Server Software and Configuration Services
Changes:
– Due to issues that some are experiencing with the switch from the state to the conntrack module a new settings has been added USE_CONNTRACK which is disabled by default except on servers running kernel 3.7+ where on new installations it will be enabled
Changes:
– Add an exception for the useless Virtuozzo kernels iptables implementation so that csf uses the deprecated state module instead of conntrack
Changes:
– Only add the /128 IPv6 bound address per NIC instead of the whole /64 to the local IPv6 addresses
– Modify SSHD and SU regexes to allow for empty hostname field in log file
– Added new option UNBLOCK_REPORT. This option will run an external script when a temporary block is unblocked
– Additional entries in csf.logignore on new installations
– Switched from using the iptables state module to using the conntrack module in preparation of the formers obsolescence
– Removed LF_EXPLOIT_CHECK and replaced it with LF_EXPLOIT_IGNORE so that new tests can be easily added and then ignored desired
– Added new LF_EXPLOIT check SSHDSPAM to check for the existence of /lib64/libkeyutils.so.1.9 or /lib/libkeyutils.so.1.9, See:
Changes:
– Fixed issue with single quotes appearing in CC lookup names leading to lfd IP blocks to fail
Changes:
– Additional entries in csf.pignore for the cPanel installation to cater for v11.36 processes on new installations
– Added workaround for cPanel /etc/cpupdate.conf check in Server Report for changes in v11.36
– Additional entries in csf.logignore on new installations
– Try harder to get a CPU temperature if lm_sensors is installed for System Statistics
– Enforce PORTFLOOD setting restrictions and issue warning if entry discarded
– Correct location of CC_ALLOWF in LOCALINPUT after update from lfd
– Make CC_[chain] actions more verbose in lfd.log
– Added new options CC_ALLOW_PORTS, CC_ALLOW_PORTS_TCP, CC_ALLOW_PORTS_UDP. This feature allows access from the countries listed in CC_ALLOW_PORTS to listed TCP/UDP ports. For example, using this FTP access port 21 could be restricted to only the specified countries
– Moved temporary and csf.allow/csf.deny rules from LOCALINPUT/LOCALOUTPUT chains to ALLOWIN/ALLOWOUT to allow for the new CC_ALLOW_PORTS feature
– Modified SMTP_PORTS to include ports 465 and 587 on new installations
– Added new option PT_FORKBOMB. Fork Bomb Protection. This option checks the number of processes with the same session id and if greater than the value set, the whole session tree is terminated and an alert sent
cPanel v11.36 has now entered the CURRENT tree and you will notice that most of your addon perl scripts failing. You can resolve this easily with our addons by reinstalling them. We have provided a simple script that can do this for you that we posted previously. This has to be done regardless as to whether you are running the latest versions:
This script will update: cmm, cmc, cmq, cse, csf, cxs, msinstall, msfe
Only those scripts that are already installed will be updated. Those that are updated are done so regardless as to whether they are the same or an older version of those available.
To use this method you must be logged into root via SSH to the server and then run:
curl -s configserver.com/free/csupdate | perl
You should take care to read through the output to ensure that all the upgrades have worked as expected.
Changes:
– Fixed issue with crontab line for TESTING option not being detected and removed when TESTING mode is disabled
We have released a new method to force an update of all of our main scripts (on cPanel servers only):
cmm, cmc, cmq, cse, csf, cxs, msinstall, msfe
Only those scripts that are already installed will be updated. Those that are updated are done so regardless as to whether they are the same or an older version of those available.
To use this method you must be logged into root via SSH to the server and then run:
curl -s configserver.com/free/csupdate | perl
You should take care to read through the output to ensure that all the upgrades have worked as expected.
Changes:
– Added missing DD setting in DA and generic installations for ST_DISKW
– Modified IPv6 port settings to reflect IPv4 port settings for new installs in csf.conf
– If a deleted executable process is detected and reported then do not further report children of the parent (or the parent itself if a child triggered the report) if the parent is also a deleted executable process
– Parent PID added to PT_DELETED_ACTION parameters
– In the Server Report allow for spaces before Apache directives
– Updated instructions for modifying log_selector for exim configurations in readme.txt and Server Report
– Modify DD calculation for ST_DISKW for disks that report in GB/s
– Updated to use the new cPanel 11.36+ integrated perl binary if exists
Changes:
– Fixed problem processing dd output for ST_DISKW on some systems
– Fixed dovecot imap login failure regex processing
– Added regexes for dovecot pop3 and imap raw logs (i.e. not syslog)