Recent posts
#1
CentOS-WebPanel GUI / CWP Security Audit - mod_auth_...
Last post by anandmys - Today at 06:54:19 AMI am getting an alert
CWP Security Audit - mod_auth_form enabled
LoadModule auth_form_module is active in /usr/local/apache/conf/httpd.conf_backup . CWP does not use this module and it is often enabled by malware. Check /usr/local/apache/modules/mod_auth_form.so and the server for a compromise.
Any recommended steps?
CWP Security Audit - mod_auth_form enabled
LoadModule auth_form_module is active in /usr/local/apache/conf/httpd.conf_backup . CWP does not use this module and it is often enabled by malware. Check /usr/local/apache/modules/mod_auth_form.so and the server for a compromise.
Any recommended steps?
#2
PHP / Re: Secure PHP versions in CWP...
Last post by mcitpsa - November 01, 2026, 07:10:31 PMHi there,
i've update one server perfectly and another one seems to be failed.
I receive everytime i tried to get into the admin or user part the message that the ioncubeloader was missing.
Tried to run the update_ioncube script dosnt fix it.
Any kind of help is apprechiated
i've update one server perfectly and another one seems to be failed.
I receive everytime i tried to get into the admin or user part the message that the ioncubeloader was missing.
Tried to run the update_ioncube script dosnt fix it.
Any kind of help is apprechiated
Code Select
php -v
PHP 8.3.30 (cli) (built: Jun 24 2026 08:40:18) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.30, Copyright (c) Zend Technologies
with the ionCube PHP Loader v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.
#3
CentOS-WebPanel Bugs / Apache hostname VirtualHosts m...
Last post by Wonder - November 01, 2026, 11:11:20 AMHello,
I have encountered an issue with the Apache hostname VirtualHost configuration on both AlmaLinux 9 and AlmaLinux 10.2 installations running CWP.
I'm currently testing CWP 1.30 on AlmaLinux 10.2, where the following Apache VirtualHost configuration files for the server hostname were missing:
I previously encountered the same issue on AlmaLinux 9.
On AlmaLinux 10.2, I verified that both original CWP templates are present:
I also used the Change Hostname feature in CWP to configure the hostname SSL certificate. The certificate was successfully generated and works correctly on the CWP administration panel (port 2031).
However, this operation did not generate the missing Apache VirtualHost configuration files.
As a result, Apache did not have a dedicated SSL VirtualHost for the server hostname, causing the following issues:
- Accessing the server hostname over HTTPS on port 443 presented the SSL certificate of another hosted domain.
- Accessing the /roundcube/ path through the server hostname redirected to /webmail/ instead of opening Roundcube directly.
For comparison, I have two existing AlmaLinux 8 / CWP servers where both hostname VirtualHost configuration files exist and Roundcube works correctly under /roundcube/.
Temporary workaround:
I manually created the missing configuration files:
The configuration includes the appropriate hostname SSL certificate directives and reverse proxy rules for Roundcube and phpMyAdmin.
After validating the Apache configuration and reloading the service:
- Apache presented the correct hostname SSL certificate on port 443.
- The /roundcube/ path worked correctly and returned HTTP 200.
- HTTPS worked correctly over both IPv4 and IPv6.
The original CWP templates are present, but the corresponding Apache VirtualHost files were not generated automatically.
Since the Change Hostname feature did not resolve the issue either, I suspect there may be a problem with the generation or deployment of these configuration files.
Could you please confirm whether this is a known issue affecting CWP on AlmaLinux 9 and 10, and whether the hostname Apache VirtualHost files are expected to be generated automatically during installation?
Thank you!
I have encountered an issue with the Apache hostname VirtualHost configuration on both AlmaLinux 9 and AlmaLinux 10.2 installations running CWP.
I'm currently testing CWP 1.30 on AlmaLinux 10.2, where the following Apache VirtualHost configuration files for the server hostname were missing:
Code Select
/usr/local/apache/conf.d/hostname.conf
/usr/local/apache/conf.d/hostname-ssl.conf
I previously encountered the same issue on AlmaLinux 9.
On AlmaLinux 10.2, I verified that both original CWP templates are present:
Code Select
/usr/local/cwpsrv/htdocs/resources/conf/web_servers/main/httpd/conf.d/hostname.conf
/usr/local/cwpsrv/htdocs/resources/conf/web_servers/main/httpd/conf.d/hostname-ssl.conf
I also used the Change Hostname feature in CWP to configure the hostname SSL certificate. The certificate was successfully generated and works correctly on the CWP administration panel (port 2031).
