options.conf suddenly overrided, PHP mess

annc

annc

Verified User
Joined
Jun 10, 2008
Messages
25
Today, i woke up and saw that none of the website hosted on one of our DA+CloudLinux server works. Quick debug and found, that PHP was not working, even phpinfo().
On all of our servers I'm using mod_fcgid + PHP Selector from Cloudliunux.

Finally, I found that something suddenly overrided 'options.conf' file (DA's CustomBuild) - there were added two new lines in the end of file:


php1_mode=lsphp alt-php54
php1_mode=lsphp alt-php55

I removed these lines (which overrided my configuration from begining of the file) and recompile PHP. Now everything work as yesterday.

But - how is it possible, that something changed that file and add that (sorry - very very stupid) two lines?
I'm pretty sure that CL does not interferre to options.conf, so my first and only thing is that DA addedd thoes lines. But why?

And no - server is not compromited and only I have permission to edit this file
 
Exactly that same problem with another server (DA+CL too, that same stack) today, options.conf modifed at 06:17 AM, found that same two lines.
Removed manually, recompiled PHP and rewrited vhosts.

What is going on? Which part of your software do that mess and how can I stop it?
 
Last edited:
same finded today, DA was updated week ago and mtime for options.conf with same data
this string "php1_mode=lsphp alt-php54" was only on one server, I removed this string, there no 5.4 on this server.
 
Thanks for reply and confirmation that it's not only my issue.
Great software - I don't know if I wake up tommorow and our services will be fine or DA will destroy it by night.

In my case, two affected servers so far, looking forward
 
Best way to temporary avoid blow up PHP would be set immutable attr on options.conf, I think.....
 
DA has nothing regarding alt-php in its codebase. I'd suggest using auditd on the file to check what changes it :)

stackoverflow.com

inotify - how to find out which user has modified file?

I'm looking for guidance on how to find out which user has modified a particular file. While inotify is great to get notification when a particular file is touched, how do I figure out which user has
stackoverflow.com stackoverflow.com
 
so we need to ask cloudlinux support? because file has same timestamp when I run ./build update da
 
DA has nothing to alt, but DA is only application which use and edit options.conf, am I wrong?
 
annc said:
DA has nothing to alt, but DA is only application which use and edit options.conf, am I wrong?
Click to expand...
No, any software (or terminal user with root privileges) can modify it :) We've heard multiple reports of LiteSpeed changing PHP mode/webserver when license gets expired, for example.

Zhenyapan said:
so we need to ask cloudlinux support? because file has same timestamp when I run ./build update da
Click to expand...
It could be many things. Custom script in /usr/local/directadmin/scripts/custom, yum/dnf update updating CL packages (dnf/yum log would reveal this) and many others. That's why I suggested to use auditd to catch the cause when it happens.
 
oh, thanks. I thought options.conf only managed by DA or by "hands", maybe cloudlinux make this when yum update was executed.
 
No smtalk, you're wrong. None of alt packages interferre with options.conf. And no - I never used Litespeed, license for DA and CL are valid. And I checked the logs of dnf.
At OS level, of course that every application with appropriate privileges can modify that file, but let's be serious.

Is not a strange to you that (so far) it's two diferrent users from different countries with that same problem?
 
trying create ticket with cloudlinux support and confirm from them.
If nothing wrong, then create ticket with Directadmin support.

So both team can checking what's cause issued.
 
I had the the same on some servers. Not running cloud linux....but i do run imunify360. Maybe Hardened PHP did something to the options. But i do not use litespeed. Nor do I have these PHP versions.

Maybe a bug somehwere regarding this (not yet implemented) new update:

Version 1.653 | Directadmin Docs

DirectAdmin Knowledge Base
docs.directadmin.com

CloudLinux Solo licenses can now use mod_lsapi package for using lsphp PHP mode. CustomBuild script is updated to allow selecting lsphp on servers using CloudLinux solo licenses.

da build set php1_mode lsphp
 
Last edited:
You must log in or register to reply here.
Back
Top