Loading the post…
Starting November 10, a cloudlinux-release update rolls out gradually to CloudLinux servers. It adds the TuxCare Extended Lifecycle Support (ELS) repositories for alt-PHP (HardenedPHP), alt-Python, alt-Node.js and alt-Ruby.
On a server registered with CLN, the repositories switch on by themselves, usually within a minute of the update, and your CloudLinux license already covers them. From then on, alt-* updates, CVE fixes included, also come from TuxCare ELS through the usual yum, dnf or apt update, so you get each fix as soon as it’s available.
A few setups need a step first: your own mirror, an outbound allowlist, a version lock, a broken CLN registration, and Ubuntu. Details are under "When you need to act".
We’re doing this because every alt-* build is published twice today, to TuxCare ELS and to our own repositories. Later, ELS becomes the only source, so each build is published once. That step hasn’t happened yet, and we’ll announce it in advance.
The update installs four packages that set up the repositories: els-php-release, els-python-release, els-nodejs-release and els-ruby-release. Where rhn-client-tools is too old to fetch the token the ELS repositories need, the same update brings a newer one.
| Release | cloudlinux-release with the change | rhn-client-tools, at least |
|---|---|---|
| CloudLinux 7 | 7.9-2.18 | 2.0.2-57 |
| CloudLinux 7 Hybrid | 7.9-2.19 | 2.0.2-57 |
| CloudLinux 8 | 8.10-17 | 3.0.5 |
| CloudLinux 9 | 9.8-4 | 3.0.5 |
| CloudLinux 10 | 10-6 | 3.0.5 |
| CloudLinux for Ubuntu 22.04 | 0.1-13 | 3.0.5 |
If you installed the els-*-release packages yourself earlier, nothing is different for you. Each repository comes on once the server has its ELS token, and one you disabled or pointed at your own mirror stays as you set it.
On servers with regular system updates, nothing.
A server without a CLN registration keeps the ELS repositories off. Nothing breaks: yum, dnf and apt keep working with your other repositories.
If a registered server doesn’t have its ELS token yet when the update runs, the update prints:
TuxCare ELS repositories stay off until this server gets its ELS token from CLN.
rhn_check is fetching it in the background. If they stay off, check the CLN registration with rhn_check.The repositories switch on as soon as the token arrives. A repository that is still off has this line above its enabled=0 (on Ubuntu, above its commented-out deb line):
# cloudlinux-release: switched off until this server has a TuxCare ELS token (rhn_check fetches it). Delete this line to keep the repo off.To check a server, list the repositories (yum on CloudLinux 7):
dnf repolist | grep -E 'php-els|alt-python|alt-nodejs|alt-ruby'
grep -l 'cloudlinux-release: switched off' /etc/yum.repos.d/*.repoThe first command lists the ELS repositories that are switched on. The second prints nothing when all of them are on. On Ubuntu, run grep -l 'cloudlinux-release: switched off' /etc/apt/sources.list.d/*.list.
If a server’s CLN registration is broken or its license has lapsed but it still has an old token, the ELS repositories answer 403 Forbidden. They stay on, so the problem is visible.
To fix it, run rhn_check. If the registration is still valid, it fetches a fresh token and the 403 goes away. If it isn’t, fix the registration or renew the license. You can also disable the ELS repositories by hand: cloudlinux-release leaves a repository you disabled alone. Once TuxCare ELS becomes the only source of alt-* updates, a server with them off gets none.
If your servers use your own mirror instead of our repositories, add the four ELS repositories and the alt-common repository to it, then point the repository files at it. Mirror access is granted per IP address, so send your mirror’s external IP address to your account manager or to TuxCare sales. TuxCare’s mirroring steps are on four pages: the alt-PHP mirror, the alt-Python mirror, the alt-Node.js mirror and the alt-Ruby mirror. cloudlinux-release leaves a repository that points at another host alone.
If your servers reach the internet only through an allowlist, allow HTTPS to repo.alt.tuxcare.com and rollout.alt.tuxcare.com. Otherwise, once the ELS repositories switch on, updates can fail the same way as with a 403.
If you exclude or version-lock rhn-client-tools (exclude= in yum.conf or dnf.conf, dnf versionlock, apt-mark hold), the server can’t take this update. On CloudLinux 7 to 10 the whole yum update or dnf update then stops with an error naming the conflict with rhn-client-tools. Remove the exclude or lock on the rhn packages before you update.
An exclude on alt-* packages blocks the update too on a server without alt-common-release. Keep alt-common-release and alt-php-els-meta out of such excludes.
apt-get upgrade keeps the new cloudlinux-release back, because it never installs new packages. Update with this command instead:
apt install rhn-client-tools cloudlinux-releaseServers still on rhn-client-tools 2.12 get version 3 from it too, which replaces their python3-rhnlib and rhnlib packages. Nothing else is removed. We recommend this command rather than apt full-upgrade, which may also propose removing alt-phpXX-fpm packages for reasons unrelated to this update.
The update reaches a growing share of servers through regular system updates, and all of them once it’s stable. To take it as soon as it’s available to your server, run yum update cloudlinux-release on CloudLinux 7 or dnf update cloudlinux-release on CloudLinux 8 to 10.
Later, alt-* packages will be published only to the TuxCare ELS repositories. We’ll announce that step in advance, once most servers have these repositories switched on. After it, a server with them off gets no new alt-* updates.
Questions about this update? Contact CloudLinux support.
Nikolay Galov
Comments