CWP (CentOS Web Panel) - Changelog
Version 1.29 - changes since version 1.28
============================================================
New: EL10 support
-----------------
- EL10 support (AlmaLinux, Rocky Linux, RHEL and other EL10 systems): installer, panel and packages (panel web server,
panel PHP, Apache, PHP Switcher/Selector build scripts). The panel now detects the EL version the same way on every EL
distribution. Install with the same command as on EL7-EL9: curl -Lo cwp-latest http://centos-webpanel.com/cwp-latest
&& sh cwp-latest.
- EL10: user panel login works. EL10 stores passwords as yescrypt, which the user panel login could not check; the login
now checks any password hash format of the system, and new passwords are stored as SHA-512 (installer and nightly
job), as on EL7-EL9.
- EL10: CSF firewall works (its kernel modules are in kernel-modules-extra, which EL10 does not install by default). The
installer installs it and existing servers get it from the nightly CWP job.
- EL10 mail: Postfix on EL10 supports only lmdb maps (no hash); the CWP Postfix configuration is switched automatically
(installer and nightly job), and the panel writes its mail maps (SNI certificates, sender white/black lists) in the
map type of the server. Mail server manager: AntiSpam/AntiVirus and DKIM & SPF install on EL10.
- EL10: background jobs started with screen (FFmpeg installer, Apache builder, PHP Selector, FTP backup) run - screen
refused to start there ("Directory /run/screen must have mode 777").
- EL10: FFmpeg installer builds current FFmpeg 7.1 (with x264, fdk-aac, LAME, VPx, Opus, AV1...); the old FFmpeg 2.8 /
libfaac build does not compile on EL10.
- EL10: Varnish installs for the Nginx + Varnish setups and no longer takes port 8443 (the EL10 package listens there
for a TLS proxy - that is the Apache SSL port); Varnish settings are kept in a systemd drop-in that package updates do
not overwrite.
- EL10 install/build scripts on the CWP CDN (mail, service and PHP build scripts, PostgreSQL), based on the EL9 ones
with the EL10 packages.
Security
--------
- ModSecurity "OWASP latest" rules did not block anything: the rule package ships its initialization file only as an
example, so the anomaly scores were never added up and attacks were only logged. New installs of these rules block by
default; on servers that already use them, the ModSecurity page shows a notice with a button to turn blocking on (the
Apache configuration is tested first). Check your sites for false positives after enabling it.
- User panel internal API: hardened the subdomain, addon domain, FTP account, URL redirect, protected directory,
reseller and streaming (ServerCast) actions. Values from the request are now validated and never reach a shell; files
inside the account's home directory (.htaccess, .htpasswd, redirect and reseller settings, playlists) are read and
written with the account's own permissions. Reseller actions now require a reseller account and only work on the
reseller's own accounts and domains. FTP passwords are no longer logged or returned in responses.
- User panel internal API: several actions (package usage, statistics, SpamExperts, mail pipes, backup start and
database restore) now require a valid session; user login and language lookups validate all values and handle files in
the home directory with the account's own permissions.
- User panel two-factor authentication: the login page now asks the internal API to verify the code; the 2FA secret is
no longer handed out.
- User panel backups: backups are now built in a protected staging directory and the finished archive is written to
~/backupcwp with the account's permissions. Database restores run with a restore account that can only access the
account's own databases, and only CWP's own database user/privilege lines are taken from the backup. Automatic backups
validate the stored file names. Backups no longer include databases of other accounts whose name starts with the same
letters. Unused legacy restore actions were removed.
- User panel: the internal helper that runs system commands for panel modules now runs them with the account's own
permissions and only on the account's own files; the few operations that need administrator rights (DNS zones, SSL
certificates, PHP selector, MySQL process list, cron) only work on the account's own domains. Add-on installers
download, unpack and run Drush with the account's permissions.
- User panel MySQL manager: databases, users and privileges are only changed for the account's own databases and users
(some checks also matched other accounts with a similar name).
- Web server configuration: per-domain settings stored in the account's home directory are validated before they are
used to build Apache/Nginx/Varnish configuration.
- PHP version selector (.htaccess) and web server settings are written with the account's permissions.
- User panel e-mail accounts and forwarders: quota, status, password and delete actions only work on addresses of the
account's own domains.
- User panel SSL (Let's Encrypt): install, renew, delete and force-renew only work on the account's own domains.
- User panel File System Lock: refuses to lock when public_html is not a real directory.
- User panel WordPress Manager: file, archive, database and WP-CLI operations run with the account's permissions;
database export/import/query use the site's own database login and only the account's databases.
- User panel add-on installers (Laravel, Magento, Nextcloud, phpBB, Moodle, WHMCS, ...) run with the account's
permissions.
