Validated WHM session context
The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
Download
Download the signed DH20.29 release
DH20.29 maps to technical package DCSF 15.10.32. The public bootstrap accepts only this exact signed release and its closed artifact inventory.
DCSF
DH20.29: what changed
This release combines WHM context, LFD state and installer repairs with the regression fix found on canary. It supersedes DH20.28; the 51-item security register remains a separate count, without counting tests as vulnerabilities.
Bounded LFD process-state compaction
LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
Permissions limited to public cPanel META modules
The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
Reliable reseller-file repair
DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
Equivalent nftables policy comparison
The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
77/77 Linux tests and a completed canary
Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.
Models, data and API costs
Model choices offered by this release: gpt-5-mini, gpt-5.4-mini, gpt-5.6-terra. Availability depends on the administrator’s OpenAI API account.
Selected local security diagnostics are sent to OpenAI after activation. Recognised secret values are redacted, but this is not an anonymity guarantee. store=false is not a Zero Data Retention guarantee; the API account and provider data policies still apply. Optional API usage is billed separately from the free DCSF software. Findings need administrator review and do not guarantee that every security issue is detected.
Retained installation and compatibility fixes
- Native WHM Jupiter interface restored. DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper. The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- nginx is the client-address authority. For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block. Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics. A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
- Native snapshot before migration. When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF. The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback. Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
- Optional AI System Scan. AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials. A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence. OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
- Populated private AI state directories. The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
- Conservative migration gates remain. An exit code 0 from an exporter is not proof of completeness. Migration still refuses unknown diagnostics or active parallel legacy policy. An active standard nftables table missing from the normalized snapshot or a changed canonical policy triggers rollback.
- Separate procfs context budget. Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
- LFD active after production updates. After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
- Bounded registration retry. Installation registration uses the extensionless HTTPS API with bounded retry and backoff. A transient failure can be retried without an unbounded wait; signed identity and source-address checks remain in force.
- SELinux-aware installation. The installer checks SELinux state before using chcon. Disabled SELinux no longer produces misleading relabel warnings, while enabled systems retain context handling.
- Native systemd handling. A systemd-only host no longer reports missing legacy SysV init files or tries to change ownership of files that are not installed. Legacy init remains supported.
- Accurate Apache and ModSecurity checks. Inactive Apache and default ModSecurity log paths are informational. With systemd, actual service state is authoritative: Zimbra's private /opt/zimbra/common/bin/httpd is not mistaken for the system Apache service. Legacy init retains a process fallback.
- Validated Zimbra mail transport. The canonical Zimbra sendmail symlink is recognized through the trusted-path check. This targeted compatibility repair does not make arbitrary symlinks trusted.
Linux release qualification: 77/77. Public-bootstrap checks: 85/85.
DCSF
DH20.29 closes the JSON::PP dependency without weakening trust
Package 15.10.32 adds JSON::PP to installer preflight and the os.pl runtime check while preserving the separation between system Perl, cPanel private Perl and explicit CPAN fallback.
Authenticated OS packages first
Outside cPanel, DCSF repairs the closed module list through exact RPM capabilities or Debian package mappings. DNF and YUM retain GPG verification, while APT rejects unauthenticated and insecure repositories.
Measured progress and re-verification
The installer inventories required modules before preflight and after repair. Attempts are bounded, must make measurable progress and succeed only when the entire closed list imports again.
CPAN only with explicit approval
The system CPAN fallback is disabled by default. The operator must pass --allow-cpan-fallback; DCSF uses a fixed HTTPS MetaCPAN mirror, closed module names and validated work directories.
cPanel private Perl boundary
On cPanel, DCSF always validates /usr/local/cpanel/3rdparty/bin/perl, derives the matching versioned cpanm and explicitly invokes it through that same private interpreter without mixing /usr/bin/perl libraries.
Required JSON::PP runtime
OLSPanel requires JSON::PP. RPM selects the signed perl(JSON::PP) capability, Debian selects libjson-pp-perl, cPanel uses private cpanm and system CPAN still requires explicit --allow-cpan-fallback.
Canary PASS: An earlier public --dryrun canary authenticated the release under test, selected the correct installer and left every regular file directly below /etc/csf byte-identical.
