TheHolbi

@Sandeep B. Hi Sandeep, CWP now officially supports compiling PHP 8.4 and 8.5, but the default PHP-FPM builds are still being linked against CWP’s legacy OpenSSL 1.1.1t: /opt/alt/php-fpm85/usr/bin/php --ri openssl openssl OpenSSL support => enabled OpenSSL Library Version => OpenSSL 1.1.1t 7 Feb 2023 OpenSSL Header Version => OpenSSL 1.1.1t 7 Feb 2023 Openssl default config => /usr/local/opensslso/openssl.cnf Directive => Local Value => Master Value openssl.cafile => no value => no value openssl.capath => no value => no value openssl.libctx => custom => custom This means that even newly compiled PHP 8.5 installations use the obsolete /usr/local/opensslso build instead of the current system OpenSSL provided by AlmaLinux 9. After correcting the compiler environment and linking PHP against the AlmaLinux 9 system libraries, the expected result is: /opt/alt/php-fpm85/usr/bin/php --ri openssl openssl OpenSSL support => enabled OpenSSL Library Version => OpenSSL 3.5.5 27 Jan 2026 OpenSSL Header Version => OpenSSL 3.5.5 27 Jan 2026 Openssl default config => /etc/pki/tls/openssl.cnf Directive => Local Value => Master Value openssl.cafile => no value => no value openssl.capath => no value => no value openssl.libctx => custom => custom This confirms that PHP 8.5 can be compiled correctly on AlmaLinux 9 against the current system OpenSSL. It also uses the correct system configuration file: /etc/pki/tls/openssl.cnf instead of: /usr/local/opensslso/openssl.cnf I previously supplied the required include and library configuration, but it appears that it was not incorporated into the official compiler setup. Could you please treat this as a priority and update the PHP-FPM 8.4/8.5 compiler so that it: uses the AlmaLinux 9 system OpenSSL headers and libraries; does not inject /usr/local/opensslso into the build environment; does not link new PHP binaries against OpenSSL 1.1.1; uses /etc/pki/tls/openssl.cnf as the default OpenSSL configuration; verifies the completed build with: /opt/alt/php-fpm85/usr/bin/php --ri openssl ldd /opt/alt/php-fpm85/usr/bin/php | grep -E 'ssl|crypto' Official PHP 8.4/8.5 support should not produce newly compiled binaries linked against an obsolete OpenSSL branch. Updating PHP alone does not provide a modern and maintainable runtime while its TLS and cryptographic functionality remains tied to OpenSSL 1.1.1t. Please review the include and library settings I sent earlier and integrate them into the official CWP compiler instead of requiring administrators to patch every generated build manually.

@Sandeep B. Hi Sandeep, There is a related issue that needs to be addressed in the official PHP 8.4/8.5 compiler implementation. Every CWP update restores the old external_modules and pre_run scripts. These scripts contain legacy assumptions and configure options that are no longer compatible with PHP 8.4 and 8.5. As a result, locally corrected compiler configurations are repeatedly overwritten by the updater. IMAP is a clear example. You previously wrote: However, IMAP remains selectable in the CWP PHP-FPM configuration interface. Selecting it causes the old IMAP, Kerberos and IMAP-SSL handling to be injected into the build, even though these options are no longer supported by bundled PHP 8.4/8.5. This makes the interface a trap for administrators: CWP offers an option that its own compiler cannot validly process. The same legacy configuration problem affects options such as: --with-imap --with-imap-ssl --with-kerberos --with-pspell --with-zlib-dir --enable-opcache Please update the complete PHP 8.4/8.5 compiler chain, not only the visible version list: Remove unsupported bundled-extension options from the PHP 8.4/8.5 interface. Make the available options version-aware. Update the official external_modules and pre_run scripts. Stop CWP updates from restoring legacy PHP 8.4/8.5 compiler definitions. Remove the forced /usr/local/opensslso OpenSSL 1.1.1 integration and use the AlmaLinux 9 system OpenSSL. If IMAP or Pspell support is planned through PECL, expose it explicitly as a PECL extension rather than retaining obsolete PHP configure options. Test a clean PHP 8.4 and 8.5 compilation after a normal CWP update, without any administrator-applied patches. At present, CWP advertises official PHP 8.4/8.5 compilation support, but the surrounding compiler configuration still belongs to older PHP releases. An administrator who simply selects the options offered by the interface can generate a failed, obsolete or incorrectly linked build. I have already provided working corrections, but maintaining local patches is not a sustainable solution when every CWP update reinstalls the broken legacy scripts. These fixes need to be incorporated into the official update packages.

Hello @oblique Yes, this appears to be an outdated CWP PHP configuration rather than a missing PHP 8.5 feature. PHP still requires the system zlib development library: dnf install -y zlib-develHowever, the legacy PHP configure option: --with-zlib-dir=...must be removed. It has not been supported since PHP 7.4. Modern PHP discovers zlib through pkg-config. Check the generated CWP configuration, usually the relevant php85.conf, and remove --with-zlib-dir. If the CWP editor itself refuses to save because the zlib block contains: include=zlib-dirthen that dependency reference is also stale and should be removed from the CWP editor definition. Keep zlib enabled and keep zlib-devel installed; only remove the obsolete zlib-dir configure option/dependency.

