Change Database Server Name

Naila

Active Member
Jun 20, 2017
26
0
51
Indonesia
cPanel Access Level
Root Administrator
Hi,

Previously I had a server that was hacked, and I saw a lot of mysql hostnames using huffingtonpost.co.za. And now I'm moving it to a 3x new server, but some cpanel accounts still display the huffingtonpost text on cPanel => Server Information (Server Name).

Where can I edit the text? and should delete from mysql ? but i am unable to find them.

MariaDB [(none)]> show variables where Variable_name like '%host%';
+-------------------------------+----------------------+
| Variable_name | Value |
+-------------------------------+----------------------+
| host_cache_size | 643 |
| hostname | server1.unisystemadmin.com |
| performance_schema_hosts_size | -1 |
| report_host | |
+-------------------------------+----------------------+
4 rows in set (0.001 sec)
MariaDB [(none)]> select host from information_schema.processlist;
+-----------+
| host |
+-----------+
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
+-----------+
11 rows in set (0.001 sec)

MariaDB [(none)]>


Screenshot (106).png

I found huffingtonpost.co.za in some file /var/cpanel/databases/

Example from grants_longsuluy.cache grants_longsuluy.yaml

{"MYSQL":{"myuser":{"myuser":["GRANT USAGE ON *.* TO 'myuser'@'202.73.26.218' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'202.73.26.218'","GRANT USAGE ON *.* TO 'myuser'@'huffingtonpost.co.za' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'huffingtonpost.co.za'","GRANT USAGE ON *.* TO 'myuser'@'server1.unisystemadmin.com' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'server1.unisystemadmin.com'","GRANT USAGE ON *.* TO 'myuser'@'localhost' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'localhost'"],"myuser_opensid":["GRANT USAGE ON *.* TO 'myuser_opensid'@'202.73.26.218' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'202.73.26.218'","GRANT USAGE ON *.* TO 'myuser_opensid'@'huffingtonpost.co.za' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'huffingtonpost.co.za'","GRANT USAGE ON *.* TO 'myuser_opensid'@'server1.unisystemadmin.com' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'server1.unisystemadmin.com'","GRANT USAGE ON *.* TO 'myuser_opensid'@'localhost' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'localhost'"]}},"PGSQL":{"myuser":{"myuser":["CREATE USER \"myuser\" WITH PASSWORD E'md5757c20a5114a59170e83bb063f6e0448';"]}}}
Another found

/usr/local/cpanel/Cpanel/iContact.pm: $email_args_hr->{'subject'} =~ s/huffingtonpost.co.za/server1.unisystemadmin.com/g;
/usr/share/cagefs-skeleton/usr/local/cpanel/Cpanel/iContact.pm: $filesys_safe_subject_header =~ s/huffingtonpost.co.za/server1.unisystemadmin.com/g;


I have tried 3 fresh server installation but huffingtonpost.co.za still exist when i migrating cpanel account to new server.
 
Last edited:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
12,497
1,968
363
cPanel Access Level
Root Administrator
While investigating this issue I noticed that the cPanel >> Server Information area only shows the first portion of the hostname. For example, if your hostname is host.domain.com, that interface only shows "host"

I've created case CPANEL-41660 for our team to adjust that to show the entire hostname, so you can watch for that in our changelogs here:

 

Naila

Active Member
Jun 20, 2017
26
0
51
Indonesia
cPanel Access Level
Root Administrator
Since I'm in the stage of becoming a system admin, I want to learn how to solve it, relying on support tickets only for instant will not increase my knowledge. I'm relying on clues from here.

I did a search with grep and find found huffingtonpost.co.za on the following mysql file. Even though I'm migrating to a new server huffingtonpost.co.za always shows up after some accounts I've migrated.

/var/lib/mysql/mysql/db.MAD
/var/lib/mysql/mysql/db.MAI
/var/lib/mysql/mysql/global_priv.MAD
/usr/share/cagefs-skeleton/var/lib/mysql/mysql/db.MAD
/usr/share/cagefs-skeleton/var/lib/mysql/mysql/db.MAI
/usr/share/cagefs-skeleton/var/lib/mysql/mysql/global_priv.MAD

I don't know where I can edit the above files, because I changed via database root but their text domains still show up in the files. And it always appears in /usr/local/cpanel/Cpanel/iContact.pm

Note: The Server Name "huffingtonpost" only apper when using jupiter themes, swicth to themes paper_lantern Server Name showing correct hostname.
 
Last edited:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
12,497
1,968
363
cPanel Access Level
Root Administrator
The issue isn't with the database. While there may be entries for that hostname in the database as well, cPanel doesn't use any MySQL data to pull information for the interface. That's why I mentioned creating a ticket, as something seems to be actually wrong with cPanel itself. It's not that we don't want to help through the Forum, but when you stumble across something new we just may not have enough detail to guide you without examining it ourselves.

For the entries you found, I have two thoughts. The first, is that you can never directly edit data inside /usr/share/cagefs. More details on the function of CageFS can be found here:


The first three entries you found are actual databases, which you wouldn't be able to edit directly. You can use the PHPMyAdmin tool at the WHM level to search the records on the server and then edit or remove the entries accordingly.