Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Pending Publication [KCARE-1036] KernelCare Patch Error Message About Trialing

Discussion in 'Security' started by BillyS, Jul 18, 2018.

  1. BillyS

    BillyS Well-Known Member

    Joined:
    Mar 22, 2013
    Messages:
    48
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    I'm getting emails several times a day with this in the subject line:

    Cron <root@host> /usr/bin/kcarectl --auto-update --gradual-rollout=auto

    The content of the email is this:

    The IP XXX.XXX.XX.XXX was already used for trialing on 2018-05-15

    I don't remember opting for a trail. How can I resolve this message?

    Bill
     
  2. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,137
    Likes Received:
    223
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    HI @BillyS


    Can you run the following over SSH please?

    Code:
    kcarectl --license-info
    Code:
    uname -r
    Also, did you install the symlink protection from KernelCare?

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. BillyS

    BillyS Well-Known Member

    Joined:
    Mar 22, 2013
    Messages:
    48
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi Lauren -

    I will run the command later today and report back. Just to clarify... I started getting this message after installing the KernelCare symlink protection. I am not a customer of the KernelCare kernel patching service.
     
  4. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,137
    Likes Received:
    223
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @BillyS

    That sounds good!

    I'm not either and I'm getting a similar error on one of my test servers and I'd like to see if the same issue is present on your server:

    Code:
    # kcarectl --license-info
    Your trial license for the IP <MyIPAddress> expired on 2018-05-29
    Code:
    kcarectl --update
    Downloading updates
    The IP <MyIPAddress> was already used for trialing on 2018-05-14
    Code:
    # uname -r
    3.10.0-862.6.3.el7.centos.plus.x86_64
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,137
    Likes Received:
    223
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    HI @BillyS

    I've ran our issue by the CloudLinux team and found that there is an issue with the kernelcare patch requesting a license. Right now the only way to stop it is by removing the IP from the CLN. I don't believe this is an optimal solution though as on my personal server when this is done I get the following:

    Code:
    # kcarectl --license-info
    The IP <MyIPAddress> hasn't been licensed
    Code:
    # kcarectl --patch-info
    No patches applied, but some are available, run 'kcarectl --update'.
    Code:
    # kcarectl --update
    Downloading updates
    Requesting trial license for <MyIPAddress>, please wait...
    HTTP Error 403: Forbidden, Retrying in 3 seconds...
    Requesting trial license for <MyIPAddress>, please wait...
    HTTP Error 403: Forbidden, Retrying in 6 seconds...
    HTTP Error 404: Not Found, Retrying in 12 seconds...
    HTTP Error 404: Not Found
    I can definitely get your IP removed from the CLN if you don't mind sending me a PM with your IP address (please don't include it in the thread response) Alternatively you can open a ticket using the link in my signature. Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.

    I have opened an internal case for our tracking purposes but I've also obtained their internal case number KCARE-1036 - as soon as I have information on when this will be resolved I'll update you here.


    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #5 cPanelLauren, Jul 19, 2018
    Last edited: Jul 19, 2018
  6. BillyS

    BillyS Well-Known Member

    Joined:
    Mar 22, 2013
    Messages:
    48
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi @cPanelLauren
    Code:
    kcarectl --license-info
    Your trial license for the IP XXX.XXX.XX.XXX expired on 2018-05-30
     uname -r
    3.10.0-862.6.3.el7.x86_64
    kcarectl --update
    Downloading updates
    The IP XXX.XXX.XX.XXX was already used for trialing on 2018-05-15
    
    While I'm interested in a long term fix, I'm a patient person and would rather not be removed from the CLN. So I'll check back here for updates :)
     
  7. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,137
    Likes Received:
    223
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @BillyS

    As I said I can definitely have your IP removed from the CLN, just be aware it may try and re-request the trial license. If you want me to do this send me a private message with your IP address or open a ticket using the instructions I provided earlier.

    I do see they've escalated the priority of the case overnight and I do believe they're going to get a fix out pretty quickly.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. BillyS

    BillyS Well-Known Member

    Joined:
    Mar 22, 2013
    Messages:
    48
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi @cPanelLauren - It appears this problem has been fixed? I'm not getting emails anymore and Security Adviser does not indicate any problmes.
     
  9. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,137
    Likes Received:
    223
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @BillyS

    Yes, in most cases when KernelCare begins to support the kernel you're running the issue will be resolved. There is just some time in between when the kernel is released to when KernelCare begins supporting it - this is true with both symlink protection and KernelCare's full product.

    The issue with this being that when a new kernel is released if you update to it prior to KernelCare's support of it you'll receive the same messages/errors.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. BillyS

    BillyS Well-Known Member

    Joined:
    Mar 22, 2013
    Messages:
    48
    Likes Received:
    2
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi @cPanelLauren - So in my System Update setting, I had Include kernel packages selected and I had to reboot the other day. I'm now getting "The IP XXX.XXX.XX.XXX was already used for trialing on 2018-05-15" messages again and Security Advisor shows the system exposed to symlink attacks. Does that mean we should turn off this System Update setting (uncheck include kernel packages)? It makes sense to me now, but I don't see any reference to this setting in cPanel's documentation.
     
  11. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,137
    Likes Received:
    223
    Trophy Points:
    173
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @BillyS

    That's really up to you and your preferences. If you uninclude kernel packages you'll need to keep track of updates and manually update when KernelCare begins supporting that kernel version. If this is something you are able to keep track of then it might work for you.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice