Control Web Panel
WebPanel => Updates => Topic started by: ripieces on July 07, 2016, 07:29:54 PM
-
I am especially worried about the last log email I got, since suddenly something with @gmail.com was popping up as get URL. Maybe someone is trying to hijack the update mechanism? (Hopefully not)
This was the last update that was "fine" this morning:
04:04: Cron <root@XXXX> [ ! -f /etc/cron.hourly/0anacron ] && run-parts /etc/cron.daily
/etc/cron.daily/cwp:
====================================================
============= CentOS Web Panel Cron ================
====================================================
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
Your CWP version: 0.9.8.17
No update needed, your CWP is up to date.
XXXX
Date which backup script is using: 2016-07-07 02:02:05
PHP Notice: Undefined variable: ssh_check_r_connection in /usr/local/cwpsrv/htdocs/resources/admin/include/cron_backup.php(1) : eval()'d code(1) : eval()'d code on line 7
Notice: Undefined variable: ssh_check_r_connection in /usr/local/cwpsrv/htdocs/resources/admin/include/cron_backup.php(1) : eval()'d code(1) : eval()'d code on line 7
PHP Notice: Undefined variable: ssh_check_r_connection in /usr/local/cwpsrv/htdocs/resources/admin/include/cron_backup.php(1) : eval()'d code(1) : eval()'d code on line 7
Notice: Undefined variable: ssh_check_r_connection in /usr/local/cwpsrv/htdocs/resources/admin/include/cron_backup.php(1) : eval()'d code(1) : eval()'d code on line 7
[...]
Then 12 minutes later things started getting strange every 4 hours:
4:12: Cron <root@XXX> /usr/local/cwp/php54/bin/php -d max_execution_time=1000000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
====================================================
============= CentOS Web Panel Cron ================
====================================================
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
Your CWP version: 0.9.8.17
PHP Warning: file_get_contents(http://centos-webpanel.com/webpanel/main.php?app=rc4key&version=0.9.8.17): failed to open stream: HTTP request failed! in /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php(1) : eval()'d code(1) : eval()'d code on line 8
PHP Warning: Division by zero in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php(1) : eval()'d code(1) : eval()'d code on line 1
PHP Notice: String offset cast occurred in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php(1) : eval()'d code(1) : eval()'d code on line 1
PHP Notice: Uninitialized string offset: 0 in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php(1) : eval()'d code(1) : eval()'d code on line 1
PHP Warning: Division by zero in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php(1) : eval()'d code(1) : eval()'d code on line 1
PHP Notice: String offset cast occurred in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php(1) : eval()'d code(1) : eval()'d code on line 1
PHP Notice: Uninitialized string offset: 0 in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php(1) : eval()'d code(1) : eval()'d code on line 1
[lots of these 3 above ...]
XXX
12:12: Cron <root@XXX> /usr/local/cwp/php54/bin/php -d max_execution_time=1000000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
====================================================
============= CentOS Web Panel Cron ================
====================================================
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
Your CWP version: 0.9.8.17
No update needed, your CWP is up to date.
XXX
16:12: Cron <root@XXX> /usr/local/cwp/php54/bin/php -d max_execution_time=1000000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
====================================================
============= CentOS Web Panel Cron ================
====================================================
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
Your CWP version: 0.9.8.17
No update needed, your CWP is up to date.
XXX
20:12: Cron <root@XXX> /usr/local/cwp/php54/bin/php -d max_execution_time=1000000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
====================================================
============= CentOS Web Panel Cron ================
====================================================
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
PHP Warning: file_get_contents(http://...@gmail.com&version=0.9.8.17): failed to open stream: HTTP request failed! HTTP/1.1 500 Internal Server Error
in /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php(1) : eval()'d code(1) : eval()'d code on line 7
Your CWP version: 0.9.8.17
No update needed, your CWP is up to date.
XXX
-
(Edited the post above and removed duplicate lines in second log and thus fit everything in a single post.)
