Altered Packages found

[Metro2]

This is something that just started happening during the upcp cron after updating from cPanel 106 to 108.0.11 (with CloudLinux 6.10 ELS)

I've checked some other threads that are similar to this, but not exactly the same and I'm wary of making any changes such as running the /usr/local/cpanel/scripts/check_cpanel_pkgs --fix option. I'm hoping maybe someone here has opinions or advice before I bother the support team with a ticket.

Nightly upcp cron generates the following email to me:

Subject: [hostname.example.com] Altered Packages found

Message body:

[check_cpanel_pkgs] There are altered Packages on “hostname.example.com”.

The system detected problems with the following cPanel-provided files that the Packaging System controls: Packages​ Status​ Additional Information​ cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/__init__.pyc Broken ..5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/edns.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/entropy.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/exception.pyc Broken ..5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/flags.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/hash.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/inet.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/ipv4.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/ipv6.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/message.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/name.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/opcode.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/query.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/rcode.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/rdata.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/rdataclass.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/rdataset.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/rdatatype.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/renderer.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/resolver.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/reversename.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/rrset.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/set.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/tokenizer.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/tsig.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/ttl.pyc Broken S.5....T. cpanel-dnspython,1.12.0,1.cp108~el6-/usr/local/cpanel/3rdparty/python/2.7/lib/python2.7/site-packages/dns/wiredata.pyc Broken S.5....T. If you did not make these changes intentionally, execute the following command as the root user to correct them: /usr/local/cpanel/scripts/check_cpanel_pkgs --fix​

And from the docs article at The check_cpanel_pkgs Script | cPanel & WHM Documentation I can see that the "broken" statuses mean:
S = File size differs
5 = MD5 sum differs
T = mTime (modified time) differs

However, I'm very hesitant to run the --fix for fear of breaking something.

And when I SSH and just run [~]# /usr/local/cpanel/scripts/check_cpanel_pkgs it gives:

[2023-02-18 10:39:51 -0500]
[2023-02-18 10:39:51 -0500] Problems were detected with cPanel-provided files which are controlled by packages.
[2023-02-18 10:39:51 -0500] If you did not make these changes intentionally, you can correct them by running:
[2023-02-18 10:39:51 -0500]
[2023-02-18 10:39:51 -0500] > /usr/local/cpanel/scripts/check_cpanel_pkgs --fix
[2023-02-18 10:39:51 -0500]
[2023-02-18 10:39:51 -0500] The following files were found to be altered from their original package form:
[2023-02-18 10:39:51 -0500] cpanel-dnspython,1.12.0,1.cp108~el6
[2023-02-18 10:39:51 -0500]
Do you want to repair these packages?(y/n):

At that point I chose no, did more searching around the web for anything similar, and decided it best to inquire here before going any further. My only real clue is the fact that it started after upping from cPanel 106 to 108

Does anyone have any insight or suggestion regarding this?

Thank you for any feedback!

 

[cPRex]

Hey there! Since these are all cPanel packages, and an update just happened, it seems normal to me. I'd just the check_cpanel_pkgs command with the --fix and let it resolve it, and then you shouldn't see any more problems.

 

[Metro2]

@cPRex Thank you for the response. I ran the /usr/local/cpanel/scripts/check_cpanel_pkgs --fix command early this morning and so far no issues. If the alerts continue or otherwise, I'll post an update here just in case anyone else has the same question / concern.

 

[cPRex]

I'm glad that helped!

 

[Metro2]

Update

I got the same alerts again over the weekend.

I ran

/usr/local/cpanel/scripts/check_cpanel_pkgs --fix

and this time the response was a bit more lengthy, and did NOT ask me "Do you want to repair these packages?".

