Tagged Questions

0
votes
1answer
25 views

How can I configure a Ubuntu LAMP web server with permissions like CPanel?

I know how to set up a LAMP stack on Ubuntu pretty well for a single website / single user, but I'd like to allow multiple users to host multiple sites on a single server. This is for different ...
0
votes
1answer
24 views

Possibility Cross File Permission Overwrite WHM/cPanel

I have 2 separate cPanel accounts, says "site1" and "site2" In "site1" there is security hole which allow the attacker to upload a shell file. I wonder why the attacker could access the files and ...
0
votes
2answers
74 views

Can you lock down Cpanel/WHM access to certain IP's?

Is it possible to only allow access to Cpanel/WHM to certain IP's? I know how to do it for standard folders, but I don't believe that will work for this purpose as they are on different ports or ...
4
votes
7answers
557 views

Preventing - Large Number of Failed Login Attempts from IP

I'm running a CentOS 6.3 server and currently receive emails entitled "Large Number of Failed Login Attempts from IP" from my server every 15 minutes or so. Surely with the below configured it should ...
0
votes
1answer
41 views

Getting much higher than usual brute-force attempts on cPanel

Although I have many client accounts on my cPanel based server I'm really the only one who has login information to any of the accounts. I have cPhulk setup to alert me and blocking after 4 failed ...
-2
votes
2answers
111 views

Any difference between a SSH user, SFTP user, cPanel user, etc? [closed]

I've recently disabled root access on my server and enabled sudo for my user. However I also use this user account for SFTP and logging into cPanel. Is there any security issue with this? By default I ...
1
vote
1answer
67 views

Stop showing server software version information on 404

e.g. if someone type url that dont exist it shows 404 page and on bottom Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 ...
0
votes
1answer
300 views

PureFTPd and symlinks

I'm running Pure-FTPD on centos 5 with cPanel installed. When somebody upload a symlink file called 1.txt and it's a symlink to /partition for example, He can browse all /partition contents from this ...
0
votes
1answer
833 views

CVE-2011-3389 from a PCI Scan on a LiteSpeed Web Server on cPanel [closed]

So we had a scan kick back with CVE-2011-3389 today and our SSL Cipher Suite is as such: ALL:!ADH:RC4+RSA:+HIGH:-MEDIUM:-LOW:-SSLv2:-EXP:!kEDH And it's still kicking back with the same complaint: ...
8
votes
2answers
446 views

Is there a way to force all cPanel users to change their passwords one time?

One of the cPanel servers I am running has constant troubles with compromised email accounts. I believe many of the users on this server have very weak passwords. I have increased the minimum password ...
1
vote
3answers
2k views

Server SSL configuration to stop warnings and errors

I've just setup SSL on the main domain in my whm/cpanel setup, the domain has it's own ip and is all up and running correctly. However when browsing the site in Chrome I get the following: Your ...
3
votes
1answer
282 views

How did a phisher upload to my server?

My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to ...
2
votes
4answers
269 views

Is using cPanel a risk from the security point-of-view?

A hosting provider is giving us the option of setting up cPanel on our dedicated server. Although I definitely find it useful and convenient to use, is there a security risk in using it?
0
votes
1answer
278 views

Linux / cPanel security - firewall or Denyhosts?

I have a VPS running cPanel that has a csf firewall configured. I've also got Host Access Control (does this mean denyhosts on cPanel?) as well as cPHulk which is a cPanel exclusive utility. My ...
0
votes
2answers
406 views

How to secure Cpanel/WHM from malacious uploads

Recently my site's index.php file was replaced with some malicious javascript code. I really don't know how it was added to the page. Today when I tried to download the file via FTP, my local ...
0
votes
2answers
478 views

ini_set disabled functions

I'm working in a hosting company and I'm pretty new. One of the company's policies is disabling ini_set php function for security reasons. There are lots of clients that have shared hosting asking us ...
0
votes
2answers
259 views

What control panels allow arbitrary passwords and why does Plesk allow only short ones?

Hosting provider M6.net explained me that the password security of its control panel (Plesk) is limited to a maximum of 14 characters. This article on Parallels explaining backs him up. However, he ...