-
:-[
I have the same problem. Now is worsen. I cannot access CWP through URL http://my-ip:2030. I see this message: "No Loader is installed. Please contact support."
I sent question to support team. Now i waiting for their reply.
-
I am having the same issue of "No Loader is installed. Please contact support." The installation was successful and i have copied the console output and it shows everything was fine. Please help me to sort this out. I am in need of urgent hosting of 3 informational websites.
Regards,
Gavin
-
ya same evey i have it :(
-
I am guessing that this has to do something with ioncube loader. I have tried searching so many things on google but none come to this issue. I have even tried reinstalling ioncube loader but its saying "its already installed"
@cwp support, please reply. so many users are facing the same issue.
Regards,
-
this is all ok..there was some issue with cwp site overloaded and because of that some of you had this error in the cron email.
-
Dear Administrator,
I am not having the issue with cron job or email. I have installed cwp on a fresh server. I am not able to open cwp panel by using http://my-ip:2030 or https://my-ip:2031. I am getting this error:
"No Loader is installed. Please contact support."
Screenshot.
(http://imgur.com/sm3vPZm)
I have not been able to open cwp admin once. Though services are running, default apache page is loading. phpinfo is working in a php file. pls tell me what should I do to make it work.
Thanks in advance,
Regards.
Gavin
-
this will be resolved
-
this is all ok..there was some issue with cwp site overloaded and because of that some of you had this error in the cron email.
:o Okay, if you say so :)
It seems to work mostly without errors now.
The last interesting thing I got in such a mail was:
sh: service: command not found
Thank you for your reply, I was afraid that something more dangerous was going on than just the site being overloaded :)
-
Dear Support,
When will be the issue, of the below quoted error, fixed. Please tell me if i should try reinstalling the complete server, or should i wait for something from your end to be fixed. I wonder how some issue in you infra. can cause my admin panel to not load with this error. Please suggest.
Regards,
G
Dear Administrator,
I am not having the issue with cron job or email. I have installed cwp on a fresh server. I am not able to open cwp panel by using http://my-ip:2030 or https://my-ip:2031. I am getting this error:
"No Loader is installed. Please contact support."
Screenshot.
(http://imgur.com/sm3vPZm)
I have not been able to open cwp admin once. Though services are running, default apache page is loading. phpinfo is working in a php file. pls tell me what should I do to make it work.
Thanks in advance,
Regards.
Gavin
-
for this error "No Loader is installed. Please contact support.", try to restart cwp
service cwpsrv restart
and if this issue continues even after restart then run the command bellow and again restart
echo "zend_extension = /usr/local/ioncube/ioncube_loader_lin_5.4.so" >> /usr/local/cwp/php54/php.iniservice cwpsrv restart
-
Hi
Thanks alot, the echo ***** method made it working. Now i am able to login.
Please tell me if i need to do the echo for loader everytime when changing the php version.
Regards,
-
I would have to disagree that this issue is "not a problem". I've been getting the weird obfuscated emails every 4 hours. It is apparent that something got seriously mangled on centos-wp's side of things.
I am therefore left with no other option than to wipe our testing server clean and utilize a different panel..
Things to consider:
This issue with the obfuscated code has been ongoing since 07/03/16. Any other company would have had this major concern corrected that same day.
Support requests alerting of the issue shouldn't be ignored, and then discounted wholesale with "don't worry it's ok" type remarks.
The gui has been at a standstill as far as development for the last year. It is slow and buggy. When people bring this to cwp's attention - they are told that their server is too slow. Please. I guess everyone that runs cwp has a slow server.
Centos-wp has absolutely no connection with the Centos Linux operating system. The whole reason I installed it, is because I thought it was a project endorsed by the actual Centos company.
Centos released a statement saying that they are not connected, and they are very unhappy that cwp insists on using their name without their permission.
All of the above, but mostly the shoddy support has lead me to this decision.
I strongly suggest others consider doing the same. Without going too deep into it - if you value the security of your server - you should not let another day go by with cwp installed. This is serious, folks.
