/etc/motd keeps being populated

[f1alan]

I am in the process of configuring a brand new VPS currently running cPanel v90.0.13. It was setup several days ago and I logged into it for the first time yesterday.

Every time I login via SSH I get the following message:

*************************************************************
************************ WARNING ****************************
*************************************************************
Your server is currently being configured for cPanel.

The cPanel installation changes a number of system files, and
for this reason it is NOT RECOMMENDED that you use your
server during this time.

We'll send you an email when cPanel is installed and your
server is ready to go!

Best Wishes,
The cPanel installer
*************************************************************

I determined that this is coming from /etc/motd and manually cleared it out, after checking
tail -f /var/log/cpanel-install*

However, if I reboot the server that message reappears and I would like to understand where it is coming from. I have tried a manual update process and this did not resolve it.

 

[cPanelJamesW]

Greetings,

When you checked the cPanel install log, did it indicate that the install completed successfully? The end of the log should look similar to this if so:

[2019-09-27 18:24:07 -0500] [9088] ( INFO): Before you configure your server, ensure that your firewall allows access on port 2087.
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): After ensuring that your firewall allows access on port 2087, you can configure your server.
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): 1. Open your preferred browser
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): 2. Navigate to the following url using the address bar and enter this one-time autologin url:
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): https://your-server-ip:2087/cpsess$sess-id/login/?session=root$login-url
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): After the login url expires you generate a new one using the 'whmlogin' command or manually login at:
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): https://your-server-ip:2087
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): Visit https://go.cpanel.net/whminit for more information about first-time configuration of your server.
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): Visit http://support.cpanel.net or https://go.cpanel.net/allfaq for additional support
[2019-09-27 18:24:07 -0500] [9088] ( INFO):
[2019-09-27 18:24:07 -0500] [9088] ( INFO): Thank you for installing cPanel & WHM $version

It sounds as though there may be a touch file that is created that may not have been removed, however, after tracing an install locally, I was not able to find any such file. Additionally, do you have any programs such as 'puppet' or 'salt' or something similar that are running?

Thanks!

 

[f1alan]

When you checked the cPanel install log, did it indicate that the install completed successfully? The end of the log should look similar to this if so:

Yes, I see exactly the same output that you quoted.

It sounds as though there may be a touch file that is created that may not have been removed, however, after tracing an install locally, I was not able to find any such file. Additionally, do you have any programs such as 'puppet' or 'salt' or something similar that are running?

This is a fresh install from our webhost and I am not familiar with either 'puppet' or 'salt'. What is the best way to check if they are running?

 

[SamA]

Hello,

"puppet" and "salt" are tools used to manage and configure servers. If you've not heard of them, the chances are they aren't on the server. However, there is a possibility that your provider may have them configured by default without your knowledge.

You can run the following command to review the process list if "puppet" or "salt" or in use:

# ps fauwx | grep -Ei "salt|puppet"

If only the grep command is returned, then their likely aren't any configured or actively running at least. In this case, we would recommend submitting a ticket using the link below so our analysts take a closer look at the issue.

How to Open a Technical Support Request

Be sure to update this thread with the ticket number.

 

[f1alan]

Thanks, I ran that command and confirmed that neither were running. I also tried to create a ticket but was advised to contact my webhost so I have opened a ticket with them.

I will update with any further details.

 

[f1alan]

I got in touch with the webhost and they could not help other than suggesting to update to the latest version of cPanel and do a factory reset of the server.

I have done both of these and I'm now running v90.0.14. The problem persists.

I would really like to get this resolved before we put this server into production so I have done a bit more investigation myself using the auditd service. It appears to be the /home/cpanel.pl script that this is originating from. I can see the bit of code that does it but I'm not familiar enough with the whole process to know the sequence that it goes through.

I would appreciate your help with this if you can make any suggestions.

 

[f1alan]

Further to that, I believe I have narrowed the problem down to the following section of code:

sub post_configure {

        _set_ssh_banner();

        # php configuration
        warn "Doing rebuild_phpconf...\n";
        (-e $APP{rebuild_phpconf}) or die "rebuild_phpconf doesn't seem to be available.";
        system( $APP{rebuild_phpconf},
                        "--default=$CONFIG{default_php_version}",
                        $CONFIG{php4_sapi},
                        $CONFIG{php5_sapi},
                        $CONFIG{php_suexec} ) == 0
                or die "rebuild_phpconf failed.";

        _clear_ssh_banner();

        return "Post-configuration done.";
}

It appears to be the "system( $APP{rebuild_phpconf}" call on line 314. I hope this helps you understand the problem.

 

[SamuelM]

Hello @f1alan

/home/cpanel.pl is not a standard script provided by cPanel. This sounds like a custom script used by your hosting provider. Can you try renaming the file or deleting it to see if that solves the problem?

As for the section of code you identified, the "rebuild_phpconf" script is used to manage the server's PHP configuration and it does not have any effect on /etc/motd. Here's an example from my test server:

[root@samtest ~]# /usr/local/cpanel/bin/rebuild_phpconf --current
DEFAULT PHP: ea-php72
ea-php72 SAPI: suphp
ea-php73 SAPI: cgi

I noticed that you said you tried to create a ticket, but I was not able to find one in our ticket system. If you still have an open ticket with us, please let us know the ticket ID here so we can check on the status of that ticket.

 

[f1alan]

Hi @cPSamuel,

/home/cpanel.pl is not a standard script provided by cPanel. This sounds like a custom script used by your hosting provider. Can you try renaming the file or deleting it to see if that solves the problem?

Yes, renaming the file did indeed solve the problem.

As for the section of code you identified, the "rebuild_phpconf" script is used to manage the server's PHP configuration and it does not have any effect on /etc/motd.

Sorry, I wasn't clear about this in my previous message as I assumed that /home/cpanel.pl was your script. The call to
_set_ssh_banner() sets the /etc/motd text and _clear_ssh_banner() clears it. Because "rebuild_phpconf" was failing, the script terminated and _clear_ssh_banner() was not called.

I looked into the exact rebuild_phpconf command that was being used and the problem was the flag "--default=ea-php56". This version of PHP is not installed by default and the command was failing. I changed that to the version of PHP that we are currently using "ea-php73" and it solved the problem.

I noticed that you said you tried to create a ticket, but I was not able to find one in our ticket system. If you still have an open ticket with us, please let us know the ticket ID here so we can check on the status of that ticket.

I did not create a ticket as your system encouraged me to open one with our webhost, which I did but they suggested that it was a cPanel problem. It is clear that this is not the case so you can now consider this issue closed.