Install Centmin Mod 130.00beta01 release discussion

Update in Centmin Mod 130.00beta01 and higher, tools/auditd.sh now uses system logrotation for compressed logs instead of auditd's own internal non-compressed log rotation. Details at https://community.centminmod.com/threads/update-tools-auditd-sh-in-130-00beta01.23027/

---

 

I updated 124.00stable and 130.00beta01 with a 2x local geoip servers using different code and set to the 2nd server by default which works better

• https://community.centminmod.com/threads/update-local-geoip-server-support-in-130-00beta01.23032/
• https://community.centminmod.com/threads/update-local-geoip-server-support-in-124-00stable.23033/

and set the 2nd local geoip server as default now

• https://community.centminmod.com/threads/set-vps_geoipcheck_v4-y-default-in-130-00beta01.23035/
• https://community.centminmod.com/threads/set-vps_geoipcheck_v4-y-default-in-124-00stable.23034/

 

A very early alpha version can be previewed at GitHub - centminmod/centminmod-config-json not ready for production use, but gives you an idea of what's to come

 

Updated 130.00beta01's MariaDB YUM repo routine today.

Centmin Mod intends for el9 OSes like Rocky Linux 9 and Alma Linux 9 to default to MariaDB 10.6 LTS releases out of the box. MariaDB official YUM repos now have a RHEL 9 version for MariaDB 10.5 and 10.6+ which apparently works and is tested on Rocky Linux 9 right now. So update MariaDB 10.5 and 10.6 routines to use RHEL 9 YUM repos when EL9 OS is detected https://community.centminmod.com/threads/update-mariadb-yum-repos-for-el9-in-130-00beta01.23169/

 

Updated 130.00beta01 for changes for SELinux disable handling https://community.centminmod.com/threads/el8-el9-selinux-disable-handling.23761/ and /tmp loop device mount routines https://community.centminmod.com/th...ocky8-causing-ro-file-system-on-reboot.23763/ and https://community.centminmod.com/th...p-device-mount-routine-in-130-00beta01.23764/

 

Updated 130.00beta01 to prep for a new centmin.sh menu option 21 which is for data management, backups and data migration features to come. Preview examples at https://community.centminmod.com/th...ion-21-submenu-routine-in-130-00beta01.23773/

 

FYI, From July 20, 2023, Centmin Mod 130.00beta01 will default to MariaDB 10.4. See full news at https://community.centminmod.com/threads/centmin-mod-130-00beta01-default-mariadb-10-4-update.23978/

 

FYI, I just updated Centmin Mod 124.00stable and 130.00beta01 with a fix for missing pure-ftpd passive port range config in CSF Firewall due to CSF v14.18 default changes which came out ~August 18, 2023. This would only impact new Centmin Mod installs from August 18, 2023 onwards.

You can run cmupdate command on your Centmin Mod install to update the code and then run and exit centmin.sh menu once to auto apply the fix and then run command

Code (Text):

egrep '^TCP_|^TCP6_|^UDP_|^UDP6_' /etc/csf/csf.conf

to check if TCP_IN and TCP6_IN now show in comma separated list of whitelisted ports the pure-ftpd passive port range entry = 30001:50011

 

Updated Centmin Mod 130.00beta01 with optional NEEDRESTART_CHECK to MOTD at SSH login

• add NEEDRESTART_CHECK='n' variable support in SSH login's MOTD (message of the day). Disabled by default. When set to NEEDRESTART_CHECK='y' in the persistent config file /etc/centminmod/custom_config.inc, when you log into server, it will run needs-restarting command only on Friday, Saturday and Sunday to check if any YUM updates require or recommend a server reboot and alert the user on SSH login. Not all YUM updates require server reboot Identify packages that will require a system reboot after an update - Red Hat Customer Portal
• run cmupdate command to update your local Centmin Mod code for this update
• Example message on CentOS 7 when SSH login with NEEDRESTART_CHECK='y' set. Centmin Mod modifies the message to add additional commands to run before rebooting server to ensure you do not corrupt your MySQL data and to recommend you schedule a time for server reboot

Code (Text):

Core libraries or services have been updated:
  kernel -> 3.10.0-1160.92.1.el7
  kernel -> 3.10.0-1160.83.1.el7
  kernel -> 3.10.0-1160.95.1.el7
  openssl-libs -> 1:1.0.2k-26.el7_9
  kernel -> 3.10.0-1160.90.1.el7

Server Reboot is required to ensure that your system benefits from these updates.

More information:
https://access.redhat.com/solutions/27943

Rather than reboot server for each YUM update, you can schedule a specific time
  i.e. on weekends

To ensure all MySQL data in memory buffers is written to disk before reboot
Run this command & wait 180 seconds before rebooting server:
  mysqladmin flush-tables && sleep 180

 

updated 130.00beta01's PostgreSQL optional install routine to add missing EL8/EL9 support and update default PostgreSQL version from 13 to 16 https://community.centminmod.com/th...16-add-el8-el9-support-in-130-00beta01.24124/

 

Updated 130.00beta01 with fix for Cloudflare zlib upstream updates which broke Nginx compilations https://community.centminmod.com/th...are-zlib-broken-update-in-130-00beta01.24139/

Unlike, 124.00stable fix https://community.centminmod.com/th...le-release-discussion.22675/page-2#post-97335 which reverts to older working commit, the 130.00beta01 fix attempts to use the latest Cloudflare zlib upstream updates and correct the culprit which breaks Nginx compilations. So that Centmin Mod Nginx can build against latest Cloudflare zlib upstream updates.