However, this operation did not generate the missing Apache VirtualHost configuration files.
As a result, Apache did not have a dedicated SSL VirtualHost for the server hostname, causing the following issues:
- Accessing the server hostname over HTTPS on port 443 presented the SSL certificate of another hosted domain.
- Accessing the /roundcube/ path through the server hostname redirected to /webmail/ instead of opening Roundcube directly.
For comparison, I have two existing AlmaLinux 8 / CWP servers where both hostname VirtualHost configuration files exist and Roundcube works correctly under /roundcube/.
Temporary workaround:
I manually created the missing configuration files:
Code Select
/usr/local/apache/conf.d/hostname.conf
/usr/local/apache/conf.d/hostname-ssl.conf
The configuration includes the appropriate hostname SSL certificate directives and reverse proxy rules for Roundcube and phpMyAdmin.
After validating the Apache configuration and reloading the service:
- Apache presented the correct hostname SSL certificate on port 443.
- The /roundcube/ path worked correctly and returned HTTP 200.
- HTTPS worked correctly over both IPv4 and IPv6.
The original CWP templates are present, but the corresponding Apache VirtualHost files were not generated automatically.
Since the Change Hostname feature did not resolve the issue either, I suspect there may be a problem with the generation or deployment of these configuration files.
Could you please confirm whether this is a known issue affecting CWP on AlmaLinux 9 and 10, and whether the hostname Apache VirtualHost files are expected to be generated automatically during installation?
Thank you!
#4
Updates / Re: CWP New Version Released 1...
Last post by Logician - November 01, 2026, 09:10:00 AMYour PHP security patch is so much appreciated! Thank you!
#5
Updates / Re: CWP New Version Released 1...
Last post by Wonder - October 31, 2026, 10:48:54 PMQuote from: overseer on October 31, 2026, 03:39:22 PMZoom! Go, go, go! Looks like I'll be going from AlmaLinux 8 to 10 as soon as the foundation gets just a little more solid.Sure! I'm currently testing the migration from AL8 to AL10 and it seems to be working perfectly! I tried 1.28 but it failed, and then I saw that 1.29 fixed that problem. But right before I started, it updated to 1.30... This looks very promising...
#6
Updates / Re: CWP New Version Released 1...
Last post by overseer - October 31, 2026, 10:08:47 PMI guess my last main quibble with the UI is the round red bubble with 0 notifications. If there are zero, I wish it would not show at all (quite distracting, really!)
And of course I wish all the dashboard widgets were completely customizable -- turn off what you don't need, fully re-order items so as to put what's most important to you at the top. For sure I don't need notices about 500 failed SSH login attempts blocked by LFD -- that's just to be expected in this business. Right now I am mitigating this with uBlock Origin blocking certain elements:
And of course I wish all the dashboard widgets were completely customizable -- turn off what you don't need, fully re-order items so as to put what's most important to you at the top. For sure I don't need notices about 500 failed SSH login attempts blocked by LFD -- that's just to be expected in this business. Right now I am mitigating this with uBlock Origin blocking certain elements:
Code Select
srv1##.cwp-att-warn.cwp-att
srv1###foo_health
srv1###foo_attention
srv1###foo_activity
srv1###foo_mysql
srv1###foo_security #7
Updates / Re: CWP New Version Released 1...
Last post by Martins-phpbb - October 31, 2026, 09:00:01 PMEvery thing runs sweet only issue i found is mod security stops apache.
alma linux 10 cwp 1.30
alma linux 10 cwp 1.30
Code Select
httpd: Syntax error on line 513 of /usr/local/apache/conf/httpd.conf: Syntax error on line 1 of /usr/local/apache/conf.d/mod_security.conf: Cannot load /usr/lib64/libxml2.so into server: /usr/lib64/libxml2.so: cannot open shared object file: No such file or directory #8
Updates / CWP New Version Released 1.30 ...
Last post by Administrator - October 31, 2026, 08:14:54 PMCWP (CentOS Web Panel) - Changelog
Version 1.30 - changes since version 1.29
============================================================
New: CWP Secure Kernel and update channels
------------------------------------------
- CWP update channels (Settings > CWP Settings > CWP updates): LTS (default for every server - tested versions with
bug and security fixes) and Edge (newest features first). An Edge version that proves stable becomes the next LTS.
Edge builds are published separately; until then every server stays on LTS.
- Security > CWP Secure Kernel rebuilt: health check (rules groups, services, SSH, web), one-click safe mode,
apply/update/roll back with an automatic health check (falls back to safe mode when a check fails), per-service
Protect / Log only / Off that is kept across rules updates, denials read on demand or captured for a chosen time
(no log daemon running all the time), "Allow" for a denial, running processes with their protection, the rules of
each service with search, automatic rules updates switch and a support bundle.