If on the other hand, you don't mind that all of your data can be easily compromised - please stay with cwp - and keep your head in the sand.
-A concerned former cwp user
(P.S. I have 30 years coding experience, and have been contracted out by various fortune 500 companies for security audits. So, I do know what I am talking about)
-
[...]
I strongly suggest others consider doing the same. Without going too deep into it - if you value the security of your server - you should not let another day go by with cwp installed. This is serious, folks.
If on the other hand, you don't mind that all of your data can be easily compromised - please stay with cwp - and keep your head in the sand.
[...]
I mainly chose CWP because it has a lot of features I wanted and is "free".
At the time I chose (February) it I wasn't aware that huge parts of the CWP related code are obfuscated, I actually thought it would be open source or something. However it is my fault for not checking better.
I am actually also worried about the security issues that CWP has or had, for example:
- File owning issues (might have been fixed by now)
http://forum.centos-webpanel.com/centos-webpanel-bugs/quotas-stack-up-(new-users-inherits-quotas-of-existing-users)/
- File permission issues (which I fixed my self, I don't really know if it's a CWP bug that others have too or only me):
http://forum.centos-webpanel.com/backup/backup-access-rights-(all-users-can-access)/
- The default GUI does not allow to install a PHP 5.x version that doesn't have security issues, meaning many users will end up with vulnerable installations:
http://forum.centos-webpanel.com/php/php-version-selector-vulnerabilities/
I am thankful for the time and work CWP developers put into CWP, however, at this point in time I cannot recommend CWP to other people due to i.e. the above reasons. Actually as of now I will be recommending the guy I manage the server with to buy a CPANEL license for the next server (if possible in the budget we have).
Maybe CWP developers should get rid of the "free" idea and switch to s.th. else, but then again that might cause a hit to the popularity of the panel. But currently it seems to me as if they don't have the time and resources to keep CWP reasonably safe to use for dumb users like me.
Edit: I am not saying that CWP is bad, but security is a number one concern for me - I mean I rather spend a bit of money on s.th. that is supposed to be secure, than having a free ride that ends up with me being screwed.
-
@GotEm4
What alternative would you recommend? What did you migrate your system to?
-
I've had very good luck with webmin on other systems. So, it was very easy to install and setup for me this go-around.
It also offers more freedom and control.
-
I've had very good luck with webmin on other systems. So, it was very easy to install and setup for me this go-around.
It also offers more freedom and control.
Thank you for your response.
-
Yes code is for reason obviously encrypted... There are hundreds sites like this using same protection to hide code from eyes and keep it hard to see it and find easy bugs and exploit them... This give some time to developers to fix errors if they update panel and missed something.
If you are so skilled why do you use free panel when there are something like webmin old enough and known for sure maybe there are not bugs inside?
For sure if someone wanna to hack your server and have knowledge you are gonna be fu... does not even mater what are you using.
Well maybe its encrypted for some other reason maybe they will sell it later who knows.
but don't talk like that and send negative picture to other users. I used 2 3 panels free before this and every single one have failed after year or two and lost support and upgrades well that's risk with free panels.
If you selling hosting you should consider before and buy something what have some guaranties but I think there is nothing online who can give you something like that. That's my opinion.
Guy's its free what are you expecting if you are planing to sell hosting and work with something like that you should have knowledge to check every settings and check servers every day. Security here does not point only to CWP oh I will install it and I m secure wtf if you are thinking like that than every single idiot can sell hosting. Every single service installed with cwp maybe can be exploited in the future who knows.....
-
Yes code is for reason obviously encrypted... There are hundreds sites like this using same protection to hide code from eyes and keep it hard to see it and find easy bugs and exploit them... This give some time to developers to fix errors if they update panel and missed something.
I'm going to take it easy on you since it is obvious there is a comprehension issue occurring on your part. I am fully aware of the various technologies used to protect source code. That is not the issue. The issue is having a major security flaw present for almost a week now, and having the devs basically say "oh, nothing to worry about - move along!". Along with their nonchalant replies regarding their slow GUI leaves one with a rather......Bad taste in their mouths.
