cPanel

New csf v2.70

Changes:

  • Modified to adopt cPanel v11 WHM theme
  • Added ports 2077 and 2078 (cPanel WebDAV server) to csf.conf for new installations for v11 cPanel
  • Added FC5 to the list of (or soon to be) unsupported OS’s
  • Fixed LF_SMTPAUTH not correctly being set to LF_FTPD when upgrading

New csf v2.67 – Major Security Fix

Changes:Security fix – A major security issue has been found (thanks to Jeff for informing us) in the LF_DIRWATCH code that can lead to arbitrary code being executed in the context of the user running lfd, i.e. root, if that option is enabled and a hacker has access to create a crafted filename in one of the watched directories. This update closes this hole.*ALL INSTALLATIONS SHOULD BE UPGRADED ASAP TO AVOID POTENTIAL EXPLOITATION*You can upgrade csf either through WHM or from the root shell using:

csf -u

New ClamAV v0.90.2

ClamAV have released a new version with security fixes. It is advised that everyone upgrade to this new version, which you can now do through the MailScanner WHM UI.

Changes in this release include some security fixes in CHM, CAB and PDF code and better handling of network problems in freshclam.Please see ChangeLog for complete list of changes. **Important note**: on April 16th CHM, CAB and PDF handlers will be disabled for 0.90 and 0.90.1 users through the dynamic engine configuration module (DCONF). Please upgrade to 0.90.2 immediately.

New csf v2.66

Changes:

  • Modified LF_CPANEL text in csf.conf for new installations to reflect the change in the SSL login handling by cPanel (i.e. it does now log SSL login IP’s)
  • Modified the log line monitoring in lfd to cope with log line flooding to prevent looping/excessive resource usage. Also recoded without the use of the POSIX routines
  • lfd process name now shows which log file it is scanning

New ClamAV v0.90.1

ClamAV have released a new version that fixes a raft of things that they broke with the v0.90 release a few days ago. We will be releasing a new version of the MailScanner installer script shortly that fixes an incompatibility in MailScanner with the new v0.9* version of ClamAV.

New Mail::ClamAV v0.20

The day we release a patch workaround the Mail::ClamAV developer has finally released fixed code for ClamAV v0.90. It will take some time to get around all the cpan.org mirrors, but you can install it from source easily enough and then revert to virus scanners = clamavmodule in MailScanner.conf

wget http://cpan.pair.com/authors/id/S/SA/SABECK/Mail-ClamAV-0.20.tar.gztar -xzf Mail-ClamAV-0.20.tar.gz cd Mail-ClamAV-0.20perl Makefile.PL makemake installpico -w /usr/mailscanner/etc/MailScanner.conf

Virus Scanners = clamavmodule

service MailScanner restart

New ClamAV v0.90

We have previously guarded against upgrading to this latest version of ClamAV as the developer of the perl module Mail::ClamAV has not updated his code to support this updated version of the ClamAV engine.However, vulnerabilities have now been published for versions of ClamAV prior to v0.90 so it seems prudent to upgrade to it now.To do this we have repackaged the ClamAV v0.90 distribution and added code to convert MailScanner to use clamav instead of clamavmodule for its Virus Scanner.The downside of this change is that there is a potential increase in server load over using the perl module method.You can upgrade now through the WHM MailScanner UI. You can ignore the Mail::ClamAV errors at the bottom of the installation procedure, but do make sure that MailScanner starts correctly and send a test message through your system (check /var/log/maillog).For anyone using MailScanner without our Front-End, you can upgrade using the same repackaged distribution with…

wget http://license.configserver.com/clamav-0.90.tar.gztar -xzf clamav-*cd clamav-*./configure –disable-zlib-vcheckmakemake installreplace “Example” “#Example” — /usr/local/etc/freshclam.confreplace “Example” “#Example” — /usr/local/etc/clamd.conffreshclamcd ../bin/rm -Rf clamav-*service MailScanner restart

Do not upgrade to ClamAV v0.90

Don’t be tempted to upgrade to ClamAV v0.90 if you are running MailScanner. The Mail::ClamAV perl module is incompatible with it at this time, so you will have to stick with ClamAV v0.87 (why can’t they develop these things to be backwards compatible?). Hopefully the Mail::ClamAV developer will fix this soon. If you must use v0.90 then you’ll have to set virus scanners = clamav in MailScanner.conf

MailScanner: Problems for Liquidweb clients

We have found that some clients hosted by Liquidweb are seeing the message “MailScanner Status: Disabled” at the top of their MailScanner front-end after a cPanel upgrade.The problem has been caused by Liquidweb’s installation of clamav rpms that modify the exim configuration each time cPanel is upgraded, thus breaking MailScanner. We have been uninstalling these rpms as part of our mailscanner install for several months now but it appears that Liquidweb has re-installed those rpms and the problem has arisen again since a recent cPanel upgrade.Fix instructions follow.If you would like us to perform the fix for you, then please log a ticket on our helpdesk with access details. There will be a $30 (half hour) charge for performing this service.Here is how to fix it:1. Remove /etc/exim.conf.local to start with a clean copy.

/bin/mv -fv /etc/exim.conf.local /etc/exim.conf.local.old/scripts/buildeximconf

2. Remove all installs and rpms of clamav and reinstall clamav.

killall clamdrpm -e clamav-db clamd clamav clamav-devel/bin/rm -Rfv /usr/bin/clam*/bin/rm -Rfv /usr/sbin/clam*/bin/rm -Rfv /usr/lib/libclam*/bin/rm -Rfv /usr/share/clam*/bin/rm -Rfv /usr/include/clam*/bin/rm -Rfv /usr/bin/freshclam*/bin/rm -Rfv /usr/etc/clamav*/bin/rm -Rfv /usr/local/bin/clam*/bin/rm -Rfv /usr/local/sbin/clam*/bin/rm -Rfv /usr/local/lib/libclam*/bin/rm -Rfv /usr/local/share/clam*/bin/rm -Rfv /usr/local/include/clam*/bin/rm -Rfv /usr/local/bin/freshclam*/bin/rm -Rfv /usr/local/etc/clamav*useradd clamavgroupadd clamavcd /root/rpmswget http://prdownloads.sourceforge.net/clamav/clamav-0.88.7.tar.gztar -xzf clamav-*cd clamav-*./configure –disable-zlib-vcheckmakemake installreplace “Example” “#Example” — /usr/local/etc/freshclam.confreplace “Example” “#Example” — /usr/local/etc/clamd.conffreshclamcd ../bin/rm -Rf clamav-*cd /root/rpms/touch /var/log/clam-update.logchown clamav:clamav /var/log/clam-update.log/scripts/perlinstaller –force Mail::ClamAV

3. Upgrade MailScanner (per instructions on website – http://www.configserver.com/cp/upgrade.html) to add correct configuration to exim.conf.local. Should be able to select option 2 (quick perl module check). You will need to do ths at the command line since you are probably already running the latest version of MailScanner.4. Re-add the dictionary attack ACL, log_selector, etc. to exim.conf.local via WHM exim configuration editor, if desired.

New csf v2.57

Changes:

  • New feature: WHM UI mod_security v1 display last X entries in the audit_log
  • New feature: WHM UI mod_security v1 edit files or directories in /usr/local/apache/conf/ that are prefixed with modsec or mod_sec
  • Tweaked the pre-configured Firewall Security Level settings