@Sandeep B. Hello, This is a PHP 5.6 FPM script for El9 AlmaLinux 9 environment: #!/bin/bash # Usage: bash /root/build-php-fpm56-el9.sh 2>&1 | tee /root/php56-build.log # External modules: # /usr/local/cwpsrv/htdocs/resources/conf/el9/php-fpm_selector/external_modules/5.6 set -euo pipefail set -x # --- Basic variables --- PHPMAJOR="56" # php-fpm56 PHPVER="5.6.40" # PHP version FPMDIR="/opt/alt/php-fpm${PHPMAJOR}" CONFBASE="/usr/local/cwp/.conf/php-fpm_conf" SELECTOR_BASE="/usr/local/cwpsrv/htdocs/resources/conf/el9/php-fpm_selector" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" LOCAL_CONFBASE="${SCRIPT_DIR}/conf" PRE_RUN_BASE="${SELECTOR_BASE}/pre_run/5.6" EXT_BASE="${SELECTOR_BASE}/external_modules/5.6" OPENSSL_HACK_DIR="/usr/local/ssls" CURL_HACK_DIR="/usr/local/curls" IMAP_HACK_DIR="/usr/local/imap-2007f" arch=$(uname -m) if [[ "$arch" == "x86_64" ]]; then platform="x86-64" libdir="/usr/lib64" else platform="x86" libdir="/usr/lib" fi run_if_exists() { local script="$1" if [ -f "$script" ]; then bash "$script" || true fi } resolve_conf_file() { local name="$1" local primary="${CONFBASE}/${name}" local fallback="${LOCAL_CONFBASE}/${name}" if [ -f "$primary" ]; then echo "$primary" return 0 fi if [ -f "$fallback" ]; then echo "$fallback" return 0 fi return 1 } ensure_executable_config() { local config_file="$1" if [ -e "$config_file" ] && [ ! -x "$config_file" ]; then chmod +x "$config_file" 2>/dev/null || true fi } prepare_config_file() { local config_file="$1" local normalized_file="$2" cp "$config_file" "$normalized_file" # The generated 5.6 selector config can contain a malformed IMAP option # string. Normalize it before invoking configure so bash passes both flags # as separate arguments. sed -i \ -e "s|--with-imap=/usr/local/imap-2007f' '--with-imap-ssl=/usr/local/ssls|--with-imap=/usr/local/imap-2007f --with-imap-ssl=/usr/local/ssls|g" \ -e 's/ --enable-intl//g' \ -e 's/ --with-icu-dir=\/usr//g' \ "$normalized_file" chmod +x "$normalized_file" 2>/dev/null || true } ensure_imap_hack_layout() { mkdir -p "${IMAP_HACK_DIR}/include" "${IMAP_HACK_DIR}/lib" "${IMAP_HACK_DIR}/lib64" "${IMAP_HACK_DIR}/c-client" if [ -d "/usr/include/imap" ] && [ ! -e "${IMAP_HACK_DIR}/include/imap" ]; then ln -sfn /usr/include/imap "${IMAP_HACK_DIR}/include/imap" fi if [ -e "/usr/lib64/libc-client.so" ]; then ln -sfn /usr/lib64/libc-client.so "${IMAP_HACK_DIR}/lib64/libc-client.so" fi if [ -e "/usr/lib64/libc-client.a" ]; then ln -sfn /usr/lib64/libc-client.a "${IMAP_HACK_DIR}/lib64/libc-client.a" fi if [ -e "/usr/lib/libc-client.so" ]; then ln -sfn /usr/lib/libc-client.so "${IMAP_HACK_DIR}/lib/libc-client.so" fi if [ -e "/usr/lib/libc-client.a" ]; then ln -sfn /usr/lib/libc-client.a "${IMAP_HACK_DIR}/lib/libc-client.a" fi } CONFIG_FILE_TEMPLATE="" ENABLE_IMAP=0 # --- Packages for Build (EL9) --- dnf -y install \ autoconf automake bison gcc gcc-c++ make pkgconf-pkg-config re2c \ krb5-devel glibc-common gnutls-devel \ libxml2-devel libxslt-devel libicu-devel \ libjpeg-turbo-devel freetype-devel libpng-devel libXpm-devel \ libzip libzip-devel \ libbsd-devel \ libtidy-devel aspell aspell-devel \ perl \ uw-imap-devel \ openldap-devel \ bzip2-devel gettext-devel gmp-devel \ openssl-devel # PHP 5.6 on EL9 must use the old CWP OpenSSL 1.x hack. if [ -d /usr/local/opensslso ]; then echo "WARN: /usr/local/opensslso exists, but PHP 5.6.40 must be built against /usr/local/ssls." fi # --- Prepare old CWP 1.x dependencies --- run_if_exists "${PRE_RUN_BASE}/dep.sh" run_if_exists "${PRE_RUN_BASE}/ldap.sh" run_if_exists "${PRE_RUN_BASE}/firebird.sh" if ! CONFIG_FILE_TEMPLATE="$(resolve_conf_file "php${PHPMAJOR}.conf")"; then echo "ERROR: php${PHPMAJOR}.conf not found in ${CONFBASE} or ${LOCAL_CONFBASE}" exit 1 fi if grep -q -- '--with-imap' "${CONFIG_FILE_TEMPLATE}"; then ENABLE_IMAP=1 run_if_exists "${PRE_RUN_BASE}/imap.sh" fi if [ ! -d "${OPENSSL_HACK_DIR}" ]; then echo "ERROR: ${OPENSSL_HACK_DIR} is missing. Run the selector pre-run dependency step first." exit 1 fi if [ ! -d "${CURL_HACK_DIR}" ]; then echo "ERROR: ${CURL_HACK_DIR} is missing. Run the selector pre-run dependency step first." exit 1 fi export PKG_CONFIG_PATH="${OPENSSL_HACK_DIR}/lib/pkgconfig:${OPENSSL_HACK_DIR}/lib64/pkgconfig:${CURL_HACK_DIR}/lib/pkgconfig:${CURL_HACK_DIR}/lib64/pkgconfig:/usr/lib64/pkgconfig" export CPPFLAGS="-I${OPENSSL_HACK_DIR}/include -I${CURL_HACK_DIR}/include" export CFLAGS="${CFLAGS:-} -fcommon" export LDFLAGS="-L${OPENSSL_HACK_DIR}/lib -L${OPENSSL_HACK_DIR}/lib64 -L${CURL_HACK_DIR}/lib -L${CURL_HACK_DIR}/lib64" export LIBRARY_PATH="${OPENSSL_HACK_DIR}/lib:${OPENSSL_HACK_DIR}/lib64:${CURL_HACK_DIR}/lib:${CURL_HACK_DIR}/lib64" export LD_LIBRARY_PATH="${OPENSSL_HACK_DIR}/lib:${OPENSSL_HACK_DIR}/lib64:${CURL_HACK_DIR}/lib:${CURL_HACK_DIR}/lib64:${LD_LIBRARY_PATH:-}" export OPENSSL_CFLAGS="-I${OPENSSL_HACK_DIR}/include" export OPENSSL_LIBS="-L${OPENSSL_HACK_DIR}/lib -L${OPENSSL_HACK_DIR}/lib64 -lssl -lcrypto" if [ "${ENABLE_IMAP}" -eq 1 ]; then ensure_imap_hack_layout export CPPFLAGS="${CPPFLAGS} -I${IMAP_HACK_DIR}/include -I${IMAP_HACK_DIR}/include/imap -I${IMAP_HACK_DIR}/c-client" export LDFLAGS="${LDFLAGS} -L${IMAP_HACK_DIR}/lib -L${IMAP_HACK_DIR}/lib64 -L${IMAP_HACK_DIR}/c-client" export LIBRARY_PATH="${LIBRARY_PATH}:${IMAP_HACK_DIR}/lib:${IMAP_HACK_DIR}/lib64:${IMAP_HACK_DIR}/c-client" export LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:${IMAP_HACK_DIR}/lib:${IMAP_HACK_DIR}/lib64:${IMAP_HACK_DIR}/c-client" fi echo "INFO: PHP 5.6 intl is disabled on EL9 because ICU 67+ is not compatible with ext/intl from PHP 5.6." # --- PHP source download: direct official php.net tarball --- PHPSOURCE="https://www.php.net/distributions/php-${PHPVER}.tar.gz" echo "Using source: $PHPSOURCE" # --- Build directory --- rm -rf /usr/local/src/php-build mkdir -p /usr/local/src/php-build cd /usr/local/src/php-build wget -q "${PHPSOURCE}" -O "php-${PHPVER}.tar.gz" if ! file "php-${PHPVER}.tar.gz" | grep -qiE "gzip compressed data|tar archive"; then echo "ERROR: Downloaded PHP source is not a valid tarball: ${PHPSOURCE}" exit 1 fi tar -xzf "php-${PHPVER}.tar.gz" cd "php-${PHPVER}" # --- Configure PHP 5.6.40 for EL9 + old CWP OpenSSL 1.x hack --- CONFIG_FILE="${CONFIG_FILE_TEMPLATE}" ensure_executable_config "$CONFIG_FILE" NORMALIZED_CONFIG_FILE="$(mktemp "/tmp/php${PHPMAJOR}.conf.XXXXXX")" prepare_config_file "$CONFIG_FILE" "$NORMALIZED_CONFIG_FILE" bash "$NORMALIZED_CONFIG_FILE" rm -f "$NORMALIZED_CONFIG_FILE" # --- Compiling --- if command -v nproc >/dev/null 2>&1; then make -j"$(nproc)" else make fi make install # --- PHP.ini + FPM scaffolding --- mkdir -p "${FPMDIR}/usr/php/php.d" mkdir -p "${FPMDIR}/usr/var/sockets" mkdir -p "${FPMDIR}/usr/etc/php-fpm.d" mkdir -p "${FPMDIR}/usr/etc/php-fpm.d/users" rsync php.ini-production "${FPMDIR}/usr/php/php.ini" sed -i 's/^short_open_tag.*/short_open_tag = On/' "${FPMDIR}/usr/php/php.ini" sed -i 's/^;cgi.fix_pathinfo=.*/cgi.fix_pathinfo=1/' "${FPMDIR}/usr/php/php.ini" sed -i 's/.*mail.add_x_header.*/mail.add_x_header = On/' "${FPMDIR}/usr/php/php.ini" sed -i 's@.*mail.log.*@mail.log = /usr/local/apache/logs/phpmail.log@' "${FPMDIR}/usr/php/php.ini" echo "include=${FPMDIR}/usr/etc/php-fpm.d/users/*.conf" > "${FPMDIR}/usr/etc/php-fpm.d/users.conf" echo "include=${FPMDIR}/usr/etc/php-fpm.d/*.conf" > "${FPMDIR}/usr/etc/php-fpm.conf" cat > "${FPMDIR}/usr/etc/php-fpm.d/cwpsvc.conf" <<EOF [cwpsvc] listen = ${FPMDIR}/usr/var/sockets/cwpsvc.sock listen.owner = cwpsvc listen.group = cwpsvc listen.mode = 0640 user = cwpsvc group = cwpsvc pm = ondemand pm.max_children = 25 pm.process_idle_timeout = 15s request_terminate_timeout = 0 EOF # --- Systemd service --- cp sapi/fpm/php-fpm.service "/usr/lib/systemd/system/php-fpm${PHPMAJOR}.service" sed -i "s|\${exec_prefix}|${FPMDIR}/usr|g" "/usr/lib/systemd/system/php-fpm${PHPMAJOR}.service" sed -i "s|\${prefix}|${FPMDIR}/usr|g" "/usr/lib/systemd/system/php-fpm${PHPMAJOR}.service" systemctl daemon-reload systemctl enable "php-fpm${PHPMAJOR}" # --- Loading Apache FPM module if not already present --- if [ ! -e "/usr/local/apache/conf.d/php-fpm.conf" ]; then cat > /usr/local/apache/conf.d/php-fpm.conf <<EOF <IfModule !proxy_fcgi_module> LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so </IfModule> EOF fi # --- External modules (imagick, redis, imap, etc.) --- if EXTERNAL_FILE="$(resolve_conf_file "php${PHPMAJOR}_external.conf")"; then ensure_executable_config "$EXTERNAL_FILE" bash "$EXTERNAL_FILE" || true else for module in \ imagick.sh \ ioncube.sh \ mailparse.sh \ memcache.sh \ mongodb.sh \ opcache.sh \ redis.sh \ sourceguardian.sh \ ssh2.sh \ xcache.sh \ yaz.sh \ zendgl.sh do run_if_exists "${EXT_BASE}/${module}" done fi # --- CSF pignore --- if [ -e "/etc/csf/csf.pignore" ]; then if ! grep -q "${FPMDIR}/usr/sbin/php-fpm" /etc/csf/csf.pignore; then echo "exe:${FPMDIR}/usr/sbin/php-fpm" >> /etc/csf/csf.pignore fi if ! grep -q "${FPMDIR}/usr/bin/php" /etc/csf/csf.pignore; then echo "exe:${FPMDIR}/usr/bin/php" >> /etc/csf/csf.pignore fi if command -v memcached >/dev/null 2>&1; then if ! grep -q "exe:/usr/bin/memcached" /etc/csf/csf.pignore; then echo "exe:/usr/bin/memcached" >> /etc/csf/csf.pignore fi fi if command -v redis-server >/dev/null 2>&1; then if ! grep -q "exe:/usr/bin/redis-server" /etc/csf/csf.pignore; then echo "exe:/usr/bin/redis-server" >> /etc/csf/csf.pignore fi fi csf -r || true fi # --- Monitor integration --- if [ -d "/etc/monit.d" ]; then if [ ! -e "/etc/monit.d/php-fpm${PHPMAJOR}" ]; then if [ -e "/usr/local/cwpsrv/htdocs/resources/conf/monit.d/php-fpm${PHPMAJOR}" ]; then cp "/usr/local/cwpsrv/htdocs/resources/conf/monit.d/php-fpm${PHPMAJOR}" /etc/monit.d/ 2>/dev/null || true monit reload || true fi fi fi rm -rf /usr/local/src/php-build rm -rf /usr/local/src/build-dir systemctl restart "php-fpm${PHPMAJOR}" echo "PHP ${PHPVER} (php-fpm${PHPMAJOR}) build finished successfully." Sometimes it is necessary for a legacy system to be able to operate temporarily even under AlmaLinux 9.

