Validated WHM session context
The WHM CGI preserves the validated cp_security_token required by the native cPanel session. Existing request validation, taint mode and same-origin response boundaries remain in place.
Nine qualified deployment paths
Hardened CSF/LFD for OLSPanel, cPanel and hosting panels
DCSF integrates with OLSPanel, cPanel & WHM, DirectAdmin, CyberPanel, CWP, InterWorx, VestaCP and Webmin, plus direct administration on supported RHEL- and Debian-family Linux systems.
DCSF
DH20.29: what changed
This release combines WHM context, LFD state and installer repairs with the regression fix found on canary. It supersedes DH20.28; the 51-item security register remains a separate count, without counting tests as vulnerabilities.
Bounded LFD process-state compaction
LFD compacts csf.temppids within its existing size and record limits, using LF_FLUSH to age process records. Accumulated temporary state no longer prevents normal tracking from recording new process identities.
Permissions limited to public cPanel META modules
The compatibility repair sets appropriate permissions only for public cPanel META modules. It does not broaden access across private configuration or the complete cPanel tree.
Reliable reseller-file repair
DH20.29 safely repairs a missing final LF in csf.resellers and corrects the shell error found on the canary. DH20.28 / 15.10.31 is superseded because its reseller repair path was faulty.
Equivalent nftables policy comparison
The comparison accepts a different listing order for independent chains while preserving rule order inside each chain and the remaining policy checks. Reordering independent chains alone no longer causes a false policy mismatch.
77/77 Linux tests and a completed canary
Maintainer qualification passed all 77 Linux test files. The autossltest2 canary update completed with CSF/LFD active and configuration preserved. The separately checked production host has passed dry-run only; this is not a production-upgrade claim.
Models, data and API costs
Model choices offered by this release: gpt-5-mini, gpt-5.4-mini, gpt-5.6-terra. Availability depends on the administrator’s OpenAI API account.
Selected local security diagnostics are sent to OpenAI after activation. Recognised secret values are redacted, but this is not an anonymity guarantee. store=false is not a Zero Data Retention guarantee; the API account and provider data policies still apply. Optional API usage is billed separately from the free DCSF software. Findings need administrator review and do not guarantee that every security issue is detected.
Retained installation and compatibility fixes
- Native WHM Jupiter interface restored. DH20.27 fixed the cPanel regression where a standalone DCSF HTML document replaced the WHM page. DCSF renders through csf.tmpl and the native master_templates/master.tmpl, retaining panel navigation and responsive layout.
- Taint-mode CGI and bounded template helper. The main CGI retains perl -T, request validation and same-origin responses. A fixed root:root 0700 helper uses cPanel private Perl and Cpanel::Template::process_template through list-form IPC::Open2. It clears interpreter-control environment variables, fixes PATH, accepts no path or template arguments and limits stdin to 32 MiB.
- nginx is the client-address authority. For the verified cPanel EA-Nginx topology, SERVER="auto" selects nginx on public ports 80/443. Its structured edge access feed supplies the real client address. WebGuard does not trust arbitrary X-Forwarded-For values or infer clients from an ordinary Apache backend log.
- Apache reports load, not a client to block. Apache listens on private ports 81/444. Its server-status and optional backend-role feed contribute overload evidence only. The local nginx peer 127.0.0.1 cannot become a blocking candidate. Unsupported or unverified proxy layouts are not assumed to have the same trust boundary.
- One trusted library tree during diagnostics. A diagnostic run of an extracted signed package beside older cPanel CSF keeps the selected package libraries first. An exact legacy prepend of /usr/local/csf/lib reasserts the trusted source root and leaves installed libraries as fallback only. Normal installed execution is unchanged.
- Native snapshot before migration. When iptables-save cannot export a known incompatible iptables-nft table, the cpanel-csf migration saves the complete nft list ruleset and exporter diagnostics with SHA-256 checksums. It proceeds only after proving the parallel legacy backend is inert and securing the exact RPM rollback package.
- Bounded rebuild through trusted CSF. The bootstrap rebuilds only the incompatible standard filter, nat, mangle, raw and security tables in the ip and ip6 families through the already installed, trusted csf -r. Unrelated native tables are not selected for normalization.
- Canonical policy check and automatic rollback. Canonical IPv4/IPv6 policies are compared before and after the rebuild. A missing table, semantic mismatch, interruption or later installation failure triggers restoration. Tests covered all ten standard tables, including a forced mismatch that restored the original policy and configuration.