- User panel MongoDB and PostgreSQL managers: database and user names, roles and passwords are validated (passwords may
not contain quotes, $, or backslash).
- User panel Node.js and Tomcat managers: application domains and paths must belong to the account; web server settings
are written with the account's permissions.
- User panel: notification settings, cron copy, caches and dashboard settings in the home directory are read and written
with the account's permissions; the asset compressor only reads panel scripts. A legacy internal action that ran
arbitrary commands was removed.
- External API (port 2304): the account backup/migration actions are only allowed for API keys with the backup
permission, "all", or the "CWP to CWP" preset; other keys (e.g. a billing key) can no longer use them.
- Webmail ports (2095/2096) and /roundcube on the panel ports: Roundcube's log files, configuration and installation
files (logs/, config/, SQL/, vendor/, .htaccess, composer files, ...) can no longer be downloaded (the existing block
never matched on the webmail ports).
- Panel web server (cwpsrv): TLS 1.0 and 1.1 are no longer offered on the panel, user panel, webmail and internal API
ports (TLS 1.2, plus TLS 1.3 where the system OpenSSL supports it). The external API port (2304) installer no longer
enables TLS 1.0/1.1 either.
Mail
----
- Incoming SPF check: "Install DKIM & SPF" now really checks SPF for incoming mail (the policy service was installed but
never used): mail whose sender domain fails SPF hard ("-all") is rejected, soft failures only get a Received-SPF
header; local and authenticated senders are not checked. New installations have it on.
- DKIM keys of new domains are 2048-bit (were 1024); the DNS record is written as several strings so the long key is
published completely. Existing keys stay until DKIM is removed and enabled again for the domain.
- SRS for forwarded mail (postsrsd): forwarders and aliases to other providers keep working where the sender's SPF is
checked (Gmail, Outlook...). Mail of the server's own domains is not rewritten. New option in Mail server manager (on
by default), on for new installations.
- With AntiSpam/AntiVirus enabled, mail sent over port 25 went out with two DKIM signatures (it passed the DKIM signer
again after the spam check). Fixed on existing servers by the nightly update and on every mail server rebuild.
- Mail on EL8 and EL9: the nightly check that installs the missing postfix-mysql package (without it no mail is
accepted) did not run from cron; it runs now.
- Mail server rebuild: MySQL map files are no longer left group/world-writable.
- Policyd: the installer adds the policy check to Postfix also when smtpd_recipient_restrictions continues on the next
lines of main.cf (EL9) - before, Policyd was installed but Postfix never used it; uninstall removes it the same way.
The Policyd page shows "Policyd not installed" instead of a blank page.
- Roundcube: /scripts/mail_roundcube_update checks the sha256 of the CWP webmail plugin files it downloads and says
clearly when Roundcube cannot be updated because the panel PHP is still 7.2; the admin panel also shows a notification
(at most once a month) when Roundcube stays on the end-of-life 1.5 for that reason.
CWP to CWP migration
--------------------
- New step "After the migration: move the old server's IP to this server". Once the old server's IP is configured on the
new server, it replaces the temporary IP in the shared IP, all accounts, all DNS zones (A records, SPF; new serial,
copies of the old zones are kept) and rebuilds the Apache/Nginx/Varnish vhosts in the background, with a log; files
outside CWP that still mention the old IP are listed.
- From EL8 source servers the migration no longer stops at 20% with "The backup on the source server stopped without
finishing"; migrations from a source running CWP 1.28 no longer stay at 0%.
- Accounts with accented webmail (Roundcube) contacts are migrated with all their mailboxes, aliases and autoresponders
again; Roundcube contacts and identities show up in webmail after the migration.
- Copied SSL certificates are registered on the new server, so the migrated domains are served over HTTPS right away.
- Addon domains and subdomains of migrated accounts no longer answer "403 Forbidden".
- Accounts without databases no longer finish with a false "Database import failed" error.
- Databases from a newer MariaDB/MySQL source (MariaDB 11 "uca1400" or MySQL 8 "0900" collations) are imported on a
server with an older MariaDB; a database whose charset/collation is still not supported is skipped with a clear
message instead of failing half way.
- "Sync again" with databases: a database is replaced only after the new copy was fetched and checked.
- A package with the same name that no account uses yet (e.g. "default" on a fresh server) takes the limits of the
source package; if local accounts already use it, its limits are kept and the migration log says what differs.
- A domain set to a PHP-FPM version that is not installed on the new server no longer ends up with a disabled vhost: it
switches to an installed version (the migration log says which).
- MySQL users of an account that have no database privileges yet are migrated too, with their password.