If you are so skilled why do you use free panel when there are something like webmin old enough and known for sure maybe there are not bugs inside?
Does Emeril Lagasse go to mcdonalds? I'm sure he does. If he is a master chef - ? That makes him a s#it chef! Same line of thinking on your part. Even though I could, you are right, for-go the control panel all together - I do like to test out new technologies and offerings. It's only human to be curious.
For sure if someone wanna to hack your server and have knowledge you are gonna be fu... does not even mater what are you using.
That is 100% correct. But by using CWP, you and the rest of the users are/will make it considerably easier to let hackers into your systems.
Well maybe its encrypted for some other reason maybe they will sell it later who knows.
That would be funny. Doubt there would be any buyers. Not only that - but I'm pretty sure the REAL CENTOS would sue the pants off of them for unauthorized use of their name. Surprised they haven't already.
but don't talk like that and send negative picture to other users.
If "product x" kills your cat/blinds you/turns you into a babbling idiot - please do not warn other consumers! You will ruin their experience... Pu-lease. I'm not saying anything that isn't true. And if nobody speaks up - nothing will ever get done to fix the serious security issues for the users that still use this product.
Guy's its free what are you expecting
Just because it is free does not mean one should give the devs a pass on glaringly serious security holes in the code. While it's nice to see that CWP has one cheerleader - taking the "Hide your head in the sand" approach does not better the product. CWP needs to hear from real people in the real world.
What they do with that input is up to them, obviously. Seeing their lack of concern though, is a very troubling sign.
-
Can someone tell me what this means exactly ? I understand no update need it's the last line that confuses me. and I'm not running php54 I'm on v7
Email subject /usr/local/cwp/php54/bin/php -d max_execution_time=1000000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
######################
Update Server Packages
######################
Your CWP version: 0.9.8.20
No update needed, your CWP is up to date.
sh: service: command not found
-
Can someone tell me what this means exactly ? I understand no update need it's the last line that confuses me. and I'm not running php54 I'm on v7
Email subject /usr/local/cwp/php54/bin/php -d max_execution_time=1000000 -q /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php
######################
Update Server Packages
######################
Your CWP version: 0.9.8.20
No update needed, your CWP is up to date.
sh: service: command not found
in email subject is full command line which checking for updates calling php file simple as that rest down is what its says information about version. last line well who knows you should ask this security experts which are talking around but seems no one of them could tell you exactly whats that except developers...
-
Yes code is for reason obviously encrypted... There are hundreds sites like this using same protection to hide code from eyes and keep it hard to see it and find easy bugs and exploit them... This give some time to developers to fix errors if they update panel and missed something.
I'm going to take it easy on you since it is obvious there is a comprehension issue occurring on your part. I am fully aware of the various technologies used to protect source code. That is not the issue. The issue is having a major security flaw present for almost a week now, and having the devs basically say "oh, nothing to worry about - move along!". Along with their nonchalant replies regarding their slow GUI leaves one with a rather......Bad taste in their mouths.
If you are so skilled why do you use free panel when there are something like webmin old enough and known for sure maybe there are not bugs inside?
Does Emeril Lagasse go to mcdonalds? I'm sure he does. If he is a master chef - ? That makes him a s#it chef! Same line of thinking on your part. Even though I could, you are right, for-go the control panel all together - I do like to test out new technologies and offerings. It's only human to be curious.
For sure if someone wanna to hack your server and have knowledge you are gonna be fu... does not even mater what are you using.
That is 100% correct. But by using CWP, you and the rest of the users are/will make it considerably easier to let hackers into your systems.
Well maybe its encrypted for some other reason maybe they will sell it later who knows.
That would be funny. Doubt there would be any buyers. Not only that - but I'm pretty sure the REAL CENTOS would sue the pants off of them for unauthorized use of their name. Surprised they haven't already.
but don't talk like that and send negative picture to other users.