DCSF
DH20.29 keeps OLSPanel actions in the visible viewport
Package 15.10.32 bounds the iframe to 640–1,200 pixels, scrolls it internally and returns it to the top after navigation. The masked modal, Watch System Logs, Search for IP and Firewall Allow remain visible while trusted-policy and real-backend checks are retained.
Discovery without a false prerequisite
The modules directory is optional. Detection accepts only supported canonical roots and a safe root-owned /etc/olspanel/base_dir declaration.
Protected-configuration preflight
Before writing, the adapter only reads metadata for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare. --dryrun executes the same checks without changing files.
Alias rejection and exact diagnostics
Symlinks, non-regular files, non-root ownership, group/world writable metadata and protected files with more than one hard link are rejected before installation with the exact failing path.
Content-preserving finalization
After installation, /etc/csf becomes root:root 0700 while csf.conf and csf.cloudflare become root:root 0600 with exactly one hard link. Existing contents remain byte-identical.
Authenticated missing file
If csf.cloudflare is missing, it may be installed only from the verified signed package; an existing file is not replaced.
No false success
The generic installer stops when recursive chmod or chown fails instead of continuing to a PASS message.
Controlled modules creation
A missing directory is created only during a real installation as root:root 0755. DCSF records privately that it created the path.
Conservative uninstall
Uninstall removes the parent only when DCSF created it and it remains empty. Foreign or non-empty content is preserved.
JSON::PP runtime dependency
Preflight and the os.pl runtime check require JSON::PP. Repair uses signed RPM capability perl(JSON::PP), Debian package libjson-pp-perl, cPanel private cpanm or the explicitly enabled system CPAN fallback.
Isolated backend compilation
After generic installation but before publishing or restarting panel integration, the adapter runs an isolated perl -T -c backend check. Failure stops OLSPanel integration.
Correct panel assets
OLSPanel serves images from the authenticated /usr/local/csf/lib/webmin/csf/images tree, where the signed package installs assets including csf.svg.
Explicit trusted policy
The backend loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1 instead of using the CyberPanel-specific default path. The complete parent chain and file must be root-controlled and non-writable by others.
Real backend-frame validation
The installer sends a bounded read-only binary request through the actual taint-mode backend. The response may not exceed 16 MiB and must contain the DCSF interface marker before integration is published or restarted. After the extmail.uck.katowice.pl upgrade, the complete Django-to-Perl-backend path returned HTTP 200.
Masked administrator reauthentication
Protected actions use a dedicated modal with a bounded type="password" field instead of window.prompt(). Escape, the cancel control and backdrop cancellation safely stop the operation, and the visible field is cleared immediately after the credential is handed to the request.
Working system-log tools
Search System Logs and Watch System Logs accept only a one-to-twenty digit nocache value. Progress ends after every response, failed requests display their HTTP status, and live search and watch checks returned HTTP 200.
Visible protected-action results
Intercepted navigation is deduplicated, deferred to the next event turn and explicitly submitted to _self with visible progress. Quick Allow and configuration save retain a complete nonempty response instead of an empty frame.
Search for IP and Firewall Allow
Tests through the real Perl backend found the newly added address, displayed the Firewall Allow list and returned normal Done and Return controls. The temporary entry was removed and the final csf.allow digest exactly matched its pre-test value.
Bounded scrollable action viewport
The action iframe stays between 640 and 1,200 pixels, scrolls long content internally and returns to the top after every navigation. The live test kept the outer page at 1,000 pixels with scroll position zero, so Search for IP, Firewall Allow, Watch System Logs and the reauthentication modal remained visible.
DCSF
What the release contains
The installer, signed update manifest, public verification key, package digest and release identity are published together.
Signed package
The 15.10.32 archive is bound by digest to the signed manifest.
Verification
The bootstrap pins the RSA-3072 key, signature, SHA-256, size and closed file inventory.
System Perl packages
JSON::PP is required by preflight and the os.pl runtime check; RPM uses signed capability perl(JSON::PP), while Debian uses libjson-pp-perl.
Explicit CPAN fallback
System CPAN runs only with --allow-cpan-fallback and uses a fixed HTTPS MetaCPAN mirror.
cPanel private Perl
The installer validates /usr/local/cpanel/3rdparty/bin/perl and uses matching cpanm through that same interpreter.
Trusted OLSPanel policy
The backend loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1; the complete path chain must be root-controlled.