@Sandeep B. Hello, here is the latest working EL9 script for PHP 8.5 FPM for AlmaLinux 9.x #!/bin/bash # Usage: bash /root/build-php-fpm85-el9.sh 2>&1 | tee /root/php85-build.log # External modules: # /usr/local/cwpsrv/htdocs/resources/conf/el9/php-fpm_selector/external_modules/8.5 set -euo pipefail set -x # --- Basic variables --- PHPMAJOR="85" # php-fpm85 PHPVER="8.5.9" # PHP version FPMDIR="/opt/alt/php-fpm${PHPMAJOR}" CONFBASE="/usr/local/cwp/.conf/php-fpm_conf" arch=$(uname -m) if [[ "$arch" == "x86_64" ]]; then platform="x86-64" libdir="/usr/lib64" else platform="x86" libdir="/usr/lib" fi # --- Packages for Build (EL9) --- dnf -y install \ krb5-devel glibc-common gnutls-devel \ libargon2 libargon2-devel libbsd-devel \ perl libzip libzip-devel pcre2 pcre2-devel \ libavif libavif-devel \ uw-imap-devel \ openssl-devel # If there is any old CWP OpenSSL hack left, don't use it.: if [ -d /usr/local/opensslso ]; then echo "WARN: /usr/local/opensslso exists, but we DO NOT USE for compiling PHP (OpenSSL 1.1 hack)." fi # --- Force OpenSSL 3.x --- export PKG_CONFIG_PATH=/usr/lib64/pkgconfig export OPENSSL_CFLAGS="-I/usr/include" export OPENSSL_LIBS="-L/usr/lib64" export LDFLAGS="-lssl -lcrypto" # --- CWP pre-conf, if exists (e.g.: pcre2, & other libs) --- if [ -e "${CONFBASE}/php${PHPMAJOR}_pre.conf" ]; then bash "${CONFBASE}/php${PHPMAJOR}_pre.conf" fi # --- PHP SOURCE DOWNLOAD CHECK: CWP CDN → OFFICIAL php.net → GitHub fallback --- CWP_URL="http://static.cdn-cwp.com/files/php/php-${PHPVER}.tar.gz" PHPNET_URL="https://www.php.net/distributions/php-${PHPVER}.tar.gz" GITHUB_URL="https://codeload.github.com/php/php-src/tar.gz/refs/tags/php-${PHPVER}" # Function: check HTTP 200 + verify tar.gz content check_and_verify() { local url="$1" local testfile="/tmp/php-test-${PHPVER}.tar.gz" echo "Checking: $url" # First check HTTP status code if ! curl -I -L -s "$url" | grep -q "200"; then echo " → HTTP check failed" return 1 fi # Download temporary test file if ! wget -q "$url" -O "$testfile"; then echo " → Download failed" return 1 fi # Validate MIME type of tar.gz if file "$testfile" | grep -qiE "gzip compressed data|tar archive"; then rm -f "$testfile" echo " → Valid TAR.GZ" return 0 fi echo " → Invalid TAR.GZ (HTML or wrong file)" rm -f "$testfile" return 1 } # Check sources in order (CWP → php.net → GitHub) if check_and_verify "$CWP_URL"; then PHPSOURCE="$CWP_URL" elif check_and_verify "$PHPNET_URL"; then PHPSOURCE="$PHPNET_URL" elif check_and_verify "$GITHUB_URL"; then PHPSOURCE="$GITHUB_URL" else echo "ERROR: Could not download a valid PHP source for version ${PHPVER}" exit 1 fi echo "Using source: $PHPSOURCE" # --- Build directory --- rm -rf /usr/local/src/php-build mkdir -p /usr/local/src/php-build cd /usr/local/src/php-build wget -q "${PHPSOURCE}" -O "php-${PHPVER}.tar.gz" tar -xzf "php-${PHPVER}.tar.gz" cd "php-${PHPVER}" # --- Configure: CWP's own php85.conf, but already wired to OpenSSL 3.x from env --- if [ ! -x "${CONFBASE}/php${PHPMAJOR}.conf" ]; then chmod +x "${CONFBASE}/php${PHPMAJOR}.conf" 2>/dev/null || true fi # PHP 8.5 no longer accepts several legacy configure flags that CWP may keep # in an already generated php85.conf. sed -i -E \ -e '/^[[:space:]]*--with-pspell(=[^[:space:]]*)?[[:space:]]*\\?[[:space:]]*$/d' \ -e '/^[[:space:]]*--with-zlib-dir=[^[:space:]]*[[:space:]]*\\?[[:space:]]*$/d' \ -e '/^[[:space:]]*--with-kerberos(=[^[:space:]]*)?[[:space:]]*\\?[[:space:]]*$/d' \ -e '/^[[:space:]]*--with-imap-ssl(=[^[:space:]]*)?[[:space:]]*\\?[[:space:]]*$/d' \ -e '/^[[:space:]]*--with-imap(=[^[:space:]]*)?[[:space:]]*\\?[[:space:]]*$/d' \ -e '/^[[:space:]]*--enable-opcache[[:space:]]*\\?[[:space:]]*$/d' \ -e 's/[[:space:]]--with-pspell(=[^[:space:]]*)?//g' \ -e 's/[[:space:]]--with-zlib-dir=[^[:space:]]*//g' \ -e 's/[[:space:]]--with-kerberos(=[^[:space:]]*)?//g' \ -e 's/[[:space:]]--with-imap-ssl(=[^[:space:]]*)?//g' \ -e 's/[[:space:]]--with-imap(=[^[:space:]]*)?//g' \ -e 's/[[:space:]]--enable-opcache//g' \ "${CONFBASE}/php${PHPMAJOR}.conf" # IMPORTANT: LDFLAGS + PKG_CONFIG_PATH already exported bash "${CONFBASE}/php${PHPMAJOR}.conf" # --- Compiling --- if command -v nproc >/dev/null 2>&1; then make -j"$(nproc)" else make fi make install # --- PHP.ini + FPM scaffolding --- mkdir -p "${FPMDIR}/usr/php/php.d" mkdir -p "${FPMDIR}/usr/var/sockets" mkdir -p "${FPMDIR}/usr/etc/php-fpm.d" mkdir -p "${FPMDIR}/usr/etc/php-fpm.d/users" rsync php.ini-production "${FPMDIR}/usr/php/php.ini" sed -i 's/^short_open_tag.*/short_open_tag = On/' "${FPMDIR}/usr/php/php.ini" sed -i 's/^;cgi.fix_pathinfo=.*/cgi.fix_pathinfo=1/' "${FPMDIR}/usr/php/php.ini" sed -i 's/.*mail.add_x_header.*/mail.add_x_header = On/' "${FPMDIR}/usr/php/php.ini" sed -i 's@.*mail.log.*@mail.log = /usr/local/apache/logs/phpmail.log@' "${FPMDIR}/usr/php/php.ini" echo "include=${FPMDIR}/usr/etc/php-fpm.d/users/*.conf" > "${FPMDIR}/usr/etc/php-fpm.d/users.conf" echo "include=${FPMDIR}/usr/etc/php-fpm.d/*.conf" > "${FPMDIR}/usr/etc/php-fpm.conf" cat > "${FPMDIR}/usr/etc/php-fpm.d/cwpsvc.conf" <<EOF [cwpsvc] listen = ${FPMDIR}/usr/var/sockets/cwpsvc.sock listen.owner = cwpsvc listen.group = cwpsvc listen.mode = 0640 user = cwpsvc group = cwpsvc pm = ondemand pm.max_children = 25 pm.process_idle_timeout = 15s request_terminate_timeout = 0 EOF # --- Systemd service --- cp sapi/fpm/php-fpm.service "/usr/lib/systemd/system/php-fpm${PHPMAJOR}.service" sed -i "s|\${exec_prefix}|${FPMDIR}/usr|g" "/usr/lib/systemd/system/php-fpm${PHPMAJOR}.service" sed -i "s|\${prefix}|${FPMDIR}/usr|g" "/usr/lib/systemd/system/php-fpm${PHPMAJOR}.service" systemctl daemon-reload systemctl enable "php-fpm${PHPMAJOR}" # --- Loading Apache FPM module if not already present --- if [ ! -e "/usr/local/apache/conf.d/php-fpm.conf" ]; then cat > /usr/local/apache/conf.d/php-fpm.conf <<EOF <IfModule !proxy_fcgi_module> LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so </IfModule> EOF fi # --- External modules (imagick, redis, imap, etc.) --- if [ -e "${CONFBASE}/php${PHPMAJOR}_external.conf" ]; then bash "${CONFBASE}/php${PHPMAJOR}_external.conf" || true fi # These extensions are unbundled from PHP 8.5 and may be absent from stale # CWP-generated external configs. for late_module in imap7.sh pspell.sh; do late_script="/usr/local/cwpsrv/htdocs/resources/conf/el9/php-fpm_selector/external_modules/8.5/${late_module}" if [ -x "${late_script}" ]; then bash "${late_script}" || true fi done # --- Monit integration for custom PHP-FPM --- MONIT_CONF_DIR="/etc/monit.d" MONIT_CONF_FILE="${MONIT_CONF_DIR}/php-fpm${PHPMAJOR}" PHPFPM_SERVICE="php-fpm${PHPMAJOR}.service" PHPFPM_BASE="/opt/alt/php-fpm${PHPMAJOR}" PHPFPM_CONF="${PHPFPM_BASE}/usr/etc/php-fpm.conf" PHPFPM_SOCKET="${PHPFPM_BASE}/usr/var/sockets/cwpsvc.sock" PHPVER_LABEL="${PHPMAJOR:0:1}.${PHPMAJOR:1:1}" echo "" echo "===== Monit integration for PHP-FPM ${PHPVER_LABEL} =====" if ! command -v monit >/dev/null 2>&1; then echo "Monit is not installed. Installing..." dnf -y install monit fi mkdir -p "${MONIT_CONF_DIR}" cat > "${MONIT_CONF_FILE}" <<EOF # PHP-FPM ${PHPVER_LABEL} - CWP alt-php custom build check process php-fpm${PHPMAJOR} matching ".*/opt/alt/php-fpm${PHPMAJOR}/usr/etc/php-fpm.conf.*" start program "/usr/bin/systemctl start ${PHPFPM_SERVICE}" stop program "/usr/bin/systemctl stop ${PHPFPM_SERVICE}" if failed unixsocket ${PHPFPM_SOCKET} then restart if cpu > 95% for 12 cycles then restart if 4 restarts within 8 cycles then timeout EOF chmod 0644 "${MONIT_CONF_FILE}" if [ ! -f "${PHPFPM_CONF}" ]; then echo "WARNING: PHP-FPM config not found yet: ${PHPFPM_CONF}" fi systemctl enable "${PHPFPM_SERVICE}" >/dev/null 2>&1 || true systemctl enable monit >/dev/null 2>&1 || true if systemctl is-active --quiet "${PHPFPM_SERVICE}"; then echo "PHP-FPM service is active: ${PHPFPM_SERVICE}" else echo "PHP-FPM service is not active yet; trying to start it..." systemctl start "${PHPFPM_SERVICE}" || true fi systemctl restart monit || true if command -v monit >/dev/null 2>&1; then monit reload || true monit validate || true fi echo "Monit config installed: ${MONIT_CONF_FILE}" echo "===== Monit integration completed =====" systemctl restart "php-fpm${PHPMAJOR}" # --- CSF pignore --- if [ -e "/etc/csf/csf.pignore" ]; then # PHP-FPM + PHP binary if ! grep -q "${FPMDIR}/usr/sbin/php-fpm" /etc/csf/csf.pignore; then echo "exe:${FPMDIR}/usr/sbin/php-fpm" >> /etc/csf/csf.pignore fi if ! grep -q "${FPMDIR}/usr/bin/php" /etc/csf/csf.pignore; then echo "exe:${FPMDIR}/usr/bin/php" >> /etc/csf/csf.pignore fi # memcached daemon if command -v memcached >/dev/null 2>&1; then if ! grep -q "exe:/usr/bin/memcached" /etc/csf/csf.pignore; then echo "exe:/usr/bin/memcached" >> /etc/csf/csf.pignore fi fi # redis-server daemon if command -v redis-server >/dev/null 2>&1; then if ! grep -q "exe:/usr/bin/redis-server" /etc/csf/csf.pignore; then echo "exe:/usr/bin/redis-server" >> /etc/csf/csf.pignore fi fi # Restart CSF/LFD to apply changes csf -r fi rm -rf /usr/local/src/php-build rm -rf /usr/local/src/build-dir echo "PHP ${PHPVER} (php-fpm${PHPMAJOR}) build finished successfully." You can use it. Critical part: /usr/local/cwpsrv/htdocs/resources/conf/el9/php-fpm_selector/pre_run/8.5/imap7.shThe working script is: #!/bin/bash set -euo pipefail echo "" echo "===== PHP-FPM 8.5 IMAP setup =====" PHPFPM="/opt/alt/php-fpm85" PHPBIN="${PHPFPM}/usr/bin/php" PHPCONFIG="${PHPFPM}/usr/bin/php-config" PHPIZE="${PHPFPM}/usr/bin/phpize" PHPINIDIR="${PHPFPM}/usr/php/php.d" IMAP_VERSION="1.0.3" echo "Installing IMAP build dependencies..." dnf -y install uw-imap-devel krb5-devel openssl-devel pkgconf make gcc autoconf if [ ! -x "${PHPCONFIG}" ] || [ ! -x "${PHPIZE}" ]; then echo "PHP-FPM 8.5 is not built yet. Dependencies are installed; run this script again after PHP 8.5 is installed to build PECL imap." exit 0 fi if "${PHPBIN}" -m 2>/dev/null | grep -qi '^imap$'; then echo "IMAP extension is already loaded for PHP-FPM 8.5." exit 0 fi mkdir -p "${PHPINIDIR}" cd /usr/local/src rm -rf "imap-${IMAP_VERSION}" imap.tgz echo "Downloading PECL imap-${IMAP_VERSION}..." curl -fL "https://pecl.php.net/get/imap-${IMAP_VERSION}.tgz" -o imap.tgz tar -xzf imap.tgz cd "imap-${IMAP_VERSION}" echo "Running phpize..." "${PHPIZE}" echo "Configuring IMAP extension..." ./configure \ --with-php-config="${PHPCONFIG}" \ --with-libdir=lib64 \ --with-imap=/usr \ --with-imap-ssl \ --with-kerberos echo "Building IMAP extension..." make -j"$(nproc)" make install PHPEXTDIR="$("${PHPCONFIG}" --extension-dir)" if [ ! -f "${PHPEXTDIR}/imap.so" ]; then echo "ERROR: imap.so was not installed to ${PHPEXTDIR}" exit 1 fi echo "extension=imap.so" > "${PHPINIDIR}/imap.ini" if "${PHPBIN}" -m 2>/dev/null | grep -qi '^imap$'; then echo "IMAP extension installed and enabled for PHP-FPM 8.5." else echo "ERROR: imap.ini was created, but PHP does not load the IMAP extension." "${PHPBIN}" -d display_errors=1 -m exit 1 fi if command -v systemctl >/dev/null 2>&1; then systemctl restart php-fpm85 || true fi echo "===== PHP-FPM 8.5 IMAP setup completed =====" These are designed to supplement the CWP UI until the system PHP 8.4, 8.5 scripts arrive.

