Install Install issues on AlmaLinux 10.2 with 141.00beta01 (CSF locks me out)

Please fill in any relevant information that applies to you:

• CentOS Version:
  Code (Text):

  AlmaLinux 10.2

• Centmin Mod Version Installed:
  Code (Text):

  141.00beta01

  
  
• Nginx Version Installed: i.e. 1.27.5 or 1.29.1 ? Run command and post output in QUOTE BBCODE tags:
  
  Code (Text):

  nginx -V

• PHP Version Installed: i.e. 7.3.33, 7.4.33, 8.0.30, 8.1.33, 8.2.29, 8.3.25, 8.4.11. Run command and post output in CODE/CODEB BBCODE tags:
  
  Code (Text):

  php -v

• MariaDB MySQL Version Installed: i.e. 10.3.xx or 10.4.xx or 10.6.xx or 10.11.xx. Run command and post output in CODE/CODEB BBCODE tags:
  
  Code (Text):

  mysqladmin ver

• When was last time updated Centmin Mod code base ? : error on installation during install of firewall
• Persistent Config: Do you have any persistent config file options set in /etc/centminmod/custom_config.inc ? You can check via this command:
  
  Code (Text):

  cat /etc/centminmod/custom_config.inc
  

  
  Post output in CODE or CODEB bbcode tags.

I am trying to install 141.00beta01 on Alma 10 on a fresh VPS. Have done so successfully a couple of weeks ago and wanted to reproduce the setup now. However, the installer script starts to produce errors when installing / configuring CSF and the result is, that the ssh connection is dropped and I am locked out. Tried it 3 times, each time with a fresh VPS, same result.

The first error I see during install is regarding memcached, but has probably no connection to my issue:

memcache/memcached routines completed
/usr/local/src/centminmod/inc/memcached_install.inc: line 757: service: command not found
*************************************************
* memcached installed

The next section is CSF and here it is becoming problematic from the start:

The start looks ok

*************************************************
csfinstalls
*************************************************
* Installing CSF firewall...
*************************************************
Installing...
Last metadata expiration check: 0:12:57 ago on Mon 03 Aug 2026 05:58:28 PM CEST.
Package perl-libwww-perl-6.76-3.el10.noarch is already installed.
No match for argument: perl-Crypt-SSLeay
Package perl-Net-SSLeay-1.94-8.el10.x86_64 is already installed.
Error: Unable to find a match: perl-Crypt-SSLeay
Pre-loading required netfilter kernel modules for AlmaLinux 10...
Verifying netfilter modules loaded...
nf_nat 69632 0
nf_conntrack 208896 1 nf_nat
nf_defrag_ipv6 24576 1 nf_conntrack
nf_defrag_ipv4 12288 1 nf_conntrack
nf_reject_ipv6 20480 0
nf_reject_ipv4 16384 0
nf_tables 401408 0
nfnetlink 20480 2 nf_tables
Configuring netfilter modules to load on boot...
Netfilter modules configured for automatic loading

(...)

Checking Perl modules...
Configuration modified to use iptables-nft
Configuration modified to use ip6tables-nft
cannot access /var/lib/alternatives/ip6tables: No such file or directory
Using configuration defaults
...Perl modules OK

and a bit later it starts to get ugly:

---

First, there is a download error

Backup of root's previous crontab saved to /root/.cache/crontab/crontab.bak
Adding Applications/Users to CSF ignore list...
Oops: Unable to download: Can't connect to download2.centminmod.com:443 (Connection timed out)
systemctl enable csf.service
systemctl restart csf.service
Flushing chain `INPUT'
Flushing chain `FORWARD'

somewhat later there are tons of these kind of errors:

Flushing chain `POSTROUTING'
ipset v7.22: Kernel error received: Invalid argument
ipset v7.22: Kernel error received: Invalid argument
csf: FASTSTART loading DROP no logging (IPv4)
csf: FASTSTART loading DROP no logging (IPv6)
Warning: Extension limit revision 0 not supported, missing kernel module?
Warning: Extension LOG revision 0 not supported, missing kernel module?
iptables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain LOGDROPIN
LOG tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix "Firewall: *TCP_IN Blocked* "
Warning: Extension tcp revision 0 not supported, missing kernel module?
Warning: Extension limit revision 0 not supported, missing kernel module?
Warning: Extension LOG revision 0 not supported, missing kernel module?
iptables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain LOGDROPOUT
LOG tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 30/min burst 5 LOG flags 8 level 4 prefix "Firewall: *TCP_OUT Blocked* "
Warning: Extension limit revision 0 not supported, missing kernel module?
Warning: Extension LOG revision 0 not supported, missing kernel module?
iptables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain LOGDROPIN
LOG udp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 limit: avg 30/min burst 5 LOG flags 0 level 4 prefix "Firewall: *UDP_IN Blocked* "
Warning: Extension limit revision 0 not supported, missing kernel module?
Warning: Extension LOG revision 0 not supported, missing kernel module?

until, many, many errors later,

ACCEPT ipv6-icmp opt -- in * out !lo ::/0 -> ::/0
Warning: Extension state revision 0 not supported, missing kernel module?
Warning: Extension state is not supported, missing kernel module?
iptables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain INPUT
ACCEPT all opt -- in !lo out * 0.0.0.0/0 -> 0.0.0.0/0 state RELATED,ESTABLISHED
Warning: Extension state revision 0 not supported, missing kernel module?
Warning: Extension state is not supported, missing kernel module?
iptables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain OUTPUT
ACCEPT all opt -- in * out !lo 0.0.0.0/0 -> 0.0.0.0/0 state RELATED,ESTABLISHED
Warning: Extension state revision 0 not supported, missing kernel module?
Warning: Extension state is not supported, missing kernel module?
ip6tables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain INPUT
ACCEPT all opt -- in !lo out * ::/0 -> ::/0 state RELATED,ESTABLISHED
Warning: Extension state revision 0 not supported, missing kernel module?
Warning: Extension state is not supported, missing kernel module?
ip6tables v1.8.11 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain OUTPUT
ACCEPT all opt -- in * out !lo ::/0 -> ::/0 state RELATED,ESTABLISHED
csf: FASTSTART loading TCP_IN (IPv4)
csf: FASTSTART loading TCP6_IN (IPv6)
csf: FASTSTART loading TCP_OUT (IPv4)
csf: FASTSTART loading TCP6_OUT (IPv6)
csf: FASTSTART loading UDP_IN (IPv4)
csf: FASTSTART loading UDP6_IN (IPv6)
csf: FASTSTART loading UDP_OUT (IPv4)
csf: FASTSTART loading UDP6_OUT (IPv6)
ACCEPT all opt -- in lo out * 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in * out lo 0.0.0.0/0 -> 0.0.0.0/0
LOGDROPOUT all opt -- in * out !lo 0.0.0.0/0 -> 0.0.0.0/0
LOGDROPIN all opt -- in !lo out * 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in lo out * ::/0 -> ::/0

The ssh connection drops at this point. Somewhat understandably, yet fatal as I can't login again as ssh times out when trying to connect. Seems that the firewall locked itself down completely.

Any hints?

 

No ideas or hints at all?

To give a little bit of context: I have two VPS, both KVM based and with the same provider, both running AlmaLinux 10, both set up from scratch based on the minimal install image that the provider offers. Both have sufficient resources (8GB respectively 16GB RAM, 60GB respectively 400GB of disc space) and are apart from that identical.

I set up the first one a couple of weeks ago and the installation of Centmin worked flawlessly as have various updates via yum and Centmin since.

I tried to set up the second one identically and run into the issue described in the start post reproducibly during installation / running the installer. As all I do is basically trigger the initial installer script there seems not too much room for errors on my side (at least as far as I can see).

The only difference between the two is the point in time, so Alma as well as the Centminscript have received some updates - which were applied flawlessly on the earlier install afterwards but possibly seem to hinder a fresh install - at least that is the only relevant difference I see.

Any help or hints what to check for or do would be greatly appreciated.