- Optional AI System Scan. AI System Scan adds quick and deep assessments to the DCSF administration interface. It is disabled by default and requires the administrator to configure a personal OpenAI API key and select a model.
- Bounded evidence and private credentials. A single background scan collects a bounded local security snapshot, with limits on reads, processes, data size and execution time. The API key is kept in a separate root-only file and is never rendered back into the interface.
- Findings tied to supplied evidence. OpenAI Responses API requests use store=false, no tools and strict structured output. Findings and recommendations must cite valid evidence IDs from the submitted snapshot. Results are advisory and do not automatically execute repairs.
- Populated private AI state directories. The installer checks owner, group and permissions of private AI state directories without requiring a directory link count of one. Existing subdirectories on ext filesystems no longer cause a false installation refusal; unsafe ownership or permissions still stop installation.
- Conservative migration gates remain. An exit code 0 from an exporter is not proof of completeness. Migration still refuses unknown diagnostics or active parallel legacy policy. An active standard nftables table missing from the normalized snapshot or a changed canonical policy triggers rollback.
- Separate procfs context budget. Contextual identity checks have a separate, bounded procfs scan budget. Hosts with many processes no longer generate false excessive usage alerts from this budget collision; ordinary process, per-UID and global limits are not relaxed.
- LFD active after production updates. After a successful production-profile update (TESTING=0), the installer restarts LFD and checks the result, including active service state on systemd. The new daemon code takes effect immediately; TESTING=1 installations are not started.
- Bounded registration retry. Installation registration uses the extensionless HTTPS API with bounded retry and backoff. A transient failure can be retried without an unbounded wait; signed identity and source-address checks remain in force.
- SELinux-aware installation. The installer checks SELinux state before using chcon. Disabled SELinux no longer produces misleading relabel warnings, while enabled systems retain context handling.
- Native systemd handling. A systemd-only host no longer reports missing legacy SysV init files or tries to change ownership of files that are not installed. Legacy init remains supported.
- Accurate Apache and ModSecurity checks. Inactive Apache and default ModSecurity log paths are informational. With systemd, actual service state is authoritative: Zimbra's private /opt/zimbra/common/bin/httpd is not mistaken for the system Apache service. Legacy init retains a process fallback.
- Validated Zimbra mail transport. The canonical Zimbra sendmail symlink is recognized through the trusted-path check. This targeted compatibility repair does not make arbitrary symlinks trusted.
Linux release qualification: 77/77. Public-bootstrap checks: 85/85.
DCSF
DH20.29 closes the JSON::PP dependency without weakening trust
Package 15.10.32 adds JSON::PP to installer preflight and the os.pl runtime check while preserving the separation between system Perl, cPanel private Perl and explicit CPAN fallback.
Authenticated OS packages first
Outside cPanel, DCSF repairs the closed module list through exact RPM capabilities or Debian package mappings. DNF and YUM retain GPG verification, while APT rejects unauthenticated and insecure repositories.
Measured progress and re-verification
The installer inventories required modules before preflight and after repair. Attempts are bounded, must make measurable progress and succeed only when the entire closed list imports again.
CPAN only with explicit approval
The system CPAN fallback is disabled by default. The operator must pass --allow-cpan-fallback; DCSF uses a fixed HTTPS MetaCPAN mirror, closed module names and validated work directories.
cPanel private Perl boundary
On cPanel, DCSF always validates /usr/local/cpanel/3rdparty/bin/perl, derives the matching versioned cpanm and explicitly invokes it through that same private interpreter without mixing /usr/bin/perl libraries.
Required JSON::PP runtime
OLSPanel requires JSON::PP. RPM selects the signed perl(JSON::PP) capability, Debian selects libjson-pp-perl, cPanel uses private cpanm and system CPAN still requires explicit --allow-cpan-fallback.
Canary PASS: An earlier public --dryrun canary authenticated the release under test, selected the correct installer and left every regular file directly below /etc/csf byte-identical.
DCSF
DH20.29 keeps OLSPanel actions in the visible viewport
Package 15.10.32 bounds the iframe to 640–1,200 pixels, scrolls it internally and returns it to the top after navigation. The masked modal, Watch System Logs, Search for IP and Firewall Allow remain visible while trusted-policy and real-backend checks are retained.
