Since DirectAdmin maintains its own CSF ‘fork’ and quite a lot of DirectAdmin servers are still running CSF, is DA aware of these vulnerabilities and are there plans to release fixes for the DirectAdmin version?
CSF security vulnerabilities and DirectAdmin
- Thread starter Indominus
- Start date
Since DirectAdmin maintains its own CSF ‘fork’ and quite a lot of DirectAdmin servers are still running CSF, is DA aware of these vulnerabilities and are there plans to release fixes for the DirectAdmin version?
This is the problem with all of these CSF forks.
Who's forked version of CSF is affected by this? Is it cPanel's fork of CSF only?
If you fork CSF, call it something else - I don't care what, but just call it something else. Rename DirectAdmin's CSF fork to daCSF. Do something to distinguish all of the CSF forks from each other. Keep calling the binary csf if you want to, but make csf -v print something distinctive.
Who's forked version of CSF is affected by this? Is it cPanel's fork of CSF only?
If you fork CSF, call it something else - I don't care what, but just call it something else. Rename DirectAdmin's CSF fork to daCSF. Do something to distinguish all of the CSF forks from each other. Keep calling the binary csf if you want to, but make csf -v print something distinctive.
While I agree: I was asking more generally.. if DirectAdmin is aware of this and if there are plans on their side to pick up the security patches for the version it now ships with.
I know for a fact that the vulnerable code is present in the DA version, or ‘daCSF’ fork if you will
. So mainly i’m trying to find out what DA’s plans are going forward and if it’s on their radar at all. It’s all not very public (yet).
I know for a fact that the vulnerable code is present in the DA version, or ‘daCSF’ fork if you will
. So mainly i’m trying to find out what DA’s plans are going forward and if it’s on their radar at all. It’s all not very public (yet).I think that it was already discussed:
Richard G
Verified User
Why? That is good for admins with a more dynamic ip, right?
Well...
This thread is asking if the security risk cPanel identified related to DirectAdmin's fork of csf...
*nudge* *nudge* *wink* *wink*
Richard G
Verified User
Sorry, could be me but I don't get it. I don't see the fun about the dyndns option related to that.
Well, the one who controles the dns, controls your firewall. Or threat actors using cachepoisoning can get themselves fully whitelisted and disable any FW blocks completely for that ip. Every dns change is like russian roulette, at least for a while. And those are just a few issues...