Since I need to fix the admin interface of 15+ servers at least at a basic level, I summarized the above steps in a correction script. #!/usr/bin/env bash set -Eeuo pipefail DESIGN_DIR="/usr/local/cwpsrv/htdocs/admin/design" CHARTS_DIR="${DESIGN_DIR}/charts" SPARKLINE_DIR="${CHARTS_DIR}/sparklines" SOURCE_FILE="${DESIGN_DIR}/plugins/charts/sparklines/jquery.sparkline.js" LINK_FILE="${SPARKLINE_DIR}/jquery.sparkline.js" design_was_immutable=0 design_unlocked=0 log() { printf '[cwp-sparkline-fix] %s\n' "$*" } fail() { log "ERROR: $*" >&2 exit 1 } restore_design_protection() { if (( design_unlocked == 1 && design_was_immutable == 1 )); then if chattr +i "$DESIGN_DIR"; then design_unlocked=0 log "Restored the immutable flag on ${DESIGN_DIR}." else log "WARNING: Could not restore the immutable flag on ${DESIGN_DIR}." >&2 fi fi } on_error() { local exit_code=$? log "The repair stopped because a command failed." >&2 restore_design_protection exit "$exit_code" } trap on_error ERR trap restore_design_protection EXIT [[ ${EUID:-$(id -u)} -eq 0 ]] || fail "Run this script as root." command -v chattr >/dev/null 2>&1 || fail "The chattr command is not available." command -v lsattr >/dev/null 2>&1 || fail "The lsattr command is not available." [[ -d "$DESIGN_DIR" ]] || fail "CWP design directory not found: ${DESIGN_DIR}" [[ -f "$SOURCE_FILE" ]] || fail "Sparkline source file not found: ${SOURCE_FILE}" if [[ -L "$LINK_FILE" ]]; then resolved_link=$(readlink -f "$LINK_FILE" || true) resolved_source=$(readlink -f "$SOURCE_FILE") if [[ "$resolved_link" == "$resolved_source" ]]; then log "The correct symlink already exists. No changes are required." exit 0 fi fail "A symlink already exists at ${LINK_FILE}, but it points to ${resolved_link:-an invalid target}." fi [[ ! -e "$LINK_FILE" ]] || fail "A non-symlink file already exists at ${LINK_FILE}." design_attributes=$(lsattr -d "$DESIGN_DIR" | awk '{print $1}') if [[ "$design_attributes" == *i* ]]; then design_was_immutable=1 log "Temporarily removing the immutable flag from ${DESIGN_DIR}." chattr -i "$DESIGN_DIR" design_unlocked=1 else log "The design directory is not immutable; no flag change is needed." fi log "Creating the missing CWP asset path." mkdir -p "$SPARKLINE_DIR" chown root:root "$CHARTS_DIR" "$SPARKLINE_DIR" chmod 750 "$CHARTS_DIR" "$SPARKLINE_DIR" log "Creating the Sparkline symlink." ln -s "$SOURCE_FILE" "$LINK_FILE" resolved_link=$(readlink -f "$LINK_FILE") resolved_source=$(readlink -f "$SOURCE_FILE") [[ "$resolved_link" == "$resolved_source" ]] || fail "Symlink verification failed." log "Protecting the new directories with the immutable flag." chattr +i "$SPARKLINE_DIR" chattr +i "$CHARTS_DIR" restore_design_protection log "Repair completed successfully." log "Symlink: ${LINK_FILE} -> ${resolved_link}" log "Reload the CWP admin interface with Ctrl+Shift+R."On the given server, copy it to the /root directory, then: cd /root chmod 750 cwp-fix-sparkline-path.sh ./cwp-fix-sparkline-path.shOr simple sh /root/cwp-fix-sparkline-path.shThe script: checks root permissions and the source file; detects if the fix already exists; does not overwrite any invalid or unknown files/symlinks; temporarily unsets the immutable attribute of the design; creates the directories and symlinks; checks the target of the symlink; resets immutable protection; attempts to reset the design directory protection even if an error occurs.