This was the output:

[~]# /usr/local/cpanel/scripts/check_cpanel_pkgs --fix
[2023-04-10 16:44:30 -0400]
[2023-04-10 16:44:30 -0400]   Problems were detected with cPanel-provided files which are controlled by packages.
[2023-04-10 16:44:30 -0400]   If you did not make these changes intentionally, you can correct them by running:
[2023-04-10 16:44:30 -0400]
[2023-04-10 16:44:30 -0400]   > /usr/local/cpanel/scripts/check_cpanel_pkgs --fix
[2023-04-10 16:44:30 -0400]
[2023-04-10 16:44:30 -0400]   The following files were found to be altered from their original package form:
[2023-04-10 16:44:30 -0400]   cpanel-dnspython,1.12.0,1.cp108~el6
[2023-04-10 16:44:30 -0400]   cpanel-php81,8.1.16,1.cp110~el6
[2023-04-10 16:44:30 -0400]
[2023-04-10 16:44:30 -0400]   Removing 2 broken rpms: cpanel-dnspython-1.12.0-1.cp108~el6.x86_64, cpanel-php81-8.1.16-1.cp110~el6.x86_64
[2023-04-10 16:44:31 -0400]   Maximum sync children set to 16 based on 45796M available memory.
[2023-04-10 16:44:31 -0400]   Downloading http://httpupdate.cpanel.net/RPM/11.108/centos/6/x86_64/sha512
[2023-04-10 16:44:31 -0400]   Downloading http://httpupdate.cpanel.net/RPM/11.110/centos/6/x86_64/sha512
[2023-04-10 16:44:31 -0400]   Successfully verified signature for cpanel (key types: release).
[2023-04-10 16:44:31 -0400]   Successfully verified signature for cpanel (key types: release).
[2023-04-10 16:44:31 -0400]   Downloading http://httpupdate.cpanel.net/RPM/11.108/centos/6/x86_64/cpanel-dnspython-1.12.0-1.cp108~el6.x86_64.rpm
[2023-04-10 16:44:31 -0400]   Downloading http://httpupdate.cpanel.net/RPM/11.110/centos/6/x86_64/cpanel-php81-8.1.16-1.cp110~el6.x86_64.rpm
[2023-04-10 16:44:33 -0400]   Disabling service monitoring.
[2023-04-10 16:44:33 -0400]   Hooks system enabled.
[2023-04-10 16:44:33 -0400]   Checking for and running RPM::Versions 'pre' hooks for any Packages about to be installed
[2023-04-10 16:44:33 -0400]   All required 'pre' hooks have been run
[2023-04-10 16:44:33 -0400]   No packages need to be uninstalled
[2023-04-10 16:44:33 -0400]   Installing new rpms: cpanel-dnspython-1.12.0-1.cp108~el6.x86_64.rpm cpanel-php81-8.1.16-1.cp110~el6.x86_64.rpm
[2023-04-10 16:44:33 -0400]   Preparing packages for installation...
[2023-04-10 16:44:33 -0400]   cpanel-php81-8.1.16-1.cp110~el6
[2023-04-10 16:44:35 -0400]   warning: /usr/local/cpanel/3rdparty/php/81/etc/php.ini created as /usr/local/cpanel/3rdparty/php/81/etc/php.ini.rpmnew
[2023-04-10 16:44:37 -0400]   config-set succeeded
[2023-04-10 16:44:37 -0400]   cpanel-dnspython-1.12.0-1.cp108~el6
[2023-04-10 16:44:38 -0400]   Hooks system enabled.
[2023-04-10 16:44:38 -0400]   Checking for and running RPM::Versions 'post' hooks for any Packages about to be installed
[2023-04-10 16:44:38 -0400]   All required 'post' hooks have been run
[2023-04-10 16:44:38 -0400]   Restoring service monitoring.

So far everything still seems OK, it's just that these notices are something new and makes me a little nervous.

 

[cPRex]

We got some more details about this over the weekend:

https://support.cpanel.net/hc/en-us/articles/13720728999959

but for now it's safe to run that "--fix" until there is an official solution.

 

[Metro2]

@cPRex thank you for the info!

