Recent posts

#21
Backup / Re: New Backup does not dump P...
Last post by DeanCTS - November 08, 2026, 11:18:58 AM
Quote from: adrianofnatal on October 07, 2026, 01:01:34 PMHi all!

New backup does not dump PostgreSQL databases and users.
Does somenone facing this issue too?

Another issue is that backups does not remember passwords and does not worked with S3 or FTP/SFTP.
After  so many updates in panel, this feature still does not work as expected.

Thanks!



Look, new backup direct to R2 Cloudflare storage working.


Ignore the test connection button > it has issues. Just paste in your API / Secret keys and hostname with https:// is a must!
#22
Updates / Re: CWP New Version Released 1...
Last post by bablil - November 08, 2026, 11:15:47 AM
The issue regarding the editing of empty files has not been fixed: "Fatal error: Uncaught ValueError: fread(): Argument #2 ($length) must be greater than 0 in /usr/local/cwpsrv/var/services/users/codeEditor.php:0 Stack trace: #0 /usr/local/cwpsrv/var/services/users/codeEditor.php(0): fread() #1 {main} thrown in /usr/local/cwpsrv/var/services/users/codeEditor.php on line 0"
#23
Backup / Re: backup bug
Last post by DeanCTS - November 08, 2026, 11:13:46 AM
Quote from: setecabanas on July 28, 2026, 09:24:16 AMHello,

Every day I have to delete /home/tmp_bak/ manually because my server's storage keeps filling up. I saw on the forum that this is a known bug. Does anyone know if it's going to be fixed, or if there's a temporary workaround?

log:

SAFE_CLEANUP_DIR: BLOCKED - no marker file in /home/tmp_bak/.backup_temp, refusing to delete.
I recommend you to delete existing backup job and create a new one using New Backup. Disable the old backup config as well.
#24
Backup / Re: New Backup Beta
Last post by DeanCTS - November 08, 2026, 10:50:19 AM
Quote from: rustylh on June 01, 2026, 05:41:37 PMI have successfully been using FTP backup under New Backup Beta for a long long time. Now, as of June 28th it just stopped working. If I go into the backup and attempt a Connection Test it connects just fine. However, the log shows :
Date Time: TYPE FTP --> 1
Date Time: Type conection Back FTP
Date Time: Failed to connect to "IP Address" (login failed)
Date Time: Blank
Date Time: Backup Finished

I have attempted to update CWP and restart services. I've tried deleting the backup and recreating all with the same results. Any help would be greatly appreciated. Thank you!

I recommend you to try incremental backup instead to kickstart the backup job processing.
#25
Updates / CWP New Version Released 1.30....
Last post by Administrator - November 08, 2026, 10:38:22 AM
CWP 1.30.5 (LTS) – changes since 1.30.4

