Is using cPanel a risk from the security point-of-view?

Question

A hosting provider is giving us the option of setting up cPanel on our dedicated server. Although I definitely find it useful and convenient to use, is there a security risk in using it?

Answer 1

cPanel / WHM is merelly a tool weather there is security risk within it or not is up to your System Administrator to take care of it.

Over 50%+ of the linux hosting companies out there use cPanel or other similar tool and they all have their good and bad sides and what covers it is the System Administrator capabilities.

cPanel is merelly all the application you usually see such as apache, bind, exim, php, and so forth meaning that if they are not kept up to date and it is not correctly configured it may result in a hole on your system.

Let's make it simple think of cPanel as a newly brand linux installation, once it is done, there are still lots of work to do to make it secure.

Answer 2

^{_{Caveat: I've not used cPanel as an admin or a user for some time, but used to administer a couple of cPanel managed servers.}}

cPanel in itself is not a particular security concern as most of the core components are standard and cPanel are quick to release updates following upstream security fixes these days.

There are a few things to consider though:

• cPanel generally gets installed on a fresh system, if this is an existing server rather than a new commission there may be extra problems - at very least you should ensure a full backup is taken before the install takes place
• While a standard cPanel install is reasonably well locked down it is worth reviewing standard lock-down techniques (like hardening your SSHd config as appropriate) to make sure everything it up to your normal standards
• Running cPanel does mean you have extra services (the cPanel management interfaces) exposed to the outside world and any extra service that is publicly addressable increases your potential attack surface area (if, for instance, someone discovers a hole in cPanel that allows admin access without correct authentication, you are potentially vulnerable until the cPanel people diagnose the problem and create+test+release an update). To mitigate this (these tips are relevant for other services too, not just cPanel):
  • Make sure you install updates to cPanel, and your base OS, in a timely manner.
  • Make sure you follow all security recommendations from the cPanel documentation and other trusted sources unless you have very good reason for not doing so (and have other provisions in place to mitigate any issues your deviation from the recommendations might open)
  • If you have cPanel installed just for your own convenience, i.e. you do not intend others to offer shared hosting and let your users use cPanel themselves, set firewall rules such that its management interfaces can only be accessed from your locations (or firewall it off from all but local connections and install setup something like OpenVPN so you can access it that way)
  • Assuming the root/reseller interface still runs on a different port to the interface for lesser privileged users, you can be selective with firewall rules above so that the base user interface is publicly available but the admin interface(s) are not
• If you do have other user accounts on the system, ensure that they keep scripts the install (from cPanel auto-installs or other add-ins) uptodate - this is not managed automatically IIRC. This counts for any code the users add, not just through the cPanel interface or similar, but it is important to check as one-click install options give people a false sense of security in my experience, as they tend to assume the system and its admins will take care of updates automatically and this is not usually the case.

Answer 3

(damn low reputation)

Just my 2 cents:

cPanel is just as secure as experienced is the SA who manages it. However, here are 2 links to help you get started with something more than just the default installation:

• www.thecpaneladmin.com > Awesome blog with tips'n'tricks for many complicated procedures in cPanel
• www.configserver.com > Some of the best free helper scripts to use with cPanel, escpecially if you are a newbie. Their CSF firewall/bruteforce detection script is plain awesome and extremely helpful!

Answer 4

Yes there is,

Firstly any vulnerability in cPanel would obviously make you vulnerable to attacks that used it. (you are making your attack surface larger by having it)

Secondly the bundled "one click" installs it has are very old and most are vulnerable to some attack or other.

Other than that no.

If your interested in security I would sincerely advise you to use suphp and suexec (for php and perl) as that will run those scripts as a specified user (one user per vhost) which means that if one site is exploited then all your other sites would be safe.

The other method (a better one but slightly more difficult to implement) is to use Apache MPM-ITK or MPM-Peruser, these have the added advantage of affording the same protection to Python, Ruby, Perl ......

At least that is what I have found to work, and what I have done for countless customers.