Discovery without a false prerequisite
The modules directory is optional. Detection accepts only supported canonical roots and a safe root-owned /etc/olspanel/base_dir declaration.
Protected-configuration preflight
Before writing, the adapter only reads metadata for /etc/csf, /etc/csf/csf.conf and /etc/csf/csf.cloudflare. --dryrun executes the same checks without changing files.
Alias rejection and exact diagnostics
Symlinks, non-regular files, non-root ownership, group/world writable metadata and protected files with more than one hard link are rejected before installation with the exact failing path.
Content-preserving finalization
After installation, /etc/csf becomes root:root 0700 while csf.conf and csf.cloudflare become root:root 0600 with exactly one hard link. Existing contents remain byte-identical.
Authenticated missing file
If csf.cloudflare is missing, it may be installed only from the verified signed package; an existing file is not replaced.
No false success
The generic installer stops when recursive chmod or chown fails instead of continuing to a PASS message.
Controlled modules creation
A missing directory is created only during a real installation as root:root 0755. DCSF records privately that it created the path.
Conservative uninstall
Uninstall removes the parent only when DCSF created it and it remains empty. Foreign or non-empty content is preserved.
JSON::PP runtime dependency
Preflight and the os.pl runtime check require JSON::PP. Repair uses signed RPM capability perl(JSON::PP), Debian package libjson-pp-perl, cPanel private cpanm or the explicitly enabled system CPAN fallback.
Isolated backend compilation
After generic installation but before publishing or restarting panel integration, the adapter runs an isolated perl -T -c backend check. Failure stops OLSPanel integration.
Correct panel assets
OLSPanel serves images from the authenticated /usr/local/csf/lib/webmin/csf/images tree, where the signed package installs assets including csf.svg.
Explicit trusted policy
The backend loads /usr/local/csf/lib/ConfigServer/panel-action-policy.json with require_trusted => 1 instead of using the CyberPanel-specific default path. The complete parent chain and file must be root-controlled and non-writable by others.
Real backend-frame validation
The installer sends a bounded read-only binary request through the actual taint-mode backend. The response may not exceed 16 MiB and must contain the DCSF interface marker before integration is published or restarted. After the extmail.uck.katowice.pl upgrade, the complete Django-to-Perl-backend path returned HTTP 200.
Masked administrator reauthentication
Protected actions use a dedicated modal with a bounded type="password" field instead of window.prompt(). Escape, the cancel control and backdrop cancellation safely stop the operation, and the visible field is cleared immediately after the credential is handed to the request.
Working system-log tools
Search System Logs and Watch System Logs accept only a one-to-twenty digit nocache value. Progress ends after every response, failed requests display their HTTP status, and live search and watch checks returned HTTP 200.
Visible protected-action results
Intercepted navigation is deduplicated, deferred to the next event turn and explicitly submitted to _self with visible progress. Quick Allow and configuration save retain a complete nonempty response instead of an empty frame.
Search for IP and Firewall Allow
Tests through the real Perl backend found the newly added address, displayed the Firewall Allow list and returned normal Done and Return controls. The temporary entry was removed and the final csf.allow digest exactly matched its pre-test value.
Bounded scrollable action viewport
The action iframe stays between 640 and 1,200 pixels, scrolls long content internally and returns to the top after every navigation. The live test kept the outer page at 1,000 pixels with scroll position zero, so Search for IP, Firewall Allow, Watch System Logs and the reauthentication modal remained visible.
DCSF
Control panels and Linux environments supported by DCSF
Each path preserves the expected CSF/LFD administration workflow while applying the same signed, hardened security baseline.
cPanel & WHM
Preserves WHM workflows and backup-first RPM migration. Verified EA-Nginx uses nginx on 80/443 for client IP and Apache on 81/444 for backend status. Dependency repair keeps /usr/local/cpanel/3rdparty/bin/perl separate from system Perl.
OLSPanel
Keeps the OLSPanel action iframe between 640 and 1,200 pixels with internal scrolling and top reset, so masked reauthentication, Watch System Logs, Search for IP and Firewall Allow remain visible.
DirectAdmin
Uses the established DirectAdmin adapter with hardened argument validation, identity transitions and shell-free privileged execution.
CyberPanel
Retains the CyberPanel integration while restricting privileged mutations to authenticated, CSRF-protected POST actions.
