Security Health Report

# ── Run on the server (ask your host for SSH access if needed) ──

# 1) What panel version are we on? (vulnerable = below 0.9.8.1205)
grep -ri "version" /usr/local/cwpsrv/htdocs/resources/admin/include/ 2>/dev/null | head -5
#   from outside instead:
curl -sk https://203.88.158.10:2087/login/ | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1

# 2) Update the panel NOW (fixes the actively-attacked flaw)
sh /scripts/update_cwp

# 3) Lock panel ports to your office IP only (CWP's firewall tool):
csf -a YOUR.OFFICE.IP.HERE "office - panel admin"
#    then edit /etc/csf/csf.conf, remove 2083 & 2087 from TCP_IN, and run:
csf -r

# 4) Does the 2018 web server even use the vulnerable video module?
nginx -v
nginx -V 2>&1 | grep -o with-http_mp4_module
#    if that prints a match, remove any 'mp4;' lines in /etc/nginx/nginx.conf, then:
nginx -t && systemctl reload nginx

# 5) Rebuild target: Rocky Linux 9 / AlmaLinux 9, current nginx, current panel.
#    Your host can usually do the account migration for you — ask them.

# 1) Close the public door NOW (on the server):
sudo ufw deny 8080/tcp
sudo ufw allow from YOUR.OFFICE.IP to any port 8080 proto tcp
sudo ufw enable

# 2) Prove it's closed — from any OUTSIDE connection (should hang, not answer):
curl -m 5 http://14.99.151.148:8080/login

# 3) Safe access, option A — SSH tunnel (works today, zero setup):
ssh -N -L 8080:localhost:8080 user@14.99.151.148
#    then open http://localhost:8080 in your browser

# 4) Safe access, option B — Cloudflare Tunnel (free, permanent):
cloudflared tunnel login
cloudflared tunnel create jenkins
cloudflared tunnel route dns jenkins jenkins.consumer-sketch.com
#    then remove the 8080 rule from step 1 — nothing needs to listen publicly

# 5) Inside Jenkins afterwards:
#    Manage Jenkins → Plugins → Update all
#    Manage Jenkins → Security → require login; enable matrix/role authorization

# ── Paste this into the Liquid Web support ticket ──
#   "Please confirm the cPanel & WHM version on my server (69.167.158.49),
#    and whether it includes the 28 April 2026 security release fixing the
#    session-management authentication bypass (CVE-2026-41940).
#    If it does not, please run an update immediately."

# ── Or, if you have root SSH access, check and fix it yourself ──
/usr/local/cpanel/cpanel -V          # prints the version
/scripts/upcp --force                # runs the update

# ── Two more one-minute protections in WHM afterwards ──
#   WHM → Security Center → cPHulk: ON   (stops password-guessing robots)
#   WHM → Two-Factor Authentication: ON  (for the root account)

# ── cswebsolutions.com (sends NO mail — lock it down completely) ──
@      TXT  "v=spf1 -all"
_dmarc TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@consumer-sketch.com"

# ── csweb.ca · cssolutions.us · csdigital.info · csdigital.ca ──
_dmarc TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@consumer-sketch.com; pct=100"
#    after two clean weeks: change p=quarantine → p=reject

# ── consumersketch.in — replace the broken record with ONE clean line ──
@      TXT  "v=spf1 include:zoho.in ~all"

# ── Verify each change afterwards ──
dig +short TXT cswebsolutions.com
dig +short TXT _dmarc.cswebsolutions.com
dig +short TXT consumersketch.in | grep spf

# 1) Is extended support active? (on the server)
pro status

# 2) If not — attach the free tier (token from https://ubuntu.com/pro):
sudo pro attach YOUR_TOKEN_HERE
sudo apt update && sudo apt upgrade -y

# 3) …or move the whole system (test on a clone first!):
sudo do-release-upgrade        # 20.04 → 22.04, then run again → 24.04

# 4) How old is the code vault (GitLab)?
sudo gitlab-rake gitlab:env:info | grep -i version
#    upgrade path per https://docs.gitlab.com/ee/update/ then:
sudo apt update && sudo apt install gitlab-ce

# 5) Optional: only your office/VPN may even SEE the login door:
sudo ufw allow from YOUR.OFFICE.IP to any port 22
sudo ufw delete allow 22