- CWP Secure Kernel updates: the panel shows the running and the boot kernel and installs new Secure Kernel versions
(nightly or with one click, without a restart). A new kernel is started once, at once or at a chosen time; 3
minutes after the boot it is checked (rules, services, SSH, web) and only then kept as the boot kernel - otherwise
the server restarts on the previous kernel by itself. Optional automatic restart at a chosen hour.
- CWP Secure Kernel: when a system kernel update makes a kernel without protection the boot kernel, the nightly CWP
job sets the running Secure Kernel back as the boot kernel and shows a notification.
Security
--------
- CWP Secure Kernel rules updates run outside the caller's protection domain (a short-lived system service). On
older Secure Kernels a rules update started by the CWP cron job could lose its own rights while the rules were
reloaded and leave them half loaded (SSH and websites stopped). Rules version 65 contains the same fix for servers
that are not updated yet.
- Secure Kernel rules update: the rules archive is downloaded per version (a CDN node could serve an older cached
archive together with the new version number) and is only installed when its version matches; otherwise the
current rules are kept.
- Features, Themes, Languages > Feature manager: rule names, modules and accounts are escaped before they are
stored.
Fixes
-----
- Apache did not start after an update when httpd.conf had mod_auth_form enabled without mod_session (CWP does not
use it; it is often enabled by malware). The CWP update now disables that line, starts Apache and shows a
notification; the Security Audit warns about an enabled mod_auth_form.
- User panel: changing the language did nothing on accounts whose ~/.conf/cwp.ini belonged to root (older accounts,
restores, migrations) - the panel saves it as the account. The nightly CWP job gives the file back to the account.
- User panel: the Cloudflare entry in the menu and on the dashboard opened "Error, module does not exist" (there is
no Cloudflare module); removed.
- Varnish (Nginx + Varnish + Apache): sites that force https ("RewriteCond %{HTTPS} off" in .htaccess, WordPress,
Joomla...) ended in an endless redirect, and http visitors could get the https page - Varnish cached pages by host
and URL only, so the redirect of the http request was also served to https. http and https are now cached
separately; existing servers get it from the nightly CWP job (the Varnish cache is emptied once).
- Installer: "--mariadb 11.4" stopped with "Installation FAILED: MariaDB" (MariaDB 11 has the mysql, mysqldump and
mysqladmin commands in separate -compat packages, which were not installed). Servers that were upgraded to MariaDB
11 by hand get those packages from the nightly CWP job, so CWP's account, database and backup tasks find them.
- EL10: panel jobs and scripts no longer print "chown: warning: '.' should be ':'" (owner:group syntax everywhere).
- PHP-FPM Selector 8.5: the CWP OPcache settings (memory, revalidate frequency, CLI) were never applied - PHP 8.5
has OPcache built in and the setup step stopped with "Missing extension file opcache.so".
- EL10: PHP 7.4 and 8.0 (PHP Selector, PHP-FPM Selector, PHP Switcher) failed to compile with the EL10 compiler (GCC
14).
- Feature manager: a changed feature list now applies to the user panel right away (it was cached for up to 5
minutes), and it also applies to accounts created by older CWP versions or imports, which were taken for reseller
accounts and ignored the admin feature list until the account was saved again in List Accounts.
- User panel dashboard: remaining addon domains / subdomains are no longer negative for unlimited (-1) packages, and
the subdomain count is calculated from the subdomain limit (it used the addon domain limit).
Version 1.30 - changes since version 1.29
============================================================
New: CWP Secure Kernel and update channels
------------------------------------------
- CWP update channels (Settings > CWP Settings > CWP updates): LTS (default for every server - tested versions with
bug and security fixes) and Edge (newest features first). An Edge version that proves stable becomes the next LTS.
Edge builds are published separately; until then every server stays on LTS.
- Security > CWP Secure Kernel rebuilt: health check (rules groups, services, SSH, web), one-click safe mode,
apply/update/roll back with an automatic health check (falls back to safe mode when a check fails), per-service
Protect / Log only / Off that is kept across rules updates, denials read on demand or captured for a chosen time
(no log daemon running all the time), "Allow" for a denial, running processes with their protection, the rules of
each service with search, automatic rules updates switch and a support bundle.
