DNS Only [check_cpanel_rpms] There are altered RPMs on xyz

[bloatedstoat]

I am having an issue whereby 2 of our DNS Only boxes running 90.0 (build 16) are reporting RPM errors.

I receive each week "[check_cpanel_rpms] There are altered RPMs on ns2.ournameserver.xyz.".

The email reports missing files as per below:-

The system detected problems with the following cPanel-provided files that the RPM controls:

RPM     Status     Additional Information
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/3rdpartylicenses.txt     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/data-table.eot     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/data-table.svg     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/data-table.ttf     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/data-table.woff     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/favicon.ico     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/index.html.tt     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/main.js     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/polyfills.js     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/runtime.js     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/styles.css     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/vendor~50edd01c.js     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/vendor~59030956.js     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/vendor~64216fa6.js     Broken     missing
cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190-/usr/local/cpanel/base/frontend/paper_lantern/ManageCalendarAccess/webpack.shim.html     Broken     missing

As such I execute /usr/local/cpanel/scripts/check_cpanel_rpms --fix, but a week later the same issue is presented once more regardless of the earlier executed commands.

Whilst this is not affecting the integrity of the machine it's becoming a bit of a nuisance as the alerts tend to demand attention and thereafter repetitive action.

How can I remedy this?

Thanks.

[[email protected] ~]# /usr/local/cpanel/scripts/check_cpanel_rpms --fix
[2020-11-01 13:15:19 +1100]
[2020-11-01 13:15:19 +1100] Problems were detected with cPanel-provided files which are RPM controlled.
[2020-11-01 13:15:19 +1100] If you did not make these changes intentionally, you can correct them by running:
[2020-11-01 13:15:19 +1100]
[2020-11-01 13:15:19 +1100] > /usr/local/cpanel/scripts/check_cpanel_rpms --fix
[2020-11-01 13:15:19 +1100]
[2020-11-01 13:15:19 +1100] The following files were found to be altered from their original RPM:
[2020-11-01 13:15:19 +1100] cpanel-ng-cpanel-ManageCalendarAccess,11,1.cp1190
[2020-11-01 13:15:19 +1100]
[2020-11-01 13:15:19 +1100] Removing 1 broken rpms: cpanel-ng-cpanel-ManageCalendarAccess-11-1.cp1190.noarch
[2020-11-01 13:15:20 +1100] Maximum sync children set to 8 based on 774M available memory.
[2020-11-01 13:15:20 +1100] Downloading http://httpupdate.cpanel.net/RPM/ng/noarch/rpm.sha512
[2020-11-01 13:15:20 +1100] Successfully verified signature for cpanel (key types: release).
[2020-11-01 13:15:20 +1100] Maximum sync children set to 8 based on 771M available memory.
[2020-11-01 13:15:20 +1100] Downloading http://httpupdate.cpanel.net/RPM/ng...l-ManageCalendarAccess-11-1.cp1190.noarch.rpm
[2020-11-01 13:15:21 +1100] Disabling service monitoring.
[2020-11-01 13:15:22 +1100] Hooks system enabled.
[2020-11-01 13:15:22 +1100] Checking for and running RPM::Versions 'pre' hooks for any RPMs about to be installed
[2020-11-01 13:15:22 +1100] All required 'pre' hooks have been run
[2020-11-01 13:15:22 +1100] No RPMS need to be uninstalled
[2020-11-01 13:15:22 +1100] Installing new rpms: cpanel-ng-cpanel-ManageCalendarAccess-11-1.cp1190.noarch.rpm
[2020-11-01 13:15:22 +1100] Preparing packages...
[2020-11-01 13:15:22 +1100] cpanel-ng-cpanel-ManageCalendarAccess-11-1.cp1190.noarch
[2020-11-01 13:15:22 +1100] Releasing lock for Cpanel::RPM::Versions::File
[2020-11-01 13:15:22 +1100] Hooks system enabled.
[2020-11-01 13:15:22 +1100] Checking for and running RPM::Versions 'post' hooks for any RPMs about to be installed
[2020-11-01 13:15:22 +1100] All required 'post' hooks have been run
[2020-11-01 13:15:22 +1100] Restoring service monitoring.

/scripts/find_and_fix_rpm_issues
Checking that the RPM DB is OK...
glibc-2.17-307.el7.1.x86_64
OK: RPM DB is responding to queries
Testing if rpm_is_working RPM is installed
package rpm_is_working is not installed
Testing if it's possible to install a simple RPM
Preparing... ########################################
Updating / installing...
rpm_is_working-1.0-0

 

[cPanelAxel]

Greetings!

We are aware of this issue affecting DNS Only servers under version 90.

Our developers are actively working on a solution for this under the following case CPANEL-34136

We have an existing thread here with this discussion:

In Progress - [CPANEL-34136] Altered RPMs found

Hi, I recently got 2 emails (one from each of our DNS cPanel servers) both saying: Altered RPMs found. I ran the script: /usr/local/cpanel/scripts/check_cpanel_rpms --fix And it did whatever it was meant to and stopped the emails... except about a week later both have come back again! How...

forums.cpanel.net

Thank you

 

[bloatedstoat]

Thanks @cPanelAxel