Get the most out of your Centmin Mod LEMP stack
Become a Member

Stable Branch fix cmsec dmotd --json blocking SSH login in 132.00stable

Discussion in 'Centmin Mod Github Commits' started by eva2000, May 24, 2026.

  1. eva2000

    eva2000 Administrator Staff Member

    59,484
    12,536
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,176
    Local Time:
    4:11 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    fix cmsec dmotd --json blocking SSH login in 132.00stable

    The dmotd login banner's cmsec_checks() called cmsec.sh --json to capture
    JSON for the Pushover loop. That call runs with DMOTD_MODE=0, which bypasses
    the stale-tolerant async cache path, so on a TTL-expired (or cold) cache it
    ran all 5 kernel CVE checks synchronously inline (~54s measured), blocking
    SSH login on the first login after the 24h cache TTL expired.


    Changes:
    - cmsec.sh: gate the DMOTD display branch in do_run()/do_check() on
    JSON_OUT != 1, so '--dmotd --json' emits JSON via the stale-tolerant DMOTD
    cache path (serves stale instantly + background refresh) instead of running
    the checks synchronously.
    - dmotd.sh and check-for-updates.sh: switch the JSON-capture calls from
    --json to --dmotd --json so they ride the cached/stale path.
    - cmsec.sh: detach the background cache refresh via setsid (re-exec of the
    public 'check --no-cache' path) so it survives an immediate logout and
    reliably warms the cache; fall back to the in-shell fork when setsid is
    unavailable.
    - dmotd.sh: bound the per-login git fetch with 'timeout 15' so an unreachable
    git remote cannot hang login.

    Continue reading...

    132.00stable branch