OLSPanel backend check
After generic installation and before publishing or restarting integration, the adapter runs perl -T -c and a real read-only framed request. The response is capped at 16 MiB and must contain the DCSF interface marker.
Masked OLSPanel authentication
Protected actions use a bounded type="password" field without window.prompt(); Escape, cancellation and backdrop cancellation stop the operation, and the visible field is cleared immediately.
OLSPanel logs and responses
Search System Logs and Watch System Logs always end their progress state. Deferred _self navigation preserves results for Quick Allow, configuration save, Search for IP and Firewall Allow.
Scrollable OLSPanel action viewport
The iframe stays between 640 and 1,200 pixels, scrolls internally and returns to the top after navigation, keeping results and the reauthentication modal visible.
OLSPanel assets
Images are served from /usr/local/csf/lib/webmin/csf/images, where the signed package also provides csf.svg.
Clean OLSPanel
Detection does not require modules, validates safe base_dir and cp.service, and runs the same preflight in --dryrun.
Safe OLSPanel configuration
Read-only preflight checks /etc/csf, csf.conf and csf.cloudflare metadata; symlinks and unsafe hard links are rejected with the exact path.
Final permissions
/etc/csf is finalized as root:root 0700, while csf.conf and csf.cloudflare become root:root 0600 without changing existing contents.
No false PASS
A recursive chmod or chown failure in the generic installer stops installation.
Safe module path
Modules is created as root:root 0755 only during installation; uninstall removes it only with recorded provenance and while it remains empty.
WebGuard
The release retains bounded replay, audit, correlation and isolated OpenLiteSpeed log collection.
Release identity
DH20.29 maps unambiguously to technical DCSF version 15.10.32.
Qualification
The package passed 77 of 77 gates and the public bootstrap passed 85 of 85 checks.
DCSF
Three supported installation paths
The bootstrap identifies the server state before changing installed files and does not treat an upgrade as a fresh installation.
Fresh installation
Requires an explicit --testing or --production profile. The recommended first run uses --testing.
DCSF upgrade
The installer detects the current version, refuses downgrades and asks before an upgrade or same-version reinstall.
Migration from cpanel-csf
It authenticates the complete package and validates cPanel private Perl with matching cpanm first, then asks for approval. After confirmation it creates a private configuration and firewall backup, checks rollback, removes the cPanel RPM and installs DCSF.
Released
Download install.shThe signed public package and installer are available.
For a fresh installation, start with --testing. For an upgrade, run the script without a profile flag to preserve the existing TESTING value and answer the installer prompt.
DCSF
Secure installation
Download the script to a file, verify the published digest and contents, then run it explicitly.
curl -fsSLo dcsf-install.sh https://dcsf.net/install.sh
printf '%s %s\n' '86cf07a9c45c1cc9a5eab7b8f9b360af98455a67927f7e52c78be2c5ff7d34f8' dcsf-install.sh | sha256sum -c -
less dcsf-install.sh
sudo sh dcsf-install.sh --testingSHA-256 install.sh: 86cf07a9c45c1cc9a5eab7b8f9b360af98455a67927f7e52c78be2c5ff7d34f8
DCSF
Release identity and verification files
All three domains serve identical bytes from one protected publication directory.
| Public release | DH20.29 |
|---|---|
| Technical version | 15.10.32 |
| SHA-256 package | ba8e5a738dec83bf4ef3abd8b59add85e88f495555f5dd8f116d837b70f86268 |
| Package size | 5,869,701 bytes |
| Closed inventory | 585 entries · SHA-256 be8bc9f4b9a04c505394c0ca3a6aa5a79aa3a819dcbb1e687daf687f7cdbc1a9 |
| SHA-256 manifest | 60c115a5d63f91725c40c66ce0647436a500cc27930edbf8614d22b4463c003f |
| Release gates | 77/77 PASS |
| Public-bootstrap checks | 85/85 PASS |
| Package source commit | 784481c2223e709ec9ab0a3e9bcc8cc41071293f |
| Release tag commit | 3849ed6a3f0b58cd5f1afaca1241d0e73f6fb90a |
| Release branch | fix/centos6-compat |
| Tag | DH20.29 |
| Manifest | manifest.txt · signature |
| Public metadata | release.json · install.sh.sha256 |
| Licence | GNU GPLv3 |