Temporary workaround for the missing Sparkline asset in CWP Pro 1.4The issue is caused by an incorrect asset path generated by the CWP admin interface. CWP requests: /admin/design/charts/sparklines/jquery.sparkline.js but the file is actually installed at: /admin/design/plugins/charts/sparklines/jquery.sparkline.js Creating a symlink from the requested location to the existing CWP file restored most of the affected admin functions, including: ModSecurity installation; PHP-FPM configuration; starting the PHP compiler; several AJAX-based administration functions. The CWP admin directories may have the immutable filesystem attribute enabled. Therefore, running mkdir directly may fail with: Operation not permitted The following temporary workaround worked on the affected servers. Run these commands as root. 1. Confirm the immutable attributelsattr -d \ /usr/local/cwpsrv/htdocs/admin \ /usr/local/cwpsrv/htdocs/admin/design The result may look like: ----i---------e------- /usr/local/cwpsrv/htdocs/admin ----i---------e------- /usr/local/cwpsrv/htdocs/admin/design The i flag means that the directory is immutable. 2. Temporarily remove the immutable flag from the design directoryOnly the design directory needs to be changed: chattr -i /usr/local/cwpsrv/htdocs/admin/design There is no need to remove the immutable flag from the parent admin directory. 3. Create the missing directory structuremkdir -p \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines Set appropriate ownership and permissions: chown root:root \ /usr/local/cwpsrv/htdocs/admin/design/charts \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines chmod 750 \ /usr/local/cwpsrv/htdocs/admin/design/charts \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines 4. Create the symlinkln -s \ /usr/local/cwpsrv/htdocs/admin/design/plugins/charts/sparklines/jquery.sparkline.js \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines/jquery.sparkline.js Verify the target: readlink -f \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines/jquery.sparkline.js The expected result is: /usr/local/cwpsrv/htdocs/admin/design/plugins/charts/sparklines/jquery.sparkline.js 5. Restore the filesystem protectionProtect the newly created directories: chattr +i \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines \ /usr/local/cwpsrv/htdocs/admin/design/charts Restore the immutable flag on the original design directory: chattr +i /usr/local/cwpsrv/htdocs/admin/design 6. Verify the final statelsattr -d \ /usr/local/cwpsrv/htdocs/admin/design \ /usr/local/cwpsrv/htdocs/admin/design/charts \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines ls -l \ /usr/local/cwpsrv/htdocs/admin/design/charts/sparklines/jquery.sparkline.js Finally, reload the CWP admin interface using a hard refresh: Ctrl+Shift+R This is only a temporary workaround. The permanent CWP correction should change the generated asset URL from: - /admin/design/charts/sparklines/jquery.sparkline.js + /admin/design/plugins/charts/sparklines/jquery.sparkline.js A future CWP update may remove the workaround, so the official package or admin template should be corrected. @Sandeep B. Please use the findings in the corrections in the CWP update.