Fixes
- PHP Defender install: after turning it on for a PHP version, CWP now checks that PHP still starts with it enabled and rolls the change back if it does not, instead of leaving every PHP page of that version blank (empty 200) when the Snuffleupagus configuration is rejected.
- Legacy backup (cron_backup.php, the nightly backup from /etc/cron.daily/cwp): on PHP 8 the Remote MySQL backup step crashed with a fatal error (mysqli_fetch_object on a failed query) and the databases were not backed up remotely; it is now guarded so the MySQL step completes.
- PHP extensions self-heal: if a PHP build was left with an extension .ini but no matching .so (an old selector/switcher bug, e.g. mbstring/imagick after a failed build), every request of that PHP died with "Unable to load dynamic library". The nightly job now disables such an orphan .ini so sites run again and logs which extension to rebuild in the PHP Selector; it also warns if a third-party oniguruma5 package is installed.
- PHP Defender install: on servers using the ready-made RPM PHP builds the Snuffleupagus compile failed with a missing PCRE2 header (pcre2.h / pcre2-config); the installer now installs pcre2-devel with the other build tools.
- PHP Selector / PHP-FPM Selector: on EL9/EL10 the install list no longer offers PHP versions that have no build recipe for that OS (e.g. 5.x, 7.0-7.2), which previously failed with "Build options ... missing or invalid - update CWP". Only versions that can actually be built are offered; already-installed versions stay listed.
- Monit page on PHP 8: the page showed "Invalid name" with an empty "Configuration Available" list and the service list could 500 (array_multisort error). Both are fixed: the available/enabled monit config lists load, and the service list no longer errors.
- DNS: if a zone file was ever left with an unreplaced {IPSERVER} placeholder (from an older migration/restore), named refused to start and ALL zones on the server went down. The nightly job now repairs such a zone with the server's shared IP and brings named back, so one bad zone can no longer take DNS down.
- Node.js Manager: apps could all show as "stopped" with Start/Stop doing nothing when the account's configured Node.js version folder existed but had no pm2 (for example a version symlinked to another). The panel now looks for a Node.js build that actually has pm2.
- Account resource limits: setting limits with an empty user name no longer creates a stray /etc/security/limits.d/.conf file; an invalid user name is ignored.
- CSF/LFD contact e-mail (Settings): the address is trimmed and validated before saving, so a leading space is no longer stored (which had kept the "contact e-mail not set" warning on) and only a valid e-mail is written.
- ClamAV signature updates: the nightly job used to re-enable the clamav-freshclam service every night, so an admin who stopped/disabled it saw it switched back on; it is now started only once and a later disable (or mask) is honoured.
- Backup Manager (account SSL): accounts whose home already had an older ssl/ folder (without the autossl/ subfolders) had their SSL certificates left out of the backup ("No such file or directory"); the backup now always creates the needed folders. The autossl list also no longer accumulates duplicate domain entries on every run.
- User panel FTP accounts: adding or changing an FTP user failed on accounts whose "domain" has no dot (some setups create such accounts), because the FTP user/domain was required to contain a dot. Dotless account domains are accepted now (ownership is still checked against the account).
- Login (admin panel and user panel): a correct password was refused when the account's system password hash used the $6$rounds=N$ form (written by some providers' panels, e.g. Hostinger), and on newer systems yescrypt hashes could not log in at all. Login now checks the password against the whole stored hash, so all current hash formats ($1$/$5$/$6$, $6$rounds=N$, yescrypt, bcrypt) work.
- Backup Manager: on panel PHP 8.1+ the FTP restore account list came up empty because an internal log line tried to print the FTP connection object (fatal error); the list loads again.
- New accounts on servers running CWP Secure Kernel: a newly created account could end up without its PHP-FPM pool, so the website returned 503 (no PHP) until the pool was rebuilt by hand. The disk-quota safety check that gates pool creation no longer switches into the account's own shell (which the secure kernel blocks); it reads the disk quota directly as the panel, so the pool is written reliably and an account is only skipped when it is genuinely over its hard disk quota.
- External API log: when a remote app that signs in without an API key (for example Softaculous / Fantastico) is refused, the log now records which API action failed and whether a token was sent, instead of a bare "Invalid Token", so these integration problems can be diagnosed from the log.
- User panel Node.js Manager: the "npm install" log window kept spinning after the install had already finished, and a window reopened later showed nothing. The window now ends when the install actually ends, keeps the whole log (it is no longer emptied as it is read), and if the install cannot start because the account reached its process (nproc) limit it says so instead of running forever.
- User panel login on EL7: after a system update of the TLS libraries (nss, openssl, curl, ca-certificates) the login could fail ("failed", 77) until the panel PHP was restarted; CWP now restarts it by itself after such updates (also right after an update from Yum Manager).
- CWP Secure Kernel: if the kernel rules were not installed on a fresh server, they are now installed automatically at the first boot of the secure kernel.
- CWP Secure Kernel module: cleaner status wording when the secure kernel is not running.
- Security audit: a service that starts a self-built program (for example ntpd compiled by hand) is now reported as a warning to check, not as a known cryptominer. Hidden processes and the known miner file names are still reported as critical.
- User panel File Manager: uploading over an existing file failed with "500" when the old file could not be overwritten (for example a file left by a restore); it is now replaced, or a clear message says why not. Extracting archives works again on servers where it did nothing, and extract errors are shown.
- "Fix mail permissions" (API and account tools): on servers whose Postfix delivers as vmail, the mailbox records now match the file owners again, so the mailboxes stay readable.
- Server host name: the SSL vhost of the host name (hostname-ssl.conf) was never written on servers that did not have it (new EL9 / EL10 servers), because Change Hostname writes the vhosts before the new certificate exists; https on the host name then showed another site's certificate and /roundcube/ went to /webmail/. It is now written as soon as the host name certificate is installed, and the nightly job adds it when it is missing.
- PHP builds started from a terminal (for example /scripts/cwp_php build fpm 5.6 on EL8) no longer stop at the dependency step waiting for input.
- PHP Defender: on servers with CWP Secure Kernel whose rules do not yet let PHP read the PHP Defender rules, turning PHP Defender on is refused with a clear message instead of leaving every PHP page of the chosen versions empty.
- The unfinished DNS Cluster page (reachable only by its address) no longer runs its test actions; it points to Slave DNS Manager, which replicates the zones.
- Nightly security cleanup: if /root/.ssh or root's authorized_keys belongs to another user (which would let that user add a root login key), it is set back to root.
- CWP to CWP migration: the calls to the other server's API use https (port 2031) instead of plain http (2030), so the API key and the temporary account passwords are no longer sent unencrypted; migrating to servers that redirect port 2030 to 2031 works again.
- Panel PHP 8.3 update (update_cwpphp83): a damaged file in /etc/yum.repos.d (for example NUL bytes or a bare URL line) no longer stops the install; the damaged files are skipped for this install and named in the output.
- WebServer template editor: templates saved with %-sequences (for example %20 in rewrite rules), + or & were changed on save; the content is now saved exactly as typed, and only template files can be opened, saved or deleted from it.
- Security: account restores from cPanel archives (cPanel migration, cPanel backup restore) and the account backup restore now accept mail accounts, forwarders and auto-replies only for the restored account's own domains and with valid names, read the archive's mail data without the shell, and copy each domain's mail separately. Please update before migrating accounts from other servers.
- Admin web terminal: logging out of the admin panel now also ends the terminal access of that session (the session's terminal token stopped working only when the terminal was opened again).
- Cgroups resource limits page: on EL8/EL9/EL10 (cgroups v2, which has no cgrules.conf) the rules box no longer shows an error, and the rules are displayed safely.
#26
Updates / CWP New Version Released 1.30....
Last post by Administrator - November 08, 2026, 10:37:46 AM
CWP (CentOS Web Panel) - Changelog
Version 1.30.4 (LTS) - changes since version 1.30.3
============================================================
CWP 1.30.4 is a bug-fix update of the LTS version.

