You are running an insecure apache setup. (Merged)

[oulzac]

new security BS in whm

Anyone else seeing this new BS update security thing at the top of WHM when the login???

if just started on every server I run about 20 mins ago.

how in the hell can I remove this??

 

[jenlepp]

Dunno about you, but I decided to update Apache. Got rid of it.

 

[kerriritter]

What's up with /scripts/easyapache

After upcp ran last night on all servers, I now have a large message in red in WHM:

"You are running an insecure Apache setup. You should run /scripts/easyapache or if you are running cPanel 7.1.9 or later (click here) to upgrade to a newer version as soon as possible to avoid your system being compromised."

Followed by a table of modules, the installed version and the current version. The only difference is Apache installed is 1.3.34 and new core is 1.3.36. I shelled out to root to run easy apache and nothing happens, says file not found though it is in /scripts/easyapache. It has done this on all servers.

Though I have never ran recompiled apache from WHM, I thought I would try it now since /scripts/easyapache won't run. So I clicked here in the red message box link, and the same exact thing.

Building Apache Config.....Done
Downloading and compiling apache+modules....
Attempting to restart httpd
Waiting for httpd to restart....
Finished

And it does not do a thing, just like at the command line. All it does is stop and restart apache.

Anyone else having this issue? I'm running:
WHM 10.8.0 cPanel 10.8.1-S114
Fedora i686 - WHM X v3.1.0

 

[fgauthier]

it is a frontpage update to FrontPage/5.0.2.2635.SR1.2

 

[krisdv]

I think it's rather Apache 1.3.34 => 1.3.36 but i would like to know why we only get these warnings now.

 

[oulzac]

the issue for is not apache or frontpage, I have been upgrading all that, but it wont go away because I am not using php5, and I dont want to.

 

[Blackknight]

Yes, this is really annoying. Any way to disable it?

Apparently Cpanel thinks php4 is insecure when it isn't. It also sucks when you have 1500 servers all saying this.

 

[oulzac]

Yes, this is really annoying. Any way to disable it?

Apparently Cpanel thinks php4 is insecure when it isn't. It also sucks when you have 1500 servers all saying this.

yeah, thats my issue, i am not going to update all my servers, for a false positive, cpanel needs to remove this asap!

 

[ZeusChicago]

After upcp ran last night on all servers, I now have a large message in red in WHM:

"You are running an insecure Apache setup. You should run /scripts/easyapache or if you are running cPanel 7.1.9 or later (click here) to upgrade to a newer version as soon as possible to avoid your system being compromised."

Followed by a table of modules, the installed version and the current version. The only difference is Apache installed is 1.3.34 and new core is 1.3.36. I shelled out to root to run easy apache and nothing happens, says file not found though it is in /scripts/easyapache. It has done this on all servers.

Though I have never ran recompiled apache from WHM, I thought I would try it now since /scripts/easyapache won't run. So I clicked here in the red message box link, and the same exact thing.

Building Apache Config.....Done
Downloading and compiling apache+modules....
Attempting to restart httpd
Waiting for httpd to restart....
Finished

And it does not do a thing, just like at the command line. All it does is stop and restart apache.

Anyone else having this issue? I'm running:
WHM 10.8.0 cPanel 10.8.1-S114
Fedora i686 - WHM X v3.1.0

I just noticed this as well (im a ServerMatrix/ThePlanet customer). Was just looking for information on it

 

[Tomas]

Very odd indeed... I ran easyapache but couldn't find anything new there.

 

[pjman]

PHP4- While we're on that subject.

Yeah, false positive suck.

But, I know PHP 5 just recently had some security fixes that were rated critical.

Is 4.4.2 still the latest PHP 4 build. I know PHP.net is saying it is, but any ideas if 4.4.3 is coming out soon, due to similar issues found in 5?

 

[ZeusChicago]

seems PLESK7 is better.. by 500%

I just blew soda pop out of my nose reading this comment :D

Plesk is so bad i un-installed it from my windows server and went back to doing everything by hand. Worthless memory pig IMHO

Cant wait for Cpanel windows version to come out

Z

*edit* i was searching for "You are running an insecure apache setup." and ran into this thread, didnt realize it was 2 years old until after I posted in it....duhhhh.

 

[david510]

Seems apache 1.3.36 released. But in the whm warning --> for Php it is showing latest version as 5.1.4. I think we need to update php to 5.1.4 from 4.4. Is there any issue in doing this. Any views.

 

[ddmobley]

I had just finished rebuilding apache about an hour ago, and when I saw that error message, I thought I had broke something. I too do not want to go to PHP5 presently for compatibility reasons. There should be a way for CPanel to tell us how to turn these warnings off.

 

[hartzcs]

I just recomplied with 4.4.2 and the new FP addons and the warning went away. For some reason I had to do it twice to get 4.4.2 to take.

 

[ddmobley]

*edit* i was searching for "You are running an insecure apache setup." and ran into this thread, didnt realize it was 2 years old until after I posted in it....duhhhh.

I just read it too for the first time. See this post for more information on the WHM apache security warning:

http://forums.cpanel.net/showthread.php?t=53272

 

[FijianTribe]

I ran into the same issue, and now appache will not start. HELP!

 

[krisdv]

I think this one covers it also:

http://forums.cpanel.net/showthread.php?t=53274

 

[ddmobley]

Seems apache 1.3.36 released. But in the whm warning --> for Php it is showing latest version as 5.1.4. I think we need to update php to 5.1.4 from 4.4. Is there any issue in doing this. Any views.

I tried to update to PHP 5.1.4 and my websites stopped working. I ran "http://myserverdomain:2086/scripts2/buildapache" and selected PHP 4.4.1 and rebuilt Apache and they started working again...

 

[ddmobley]

I ran into the same issue, and now appache will not start. HELP!

Run "http://yourserversdomainname:2086/scripts2/buildapache", select PHP 4.4.1 (or whatever you were running) and let Apache rebuild. That will get Apache restarted until we figure out how to bypass this warning message.