Tag: cpanel

To stop all services on a cPanel server, you can follow commands in the command line interface.

systemctl stop tailwatchd.service
systemctl stop dnsadmin.service
systemctl stop sw-engine.service
systemctl stop dovecot
systemctl stop exim
systemctl stop named
systemctl stop pure-ftpd
systemctl stop cpdavd
systemctl stop cpanel
systemctl stop spamd
systemctl stop jetmongod.service
systemctl stop cphulkd.service
systemctl stop mysqld.service
systemctl stop cpanel_php_fpm.service
systemctl stop ea-php83-php-fpm.service
systemctl stop ea-php82-php-fpm.service
systemctl stop ea-php80-php-fpm.service
systemctl stop ea-php74-php-fpm.service
systemctl stop ea-php73-php-fpm.service
systemctl stop crond
systemctl stop chronyd.service
systemctl stop cpanellogd.service
systemctl stop wp-toolkit-background-tasks.service
systemctl stop wp-toolkit-scheduled-tasks.service
systemctl stop rngd.service

Back to Cpanel Server

Symlink attack exploits the way Linux operating systems handle symbolic links (symlinks). A symlink is a pointer to another file or directory that is used by the operating system to access the linked file or directory. In a symlink attack, an attacker creates a symbolic link that points to a file or directory that the attacker does not have permission to access. When the web server attempts to access the linked file or directory, the attacker can gain access to it.

Symlink attacks can be used to gain access to sensitive data. On a Cpanel Server, hackers usually create a symlink to common configuration files used by popular CMS on other hosting accounts on the same server. With this hackers can get database credentials of other websites hosted on the server. Many CMS store user credentials in the MySQL database, and they will be able to change passwords and gain access to websites.

Solution 1: CloudLinux CageFS (Paid)

The best way to prevent a symlink attack on the Cpanel server is to use CloudLinux CageFS, this isolates each site into its own isolated areas, so one website’s files won’t be able to another site.

Solution 2: mod_ruid2

If you are not using CloudLinux, you can use the following method to protect against the symlink attack. mod_ruid2 is an Apache module, that can be enabled in EasyApache 4.

In WHM > Software > EasyApache 4, enable mod_ruid2.

Under WHM > Server Configuration > Tweak Settings, enable jail Apache

Go to WHM > Security Center > Security Advisor, and install KernelCare’s Free Symlink Protection.

If you enable SSH access for cPanel accounts, make sure it is “jailed Shell” under WHM > Account Functions > Manage Shell Access

Back to cPanel Server

PHP ssh2 module allows you to connect to SSH servers. On Cpanel servers, this module is not available under EasyApache. You need to install using PECL. The PECL module installer in WHM does not list this module. The module is available to download from

https://pecl.php.net/package/ssh2

To install it, log in to the Cpanel server as SSH user root or login to WHM as user root, go to Terminal.

Run the command

/opt/cpanel/ea-php74/root/bin/pecl install ssh2-1.3.1

This will install ssh2 module for PHP 7.4.

For PHP 8.0, you can run

/opt/cpanel/ea-php80/root/bin/pecl install ssh2-1.3.1

You can also specify the full download URL for the SSH2 module like

/opt/cpanel/ea-php74/root/bin/pecl install https://pecl.php.net/get/ssh2-1.3.1.tgz

If you need to install SSH module for another PHP version, change ea-php74 to whatever PHP version you are using. Make sure you select the appropriate ssh2 module version that works with the PHP version you are using.

After installing, restart Apache with

systemctl restart httpd

To verify the ssh2 module is installed, create a PHP file with phpinfo() function, you will see.

Back to Cpanel Server