Allow
autocomplete for login screens. [?]
This feature allows users
to enable browser-native password caching for
cPanel, WHM, and webmail logins. If you turn
this off, it will not affect legacy-style (I.e.
pre-11.32) login themes.
|
|
Hide login password from cgi
scripts [?]
This setting allows you to
hide the REMOTE_PASSWORD environment variable
from scripts executed through cpsrvd's cgi
handler.
|
|
Validate the IP addresses
used in all cookie-based logins. This will limit
the ability of attackers who capture cPanel
session cookies to use them in an exploit of the
cPanel or WebHost Manager interfaces. For this
setting to have maximum effectiveness,
proxydomains should also be disabled. Strict
validation requires the current IP address and
the cookie IP address to exactly match. Loose
validation only requires they are in the same
/24.
|
|
Allow WHM/Webmail/cPanel
services to create core dumps for debugging
purposes. Core dumps often contain sensitive
information but may be necessary for debugging
certain types of service crashes.
|
|
Send passwords when
creating a new account [?]
Send passwords in
plaintext over email when creating a new
acccount. Enabling this option is a security
risk.
|
|
This option enables the
EasyApache FileProtect module, which improves
the security of each user’s
public_html directory. [ More
Info]
|
|
Blank referrer
safety check [?]
Only permit
cpanel/whm/webmail to execute functions when the
browser provides a referrer. This will help
prevent XSRF attacks but may break integration
with other systems, login applications, and
billing software. Cookies are required with this
option enabled.
|
|
Referrer safety
check [?]
Only permit
cpanel/whm/webmail to execute functions when the
browser provided referrer (Domain/IP and Port)
exactly matches the destination URL. This will
help prevent XSRF attacks but may break
integration with other systems, login
applications, and billing software. Cookies are
required with this option enabled.
|
|
Require SSL for cPanel
Services [?]
This option forces the
server to redirect unencrypted cPanel, Webmail,
WHM, and DAV requests to secure ports according
to the SSL redirection settings. If “Choose the
closest matched domain for which that the system
has a valid certificate when redirecting from
non-SSL to SSL URLs” is enabled, the system will
redirect to the best matched certificate for the
domain. If “Choose the closest matched domain
for which that the system has a valid
certificate when redirecting from non-SSL to SSL
URLs” is disabled, the system will redirect to
the https:// URL for the domain, even if no
valid certificate exists for the domain.
|
|
Allow
PHP to be run when logged in as a reseller to
WHM [?]
Special care should be
taken when enabling this functionality since PHP
will be running as root. Any application you
permit to run under this setup should make
special security considerations to avoid
catastrophe.
|
|
Allow apps that have not registered with AppConfig
to be run when logged in as a reseller to
WHM. [?]
This option was introduced
in cPanel 11.38.1 to provide additional
visibility of installed apps and addons and the
privilege level at which they are installed.
This forces apps and addons to register with
AppConfig before WHM will execute them when
logged in as a reseller.
|
|
Allow
apps that have not registered with AppConfig to be
run when logged in as root or a reseller with the
"all" ACL in WHM. [?]
This option was introduced
in cPanel 11.38.1 to provide additional
visibility of installed apps and addons and the
privilege level at which they are installed.
This forces apps and addons to register with
AppConfig before WHM will execute them when
logged in as root or a reseller with the "all"
ACL.
|
|
This setting allows WHM applications and addons to
execute even if an ACL list has not been
defined. [?]
Enabling this option will
permit WHM apps and addons to run without an
ACLs list defined in their AppConfig file.
|
|
This setting allows cPanel and Webmail applications
and addons to execute even if a feature list has not
been defined. [?]
Enabling this option will
permit cPanel and Webmail apps and addons to run
without an feature list defined in their
AppConfig file.
|
|
Use MD5
passwords with Apache [?]
Use MD5 encoded passwords
in Apache htpasswd files. When this option is
disabled, crypt-encoded passwords are used.
Crypt-encoded passwords are limited to a maximum
length of 8 characters, while MD5-encoded
passwords may be any length.
|
|
EXPERIMENTAL: Jail Apache
Virtual Hosts using mod_ruid2 and cPanel®
jailshell. [?]
If mod_ruid2 is compiled
in via EasyApache, mod_ruid2 is enabled, and a
user has their shell set to jailshell or
noshell, enabling this option will chroot() a
user's Apache Virtual Host into the cPanel®
jailshell environment. Each user will require 14
bind mounts. While modern Linux supports a very
large number of bind mounts, many processes read
/proc/mounts. Reading /proc/mounts can be quite
expensive when it becomes large.
|
|
Signature
validation on assets downloaded from cPanel &
WHM mirrors. [?]
When you select a keyring
type, signatures will be downloaded and verified
against the type of keyring selected. Official
releases are signed with the Release keyring.
The Development keyring is used for test builds
only and is not as safe. All signature
validation will be turned off when you select
the ‘Off’ option.
|
|
Default SSL/TLS Key
Type [?]
The type of key that the
system will create by default for SSL/TLS
certificates and signing requests.
|
|
Generate a self signed SSL certificate if a CA
signed certificate is not available when setting up
new domains. [?]
When you create a new
domain, cPanel will apply the best available
certificate (CA signed); otherwise cPanel will
apply a self-signed SSL certificate and request
a new certificate via AutoSSL if it is enabled.
Warning: If you disable this option, and a CA
signed certificate is not available, when a user
attempts to visit the newly created domain over
https, the user will see the first SSL
certificate installed on that IP address.
Warning: If you enable this option and do not
have a CA signed certificate or AutoSSL enabled,
Google search results may point to the SSL
version of the site with a self-signed
certificate, which will generate warnings in the
users’ browser. To avoid both of these
concerns, we strongly recommend that you enable
AutoSSL.
|
|
Verify
signatures of 3rdparty cPaddons. [?]
When this option is
enabled, cPanel will verify GPG signatures of
all 3rdparty cPaddons. This setting is only
available if Signature Validation is enabled.
|
|
Allow
deprecated WHM accesshash authentication [?]
Allow the use of
~/.accesshash files for authenticating API
calls. This method of authentication has been
deprecated in favor of API Tokens.
|
|
Use X-Frame-Options and
X-Content-Type-Options headers with cpsrvd [?]
Use the X-Frame-Options
HTTP response header to indicate whether a
browser can render a page in a <frame>,
<iframe> or <object> tag. This
allows websites to ensure that their contents
are not embedded into other sites, to avoid
clickjacking attacks. The server uses the
X-Content-Type-Options response HTTP header to
indicate that the MIME types in the Content-Type
headers should not be changed or
followed. When you enable this option, the
system adds the X-Frame-Options header, with a
value of SAMEORIGIN, and the
X-Content-Type-Options header, with a value of
nosniff, to cpsrvd responses.
|
|
Enable strict SSH
host key checking [?]
Require that outgoing SSH
connections made by cPanel & WHM verify the
remote system's key. This setting helps to
protect against man-in-the-middle
attacks. When you enable this setting, every
remote system that is connected to via SSH must
have a valid key in the /etc/ssh/ssh_known_hosts
file. If you set this value to "dns", the
remote system has SSHFP records in a
DNSSEC-signed zone, and the local system uses
EDNS0 resolving, use these records to validate
the remote system. If you set this value to
"dns" but the system does not use SSHFP records
in a DNSSEC-signed zone or does not use ENDS0
resolving, the system will act as though the
option were set to "enabled".
|
|
Display a message to
reboot the server after essential software
updates. [?]
Set this option to Off to
prevent a message that encourages rebooting your
server. Note: Disabling the reboot
warning can cause security concerns to be
unaddressed.
|
|
Enable Content-Security-Policy on
some interfaces [?]
Enable the
Content-Security-Policy header on some
interfaces in WHM. This can help prevent certain
cross-site scripting (XSS) attacks. JavaScript
loaded from external sites will be blocked when
visiting a CSP-enabled interface.
|
|