CWP
Supports the existing Control Web Panel administration path with the same signed package, parser limits and firewall-state safeguards.
InterWorx
Integrates with NodeWorx and enforces native FIREWALL authority, blocking secondary accounts that do not hold that permission.
VestaCP
Keeps the VestaCP CSF/LFD integration path while applying the common DCSF release, input-validation and recovery controls.
Webmin
Supports CSF/LFD administration through Webmin with the same hardened backend and signed update channel.
Generic Linux
Provides direct operation on supported RHEL- and Debian-family servers. Missing closed-list Perl modules are repaired through GPG-verified RPM capabilities or authenticated APT package mappings.
DCSF
DH20.29 integration matrix
Every path was qualified before the signed package was published. OLSPanel, cPanel and panel-free mode use separated, closed Perl dependency-repair paths.
| Environment | Integration path | Coverage | Status |
|---|---|---|---|
| cPanel & WHM | Hosting panel and RPM migration | Preserves WHM workflows and backup-first RPM migration. Verified EA-Nginx uses nginx on 80/443 for client IP and Apache on 81/444 for backend status. Dependency repair keeps /usr/local/cpanel/3rdparty/bin/perl separate from system Perl. | Qualified |
| OLSPanel | Native Django module and fixed privileged backend | Keeps the OLSPanel action iframe between 640 and 1,200 pixels with internal scrolling and top reset, so masked reauthentication, Watch System Logs, Search for IP and Firewall Allow remain visible. | Qualified |
| DirectAdmin | Panel adapter and privileged bridge | Uses the established DirectAdmin adapter with hardened argument validation, identity transitions and shell-free privileged execution. | Qualified |
| CyberPanel | Protected web-panel adapter | Retains the CyberPanel integration while restricting privileged mutations to authenticated, CSRF-protected POST actions. | Qualified |
| CWP | Control Web Panel adapter | Supports the existing Control Web Panel administration path with the same signed package, parser limits and firewall-state safeguards. | Qualified |
| InterWorx | NodeWorx panel adapter | Integrates with NodeWorx and enforces native FIREWALL authority, blocking secondary accounts that do not hold that permission. | Qualified |
| VestaCP | Server-panel adapter | Keeps the VestaCP CSF/LFD integration path while applying the common DCSF release, input-validation and recovery controls. | Qualified |
| Webmin | System-administration adapter | Supports CSF/LFD administration through Webmin with the same hardened backend and signed update channel. | Qualified |
| Generic Linux | Panel-free CSF/LFD administration | Provides direct operation on supported RHEL- and Debian-family servers. Missing closed-list Perl modules are repaired through GPG-verified RPM capabilities or authenticated APT package mappings. | Qualified |
DCSF
Web servers supported by WebGuard
The adapter derives the canonical domain from server configuration and never treats a raw Host header as sufficient evidence. DH20.29 retains isolated OpenLiteSpeed logging and bounded replay cost.
Canonical vhosts and verified cPanel proxy
Adapters accept only canonical vhosts or configured aliases. In verified cPanel EA-Nginx, nginx on 80/443 supplies client IP; Apache on 81/444 supplies backend load, never the local proxy peer as a blocking candidate.
Hard replay ceilings
Replay accepts at most 50,000 input lines, 30 seconds and 2,000 emitted audit records, and reports whether the result is complete.
Bounded causal correlation
Audit buffers are capped, quadratic scans are avoided and out-of-order source timestamps cannot corrupt the rolling vhost window.
Isolated OpenLiteSpeed evidence
A root service copies only the validated OLS log into a 256 MiB-capped DCSF file rotated at 128 MiB, outside the foreign-owned log tree.
Safe by default
WEBGUARD=0 and WEBGUARD_MODE=report keep both the engine and optional collector disabled until an operator validates the evidence.
Bounded enforcement
Enforce mode can create only temporary exact-IP, inbound, listener-port-specific DCSF actions and protects allow, ignore, monitoring and trusted proxy or CDN ranges.
DCSF DH20.29
Refreshed interface on desktop and mobile
The common cPanel, DirectAdmin, Webmin, InterWorx and standalone interface now provides a compact header, readable status stack, clearer tabs, forms and tables, plus responsive mobile rules.
- Readable actions without layout shifts
- Responsive tables and forms
- Dark-mode support
- Desktop and mobile presentation tests