If "product x" kills your cat/blinds you/turns you into a babbling idiot - please do not warn other consumers! You will ruin their experience... Pu-lease. I'm not saying anything that isn't true. And if nobody speaks up - nothing will ever get done to fix the serious security issues for the users that still use this product.
Guy's its free what are you expecting
Just because it is free does not mean one should give the devs a pass on glaringly serious security holes in the code. While it's nice to see that CWP has one cheerleader - taking the "Hide your head in the sand" approach does not better the product. CWP needs to hear from real people in the real world.
What they do with that input is up to them, obviously. Seeing their lack of concern though, is a very troubling sign.
if you did find some security issue and reported to them and everybody keeps quiet then its serious shit :) then you and developers know how to fix it we are all screwed if no one do it.
I m demanding developers to respond to this its getting hot here..
PS: don't be angry you should helping here its easy to talk about security issues you responded that I m 100% about security, and you should tell how to fix it not talking about legal or illegal name use. No one cares about name...
This is gone from bug report to illegal name use and some cats dogs whatever you can find million reasons and at the end we will agree that we are disagree in some cases :)
ADMINS RESPOND ABOUT SECURITY IF ITS POSSIBLE :)
-
I have same problem with every 4 hours automatic email and also im interested how we have CWP ver 0.9.8.20 while they said the latest ver is 0.9.8.17 ???
I hope you developer do something for this matter and fix it asas for you!
Regards
-
well every 4h is same here... well they say its ok because they had some problems with servers.
To be honest I did not have any errors in report like someone on first page copied from email they got some update linked to gmail or something like that, and yes I have too sh error after update to .20...
After checking all emails didnt find any error like guy in first or second post have, seems every one have some kind different error.
Seems everything works fine except new module letsentcrypt...
Possible update some kind bug which is not mentioned in change log in new version .20
-
cwp is now switched to automated updates, meaning that there will be no more releases every few months like before, now we will have much more developers working on it so we could have even a few updates at the same day.
Please for you who are not trusting us, stop using cwp and asking the same questions all the time.
If you want to contribute then join development and starting helping others.
-
forgot to add, for letsencrypt issue you can contact support to check it, as always we are resolving bugs for free.
-
cwp is now switched to automated updates, meaning that there will be no more releases every few months like before, now we will have much more developers working on it so we could have even a few updates at the same day.
Please for you who are not trusting us, stop using cwp and asking the same questions all the time.
If you want to contribute then join development and starting helping others.
THANK YOU :)
-
I must mention that i don't have every automated email from my server any more (it's passed more that 6 hours and there is not any email yet) after CWP update ver 0.9.8.21 but in my last email from server that i got there is same error. You can see that below:
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
PHP Warning: [obfuscated](http://...@gmail.com&version=0.9.8.21): failed to open stream: HTTP request failed! HTTP/1.1 500 Internal Server Error
in /usr/local/cwpsrv/htdocs/resources/admin/include/cron.php on line 0
Your CWP version: 0.9.8.21
sh: service: command not found
TERM environment variable not set.
5#.###.###.##2 (i hide my IP!)
I must say that my server and website seems works normally while i had that (old) problem as well.
Regards
-
at the moment latest version is 0.9.8.23...also there will be at least one more new release today, meaning if your version at the moment is 0.9.8.23 then all works fine....also there will be no more notification emails every 4 hours.
-
My last email was today about 12:00
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
Your CWP version: 0.9.8.21
sh: service: command not found
TERM environment variable not set.
***.***.***.***
Again I didn't see any messages and errors like that:
PHP Warning: [obfuscated](http://...@gmail.com&version=0.9.8.21): failed to open stream: HTTP request failed! HTTP/1.1 500 Internal Server Error
If admin can explain what is meaning of that gmail in url when its checking for updates.. I never didn't see that in my emails..
current version here at my cwp is .23 it means everything went fine like admin said before.
-
that is probably your email from cwp settings