Messages

16

PHP / Re: AH01075: Error dispatching request to : (polling)

« on: May 23, 2025, 12:49:24 AM »

[Wed May 21 00:34:42.824943 2025] [proxy_fcgi:error] [pid 296120:tid 296160] (70007)The timeout specified has expired: [client xxx:43672] AH01075: Error dispatching request to : (polling)

Connection refused: AH02454: FCGI: attempt to connect to Unix domain socket /opt/alt/php-fpm82/usr/var/sockets/domain.sock (localhost:8000) failed

AH01079: failed to make connection to backend: localhost

I Get this error EVERY night at around 00-02 the only way to get the page up again is by restarting the php-fpm service.

All other sites on the server are online only 1 page goes down. i cant figure out what causes this. Any ideas?

A simple restart on your php-fpm server, while serving pages, can cause these messages.

A restart on your php-fpm server can occur if you run a cron process restarting the server at that time, or, for example, if you set a rebuild in the CWP configuration that did not complete.

Check the cron logs (/var/log/cron) at that time to see if there is a process restarting your php-fpm around that time.

Regards,

Netino

17

SSL / Re: Probelm with renewing SSL certs

« on: May 23, 2025, 12:35:48 AM »

Hi friend, I get the next when run the script

ot@mail ~]# ./script.sh xxx.com
[Tue May 20 09:48:46 -05 2025] Unknown parameter: mail

This is not a message from acme.sh.
So, may be you copy something wrong in your script.?

Try to replace the parameters directly in the main command in that script (/root/.acme.sh/acme.sh ... )

Type all these commands, step-by-step, in bash from your server:

Code: [Select]

# DOM=xxx.com
# WEBS=""
# systemctl -q is-active nginx && WEBS="${WEBS} nginx"
# systemctl -q is-active httpd && WEBS="${WEBS} httpd"
# /root/.acme.sh/acme.sh --cert-home /root/.acme.sh/cwp_certs --webroot /usr/local/apache/autossl_tmp --issue -d ${DOM} mail webmail ftp cpanel --ecc \
  --cert-file /etc/pki/tls/certs/${DOM}.cert \
  --key-file  /etc/pki/tls/private/${DOM}.key \
  --fullchain-file /etc/pki/tls/certs/${DOM}.bundle \
  --reloadcmd "systemctl restart ${WEBS}"

Alternatively, you can put your parameters between quotation marks, like:

Code: [Select]

# DOM="xxx.com"
(...)
# /root/.acme.sh/acme.sh --cert-home "/root/.acme.sh/cwp_certs" --webroot "/usr/local/apache/autossl_tmp" --issue -d "${DOM}" "mail" "webmail" "ftp" "cpanel" --ecc \
(...)

You can check where are the error, and post here.

18

SSL / Re: Probelm with renewing SSL certs

« on: May 20, 2025, 02:37:33 AM »

Try to repair and create a new configuration with run the following script(still working with acme.sh):

Code: [Select]

#!/bin/bash

DOM=${1}
WEBS=""
systemctl -q is-active nginx && WEBS="${WEBS} nginx"
systemctl -q is-active httpd && WEBS="${WEBS} httpd"

/root/.acme.sh/acme.sh --cert-home /root/.acme.sh/cwp_certs --webroot /usr/local/apache/autossl_tmp --issue -d ${DOM} mail webmail ftp cpanel --ecc \
  --cert-file /etc/pki/tls/certs/${DOM}.cert \
  --key-file  /etc/pki/tls/private/${DOM}.key \
  --fullchain-file /etc/pki/tls/certs/${DOM}.bundle \
  --reloadcmd "systemctl restart ${WEBS}"

Run it with:

Code: [Select]

# chmod script.sh
# ./script.sh your-domain.com

After that, try to renew with CWP (because CWP still could claim the domain have not a cert)

19

E-Mail / Re: Spamassassin Error: cannot create user preferences file //.spamassassin/user_pre

« on: May 20, 2025, 02:24:56 AM »

The user/group ownerships in /var/lib/spamassassin should be the same configured in your master.cf file.
What procedure you did use to install and configure it?