 

[cPRex]

Sure thing!!!

 

[rockhost]

Greetings, I found this thread Googling after receiving the following notification over the weekend (Saturday and Sunday mornings). However, it has since stopped. Is it possible the issue fixed itself? I am able to run the command as root. However, I want to confirm it will not kill any running process / php. Please advise. THANK YOU!

The system detected problems with the following cPanel-provided files that the Packaging System controls:

Packages​	Status​	Additional Information​
cpanel-php81,8.1.16,1.cp110~el7-/usr/local/cpanel/3rdparty/php/81/lib/php/.filemap	Broken	S.5....T.

If you did not make these changes intentionally, execute the following command as the root user to correct them:

/usr/local/cpanel/scripts/check_cpanel_pkgs --fix​

 

[cPRex]

Running this command won't hurt anything on the server as this is related to the internal cPanel PHP version.

 

[rockhost]

This appears to have worked, thank you. Just thought I would share for others.

[root@chi3 ~]# /usr/local/cpanel/scripts/check_cpanel_pkgs --fix
[2023-04-17 17:12:55 -0500]
[2023-04-17 17:12:55 -0500] Problems were detected with cPanel-provided files which are controlled by packages.
[2023-04-17 17:12:55 -0500] If you did not make these changes intentionally, you can correct them by running:
[2023-04-17 17:12:55 -0500]
[2023-04-17 17:12:55 -0500] > /usr/local/cpanel/scripts/check_cpanel_pkgs --fix
[2023-04-17 17:12:55 -0500]
[2023-04-17 17:12:55 -0500] The following files were found to be altered from their original package form:
[2023-04-17 17:12:55 -0500] cpanel-php81,8.1.16,1.cp110~el7
[2023-04-17 17:12:55 -0500]
[2023-04-17 17:12:55 -0500] Removing 1 broken rpms: cpanel-php81-8.1.16-1.cp110~el7.x86_64
[2023-04-17 17:12:56 -0500] Maximum sync children set to 16 based on 56453M available memory.
[2023-04-17 17:12:56 -0500] Downloading http://httpupdate.cpanel.net/RPM/11.110/centos/7/x86_64/sha512
[2023-04-17 17:12:58 -0500] Successfully verified signature for cpanel (key types: release).
[2023-04-17 17:12:58 -0500] Downloading http://httpupdate.cpanel.net/RPM/11.110/centos/7/x86_64/cpanel-php81-8.1.16-1.cp110~el7.x86_64.rpm
[2023-04-17 17:12:58 -0500] Disabling service monitoring.
[2023-04-17 17:12:59 -0500] Hooks system enabled.
[2023-04-17 17:12:59 -0500] Checking for and running RPM::Versions 'pre' hooks for any Packages about to be installed
[2023-04-17 17:12:59 -0500] All required 'pre' hooks have been run
[2023-04-17 17:12:59 -0500] No packages need to be uninstalled
[2023-04-17 17:12:59 -0500] Installing new rpms: cpanel-php81-8.1.16-1.cp110~el7.x86_64.rpm
[2023-04-17 17:12:59 -0500] Preparing packages...
[2023-04-17 17:12:59 -0500] cpanel-php81-8.1.16-1.cp110~el7.x86_64
[2023-04-17 17:13:01 -0500] warning: /usr/local/cpanel/3rdparty/php/81/etc/php.ini created as /usr/local/cpanel/3rdparty/php/81/etc/php.ini.rpmnew
[2023-04-17 17:13:02 -0500] config-set succeeded
[2023-04-17 17:13:02 -0500] Hooks system enabled.
[2023-04-17 17:13:02 -0500] Checking for and running RPM::Versions 'post' hooks for any Packages about to be installed
[2023-04-17 17:13:02 -0500] All required 'post' hooks have been run
[2023-04-17 17:13:02 -0500] Restoring service monitoring.
[root@chi3 ~]#