Hello, I am experiencing a CWP admin interface issue on multiple servers, and I would like to know whether anyone has already found a fix or workaround. The problem occurs both: on a fresh CWP installation; and after upgrading working CWP 0.9.x installations to CWP Pro 1.2, 1.3 or 1.4. The affected systems run AlmaLinux 9.x latest Several essential CWP functions no longer complete their AJAX operations. For example: PHP installation; DNF update; ModSecurity installation; some dashboard and main-page lists. The loading icon keeps spinning, while the browser console reports the following errors: GET https://hostname:2031/<CWP_ADMIN_SECURE_PATH>/admin/design/charts/sparklines/jquery.sparkline.js net::ERR_ABORTED 404 (Not Found) blank.js:13 Uncaught TypeError: $(...).sparkline is not a function at blank.js:13:13 Another error is also displayed on some affected pages: Uncaught TypeError: Cannot read properties of undefined (reading 'ext') The first error appears to be the primary problem: CWP’s own admin interface requests: /admin/design/charts/sparklines/jquery.sparkline.js but the file is not available at that location. Consequently, the sparkline() function is undefined, and CWP’s blank.js fails. CWP support has already corrected part of the underlying installation problem, but these frontend errors remain and prevent several admin functions from working properly. I have also noticed that CWP’s directories contain a node_modules directory. This raises another possibility: perhaps the affected CWP release requires an internal frontend asset build or deployment step that was not executed, failed silently, or was omitted from the installation/update process. There may be a CWP-specific build command, deployment script or package-maintenance command responsible for copying the JavaScript dependencies into the public admin asset directory. Has anyone encountered and resolved this in CWP Pro 1.3 or 1.4? In particular, I would appreciate information about: Where jquery.sparkline.js is supposed to be installed in the current CWP version. Whether the CWP packages or node_modules contain the file under another path. Whether there is an official CWP asset build, deployment or repair command that restores the missing frontend files. Whether the installer or updater normally runs an npm, Webpack, Gulp, Vite or other asset-processing step. Whether a package reinstall can safely restore the missing assets. Whether copying or symlinking the file from its actual location is a safe temporary workaround. Whether additional JavaScript dependencies are missing, which might explain the reading 'ext' error. If someone has a working CWP Pro 1.4 installation, it would also be helpful to compare: the relevant package.json scripts; the location of jquery.sparkline.js; the contents and permissions of the public sparklines asset directory; any CWP installer or updater logs related to frontend asset deployment. The relevant public directory may be similar to: /usr/local/cwpsrv/htdocs/resources/admin/design/charts/sparklines/or another corresponding directory used by the current release. For safety, I do not want to run npm install, npm update or an unknown build command inside CWP’s production directories without first identifying the official CWP procedure. Such a command could change dependency versions or overwrite vendor-managed assets. Any confirmed workaround, official command, package name, file location or diagnostic result would be very useful. I can also forward the technical findings to @Sandeep B. . at CWP support to assist with the permanent correction. Thank you.

@SeaScoot Hello, In my 8.4.ini [config-path] default=1 required=1 option="--prefix=/opt/alt/php-fpm84/usr --with-config-file-path=/opt/alt/php-fpm84/usr/php" info-file=config-path.txt pre-script="php84.sh" [config-scan] default=1 required=1 option="--with-config-file-scan-dir=/opt/alt/php-fpm84/usr/php/php.d" info-file=config-scan.txtand in my 8.5.ini [config-path] default=1 required=1 option="--prefix=/opt/alt/php-fpm85/usr --with-config-file-path=/opt/alt/php-fpm85/usr/php" info-file=config-path.txt pre-script="php85.sh" [config-scan] default=1 required=1 option="--with-config-file-scan-dir=/opt/alt/php-fpm85/usr/php/php.d" info-file=config-scan.txtthere are lines to select the correct folder and version.

