CPanel Security : Tips Collection

I think these links are great for hardening security on CPanel

Common Tips from CPanel itself

Improving System Security on CPanel System

How to modify cPanel Skin : hide apache, php, mysql, kernel and ip address infos

I want this information, such as apache, php, mysql, kernel and ip address not shown on cPanel. I thought I modified skin file, so i downloaded the file from WHM. The file has size 10mb in gunzip format, but when it was extracted to original file, the size had became 458mb. I tracked code for apache, php, mysql, kernel and ip address on stat.html and deleted them. I stumbled to big problem, when i should compressed all files into one gunzip file. I edited and compressed on Windows, which is huge problem. The gunzip file was very big, it was 100mb.
Why did i compress skin files into a gunzip file? because WHM/cPanel needs the skin in tarball format.

I was googling and found a presentation file from one of cPanel Staff. He said that cPanel 11 has Branding feature where you can modify skin on cPanel enviroment. I thought this is great, I don’t bother to compress and upload a modified file.

Here is a way how to modify cPanel Skin
1. Log into cPanel Main (Reseller) Account. Make sure you have a branding editor. Please use CPanel Main Account, not WHM, because i had tried and it will bring you cPanel enviroment when you choose a branding editor in WHM (Themes on Left Panel). Editing on cPanel Main Account will effect entire domains
2. You’ll see installed styles. You can choose which style you want, just checked enabled/disabled.
3. Choose one style to Apply to My Account (this will apply to your account only), Apply to All Accounts (this will apply to entire account on your server), Set as Default for New Accounts (this will apply to every new account created on the server)
6. Choose Edit this Style
7. Choose Edit HTML Pages > Choose Entry Page, index.html > Click Edit
8. Find line no 160 and delete apache, php, mysql, kernel and ip infos.
9. Click Save. You’re Done

You can do this on other styles too

How to transfer Cpanel accounts from one server to another (Cpanel)?

UPDATE

Note :
The server we are transferring the accounts from : OLD SERVER
The server to are transferring the accounts to : NEW SERVER

PROCESS ON NEW SERVER
1. Log into WHM. If your server is new, create a main account. The main account also setup as nameservers. Or if your server isn’t new, you can create or use another account on your NEW SERVER. The account will be used to accept backup file from OLD SERVER. Remember : address (a domain name or an ip address), NEW SERVER’s account and password will be used as a container for OLD SERVER’s backup file.

PROCESS ON OLD SERVER :
1. Log into cPanel account. If you don’t know your clients login (if you move entire server with some accounts belongs to clients), use a client username and your master password. Choose Admin Layer
2. Choose Backup (Do not choose Backup Wizard). Then choose Genereate/Download A Full Backup
3. Select the backup destination to be Remote FTP Server.
4. Enter you email address for verification. If you transferred your client, make sure to enter your own email address, not your client.
5. Enter this :
Remote Server : NEW SERVER’s address (you can use a domain name or an ip address)
Remote User : NEW SERVER’s account (you can use NEW SERVER’s main account. This was explain in PROCESS ON NEW SERVER STEP NO. 1)
Remote Password : NEW SERVER’s account password
PORT : 21
6. That would be enough. Click Generate Backup. This may take some time to backup the files, depending on how large the account is. You should receive an email provided in the above info once it’s complete.

AFTER YOU GET OLD SERVER’s Backup File on NEW SERVER
1. Log into SSH on your NEW SERVER
2. type this :
cd /home/account_name
note : account_name is the name of the account used to backup OLD SERVER’s account files

ls
Running the list command will make you see the tar file of the account on the OLD SERVER.
3. Move the tar file to your NEW SERVER’s /home directory with the following command :
mv tar_file_name /home
4. Log into NEW SERVER’s WHM and go to Backup and choose Restore a Full Backup/cpmove file. You should see the OLD SERVER’s file with old account’s username under Possible cpmove archives found.
5. Type in the account name ( I suggested that you should use same account name with old account) in the text field in WHM (Enter the username for the account you wish to restore)
6. Click Restore

Additional information : After transfer completed, check out a package on an account. Make sure you setup the right package used by the account.
Warning : Use Steps above one by one, meaning that you should restore an account at once, not multiple files at once. When you reach step no 2 in AFTER YOU GET OLD SERVER’s Backup File on NEW SERVER, move only one file to /home directory or you can make cpanel confused.

Redirect Subdomain to another ip address or url

I have a tumblr site.We can use our own domain instead tumbr address, redirect our domain to tumblr. Not only a domain,we also can redirect a subdomain to tumblr. It’s easy. Go to our domain control panel. Choose your DNS Zone. We must point the domain’s A-Record to tumblr’s ip address. Add a DNS Record : host A ip_address or for example test.com A 72.32.231.8 (domain) or test.test.com A 72.32.231.8 (subdomain).Don’t use plesk’ or cpanel’s subdomain services to create an A-record, ifwe use this, plesk or cpanel actually create a subdomain with a directory and an ftp for the subdomain. We don’t need this.

Log in to tumblr, open Settings inside Account drop down menu. Choose ‘use a custom domain name’ and type a domain name or a subdomain name. Save our new settings. We may need to wait up to 72 hours or less for the change to take effect.

Upgrading php and mysql (cPanel using WHM)

Upgrading cPanel is a lot easy than upgrading Plesk, especially if we use WHM (Web Hosting Manager).

1. Log into WHM
2. Go to Apache Update in Software Category
3. Click Load Previous Config, uncheck previous php version and check the new php version. Same with mysql
4. Press Start Build

Note : some components also provided, such as xml-rpc, not just php and mysql. So read through options available in Apache Update, before Start Build

Installing phpMyAdmin outside CPanel or Plesk

CPanel and Plesk have phpMyAdmin inside their Control Panel/Administration Site. Only ‘root or ’superuser’ can access phpMyAdmin. This can be difficult if we have a development team, which each member needs to access databases. So we install phpMyAdmin outside Control Panel.

• Download phpMyAdmin version 2.9.x or above
• Extract phpMyAdmin and upload to server. Create a ‘not easy guess” folder name
• Change config.sample.inc.php to config.inc.php. Fill in a blowfish secret word and empty username and password in config.inc.php
• Don’t give ‘root’ password, create user and password for each member.
• Protect folder
  CPanel : Site Management Tools > Web Protect
  Plesk : Domains > Hosting > Directories (Protected Directories)
• Don’t give username and password for Protected Folder or Protected Directory to people who doesn’t have right to access the folder.