- CWP Secure Kernel updates: the panel shows the running and the boot kernel and installs new Secure Kernel versions
(nightly or with one click, without a restart). A new kernel is started once, at once or at a chosen time; 3
minutes after the boot it is checked (rules, services, SSH, web) and only then kept as the boot kernel - otherwise
the server restarts on the previous kernel by itself. Optional automatic restart at a chosen hour.
- CWP Secure Kernel: when a system kernel update makes a kernel without protection the boot kernel, the nightly CWP
job sets the running Secure Kernel back as the boot kernel and shows a notification.
Security
--------
- CWP Secure Kernel rules updates run outside the caller's protection domain (a short-lived system service). On
older Secure Kernels a rules update started by the CWP cron job could lose its own rights while the rules were
reloaded and leave them half loaded (SSH and websites stopped). Rules version 65 contains the same fix for servers
that are not updated yet.
- Secure Kernel rules update: the rules archive is downloaded per version (a CDN node could serve an older cached
archive together with the new version number) and is only installed when its version matches; otherwise the
current rules are kept.
- Features, Themes, Languages > Feature manager: rule names, modules and accounts are escaped before they are
stored.
Fixes
-----
- Apache did not start after an update when httpd.conf had mod_auth_form enabled without mod_session (CWP does not
use it; it is often enabled by malware). The CWP update now disables that line, starts Apache and shows a
notification; the Security Audit warns about an enabled mod_auth_form.
- User panel: changing the language did nothing on accounts whose ~/.conf/cwp.ini belonged to root (older accounts,
restores, migrations) - the panel saves it as the account. The nightly CWP job gives the file back to the account.
- User panel: the Cloudflare entry in the menu and on the dashboard opened "Error, module does not exist" (there is
no Cloudflare module); removed.
- Varnish (Nginx + Varnish + Apache): sites that force https ("RewriteCond %{HTTPS} off" in .htaccess, WordPress,
Joomla...) ended in an endless redirect, and http visitors could get the https page - Varnish cached pages by host
and URL only, so the redirect of the http request was also served to https. http and https are now cached
separately; existing servers get it from the nightly CWP job (the Varnish cache is emptied once).
- Installer: "--mariadb 11.4" stopped with "Installation FAILED: MariaDB" (MariaDB 11 has the mysql, mysqldump and
mysqladmin commands in separate -compat packages, which were not installed). Servers that were upgraded to MariaDB
11 by hand get those packages from the nightly CWP job, so CWP's account, database and backup tasks find them.
- EL10: panel jobs and scripts no longer print "chown: warning: '.' should be ':'" (owner:group syntax everywhere).
- PHP-FPM Selector 8.5: the CWP OPcache settings (memory, revalidate frequency, CLI) were never applied - PHP 8.5
has OPcache built in and the setup step stopped with "Missing extension file opcache.so".
- EL10: PHP 7.4 and 8.0 (PHP Selector, PHP-FPM Selector, PHP Switcher) failed to compile with the EL10 compiler (GCC
14).
- Feature manager: a changed feature list now applies to the user panel right away (it was cached for up to 5
minutes), and it also applies to accounts created by older CWP versions or imports, which were taken for reseller
accounts and ignored the admin feature list until the account was saved again in List Accounts.
- User panel dashboard: remaining addon domains / subdomains are no longer negative for unlimited (-1) packages, and
the subdomain count is calculated from the subdomain limit (it used the addon domain limit).
#9
Updates / Re: CWP New Version Released 1...
Last post by Wonder - October 31, 2026, 06:35:18 PMQuote from: bablil on October 31, 2026, 04:39:57 PMThanks,Quote from: Wonder on October 31, 2026, 04:28:25 PMOhh, this is simply amazing!! Update after update, it's getting much better.
I did a clean install on AL10, the installation script was updated, and what a difference! I remember when I tried installing on AL9 and it was a nightmare, today it was fantastic...Quote from: bablil on October 31, 2026, 04:24:01 PM4 - The "Cloudflare" button in the user panel triggers an error: "Error, module does not exist."
Where is this button you mentioned?
I don't see anything from Cloudflare in the panel...
#10
Updates / Re: CWP New Version Released 1...
Last post by bablil - October 31, 2026, 04:39:57 PMQuote from: Wonder on October 31, 2026, 04:28:25 PMOhh, this is simply amazing!! Update after update, it's getting much better.
I did a clean install on AL10, the installation script was updated, and what a difference! I remember when I tried installing on AL9 and it was a nightmare, today it was fantastic...Quote from: bablil on October 31, 2026, 04:24:01 PM4 - The "Cloudflare" button in the user panel triggers an error: "Error, module does not exist."
Where is this button you mentioned?
I don't see anything from Cloudflare in the panel...