After recent CWP updates, some AlmaLinux 9.x servers may report false security alerts when running: sh /scripts/cwp_security_audit A typical false positive looks like this: ------------------------------------------------------ [INFO] Auditing cwpsrv (PID: 767572) [OK] cwpsrv looks clean. ------------------------------------------------------ [INFO] Auditing php-fpm-cwp (PID: 710) [SECURITY ALERT] Unknown/Untrusted file: /usr/lib64/gconv/gconv-modules.cache Error:Can't add notification![SECURITY ALERT] Unauthorized port: php-fpm Error:Can't add notification!------------------------------------------------------ [INFO] Auditing apache (PID: 768077) [OK] apache looks clean. ------------------------------------------------------ [DONE] Security audit finished. In this case the warning is misleading. On AlmaLinux 9.x, the file: /usr/lib64/gconv/gconv-modules.cache is a normal system file used by the GNU C Library character conversion system. The original CWP audit script does not include /usr/lib64/gconv/ in the allowed library paths, so it incorrectly reports this file as unknown or untrusted. There is also a second parsing issue in the port audit section. The original script extracts listening ports using a simple awk -F':' expression against generic lsof output. In some cases this can incorrectly parse process-related text and produce an alert such as: [SECURITY ALERT] Unauthorized port: php-fpm Obviously, php-fpm is not a port number. What needs to be fixedThere are two small changes that solve the false positives. First, add this path to ALLOWED_LIB_PATHS: "/usr/lib64/gconv/" Second, replace the port audit line with a more precise lsof command that only checks TCP listening sockets: local CURRENT_PORTS=$(lsof -Pan -p $PID -iTCP -sTCP:LISTEN 2>/dev/null | awk 'NR>1 {split($9,a,":"); print a[length(a)]}') This avoids parsing unrelated lsof lines and prevents values like php-fpm from being treated as ports. Patched version of /scripts/cwp_security_auditBelow is the corrected version. It keeps the original logic but fixes the AlmaLinux 9.x false positives. #!/bin/bash # --- CONFIGURATION --- ALLOWED_LIB_PATHS=( "/usr/lib64/lib" "/usr/lib64/ld-" "/usr/local/ioncube/" "/usr/lib/locale/" "/usr/local/cwp/" "/usr/local/apache/modules/" "/usr/local/lib/" "/usr/lib64/gconv/" ) ALLOWED_BINARIES=( "/usr/local/cwpsrv/bin/cwpsrv" "/usr/local/cwp/php71/sbin/php-fpm" "/usr/local/apache/bin/httpd" ) ALLOWED_PORTS=("2030" "2031" "2082" "2083" "2086" "2087" "2095" "2096" "9000" "2302" "2304" "8181" "8443" "80" "443") # --- INITIALIZATION --- if ! command -v lsof &> /dev/null; then yum install -y lsof fi # --- FUNCTIONS --- check_process() { local PROC_NAME=$1 local SEARCH_PATTERN=$2 local PID=$(ps aux | grep "$SEARCH_PATTERN" | grep -v grep | awk '{print $2}' | head -n 1) if [ -z "$PID" ]; then echo "[SKIP] Process '$PROC_NAME' not found." return fi echo "------------------------------------------------------" echo "[INFO] Auditing $PROC_NAME (PID: $PID)" local GLOBAL_ERROR=0 # 1. Detect GHOST Files (DELETED or missing via stat) local GHOST_DATA=$(lsof -p $PID -n | grep -E "DEL|\(stat:" | grep -v "/dev/zero") if [ ! -z "$GHOST_DATA" ]; then echo "[!!! CRITICAL ALERT !!!] Ghost files (deleted but running) found:" echo "$GHOST_DATA" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Ghost files (deleted but running)" --message="[!!! CRITICAL ALERT !!!] Ghost files (deleted but running) found, for more info run: sh /scripts/cwp_security_audit" GLOBAL_ERROR=1 fi # 2. Deep Memory Audit (Path + RPM Package Check) local CURRENT_MEM=$(lsof -p $PID -n | grep "mem" | awk '{for(i=9;i<=NF;i++) printf "%s ", $i; print ""}' | sed 's/(stat:.*//' | xargs) for FILE in $CURRENT_MEM; do [[ -z "$FILE" || "$FILE" == "REG" || "$FILE" == "mem" || "$FILE" == "/" ]] && continue local MATCH=0 for ALLOWED in "${ALLOWED_LIB_PATHS[@]}"; do if [[ "$FILE" == "$ALLOWED"* ]]; then MATCH=1; break; fi done for ALLOWED in "${ALLOWED_BINARIES[@]}"; do if [[ "$FILE" == "$ALLOWED" ]]; then MATCH=1; break; fi done if [ $MATCH -eq 0 ]; then echo "[SECURITY ALERT] Unknown/Untrusted file: $FILE" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unknown/Untrusted file" --message="[SECURITY ALERT] Unknown/Untrusted file: $FILE" GLOBAL_ERROR=1 else if [[ "$FILE" == "/usr/lib64/"* ]]; then if ! rpm -qf "$FILE" &>/dev/null; then echo "[!!! DANGER !!!] File in system path but NOT owned by any package: $FILE" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - File in system path" --message="[!!! DANGER !!!] File in system path but NOT owned by any package, for more info run: sh /scripts/cwp_security_audit" GLOBAL_ERROR=1 fi fi fi done # 3. Port Audit local CURRENT_PORTS=$(lsof -Pan -p $PID -iTCP -sTCP:LISTEN 2>/dev/null | awk 'NR>1 {split($9,a,":"); print a[length(a)]}') for PORT in $CURRENT_PORTS; do local PORT_MATCH=0 for ALLOWED in "${ALLOWED_PORTS[@]}"; do if [ "$PORT" == "$ALLOWED" ]; then PORT_MATCH=1; break; fi done if [ $PORT_MATCH -eq 0 ]; then echo "[SECURITY ALERT] Unauthorized port: $PORT" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unauthorized port: $PORT" --message="[SECURITY ALERT] Unauthorized port, for more info run: sh /scripts/cwp_security_audit" GLOBAL_ERROR=1 fi done [ $GLOBAL_ERROR -eq 0 ] && echo "[OK] $PROC_NAME looks clean." } # --- EXECUTION --- check_process "cwpsrv" "cwpsrv: master process" check_process "php-fpm-cwp" "php-fpm: master process .*cwpsrv.conf" check_process "apache" "/usr/local/apache/bin/httpd" echo "------------------------------------------------------" echo "[DONE] Security audit finished." Problem: CWP updates may overwrite the fixCWP updates may overwrite /scripts/cwp_security_audit, so manually patching the file once is not always enough. One practical solution is to keep a local fixed copy and automatically restore it if CWP replaces the file during an update. The following installer creates: /root/cwp-overrides/cwp_security_audit.fixed /root/cwp-overrides/repair-cwp-security-audit.sh /etc/systemd/system/cwp-security-audit-override.service /etc/systemd/system/cwp-security-audit-override.path /etc/cron.d/cwp-security-audit-override The systemd.path unit watches /scripts/cwp_security_audit. If the file changes, the repair script compares it to the fixed version and restores the patched file if needed. A daily cron fallback is also added in case the file watch misses an event. Installer scriptSave this as: install-cwp-security-audit-override.sh Then run it as root: chmod +x install-cwp-security-audit-override.sh ./install-cwp-security-audit-override.sh #!/bin/bash set -euo pipefail # ============================================================ # CWP security audit override installer # Restores the locally fixed /scripts/cwp_security_audit # if CWP updates overwrite it. # ============================================================ if [ "$(id -u)" -ne 0 ]; then echo "ERROR: This installer must be run as root." exit 1 fi OVERRIDE_DIR="/root/cwp-overrides" BACKUP_DIR="${OVERRIDE_DIR}/backups" FIXED_FILE="${OVERRIDE_DIR}/cwp_security_audit.fixed" REPAIR_SCRIPT="${OVERRIDE_DIR}/repair-cwp-security-audit.sh" TARGET="/scripts/cwp_security_audit" SERVICE_FILE="/etc/systemd/system/cwp-security-audit-override.service" PATH_FILE="/etc/systemd/system/cwp-security-audit-override.path" CRON_FILE="/etc/cron.d/cwp-security-audit-override" LOG_FILE="/var/log/cwp-security-audit-override.log" echo "------------------------------------------------------" echo "[INFO] Installing CWP security audit override" echo "------------------------------------------------------" mkdir -p "$OVERRIDE_DIR" "$BACKUP_DIR" chmod 700 "$OVERRIDE_DIR" chmod 700 "$BACKUP_DIR" if ! command -v lsof >/dev/null 2>&1; then echo "[INFO] lsof not found. Installing..." if command -v dnf >/dev/null 2>&1; then dnf install -y lsof elif command -v yum >/dev/null 2>&1; then yum install -y lsof else echo "WARNING: Neither dnf nor yum found. Please install lsof manually." fi fi if [ -f "$TARGET" ]; then INITIAL_BACKUP="${BACKUP_DIR}/cwp_security_audit.initial.$(date '+%Y%m%d-%H%M%S').bak" cp -a "$TARGET" "$INITIAL_BACKUP" echo "[INFO] Current target backed up to: $INITIAL_BACKUP" else echo "[WARNING] Target file does not exist yet: $TARGET" fi cat > "$FIXED_FILE" <<'CWP_FIXED_SCRIPT' #!/bin/bash # --- CONFIGURATION --- ALLOWED_LIB_PATHS=( "/usr/lib64/lib" "/usr/lib64/ld-" "/usr/local/ioncube/" "/usr/lib/locale/" "/usr/local/cwp/" "/usr/local/apache/modules/" "/usr/local/lib/" "/usr/lib64/gconv/" ) ALLOWED_BINARIES=( "/usr/local/cwpsrv/bin/cwpsrv" "/usr/local/cwp/php71/sbin/php-fpm" "/usr/local/apache/bin/httpd" ) ALLOWED_PORTS=("2030" "2031" "2082" "2083" "2086" "2087" "2095" "2096" "9000" "2302" "2304" "8181" "8443" "80" "443") if ! command -v lsof &> /dev/null; then yum install -y lsof fi check_process() { local PROC_NAME=$1 local SEARCH_PATTERN=$2 local PID=$(ps aux | grep "$SEARCH_PATTERN" | grep -v grep | awk '{print $2}' | head -n 1) if [ -z "$PID" ]; then echo "[SKIP] Process '$PROC_NAME' not found." return fi echo "------------------------------------------------------" echo "[INFO] Auditing $PROC_NAME (PID: $PID)" local GLOBAL_ERROR=0 local GHOST_DATA=$(lsof -p $PID -n | grep -E "DEL|\(stat:" | grep -v "/dev/zero") if [ ! -z "$GHOST_DATA" ]; then echo "[!!! CRITICAL ALERT !!!] Ghost files (deleted but running) found:" echo "$GHOST_DATA" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Ghost files (deleted but running)" --message="[!!! CRITICAL ALERT !!!] Ghost files (deleted but running) found, for more info run: sh /scripts/cwp_security_audit" GLOBAL_ERROR=1 fi local CURRENT_MEM=$(lsof -p $PID -n | grep "mem" | awk '{for(i=9;i<=NF;i++) printf "%s ", $i; print ""}' | sed 's/(stat:.*//' | xargs) for FILE in $CURRENT_MEM; do [[ -z "$FILE" || "$FILE" == "REG" || "$FILE" == "mem" || "$FILE" == "/" ]] && continue local MATCH=0 for ALLOWED in "${ALLOWED_LIB_PATHS[@]}"; do if [[ "$FILE" == "$ALLOWED"* ]]; then MATCH=1; break; fi done for ALLOWED in "${ALLOWED_BINARIES[@]}"; do if [[ "$FILE" == "$ALLOWED" ]]; then MATCH=1; break; fi done if [ $MATCH -eq 0 ]; then echo "[SECURITY ALERT] Unknown/Untrusted file: $FILE" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unknown/Untrusted file" --message="[SECURITY ALERT] Unknown/Untrusted file: $FILE" GLOBAL_ERROR=1 else if [[ "$FILE" == "/usr/lib64/"* ]]; then if ! rpm -qf "$FILE" &>/dev/null; then echo "[!!! DANGER !!!] File in system path but NOT owned by any package: $FILE" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - File in system path" --message="[!!! DANGER !!!] File in system path but NOT owned by any package, for more info run: sh /scripts/cwp_security_audit" GLOBAL_ERROR=1 fi fi fi done local CURRENT_PORTS=$(lsof -Pan -p $PID -iTCP -sTCP:LISTEN 2>/dev/null | awk 'NR>1 {split($9,a,":"); print a[length(a)]}') for PORT in $CURRENT_PORTS; do local PORT_MATCH=0 for ALLOWED in "${ALLOWED_PORTS[@]}"; do if [ "$PORT" == "$ALLOWED" ]; then PORT_MATCH=1; break; fi done if [ $PORT_MATCH -eq 0 ]; then echo "[SECURITY ALERT] Unauthorized port: $PORT" /usr/local/cwp/php71/bin/php /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php --level="danger" --subject="CWP Security Audit - Unauthorized port: $PORT" --message="[SECURITY ALERT] Unauthorized port, for more info run: sh /scripts/cwp_security_audit" GLOBAL_ERROR=1 fi done [ $GLOBAL_ERROR -eq 0 ] && echo "[OK] $PROC_NAME looks clean." } check_process "cwpsrv" "cwpsrv: master process" check_process "php-fpm-cwp" "php-fpm: master process .*cwpsrv.conf" check_process "apache" "/usr/local/apache/bin/httpd" echo "------------------------------------------------------" echo "[DONE] Security audit finished." CWP_FIXED_SCRIPT chmod 600 "$FIXED_FILE" cat > "$REPAIR_SCRIPT" <<'REPAIR_SCRIPT' #!/bin/bash set -euo pipefail TARGET="/scripts/cwp_security_audit" FIXED="/root/cwp-overrides/cwp_security_audit.fixed" BACKUP_DIR="/root/cwp-overrides/backups" LOG="/var/log/cwp-security-audit-override.log" mkdir -p "$BACKUP_DIR" timestamp="$(date '+%Y-%m-%d %H:%M:%S')" notify_cwp() { local level="$1" local subject="$2" local message="$3" if [ -x /usr/local/cwp/php71/bin/php ] && [ -f /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php ]; then /usr/local/cwp/php71/bin/php \ /usr/local/cwpsrv/htdocs/resources/admin/include/libs/notifications/cli.php \ --level="$level" \ --subject="$subject" \ --message="$message" \ >/dev/null 2>&1 || true fi } if [ ! -f "$FIXED" ]; then echo "[$timestamp] ERROR: fixed file not found: $FIXED" >> "$LOG" notify_cwp "danger" \ "CWP override error" \ "Fixed CWP security audit file not found: $FIXED" exit 1 fi if [ ! -f "$TARGET" ]; then echo "[$timestamp] WARNING: target file missing, restoring: $TARGET" >> "$LOG" install -m 755 "$FIXED" "$TARGET" notify_cwp "warning" \ "CWP security audit restored" \ "Target file was missing and has been restored: $TARGET" exit 0 fi target_hash="$(sha256sum "$TARGET" | awk '{print $1}')" fixed_hash="$(sha256sum "$FIXED" | awk '{print $1}')" if [ "$target_hash" != "$fixed_hash" ]; then backup="$BACKUP_DIR/cwp_security_audit.$(date '+%Y%m%d-%H%M%S').bak" cp -a "$TARGET" "$backup" install -m 755 "$FIXED" "$TARGET" echo "[$timestamp] RESTORED: $TARGET was changed. Backup saved to: $backup" >> "$LOG" notify_cwp "warning" \ "CWP override restored cwp_security_audit" \ "CWP update changed /scripts/cwp_security_audit. The local fixed version was restored. Backup: $backup" else echo "[$timestamp] OK: no change detected." >> "$LOG" fi REPAIR_SCRIPT chmod 700 "$REPAIR_SCRIPT" cat > "$SERVICE_FILE" <<'SERVICE_UNIT' [Unit] Description=Restore local fixed CWP security audit script if overwritten [Service] Type=oneshot ExecStart=/root/cwp-overrides/repair-cwp-security-audit.sh SERVICE_UNIT chmod 644 "$SERVICE_FILE" cat > "$PATH_FILE" <<'PATH_UNIT' [Unit] Description=Watch CWP security audit script for changes [Path] PathChanged=/scripts/cwp_security_audit PathModified=/scripts/cwp_security_audit Unit=cwp-security-audit-override.service [Install] WantedBy=multi-user.target PATH_UNIT chmod 644 "$PATH_FILE" cat > "$CRON_FILE" <<'CRON_FALLBACK' # CWP security audit override fallback check # Runs daily in case systemd.path missed a file change. 17 3 * * * root /root/cwp-overrides/repair-cwp-security-audit.sh >/dev/null 2>&1 CRON_FALLBACK chmod 644 "$CRON_FILE" systemctl daemon-reload systemctl enable --now cwp-security-audit-override.path echo "[INFO] Running first repair/check..." "$REPAIR_SCRIPT" echo "------------------------------------------------------" echo "[OK] Installation finished." echo echo "Status:" systemctl --no-pager status cwp-security-audit-override.path || true echo echo "Last log entries:" tail -n 10 "$LOG_FILE" 2>/dev/null || true echo "------------------------------------------------------" VerificationAfter installation, run: systemctl status cwp-security-audit-override.path tail -n 30 /var/log/cwp-security-audit-override.log sha256sum /scripts/cwp_security_audit /root/cwp-overrides/cwp_security_audit.fixed The two sha256sum values should be identical. Then run the CWP audit again: sh /scripts/cwp_security_audit On a clean AlmaLinux 9.x server, the previous false alerts for: /usr/lib64/gconv/gconv-modules.cache and: Unauthorized port: php-fpm should be gone. NotesThis does not disable the CWP security audit. It only fixes two false-positive conditions: missing allowed path for /usr/lib64/gconv/, unsafe parsing of listening ports from generic lsof output. The script also keeps backups of any CWP-provided version that gets overwritten, so you can later compare what changed after an update: ls -lah /root/cwp-overrides/backups/ This approach is safer than using: chattr +i /scripts/cwp_security_audit because CWP updates are not blocked. The update can complete normally, and the local fixed version is restored afterwards.

