Dev {Tricks}

You are here: Home / Archives for Server and Hosting

by

How to secure CWP (CentOS Web Panel)

CWP (CentOS Web Panel) is powerful but not secure by default. If you leave it as-is, it will get attacked.

Here’s a practical hardening guide:

🔒 1. Change Default Ports (VERY IMPORTANT)

CWP runs on:

  • 2030 (HTTP)
  • 2031 (HTTPS)

👉 Bots scan these ports constantly.

Change it:

Edit config:

vi /usr/local/cwpsrv/conf/cwpsrv.conf

Change:

listen 2031 ssl;

➡️ Example:

listen 2087 ssl;

Then restart:

service cwpsrv restart

🔐 2. Enable Firewall (CSF) Properly

CWP comes with CSF (ConfigServer Firewall)

Go to:
👉 CWP → Security → CSF Firewall

Recommended:

  • Enable TESTING = 0
  • Enable:
    • SYN Flood Protection
    • Port Scan Tracking
    • Connection Tracking

Allow only needed ports:

22 (SSH)
80 (HTTP)
443 (HTTPS)
YOUR NEW CWP PORT

🚫 3. Disable Root Login (SSH)

Edit:

vi /etc/ssh/sshd_config

Change:

PermitRootLogin no

Restart:

systemctl restart sshd

👉 Create a sudo user instead.

🔑 4. Use SSH Key (No Password Login)

vi /etc/ssh/sshd_config

Set:

PasswordAuthentication no

👉 This alone blocks 90% of brute-force attacks.

🧱 5. Enable ModSecurity + OWASP Rules

Go to:
👉 CWP → Security → ModSecurity

Enable:

  • ModSecurity = ON
  • OWASP rules = ON

👉 Protects against:

  • SQL injection
  • XSS
  • common exploits

🌍 6. Restrict CWP Access by IP (BEST MOVE)

If only you use the panel:

Allow only your IP:

In CSF:

csf -a YOUR_IP

Then block panel port for others.

👉 This is one of the strongest protections.

🔄 7. Keep System Updated

yum update -y

And update CWP:

sh /scripts/update_cwp

🛡️ 8. Install Fail2Ban (Extra Layer)

yum install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

👉 Protects:

  • SSH
  • login brute force

🔐 9. Secure PHP & Disable Dangerous Functions

Edit php.ini:

vi /usr/local/php/php.ini

Disable:

exec,passthru,shell_exec,system,proc_open,popen

📂 10. Fix File Permissions

chmod 755 /home/*
chmod 644 public_html files

🔒 11. SSL for Panel

Make sure you use:

https://your-ip:PORT

👉 You can install Let’s Encrypt inside CWP panel.

🚨 12. Change Default Login URL (Optional but smart)

Use firewall rules to restrict /login access or proxy it.

💡 Bonus (Highly Recommended)

  • Disable unused services:
systemctl disable ftp
  • Remove unused PHP versions
  • Monitor logs:
/var/log/secure

✅ Minimum Must-Do Checklist

If you do nothing else, do these 5:
✔ Change port
✔ Enable CSF firewall
✔ Disable root SSH
✔ Use SSH key
✔ Restrict IP access

 

 

by

WordPress site with WooCommerce is down with Mod Security

  • Mod Security Configuration in CWP User Panel
  • Woocommerce API problem with CWP Panel
  • mod_security issues
  • WooCommerce REST API does not work with OWASP ModSecurity Core Rules
  • WordPress site with WooCommerce is down in Plesk: 403 Forbidden
  • WooCommerce 8.5.1 issues with Web Application Firewall (ModSecurity)
  • Securing WordPress with ModSecurity

Cause:
WooCommerce triggers the web application firewall rule 218500 from the Comodo ruleset, blocking access.

Solution:
Disable rule 218500 on the affected domains.

  • Plesk: Go to Domains > example.com > Web Application Firewall (ModSecurity).
    • By rule IDs “218500”
  • CWP:
    • Log into your CWP User Panel.
    • Navigate to the CWP Settings.
    • Click on Mod Security to access the Mod Security configuration settings.
    • Edit rules
    • Add Id Rules “218500”
    • Done.

 

by

How to install Maldet alert?

Step 1: Install Zenity

sudo apt update
sudo apt upgrade
sudo apt -y install zenity

Step 2: Create the Maldet Popup script

mkdir /home//scripts
cd /home//scripts
mkdir log

…and in this /home//scripts directory, create a new file called maldet_popup.sh containing the following.

#!/bin/bash
# AUTHOR: Max Meinhardt. 05/30/23.
# DESCRIPTION: This script parses “maldet –report list” for any scan report lines that have HITS > 0, and displays a popup dialog showing those lines.

DAYS_THRESHOLD=7 # Max number of days to look back for a maldet scan

# Get the current date and the date two days ago
CURRENT_DATE=$(date +%Y-%m-%d)
THRESHOLD_DATE=$(date -d “$DAYS_THRESHOLD days ago” +%Y-%m-%d)

# Run the maldet command and process the output
maldet_output=$(maldet –report list)

# Variables to store triggering lines and the flag to track if there are any triggering lines
triggered=false
triggering_lines=””

# Set the IFS to newline
IFS=$’\n’

# Iterate over the maldet output and check for triggering lines
while IFS= read -r line; do
if [[ $line == *SCANID:* ]]; then
HITS=$(echo “$line” | awk -F’|’ ‘{print $5}’ | awk -F’HITS:’ ‘{print $2}’ | awk ‘{print $1}’)
DATE=$(echo “$line” | awk ‘{print $1″ “$2” “$3}’)
LINE_DATE=$(date -d “$DATE” +%Y-%m-%d)
if [[ “$LINE_DATE” > “$THRESHOLD_DATE” ]]; then
if [ “$HITS” -gt 0 ]; then
triggered=true
triggering_lines+=”\n$line”
fi
fi
fi
done <<< “$maldet_output”

# Display the popup dialog if there are any triggering lines
if [ “$triggered” = true ]; then
# Display the popup dialog with buttons to open maldet reports
zenity –info –width=0 –display=:0.0 –title=”Malware Detected” –text=$USER”: Malware has been detected in the last $DAYS_THRESHOLD days:\n$triggering_lines \
\n\nTo view a malware scan report, type \”maldet –report SCANID\” in a terminal window.” \
–ok-label=”Close”
fi

Then, add permissions to execute it.

chmod +x maldet_popup.sh

by

How to Install Maldet and Run a Scan | Maldetect

Download the current version of maldet at https://www.rfxn.com/downloads/maldetect-current.tar.gz

wget https://www.rfxn.com/downloads/maldetect-current.tar.gz

Extract the downloaded file

tar -xvf maldetect-current.tar.gz

Go to the extracted directory

cd maldetect-1.6.5

Now install it

./install.sh

You done!

Maldet update command

maldet -u
maldet -d

Maldet Configuration Files

  • exec file: /usr/local/maldetect/maldet
  • exec link: /usr/local/sbin/maldet
  • exec link: /usr/local/sbin/lmd
  • cron.daily: /etc/cron.daily/maldet

How to USE maldet ?

Scan

maldet -a /path/to/scan

OR

maldet --scan-all /path/to/scan

View the scan report

maldet -e SCANID
maldet --report SCANID

How to setup Email Alert on Maldet?

vi /usr/local/maldetect/conf.maldet