Fixes
-----
- New Backup to NFS: a share that does not answer is tried a second time with a longer wait, and the backup log now says why the mount failed (it showed only "Failed to mount NFS:").
- New Backup restore from NFS: the account list, the restore itself and the "Browse NFS share" button use the same mount with a second try; when the share cannot be mounted the list says why instead of only "No Backup".
- New Backup restore from NFS (incremental): the backup dates of an account are listed again (the list showed "No Backup" although the backups were on the share).
- CWP Secure Kernel > Rules: a service that follows the mode of the service that starts it (for example PHP (suPHP / CGI) under a web server set to "Log only") can be set to Protect again; the click was lost and the row stayed on "Log only".
- CWP Secure Kernel: the policy tools (cwpsecure-tools) are installed automatically when only the kernel was installed (the Rules tab stayed empty and rule updates failed with "CWPsecure rules not installed"); the Secure Kernel repository file is corrected when it points to another EL version.
- Webmail: the panel auto-login plugin of Roundcube is installed as plain PHP again; after 1.30.3 webmail could show only "No Loader is installed" on servers where the webmail PHP has no ionCube loader.
- WordPress Manager: installing WordPress with a new database no longer fails with "Failed to create database user" (code 1001); the database user got a wrong password.
- Account restore (New Backup): the restore log is readable by root only and no longer contains the FTP password file of the server; FTP account names and folders from a backup are checked before they are added.
- User panel Backups: MySQL backups (manual and automatic) contained no database when the account's databases were reachable only through a wildcard grant ("account_%"); the backup now takes the account's real databases and also saves stored procedures, events and triggers.
- Admin panel: the user panel login check no longer writes a curl progress bar into the panel log on every page.