Thanks. It is good suggestion.

@Starburst The mentioned issue may related to this topic:

This phenomenon typically occurs after a MariaDB upgrade.Typical log fragments in the maillog: warning: connect to 127.0.0.1:10031: Connection timed out warning: problem talking to server 127.0.0.1:10031 451 4.3.5 Recipient address rejected: Server configuration problem install_driver(mysql) failed: Can't locate DBD/mysql.pmThis indicates that cbpolicyd (Cluebringer) cannot load the required Perl database driver. Root CausePolicyd relies on a Perl DBI driver to connect to its MariaDB/MySQL backend. If the DBD::mysql module is removed or mismatched, Policyd child processes exit with status 2, and Postfix rejects all RCPT requests due to policy service timeout. AlmaLinux 8 vs AlmaLinux 9 BehaviorAlmaLinux 8 (EL8)Policyd requires: perl-DBD-MySQL The configuration remains in /etc/cbpolicyd/cbpolicyd.conf DSN=DBI:mysql:database=postfix_policyd;host=localhostInstalling perl-DBD-MySQL resolves the issue. AlmaLinux 9 (EL9)EL9 introduces a packaging change where installing perl-DBD-MySQL may attempt to pull MySQL 8 libraries that conflict with MariaDB. Instead, install: dnf install perl-DBD-MariaDBThen update the Policyd configuration: Edit: /etc/cbpolicyd/cbpolicyd.confReplace: DSN=DBI:mysql:database=postfix_policyd;host=localhostWith: DSN=DBI:MariaDB:database=postfix_policyd;host=localhostThis forces Policyd to load the DBD::MariaDB driver instead of DBD::mysql. After modification: systemctl restart cbpolicyd systemctl restart postfixKey TakeawayEL8 → install perl-DBD-MySQL EL9 → install perl-DBD-MariaDB and change the DSN driver in /etc/cbpolicyd/cbpolicyd.conf Failure to update the DSN on EL9 will cause continuous Policyd crashes and complete mail flow disruption. This distinction is critical for maintaining stable CWP mail servers after MariaDB upgrades or package maintenance.

Still CWP Pro with EL9 based op.system. It's true that it needs some tweaking after installation, but it still offers far better services than other alternatives.

@SubZero5 Something was missing to run the installation script, but I can't see what it is.