- The migration page warns when this server has no CWPpro licence yet (without it the PHP-FPM sites of migrated accounts
stop working on this server).
Web servers
-----------
- Apache (cwp-httpd) updated to 2.4.69 on EL7, EL8 and EL9 (new package for EL10). Apache configuration files are no
longer replaced by package updates; works unchanged with Apache only, Nginx + Apache and Nginx + Varnish + Apache.
- Apache (cwp-httpd 2.4.69-2, EL8 and EL10): the 2.4.69-1 package had a broken apxs tool, so Apache modules could not be
built and putting Nginx in front of Apache could leave Apache stopped. Fixed package; existing servers get apxs
repaired by the nightly CWP job, and the web server setup uses Apache's own mod_remoteip for the real visitor IP
whenever mod_rpaf cannot be built.
- Apache: restarting Apache could keep all websites down (502) for up to 90 seconds while a single slow request was
still running. A restart now waits at most 10 seconds for running requests.
- Apache builder: offers current Apache versions up to 2.4.69.
- Nginx: updated to 1.30.6 also on EL7 (the nginx.org packages for EL7 stopped at 1.26.1; CWP now provides the package
for EL7 in its repository, built from the official nginx.org sources).
- Nginx updates no longer bring back the "Welcome to nginx" default site, keep the open files limit (65535), and on
servers with CWP Secure Kernel no longer leave nginx without its PID file. The configuration check no longer reports a
false "Too many open files" error on servers with several hundred domains.
- Nginx: TLS 1.3 is enabled for all domains (vhosts get it when they are rebuilt). Images are no longer gzip-compressed
again. The Cloudflare address list is updated and includes IPv6.
- Nginx: disabling a still active "Welcome to nginx" default site now restarts nginx (a reload could not move nginx to
the server IPs, so new domains were not served until the next restart).
- Varnish: when /etc/varnish/default.vcl is still the stock file of the varnish package, it is replaced with the CWP one
as soon as a domain is rebuilt; before, every request through Varnish answered 503.
- Web servers: a domain or subdomain whose path is not valid is skipped when the vhosts are rebuilt instead of breaking
the Apache/Nginx configuration of the whole server (logged in /var/log/cwp/webservers_rebuild.log).
- Web server and PHP-FPM templates: a custom template containing % signs of its own (e.g. php-fpm access.format, Apache
LogFormat) was treated as "template failed", the configuration was saved as .disabled and the site returned 502.
- Panel web server (cwpsrv) updated to nginx 1.30.6 (from 1.24.0 on EL8/EL9 and 1.15.10 on EL7). Existing panel
configuration is kept.
PHP
---
- PHP Selector, PHP-FPM Selector and PHP Switcher: end-of-life PHP versions that CWP builds with its security backport
(5.4.45 - 8.1.34) are marked "CWP security patch" in the version list; an installed patched version is shown as the
current version again.
- After a rebuild or a switch to another PHP version, the ionCube and SourceGuardian lines could still name the loader
of the previous version, so PHP printed only the loader error and the user panel PHP Selector failed when saving. The
loader lines and a stale extension_dir are now corrected after every build and nightly.
- PHP (EL8/EL9): PHP versions built with CWP's private OpenSSL could not verify any TLS certificate (HTTPS requests,
SMTP with STARTTLS, payment/mail APIs failed). The nightly CWP job now points it at the system CA bundle.
- PHP 8.3-8.5 on EL8/EL9: mbstring was silently missing when the PowerTools / CRB repository was not enabled; the build
now installs it from there and reports it clearly when it cannot.
- Options such as zlib could not be enabled for a version built before (the page reported a missing dependency).
- PHP Switcher: saving the build options no longer hangs when a CWP CDN node does not answer.
- Packages: saving a package on a server without cgroups stored "undefined" as the cgroups policy, which broke the user
panel PHP Selector for its accounts. Fixed, and existing packages are cleaned up automatically.
- CWP update: "Unable to start pcre module" is repaired also when a second, newer pcre2 library without JIT was
installed in /usr/local/lib by a PHP build.
Panel
-----
- New CWP Update page (Dashboard "CWP update available" and the Maintenance "Update" tile opened "The module update does
not exist"): installed and latest version, "Update CWP now" and its log.
- CWP update (/scripts/update_cwp) run by hand from a terminal no longer prints "pkttyagent ... Unable to register
authentication agent" warnings after every service restart/reload.
- Terminal (admin panel): rebuilt on a current terminal component. UTF-8 input and output work, keys typed with AltGr
(e.g. \ | @ { } on European keyboards) work, pasted text is kept as it is. New toolbar: shell, reconnect, font size.
The terminal no longer stops working after the first night and no longer closes terminals open in other tabs.