Update: sh /scripts/update_cwp (as root) or wait for the nightly automatic update.
#27
Backup / Re: NEW Backup: Still in Perpe...
Last post by Administrator - November 08, 2026, 10:32:40 AM
cwp recently fixed all bugs and support is now at the highest level ever responding very fast and resolving issues in minutes, also bugs get resolved i the same day.

CWP has now the latest software always so it much more advanced.
CWP secure kernel provides highest security for our server and we are also soon releasing our own version of cage fs similar to cloudlinux so you don't need cloudlinux, you only need cwppro.

And don't forget cwp is now very fast and you can report any issue via cwp support tickets and it gets resolved very fast.

Also our developers are now following forum for issues and they get resolved also very fast.
New CWP version is coming soon with the edge version having a complete new cwp design and new features.

Recently we also introduced our new billing system where we also provide free support and custom module development.

Many more new things are coming soon.
While speaking new CWP 1.30.5 LTS is now out
#28
Backup / Re: NEW Backup: Still in Perpe...
Last post by djprmf - November 08, 2026, 10:15:39 AM
Quote from: DeanCTS on November 08, 2026, 10:02:16 AMMaybe the biggest problem of backup feature is unclear docs but it is working smooth as a charm. I have used CWP for about a decade and never ever had a problem with backup or restore, but again, I'm advanced user and can figure when things in documentation are unclear or when the interface is a bit harder to understand due to lower user experience.

The recent versions have improved a lot in this matter.
But documentation is still lacking.
Hope to see it improve as the panel is also improving and with bigger stance on the public changelogs.
#29
Backup / Re: NEW Backup: Still in Perpe...
Last post by DeanCTS - November 08, 2026, 10:02:16 AM
Quote from: adrianofnatal on October 11, 2026, 08:25:05 PMIm PRO user too, for YEARS.

I quit from CWP panels, today, I have only one server.

One of the reasons was backup malfunction.

Other was:
- Isolation of account files and processes are weak, relying only in file permissions.
- NodeJS apps difficult to read error logs (they aren't integrated in panel and dont show app ID to get log from console)
- Proxy template does not work. You can create a proxy template and set to domain but in next reload, panel does not use your template.
- OWASP modsecurity rules does rename initialization file, causing the rules to be not applyed (just warnings showed). If you rename manualy, it works, but in next update, your rename is lost.
- Customer panel with a log of bugs, including not show Postgresql databases.
- Postgres databases are not backuped.
- NodeJS apps was not recreated after backup restore.
- Migration from CWP to CWP does not work with SSH private keys.
- We have problems with invasion of our servers. Suspect that was entering throug API port 2304.
- Some file editors save files with errors.

This was what I found.

It could be a good, promising panel, but I don't know what goes on behind the scenes.
In the meantime, as hosting managers, we can't rely on it.


Maybe the biggest problem of backup feature is unclear docs but it is working smooth as a charm. I have used CWP for about a decade and never ever had a problem with backup or restore, but again, I'm advanced user and can figure when things in documentation are unclear or when the interface is a bit harder to understand due to lower user experience.
#30
Backup / Re: NEW Backup (beta) / Restor...
Last post by DeanCTS - November 08, 2026, 09:40:19 AM
Please note that you need to import files from your S3 to /newbackup in order to restore.


As you can see, the restoration works and detects account/date involved once copied to the local /newbackup dir.

The S3 storage is just your safekeeping option for archiving backups or serving as secondary repository.