Check if you already created a user for spamassassin.
If you don't have already made, create the user for spamassassin(any name you choose, here is 'spamfilter'):

Code: [Select]

groupadd -g 1001 spamfilter
useradd -u 1001 -g spamfilter -s /sbin/nologin -d /var/lib/spamassassin spamfilter
chown -R spamfilter:spamfilter /var/lib/spamassassin

And try to replace that line in your master.cf file, with this:

Code: [Select]

spamassassin unix -     n       n       -       -       pipe user=spamfilter argv=/usr/bin/spamc -f -e  /usr/sbin/sendmail -oi -f ${sender} ${recipient}


20

E-Mail / Re: Spamassassin Error: cannot create user preferences file //.spamassassin/user_pre

« on: May 15, 2025, 11:29:52 PM »

Run these commands:

Code: [Select]

# ls -alF /var/lib/spamassassin

Code: [Select]

# grep spamassassin /etc/postfix/master.cf | grep pipe | sed -r 's/^spamassassin.*pipe user=(\S+).*/\1/'
and post here.

Regards,
Netino

21

SSL / Re: Probelm with renewing SSL certs

« on: May 14, 2025, 02:20:06 AM »

Ah but the website is in other server that I dont adimistrate. How can I to change the comprobation mode?

You simply can't get certificates via LetsEncrypt in apache mode if you can't save tokens in a specific are of the web server.
But with another app (certbot) in DNS mode, you could.
You manage the DNS server of these sites?

22

E-Mail / Re: How to enforce strong passwords when creating email accounts in CWP

« on: May 09, 2025, 01:56:56 AM »

The process of forcing the creation of stronger passwords can be seen here:
https://docs.redhat.com/en-us/documentation/red_hat_enterprise_linux/7/html-single/security_guide/index#sec-Forcing_Strong_Passwords

However, this reinforcement is done at the operating system level through the Linux kernel PAM module.

At the CWP application level, this choice is not offered to the user when creating/changing the password, and I have never tested whether, if the password is not accepted by the operating system, CWP will recognize it and request the password again. You will only find out by running a test.

Regards,
Netino

23

SSL / Re: Probelm with renewing SSL certs

« on: May 09, 2025, 01:38:16 AM »

Possibly a bug from CWP.
This happened to me migrating domains from another server.
Once the domain was renewed manually, now the renewing process is automatic again.

Try to create a script, named like 'renew-cert.sh', to renew manually:

Code: [Select]

#!/bin/bash

DOM=${1}
/root/.acme.sh/acme.sh --home /root/.acme.sh/cwp_certs --renew --ecc -d ${DOM} --force

Change permissions:

Code: [Select]

# chmod 700 renew-cert.sh
And run the script (replacing "domain.com" with your domain):

Code: [Select]

# ./renew-cert.sh domain.com
Regards,
Netino

24

Information / Re: check all autoSSL (Lets encrypt) that failed

« on: May 03, 2025, 01:31:27 AM »

Thanks! No way for an integrated feature in the panel? To alert us, etc?

While this feature is not implemented in CWP, you can use this command in cron, to be alerted:

Code: [Select]

# find /etc/pki/tls/certs -type f -name \*.cert -mtime +60 | sed -e 's#^/etc/pki/tls/certs/##g' -e 's#\.cert$##' | xargs -I '{}' bash -c 'echo -e "Domain Cert {} expired.\n.\n" | mail -s "ALERT: Domain Cert {} expired" your-mail@yourdomain.com'
Regards,
Netino

25

CentOS 8 Problems / Re: ImageMagick installation on Almalinux 8

« on: April 29, 2025, 03:12:16 AM »

Hi,

php -v giving error of unable to load dynamic library 'imagick.so'
(...)
but found that following line not working:
ln -s /usr/local/include/ImageMagick-6 /usr/local/include/ImageMagick

On checking, I didnot found any folder /usr/local/include/ImageMagick-6  in my Almalinux ver 8
(...)

I think the right command is:

Code: [Select]

ln -s /usr/include/ImageMagick-6 /usr/local/include/ImageMagick-6
The include library exists in '/usr/include/ImageMagick-6' in AL8.

Regards,
Netino

26

E-Mail / Re: Stop forwarding SPAM emails

« on: April 24, 2025, 02:40:02 AM »

(Adapted from: <https://docs.directadmin.com/other-hosting-services/preventing-spam/outgoing-spam.html#why-forwarders-to-external-mailservers-can-be-dangerous-for-your-server>)

Why forwarders to external mailservers can be dangerous for your server

It's not uncommon for clients to want to forward mail from their own domain to an external email address, say Gmail, for example.

The path of an email sent to the user@domain.com forwarder would be:

Sender -> CWP box: user@domain.com -> External: user@gmail.com
This will work fine, until spam comes into the picture.

