Adding KernelCare patch via command line

CanSpace

Well-Known Member
Nov 25, 2011
53
53
68
cPanel Access Level
DataCenter Provider
We use a script to provision new servers and one step we'd like to add is provisioning kernelcare's free symlink patch automatically.

How can this be done via the command line? Assuming this is on a brand new server with a standard kernel.
 

dalem

Well-Known Member
PartnerNOC
Oct 24, 2003
2,918
131
368
SLC
cPanel Access Level
DataCenter Provider
add a bash script to run something like this

--------------------------------
#!/bin/bash
curl -s https://repo.cloudlinux.com/kernelcare/kernelcare_install.sh | bash
kcarectl --set-patch-type free --update
echo "fs.enforce_symlinksifowner = 1" >>/etc/sysconfig/kcare/sysctl.conf
echo "fs.symlinkown_gid = 99" >>/etc/sysconfig/kcare/sysctl.conf
sysctl -w fs.enforce_symlinksifowner=1
sysctl -w fs.symlinkown_gid=99
-----------------------------------------
 
  • Like
Reactions: cPanelLauren

CanSpace

Well-Known Member
Nov 25, 2011
53
53
68
cPanel Access Level
DataCenter Provider
Actually it can be enabled via WHM. If you click the security advisor link in WHM it will warn you that symlink protection is not installed and provide you with a link to add the free kernelcare patch (which it will do for you). I want to know how to do this via teh command line.
 

CanSpace

Well-Known Member
Nov 25, 2011
53
53
68
cPanel Access Level
DataCenter Provider
Sigh. No you are incorrect - you can add the free kernelcare patch via WHM, and that is what I am trying to figure out how to do via the command line. Thanks for your assistance but it is not useful.
 

cPanelLauren

Forums Analyst II
Staff member
Nov 14, 2017
8,126
667
263
Houston
cPanel Access Level
DataCenter Provider
Hello @CanSpace

The instructions provided were correct. That is the way to add symlink protection over CLI. If you want to add it through WHM you'll need to run the security advisor at WHM>>Security Center>>Security advisor this calls a perl module:
Code:
/usr/local/cpanel/Cpanel/Security/Advisor/Assessors/Kernel.pm
Because this is a perl module with many different functions it's not available as a WHMAPI1 function and is best/easiest done using CloudLinux's instructions pending your Kernel is stock CentOS

Thanks!