Existing users can run cmupdate command before, running centmin.sh menu option 4

 

Nginx 1.25.3 released with official HTTP/2 Rapid Reset DDOS Attack vulnerability patched mitigations https://community.centminmod.com/th...os-attack-vulnerability-cve-2023-44487.24186/

 

Updated 130.00beta01 to allow Nginx to be able to optionally build against system OpenSSL version, meaning Nginx can be built against EL8's OpenSSL 1.1.1k or EL9's OpenSSL 3.0.7 versions now as well https://community.centminmod.com/th...r-nginx-system-openssl-in-130-00beta01.24213/

 

Updated 130.00beta01 update to ensure CSF Firewall's initiall install's configured IP deny blocks for shodan, censys scanners etc are re-added to CSF Firewall deny IP list /etc/csf/csf.deny when it detects the number of IP denied entries is running within 100 entries of the preset CSF Firewall DENY_IP_LIMIT threshold in /etc/csf/csf.conf. Addresses the fact that these preset IP deny blocks will eventually get auto purged once reaching DENY_IP_LIMIT threshold https://community.centminmod.com/th...-range-list-in-123-09beta01.18710/#post-97617

https://community.centminmod.com/th...-csf-blocks-sh-cronjob-in-130-00beta01.24224/

Also improve tools/initial-csf-blocks.sh cronjob and add ability for Centmin Mod users to create /etc/centminmod/csf/csf-permaban.conf config file where can add your own permanent ban IP addresses one per line that you want to ensure the tools/initial-csf-blocks.sh cronjob re-adds to CSF Firewall /etc/csf/csf.deny list when this list is auto pruned once reaching CSF Firewall's preset DENY_IP_LIMIT max IPs banned.

https://community.centminmod.com/th...-csf-blocks-sh-cronjob-in-130-00beta01.24225/

 

Updates in 130.00beta01 have been made for newer GCC 13 support in upcoming EL 8.9+ and EL 9.3+ OSes https://community.centminmod.com/tags/gcc-13/

 

The official MariaDB 10.3 YUM public mirror has now bee deprecated and removed as MariaDB 10.3 is end of life (EOL). MariaDB folks moved 10.3 YUM public mirror to archives mirror now.

As MariaDB 10.3 yum mirrors are now deprecated as 10.3 is EOL:

1. I updated Centmin Mod 124.00stable and 130.00beta01 to switch the MariaDB 10.3 yum mirror over to the archives mirror. You want to run cmupdate command to pull these update fixes to your local Centmin Mod install, and run and exit centmin.sh once to apply the fix updates.
2. For Centmin Mod 124.00stable, like 130.00beta01, now has switched to MariaDB 10.4 initial fresh new installs. If you're using Centmin Mod with MariaDB 10.3, you'd want to run cmupdate command and then update to MariaDB 10.4 via centmin.sh menu option 11 submenu option 8 as outlined at https://community.centminmod.com/threads/mariadb-10-1-upgrades-to-mariadb-10-2-10-3-and-10-4.17793/

 

Added to 130.00beta01 optional freenginx forked Nginx support via variable FREENGINX_INSTALL='y' that you can optionally set in the persistent config file /etc/centminmod/custom_config.inc (disabled by default), which will have Nginx version build tagged with -freengx

 

For Centmin Mod 130.00beta01 and newer users on AlmaLinux 8 or 9, they can now take advantage of the latest Rsync 3.2.7+ versions with above zstd and lz4 compression and xxhash algorithm support when you use Rsync with such options as outlined here. See commit note at https://community.centminmod.com/th...rt-yum-repo-to-el8-el9-in-130-00beta01.24585/

 

Maxmind GeoLite2 Database Download & Rate Limit Enforcement March 2024

Centmin Mod 130.00beta01 has been updated to tackle Maxmind's latest changes in GeoLite2 database download policy and rate limits https://community.centminmod.com/th...ase-routines-for-nginx-in-130-00beta01.24815/. You can discuss these changes in existing thread at https://community.centminmod.com/th...eolite2-free-database-download-changes.18960/.

• Maxmind is now enforcing GeoLite2 database download rate limits as of March 2024 to 30 daily direct API downloads and recommends users to download a copy locally to distribute to many servers if you hit the limits https://support.maxmind.com/hc/en-us/articles/4408216129947-Download-and-Update-Databases
• Maxmind has been slowly clamping down on the free GeoLite2 database downloads see https://community.centminmod.com/th...eolite2-free-database-download-changes.18960/ and https://community.centminmod.com/th...eolite2-free-database-download-changes.18959/.
• Centmin Mod uses GeoLIte2 databases in 2 places, 1 is via CSF Firewall it optionally can use GeoLite2 database for IP address geo meta data lookups but defaults to now using alternative geo meta databases like DB-IP instead of GeoLite2 in CSF Firewall config file /etc/csf/csf.conf CC_SRC = "2" variable set as outlined at https://community.centminmod.com/th...eolite2-free-database-download-changes.18960/. The Maxmind changes here will need CSF Firewall developers to update if impacted
• Centmin Mod's 2nd usage of GeoLite2 database is in optional Nginx GeoLite2 nginx module which isn't enabled by default unless you set in persistent config file /etc/centminmod/custom_config.inc the variable NGINX_GEOIPTWOLITE='y' prior to centmin.sh menu option 4 Nginx upgrade/recompiles or prior to initial Centmin Mod installation. Centmin Mod 130.00beta01 latest update is for this second usage case for Nginx GeoLite2 nginx module routine to use cached copy if the Centmin Mod user doesn't setup their own Maxmind API key as outlined under solutions header in post at .https://community.centminmod.com/th...eolite2-free-database-download-changes.18960/
• Existing Centmin Mod 130.00beta01 users can get this update via cmupdate command. Once that is tested to work well, will also backport changes to 124.00stable.