Could not update to Drupal 7.22 on CentOS running cPanel. Received a fatal error whitescreen relating to not finding panels/minipanels script. When I turned off all modules related to panels/minipanels, and retried the update, I recived as list of messages reporting missing modules: ctools,rules,wysiwyg, etc.
*** Be sure to click "READ MORE" at the bottom of this comment.
Going through server logs I found the following in /var/log/lfd.log:
Apr 8 19:26:22 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/rules/rules.api.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/ctools.api.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/page_manager/page_manager.api.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/page_manager/theme/page-manager-edit-page.tpl.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/stylizer/plugins/export_ui/stylizer_ui.class.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/tests/ctools.drush.sh [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/tests/plugins/cached/ctoolsCachedPluginArray2.class.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/tests/plugins/cached/ctoolsCachedPluginArray.class.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:23 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/tests/plugins/not_cached/ctoolsNotCachedPluginArray2.class.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:24 vps lfd[4904]: *Suspicious File* /tmp/update-extraction-8cae2b26/ctools/tests/plugins/not_cached/ctoolsNotCachedPluginArray.class.php [myuser:myuser (501:501)] - Script, file extension
Apr 8 19:26:24 vps lfd[4904]: Too many hits for *LF_DIRWATCH* - Directory Watching disabled
Apr 8 19:29:23 vps lfd[5132]: *User Processing* PID:5126 Kill:0 User:myuser VM:291(MB) EXE:/usr/bin/php CMD:/usr/bin/php /home/myuser/public_html/drupal/index.php
Apr 8 19:26:24 vps lfd[4904]: Too many hits for *LF_DIRWATCH* - Directory Watching disabled
QUESTION 1: Why is the update process generating "Suspecious Files" warnings and leaving directories of files in /tmp instead of in the Drupal installation directory where they belong ???
QUESTION 2: Is this truly a security concern, a Drupal 7.22 update problem, or merely a CFS (security) configuration issue ???
QUESTION 3: What should be done ??? I am guessing that others will also encounter this issue.
Comments
Comment #1
catchThis looks like a cPanel issue from the description, before being able to figure out if it's a Drupal issue we'd need to know how you're doing the update.
Comment #2
SandPond commentedTurned out to be cPanel firewall/security directory watch:
ConfigServer Security & Firewall/
csf - ConfigServer Firewall/Firewall Configuration/
SECTION:Directory Watching & Integrity
LF_DIRWATCH = 300
Changed it to "0" to turn it off.
Comment #3
grindlay commentedAs an alternative (because ConfigServer's directory watching *is* useful), consider adding the following to your
csf.fignorefile :/tmp/update-extraction*That will allow CSF.LFD to ignore your "suspicious" files.
Keywords : Configserver, LFD, Suspicious File Alerts, Drupal, /tmp/update-extraction-
Comment #4
grindlay commentedNot a bug. Normal behaviour of CSF/LFD. Workarounds given x2.
Comment #5
jkingsnorth commented