm currently running CentOS stream 8.

6

E-Mail / Re: Client host rejected: Access denied

« on: April 13, 2023, 02:50:19 PM »

You seem to have a problem with this line:

Code: [Select]

smtpd_client_restrictions = reject_unknown_clientUncomment this.

Here's my resctrictions on my main.cf file:

Code: [Select]

# rules restrictions
smtpd_client_restrictions =
smtpd_helo_restrictions =
smtpd_sender_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_non_fqdn_sender,
        reject_unknown_sender_domain,
        check_sender_access hash:/etc/postfix/sender_access
smtpd_recipient_restrictions = check_policy_service inet:127.0.0.1:10031,
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_unauth_destination,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unknown_recipient_domain,
        check_policy_service unix:private/policyd-spf
        #reject_rhsbl_helo dbl.spamhaus.org,
        #reject_rhsbl_reverse_client dbl.spamhaus.org,
        #reject_rhsbl_sender dbl.spamhaus.org,
        #reject_rbl_client zen.spamhaus.org
# uncomment for realtime black list checks
# ,reject_rbl_client zen.spamhaus.org
# ,reject_rbl_client bl.spamcop.net
# ,reject_rbl_client dnsbl.sorbs.net

7

E-Mail / Re: Client host rejected: Access denied

« on: April 10, 2023, 09:45:51 PM »

Please post the content of /etc/postfix/main.cf

8

PHP / Re: None PHP7+ installation was found!

« on: April 09, 2023, 07:50:47 PM »

i have Pro version of CWP but I dont't have Managed CWP

If you can't install PHP-FPM with CWP Pro, then you have something wrong with your system.
If you want to manually install PHP Defender then look at this only if you have PHP-FPM already installed, but I still wouldn't recommend a manual install. I would recommend reinstalling the entire system and reinstall CWP Pro.
https://forum.centos-webpanel.com/index.php?topic=11590.msg39998#msg39998

by the way, you need PHP-FPM version 7+ if you want PHP Defender.

9

Information / Re: Cloudflare Tunnel

« on: April 09, 2023, 07:46:06 PM »

Technically, any privately provided internet service from an ISP is for private use only. Most ISPs don't monitor you, but lets say you have fiber and a static IP. If you start getting DDOS-ed and/or a lot of activity, then they will start looking into you.

Take a look into these articles:
https://developers.cloudflare.com/fundamentals/get-started/setup/allow-cloudflare-ip-addresses/#allowlist-cloudflare-ip-addresses
https://gist.github.com/Manouchehri/cdd4e56db6596e7c3c5a

10

Information / Re: Ebury trojan on all of my CWP servers

« on: April 09, 2023, 07:30:39 PM »

Ok, there seems to be a possible false positive story going on here...

Step by step:
First:

Code: [Select]

ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"This code's only purpose is to find out whether or not the command "ssh -G" returns the message "illegal option" in the first line. If it doesnt return this line, then it somehow means that the system is infected.

Second:
Searching for those files:

Code: [Select]

[root@pmail ~] ls -all /lib64/libkeyutils.so*
lrwxrwxrwx  1 root root    27 Jun 19  2021 /lib64/libkeyutils.so -> /usr/lib64/libkeyutils.so.1
lrwxrwxrwx. 1 root root    18 Jun 19  2021 /lib64/libkeyutils.so.1 -> libkeyutils.so.1.6
-rwxr-xr-x. 1 root root 16192 Jun 19  2021 /lib64/libkeyutils.so.1.6
Take a look at the date.

Next step is to check if those files are installed from a repo:

Code: [Select]

[root@pmail ~]# rpm -q --whatprovides /lib64/libkeyutils.so*
keyutils-libs-devel-1.5.10-9.el8.x86_64
keyutils-libs-1.5.10-9.el8.x86_64
keyutils-libs-1.5.10-9.el8.x86_64

Next step is to check when was this installed:

Code: [Select]

[root@pmail ~]# dnf history list keyutils-libs
ID     | Command line                                                                                                                                                                           | Date and time    | Action(s)      | Altered
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
     1 |                                                                                                                                                                                        | 2021-12-26 14:06 | Install        |  362 EETake a look at the date and what line number is this. It says line number 1. Which means these files are installed on the first ever install

Code: [Select]

[root@pmail ~]# dnf history info 1 | grep 'keyutils-libs'
    Install keyutils-libs-1.5.10-9.el8.x86_64                         @baseos
This install was BEFORE CWP was installed. So, this seems like some mass hysteria going on with these files. It's a false positive.

Third:

Code: [Select]

netstat -plan | grep atdIt returns a result, but nothing is using it.

Probably because I have all ports closed except those needed?
Now, does a result from this last command indicate that my system is infected?

Here is an example of another article saying that a result like this means you're infected:

unix 2 [ ACC ] STREAM LISTENING 103713 8119/atd @/tmp/dbus-ZP7tFO4xsL

The red part is what indicates infection. I don't have the red part on my output.

11

PHP / Re: None PHP7+ installation was found!

« on: March 23, 2023, 05:58:27 PM »

Snuffleupagus (aka PHP Defender) only works with PHP-FPM.
PHP-FPM is only available with the Pro version of CWP.

12

Information / Re: Ebury trojan on all of my CWP servers

« on: March 23, 2023, 05:52:48 PM »

just did a complete scan. Took 108 minutes scanning almost half a million files. I dont have it

13

Installation / Re: mail server only

« on: March 14, 2023, 04:18:59 PM »

oh wait, I havnt though about the part of SSL renewal. I think this CWP process needs those http ports open? and even possibly requiring correct DNS configuration to the same server.

On my server, I have not installed individual email SSL certificates for each domain. What I have done is to let all email account use the same smtp/imap hostname which is the same address as the server hostname/URL. This way I only need to renew the SSL for the hostname instead of all of them. This way, you may also create a script that will manually renew the certificate without using http-verification method

14

Installation / Re: mail server only

« on: March 10, 2023, 04:06:46 PM »

I get nightly forensic reports from google on my spf and dkim records.  They are always positive.  Google pays close attention to both of these records.

But I still have the question of how do I set up individual emails on the mail server without domains on the same server:

info@domain1.com
info@domain2.com
info@domain3.com

etc etc.

You will have to create a domain in order to create emails for those domains. After that, just don't point any DNS A-record to this server.
Block http/https ports with firewall as well if you like to completely block them.

15

New Modules / Re: [module] PhpMyAdmin auto login

« on: December 22, 2022, 05:30:42 PM »

Please does anyone know how to make this work for CWP in 2022?

Have you even tried the phpmyadmin button in the menu of admincp and usercp instead of reviving a 7 years old thread?
It's already there!

In my opinion, this should actually be reversed. I don't like auto-logins to security-sensitive areas.