- GoAccess statistics: the monthly report was never created - on the 1st of the month GoAccess did not run at all, so
the daily report for the last day of the month and the monthly cleanup were skipped too.
- Cgroups Resource Limits now work on EL9 (cgroup v2): the new cwp-cgroups2 service applies the CPU, memory and disk
limits of the policies as systemd slices per account.
- Server Date & Time: changing the timezone also sets it for the panel's own PHP; the form shows the server's local time
and the clock is only set when date or time were changed; "Restore or keep server timezone" no longer deletes
/etc/localtime; UTC can be selected.
- Node.js Manager: "NPM install" and npm console commands of an account's application work again; a stopped install
(process limit) shows why instead of "running" forever. User panel Node.js / Tomcat: an install that could not start
is no longer shown as running forever.
- User panel File Manager: "Compress" works when the archive is saved in another folder; .tar.gz archives are
compressed.
- User panel DNS Zone Editor: records for the domain itself ("@", e.g. SPF/DMARC/verification TXT, CAA) can be added and
edited again, and CAA values with ";" are accepted.
- User panel backups: backups uploaded to FTP are sent in binary mode. Protected directories with spaces or special
characters in the name work.
- List Accounts "Export to Csv": accented characters are no longer garbled in Excel.
- CSF firewall: "Check for updates" no longer fails with "Unable to download: No Host option provided" (ConfigServer
closed its download servers; CSF is updated together with CWP); the daily CSF auto-update check is switched off.
- phpMyAdmin update no longer stays silently on the old version when the phpMyAdmin folder is locked.
- Security Audit: libraries in /usr/local/lib64 (libzip from the PHP builds) are no longer reported as unknown files.
- Logs: Apache's own logs (incl. modsec_audit.log) and the panel PHP log are rotated (weekly or at 100 MB); scanners
probing missing files on the panel ports no longer fill the panel error log; the nightly log fix no longer restarts
the panel every night; installer downloads no longer write progress lines into the panel PHP log; fewer PHP warnings.
- Admin panel menu: all menu groups use the same icon set.
Zoom! Go, go, go! Looks like I'll be going from AlmaLinux 8 to 10 as soon as the foundation gets just a little more solid.
my licenses not working after updates all websites down.
Some issues that need to be fixed:
1 - Changing the language in the user panel does not work.
2 - The "File System Lock" button does not work.
3 - Disk usage statistics in the user panel do not work.
4 - The "Cloudflare" button in the user panel triggers an error: "Error, module does not exist."
Ohh, this is simply amazing!! Update after update, it's getting much better.
I did a clean install on AL10, the installation script was updated, and what a difference! I remember when I tried installing on AL9 and it was a nightmare, today it was fantastic...
Quote from: bablil on October 31, 2026, 04:24:01 PM4 - The "Cloudflare" button in the user panel triggers an error: "Error, module does not exist."
Where is this button you mentioned?
I don't see anything from Cloudflare in the panel...
Quote from: Wonder on October 31, 2026, 04:28:25 PMOhh, this is simply amazing!! Update after update, it's getting much better.
I did a clean install on AL10, the installation script was updated, and what a difference! I remember when I tried installing on AL9 and it was a nightmare, today it was fantastic...
Quote from: bablil on October 31, 2026, 04:24:01 PM4 - The "Cloudflare" button in the user panel triggers an error: "Error, module does not exist."
Where is this button you mentioned?
I don't see anything from Cloudflare in the panel...
(https://i94.servimg.com/u/f94/18/04/55/46/captur34.png)
Quote from: bablil on October 31, 2026, 04:39:57 PMQuote from: Wonder on October 31, 2026, 04:28:25 PMOhh, this is simply amazing!! Update after update, it's getting much better.
I did a clean install on AL10, the installation script was updated, and what a difference! I remember when I tried installing on AL9 and it was a nightmare, today it was fantastic...
Quote from: bablil on October 31, 2026, 04:24:01 PM4 - The "Cloudflare" button in the user panel triggers an error: "Error, module does not exist."
Where is this button you mentioned?
I don't see anything from Cloudflare in the panel...
(https://i94.servimg.com/u/f94/18/04/55/46/captur34.png)
Thanks,
Quote from: overseer on October 31, 2026, 03:39:22 PMZoom! Go, go, go! Looks like I'll be going from AlmaLinux 8 to 10 as soon as the foundation gets just a little more solid.
Sure! I'm currently testing the migration from AL8 to AL10 and it seems to be working perfectly! I tried 1.28 but it failed, and then I saw that 1.29 fixed that problem. But right before I started, it updated to 1.30... This looks very promising...
Your PHP security patch is so much appreciated! Thank you!