How to secure a WHM/cPanel?

Kaz Wolfe · Feb 2, 2019

I installed WHM/cPanel on my server but seem i am just using default setting from them. Does WHM need to improve security? if yes how to do? can you tell me the ways?

Localnode · Feb 2, 2019

Here's a good start:
https://documentation.cpanel.net/display/CKB/Tips+to+Make+Your+Server+More+Secure

I'd suggest - if you're not comfortable - is to use a managed company to secure the server for you.

HostechSupport · Feb 2, 2019

WHM - Server setup - Tweak Security:

Enable open_basedir protection
Disable Compilers for all accounts(except root)
Enable Shell Bomb/memory Protection
Enable cPHulk Brute Force Protection
WHM - Account Functions:

Disable cPanel Demo Mode
Disable shell access for all accounts(except root)
WHM - Service Configuration - FTP Configuration:

Disable anonymous FTP access
You can enable cPHulk install csf firewall and change your SSH port number to custom one. That would be enough.

Kaz Wolfe · Feb 3, 2019

Localnode said:
Here's a good start:
https://documentation.cpanel.net/display/CKB/Tips+to+Make+Your+Server+More+Secure

There are many guides there, I will check them out.

Localnode said:
I'd suggest - if you're not comfortable - is to use a managed company to secure the server for you.

Sure but I would like to manage and secure my server myself.

mobin · Feb 7, 2019

Since you want to do this yourselves..you should do a lot of research, read multiple articles, compare/collect the steps and compile a list that suits best. If you google "cpanel server hardening" you can find lot of articles to secure your cPanel server.

bountysite · Feb 7, 2019

Most of the information is about adding security to your hosting server, which is what you need.

I have heard use of fail2ban, CSF, regularly for firewall.
Brute force protection on sites(application layer), is also good
Ensure you have offsite backup
Have File Change monitoring to keep track of file changes, which helps you catch suspicious files early
Run ssh on different port, only known to you
I am guessing anonymous FTP should already be disabled, by default
Use cgroups, based file isolation(Eg CloudLinux). To protect from cross site contamination
If you can enable Strict SSL for FTP(instead of optional). Basically forcing end users to use FTPS
ClamAV, rkhunter for basic malware protection
Ensure that sites are running latest updates
Modsecurity for local WAF
If you are giving ssh access, enforce strong password policy
Disable root login for ssh
Remove unnecessary services
Disable compilers
Restrict new outbound traffic, if you can. Prevents some reverse shells.

bountysite · Feb 12, 2019

Try using BountySite.
BountySite downloads all files in the first backup and stores in revision control. Subsequent backups are only incremental. In case there are file changes, BountySite notifies with files created, modified and deleted summary, on backup, via mail(text only) and control panel notification.
Site owner is the best person to judge whether the file change is unauthorized. Site owner can then decide to revert back or delete file(s).

Dormant sites can be protected by using Stable operating mode, in which case all file changes are considered as unauthorized, and are auto reverted to a specific snapshot.

BountySite has storage nodes across the globe, choose one close to your Hosting server location for best performance.

AlbaHost · Feb 13, 2019

And enable 2FA aswell

How to secure a WHM/cPanel?

Kaz Wolfe

Well-known member

Localnode

Well-known member

HostechSupport

Active member

Kaz Wolfe

Well-known member

Kaz Wolfe

Well-known member

mobin

Well-known member

bountysite

Well-known member

Kaz Wolfe

Well-known member

bountysite

Well-known member

AlbaHost

Well-known member

DaRecordon

Well-known member

AlbaHost

Well-known member

Latest posts New threads

Latest posts

New threads

Latest Hosting Offers New Reviews

Latest hosting offers

Popular Contributors - Past 30 Days

Sponsors

Tag Cloud