cPFence UI is Here – Security Management, Now with a Mouse!: Page 2 - Enhance Control Panel

cPFence UI is Here – Security Management, Now with a Mouse!

sikmo

@cPFence just a quick question. Wouldn't be better / easier to do a web based ui with all already running? Instead of terminal based "ui"?

cPFence

sikmo

For this, we need the Enhance Framework, which isn’t ready yet. It’s already “planned” on their roadmap with no specific releases yet, but instead of waiting, we went ahead and built this local UI to save time and improve usability right now.

As for an external, central UI , that’s not on our roadmap at all, for two main reasons:

GDPR compliance wouldn’t be possible with this approach. Our main paying clients require this as a must, so it’s a no-go.
Enhance is already a central control panel for all servers, and once the framework is released, we’re sure most users will prefer a built-in UI over any external solution. That would make an external central UI practically useless. And we totally get it, that’s the power of Enhance after all. It’s designed to give you one admin panel for all your servers. Enhance is central by nature.

sikmo

cPFence I wouldn't expect external UI, more like UI on custom port on ip that control panel is.

I would think it would be better for a lot if users. On top if that, you could link your support docs to specific parts to read more.

I know my ways in terminal and it's fine. But if there was web based UI running locally e.g created website in control panel I could add domain to (point at it) I would be really glad and I think many other users too. Plus it could increase usage of your products for people for whom terminal is not first or second choice.

cPFence

sikmo I wouldn't expect external UI, more like UI on custom port on ip that control panel is.

I totally get your point, and I agree that it would improve usability a lot. But for this to happen, it would raise security concerns and potential issues.

Also, once Enhance releases the framework, users will start asking for a built-in UI, and by then, we’d be forced to drop this “workaround” UI and rebuild everything from scratch. It’s just a matter of time before that happens. So instead of putting effort into something temporary, we’d rather focus on solutions that will last and align with Enhance’s long-term direction.

8Dweb

cPFence Thank you for this. It will make certain things related to understanding where domains are located much easier. Once v. 12 shakes out a bit more we will follow that upgrade path and then upgrade cpfence on each server. Your team has been great.

cPFence

8Dweb

Thank you! Glad you found the new feature useful. With Docker out of the way, we’re working on lots of exciting new features coming soon.

Yeah, we’re thinking the same, probably giving it another week or so to let things settle before upgrading our production servers.

iotivedo

@cPFence To be honest, I waited to get the first licenses because the idea of having a centralised panel for all servers was too tempting. But seeing the commitment to the Enhance community, the many updates, guides... I decided to start trying CPFence seriously... still with the hope that a centralised UI for the entire cluster will arrive 😃 In the meantime, thanks for what you do...
from now on I'm on board too 😃

cPFence

iotivedo

Welcome aboard! Glad to have you as a valued cPFence user. Once the Enhance team finalizes the framework, we’ll be sure to build a centralized built-in UI on top of it.

8Dweb

@cPFence quick question, we have run cpfence --update and yet:
You are already using the latest cPFence Full version: 3.3.30

Is the .32 version only for Enhance v. 12?

This is not a problem if that is the case, but we will not be updating to v12 until the volume of bugs/issues dwindles significantly from what is happening up through today.

leonardo

8Dweb we have same thing and we are on v11 and we also plan to upgrade only in a few weeks probably until bugs are ironed out 😃

cPFence

8Dweb

Yes, the new versions will be for Enhance v12 only, as the new database features won’t work with Docker-based MySQL. Same here, we’re holding off on updating until things settle down and bug fix releases stop. Once that happens, we’ll run thorough tests and share our findings.

pratik_asabe

cPFence Yes, the new versions will be for Enhance v12 only

but we still be able to use older version for a while right? because we are also not going to upgrade to v12 until next week..

I hope you take care of users like us who still waiting for safe moment to jump in v12..

cPFence

pratik_asabe

Yes, of course. We’re still pushing hourly updates for virus signatures and WAF rules for v11. It’s the version we’re using on our own servers, so it’s well-supported. The thing is, we’ve had several features ready with the code almost done, but Docker limitations prevented us from adding them to cPFence. With v12, we’ll start rolling those out one by one, as they won’t be possible for v11 anyway.

mbe81

@cPFence Another small improvement can be made: my killed_queries.history only contains killed queries which are just open connections. They are in the process list with command sleep. I think you don't have to kill those connections.

cPFence

mbe81

Thanks for the feedback. The SLEEP connections being killed are harmless for application performance but actually help prevent issues in the long run. While sleeping connections may seem idle, they still consume memory and connection slots. If too many accumulate, it can lead to hitting the max_connections limit, causing new queries to fail and you will see errors like "Too many connections" when new clients attempt to connect. In some cases, idle connections can also hold transactions open, blocking other queries. There are situations where thousands of SLEEP queries can pile up and severely degrade server performance. Killing these helps free up resources and prevents such bottlenecks. This is a common practice among hosting companies, especially those not using CloudLinux, to better manage idle connections.

wenani

@cPFence Is it okay / recommended to edit the config file for one who prefers it over using the UI? I find me more comfortable with the direct edits and running commands on terminal than using the UI.

cPFence

wenani

Yes, you can edit the config file directly and use the CLI if that’s what you prefer—no issues.

cPFence

Version 3.3.34 (18th February 2025)

Added

- Full IPv6 compatibility – setting a new standard in server security!
cPFence is now 100% IPv6 compatible, making us the first server security solution in the shared hosting industry to achieve full, unrestricted IPv6 support. While Imunify360 offers partial IPv6 support, it comes with limitations and costs up to 10 times more. cPFence delivers robust IPv6 protection at a fraction of the price. While others are still catching up, cPFence is proud to lead the way. Our IPv6 support includes:

IPv6 blacklisting and whitelisting: Block or allow IPv6 addresses with ease.
Country blocking module: Now fully IPv6-ready, ensuring countries you block are truly blocked, regardless of IP type.
Brute force protection: SSH, FTP, and web services protection now fully IPv6-compatible. (Mail services support coming soon.)
IPDB IPv6 support: Our real-time IP threat database is now IPv6-ready. As more IPv6 traffic grows, cPFence will build the most powerful and accurate IPv6 threat intelligence.

- Added the ability to bulk IP whitelisting and blacklisting via admin ui:
Managing large IP lists is now easier than ever. You can now bulk add or remove IP addresses to your whitelist or blacklist directly from the admin ui, no more adding IPs one by one.

rdbf

Would it be possible for cPFence to automatically add all ip addresses (preferably ipv4 and ipv6) of the whole estate to the ipdb whitelist file on each of the servers?

It's possible for the servers to start blacklisting each other, for example, when the permissions on the backup server are messed up, each backup attempts an ssh-connection which then fails. Have enough of them, and the web server gets banned by the backup server.

cPFence

rdbf

Unfortunately, this isn’t possible because the IPs are only stored on the main control panel, so cPFence doesn’t have access to the full cluster’s IPs. However, the latest version of cPFence automatically whitelists the server IP and DNS IPs for both IPv4 and IPv6.

You can bulk whitelist all your IPv4 and IPv6 addresses in one shot using the Admin UI > Bulk Whitelist IPs tool.

Another useful feature in cPFence is the ability to manage your custom whitelist of IPs for all your servers. Simply set up this cron job on all servers:

/opt/cpfence/app/setup/cpfmain --bulk-whitelist-ip https://domain.com/custom_whitelist.txt

This command or cron will allow you to bulk whitelist IPs from the specified URL for better control and security management.

« Previous Page