Security CSF Firewall v16.31 Security Update For Centmin Mod

Centmin Mod's forked CSF package has been updated to 16.31, and it's now live on the Centmin Mod mirror. This one's a security-focused release - it brings the security fixes from cPanel CSF Fork (16.20 and 16.30-1), adapted and tested for Centmin Mod. There's also additional features and fixes unique to Centmin Mod CSF Firewall fork.

The security vulnerabilities could allow an attacker to gain root user access to the server

CSF daily auto update should also update your server automatically. If not see below for manual update command. To confirm check the version:

Code (Text):

csf -v

Code (Text):

csf -v
csf: v16.31 (generic)

What's new

• Safer auto-updates - csf -u now checks the downloaded package against the mirror's published SHA256 checksum before installing anything, and bails out cleanly on a failed or partial download. TLS certificate verification is enforced on all mirror fetches.
• New: downgrade support - csf -ud rolls you back to the previous release (15.02) whenever you need it, using the same verified download. Handy if you want to sit out an update, or revert quickly after upgrading.
  Code (Text):

  csf --help
  
         -u,  --update
                Check for updates to csf and upgrade if available
  
         -uf    Force an update of csf whether and upgrade is required or not
  
         -ud    Downgrade csf to the previous release (e.g. roll back to the
                last known-good version) using the mirror's /csf-previous/ path.
                The downloaded package is SHA256-verified before install, like -u
  

• Smoother boot recovery - if the saved firewall rules can't be restored at boot - say, a ruleset saved by an older version - csf now rebuilds the full ruleset from your configuration during that same boot. The firewall comes up complete; no second reboot, no manual restart. This is new in 16.31: in original CSF 15.00 and Centmin Mod CSF forked 15.02 and the cPanel 16.30-1 fork, a failed restore at boot went silently unnoticed, leaving the firewall incomplete with no warning. 16.31 reports the problem and recovers from it in the same boot.
• Updated defaults - the Apache server-status check now points at the current status URL instead of a legacy cPanel-era alias. Only relevant if you run cPanel with Centmin Mod CSF Firewall v16.31+ forked version.
• Hardened reCAPTCHA / unblock handling - only relevant if you use the Messenger unblock page, which is off by default (MESSENGER = "0" in csf.conf) on Centmin Mod installs. If you enable it on an nginx + PHP-FPM (non-suexec) setup, set MESSENGER_USER and MESSENGERV3GROUP in /etc/csf/csf.conf to your PHP pool user and group - for default Centmin Mod installs that's nginx/nginx.

How to update

Code (Text):

csf -u

Need to roll back & downgrade to previous CSF version?

Code (Text):

csf -ud

---

 

If you SSH log in to your server, you would also have a MOTD (message of the day) notice for CSF Firewall version update like

Code (Text):

===============================================================================
 Centmin Mod 141.00beta01 — up to date
 CSF    15.02 → 16.31 available — run csf -u
===============================================================================

 

FAQ

1. Are these issues exploitable remotely, or only by someone with local access?

Yes - some of the issues could be triggered without any local access, which is why they were treated as critical. Some vulnerabilities might not apply to Centmin Mod default CSF installed configuration unless specific CSF config file /etc/csf/csf.conf settings are enabled by users after Centmin Mod installation of CSF. However, all security vulnerabilities are fixed in Centmin Mod CSF v16.31.