CWP (CentOS Web Panel) - Changelog
Version 1.30 - changes since version 1.29
============================================================
New: CWP Secure Kernel and update channels
------------------------------------------
- CWP update channels (Settings > CWP Settings > CWP updates): LTS (default for every server - tested versions with
bug and security fixes) and Edge (newest features first). An Edge version that proves stable becomes the next LTS.
Edge builds are published separately; until then every server stays on LTS.
- Security > CWP Secure Kernel rebuilt: health check (rules groups, services, SSH, web), one-click safe mode,
apply/update/roll back with an automatic health check (falls back to safe mode when a check fails), per-service
Protect / Log only / Off that is kept across rules updates, denials read on demand or captured for a chosen time
(no log daemon running all the time), "Allow" for a denial, running processes with their protection, the rules of
each service with search, automatic rules updates switch and a support bundle.
- CWP Secure Kernel updates: the panel shows the running and the boot kernel and installs new Secure Kernel versions
(nightly or with one click, without a restart). A new kernel is started once, at once or at a chosen time; 3
minutes after the boot it is checked (rules, services, SSH, web) and only then kept as the boot kernel - otherwise
the server restarts on the previous kernel by itself. Optional automatic restart at a chosen hour.
- CWP Secure Kernel: when a system kernel update makes a kernel without protection the boot kernel, the nightly CWP
job sets the running Secure Kernel back as the boot kernel and shows a notification.
Security
--------
- CWP Secure Kernel rules updates run outside the caller's protection domain (a short-lived system service). On
older Secure Kernels a rules update started by the CWP cron job could lose its own rights while the rules were
reloaded and leave them half loaded (SSH and websites stopped). Rules version 65 contains the same fix for servers
that are not updated yet.
- Secure Kernel rules update: the rules archive is downloaded per version (a CDN node could serve an older cached
archive together with the new version number) and is only installed when its version matches; otherwise the
current rules are kept.
- Features, Themes, Languages > Feature manager: rule names, modules and accounts are escaped before they are
stored.
Fixes
-----
- Apache did not start after an update when httpd.conf had mod_auth_form enabled without mod_session (CWP does not
use it; it is often enabled by malware). The CWP update now disables that line, starts Apache and shows a
notification; the Security Audit warns about an enabled mod_auth_form.
- User panel: changing the language did nothing on accounts whose ~/.conf/cwp.ini belonged to root (older accounts,
restores, migrations) - the panel saves it as the account. The nightly CWP job gives the file back to the account.
- User panel: the Cloudflare entry in the menu and on the dashboard opened "Error, module does not exist" (there is
no Cloudflare module); removed.
- Varnish (Nginx + Varnish + Apache): sites that force https ("RewriteCond %{HTTPS} off" in .htaccess, WordPress,
Joomla...) ended in an endless redirect, and http visitors could get the https page - Varnish cached pages by host
and URL only, so the redirect of the http request was also served to https. http and https are now cached
separately; existing servers get it from the nightly CWP job (the Varnish cache is emptied once).
- Installer: "--mariadb 11.4" stopped with "Installation FAILED: MariaDB" (MariaDB 11 has the mysql, mysqldump and
mysqladmin commands in separate -compat packages, which were not installed). Servers that were upgraded to MariaDB
11 by hand get those packages from the nightly CWP job, so CWP's account, database and backup tasks find them.
- EL10: panel jobs and scripts no longer print "chown: warning: '.' should be ':'" (owner:group syntax everywhere).
- PHP-FPM Selector 8.5: the CWP OPcache settings (memory, revalidate frequency, CLI) were never applied - PHP 8.5
has OPcache built in and the setup step stopped with "Missing extension file opcache.so".
- EL10: PHP 7.4 and 8.0 (PHP Selector, PHP-FPM Selector, PHP Switcher) failed to compile with the EL10 compiler (GCC
14).
- Feature manager: a changed feature list now applies to the user panel right away (it was cached for up to 5
minutes), and it also applies to accounts created by older CWP versions or imports, which were taken for reseller
accounts and ignored the admin feature list until the account was saved again in List Accounts.
- User panel dashboard: remaining addon domains / subdomains are no longer negative for unlimited (-1) packages, and
the subdomain count is calculated from the subdomain limit (it used the addon domain limit).
Every thing runs sweet only issue i found is mod security stops apache.
alma linux 10 cwp 1.30
httpd: Syntax error on line 513 of /usr/local/apache/conf/httpd.conf: Syntax error on line 1 of /usr/local/apache/conf.d/mod_security.conf: Cannot load /usr/lib64/libxml2.so into server: /usr/lib64/libxml2.so: cannot open shared object file: No such file or directory
I guess my last main quibble with the UI is the round red bubble with 0 notifications. If there are zero, I wish it would not show at all (quite distracting, really!)
And of course I wish all the dashboard widgets were completely customizable -- turn off what you don't need, fully re-order items so as to put what's most important to you at the top. For sure I don't need notices about 500 failed SSH login attempts blocked by LFD -- that's just to be expected in this business. Right now I am mitigating this with uBlock Origin blocking certain elements:
srv1##.cwp-att-warn.cwp-att
srv1###foo_health
srv1###foo_attention
srv1###foo_activity
srv1###foo_mysql
srv1###foo_security