The issue with spam is that, if the proper blocks are not in place, your CWP box will happily relay spam to Gmail, which could then cause Gmail to think that the spam is originating from your CWP box, thus getting your IP blacklisted even though the spam came from somewhere else.

Another issue is that, if Gmail then determines that the message is spam, it may be denied at the Gmail server, thus returning it back to your CWP box to figure out what to do with. Since the sender is not from the CWP box, and the final recipient is Gmail (which was denied), Postfix tries to send it back to the original "sender", which with spam, is almost always fake/spoofed (these headers can be spoofed).

This causes "backscatter", where Postfix is trying to return a message to an address that was not the actual sender. This backscatter is also a potential hazard to getting your IP blacklisted.

Solutions:

- Avoid forwarders to external domains whenever possible (it is usually hard to convince users of this).

- For Gmail, as an example, have Gmail pull your POP emails to Gmail, rather than you pushing them via forwarders. See this guide for more info.

- Ensure SpamAssassin is enabled, and set it to drop spam or send to spambox (do not use "deliver to inbox"). At a minimum, use "drop high scoring spam".

- Block bounces from leaving.

- RBL Blocking is a robust way of blocking spam before Postfix even sees the message (realtime IP based block). Some consider RBL blocking to sometimes be too strict in that it may often block entire ISP ranges (send on port 587 with smtp-auth, instead of port 25).

Regards,
Netino

27

Updates / Re: New problems with updates

« on: April 24, 2025, 02:22:09 AM »

To be blunt and honest, there is no reasonable reason to keep a system like Centos7, whose support has been out of date for almost a year, and therefore subject to security holes. Upgrade as soon as you can, if you don't want to make yourself and your client victims of cyber attacks. Right now Centos7 may already be subject to flaws that you don't know about, for the simple reason that they haven't been disclosed for almost a year, and they won't be disclosed anymore.

Regards,
Netino

28

CentOS-WebPanel Bugs / Re: Lost access to CWPpro after a server restart

« on: April 15, 2025, 03:23:20 AM »

Hey,

I've opened a ticket on this already and will update this thread with more information. I logged into CWP web panel and was greeted by this:

(...)


(...)
Everything else is working perfectly fine, I haven't changed my default SSH ports but I don't think that'd be causing it.

I ordered CWPpro and used the "sh /scripts/update_cwp" command to force and update to enable CWPpro, but after a recent restart due to Vultr's London datacenter maintenance, this warning starting showing up. My IP address is the exact same.

Check if you have some firewall block to 'centos-webpanel.com' or to IP adress [158.69.227.165].
These are used to update the system.

Regards,
Netino

29

Other / Re: Varnish 7 Installation & Configuration

« on: April 10, 2025, 01:18:09 AM »

Has anyone successfully installed Varnish 7 on CWP yet?

I've tried a couple of times now but still get 503 when testing. Has anyone figured out the correct changes for the varnish.service file?

Yes.
You already install it?

After install, you need to change the line in file '/usr/lib/systemd/system/varnish.service' of default installation, from:

Code: [Select]

ExecStart=/usr/sbin/varnishd -a :6081 -f /etc/varnish/default.vcl -s malloc,256m
to:

Code: [Select]

ExecStart=/usr/sbin/varnishd -a :82 -f /etc/varnish/default.vcl -s malloc,256m
After that, run:

Code: [Select]

# systemctl daemon-reload

30

Apache / Re: How to stop malicious scans

« on: March 30, 2025, 12:57:22 AM »

I don't know what header you talking about, I copied the original code from the access_log and didn't change them.

I use Nginx & Apache.
(...)

The useragent header is the HTTP header that identifies the navigator acessing you HTTP server.

Does this affect Googlebot and Bingbot crawling pages?

No.

Is there any other way to stop it?

Yes.
Googlebot and Bing use honest useragents, so if you want to block them, you can simply block the "Googlebot" and "bingbot" useragents directly:

Code: [Select]

if ($http_user_agent ~* "(Googlebot|bingbot)") {
    return 403;
}

You can choose too any other useragent:

Code: [Select]

if ($http_user_agent ~* "(Googlebot|bingbot|Android|iPhone|iPod|Symbian|BlackBerry|Windows Phone|Mobile|J2ME)") {
    return 403;
}

You can install the "Nginx Ultimate Bad Blocker" to block hundreds other useragents:
https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker