Host Access Control - Proxy Subdomains Bypass

[mbd5882]

Hello,

I'm trying to block WHM access to our company network only. I created a Host Access Control rules as below.

whostmgrd OFFICEIP allow # Allow office staff access
whostmgrd LOCAL allow # Allow local API requests
whostmgrd ALL DENY # Deny all others access

This worked fine and all other IP addresses attempting to access WHM through ports 2086 and 2087 were given a forbidden message.

However, WHM can still be accessed through the cPanel proxy subdomains as whm.customerdomain.tld as this is through Apache.

How can I block WHM access through the proxy subdomains also? Is my only solution to disable the proxy subdomains?

I appreciate any help on this issue.

Regards,
Asad Haider

 

[cPanelTristan]

Hello Asad,

That's a really good question that I've never realized that it was the case. I would have thought the wrapper itself for whostmgrd process couldn't be bypassed by proxy subdomains, but I've just tested this on my machine where I did a deny just for my IP for whostmgrd and whm.mydomain.com bypassed the restriction.

The only way I could see around this issue would be to only allow WHM on a dedicated IP that you aren't using for anything else, then to only allow that proxy subdomain for whm on that dedicated IP. At that point, you could restrict all port traffic to that IP to only the allowed IPs.

Alternatively, you could remove the whm proxy subdomain entirely and only have the others.

Thanks!

 

[mbd5882]

Hi Tristan,

Sorry about the two threads, all our staff have access to this account so I should have posted it under here.

Thanks for looking into it, I thought you would be aware of the issue already. I came across it accidentally while testing if the blocking was working and couldn't find a fix or similar reported issue on the forums.

I guess I'll disable proxy subdomains for now to prevent access. We'll take a look into running it on a dedicated IP address and blocking it that way.

Would you guys be looking into this further? or letting people know about it?

Thanks,
Asad

 

[cPanelTristan]

Hello Asad,

I'm going to go through our internal reports to see if anything is mentioned about it and then inquire about the issue. It isn't necessarily a bug, but it might well be something needing documented on our site if it hasn't been.

Since I was not aware of it, I'd imagine many others aren't aware of it either. There's no warning in either the proxy subdomains tweak setting nor in Host Access Control about these bypassing the restrictions.

Thanks!