Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Minimal permissions for managing CSF through API token

Discussion in 'cPanel Developers' started by Miguel G, Mar 2, 2018.

Tags:
  1. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    I am setting up an API token for accessing CSF and run this command:

    https://server:2087/cgi/configserver/csf.cgi?action=kill&ip=XXX.XXX.XXX.XXX

    If I give full permissions it works fine, but If I try to edit permissions and use minimal permissions just to access CSF and not other commands I get an error.

    I have set up the following:

    [x] Third Party ServicesAdditional Software
    [x] ConfigServer Security & Firewall (Reseller UI) software-ConfigServer-csf

    But It doesn´t work. I have tried to enable/disable other permissions but no luck.
     
    #1 Miguel G, Mar 2, 2018
  2. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Could you elaborate on how you are attempting to utilize the API token? Keep in mind that per our documentation, you can currently only use API tokens with the following features:
    • WHM API functions.
    • DNS Clusters.
    • Configuration Clusters.
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Mar 6, 2018
  3. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    Not sure I understand what you mean.

    I am trying to unblock an IP in CSF. As I said with full permissions I am able to do that.
     
    #3 Miguel G, Mar 6, 2018
  4. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    For instance, how are you authenticating with the API token? Are you using a web browser? What error message do you receive?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelMichael, Mar 6, 2018
  5. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    #5 Miguel G, Mar 6, 2018
  6. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    If you are logging in as a reseller to access CSF, you must first authorize the reseller user via the following option as "root" in "WHM >> ConfigServer Security & Firewall":

    CSF >> cPanel Resellers >> Edit Reseller Privs

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 cPanelMichael, Mar 6, 2018
  7. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    I´m not giving permissions to any reseller. I just create an API token in "Manage API tokens" and use with root as in PHP

    $api = curl_init();
    curl_setopt($api, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($api, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($api, CURLOPT_HEADER, 0);
    curl_setopt($api, CURLOPT_RETURNTRANSFER, 1);
    $auth[0] = "Authorization: WHM root:$token";
    curl_setopt($api, CURLOPT_HTTPHEADER, $auth);

    Thanks!
     
    #7 Miguel G, Mar 6, 2018
  8. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    I believe this is a limitation of the CSF application itself. For instance, I was able to get it working by authorizing "root" via the following option in "WHM >> ConfigServer Security & Firewall":

    CSF >> cPanel Resellers >> Edit Reseller Privs

    EX:

    Code:
    root:1:USE,UNBLOCK


    I recommend reporting this to ConfigServer directly:

    Report Bugs (csf) - ConfigServer Community Forum

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 cPanelMichael, Mar 6, 2018
  9. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    Thanks! I am going to report it as a bug, but I still I don´t get the same message reporting the IP has been unblocked. I get no message!
     
    #9 Miguel G, Mar 6, 2018
  10. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    Is there any way to create an API token for a simple account? I am thinking of creating a separate user for unblocking IPs
     
    #10 Miguel G, Mar 14, 2018
  11. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    You could create a new cPanel user and make it a reseller. You'd then access WHM as the reseller user and browse to "WHM Home » Development » Manage API Tokens" to create a separate API token for the reseller. There's a feature request here you may also want to vote for:

    root to be able to manage all user's tokens with api_token functions

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #11 cPanelMichael, Mar 14, 2018
  12. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    Thanks for your reply! But if that account credentials are taken, new accounts could be created by the bad guys, couldn´t they?

    Is it possible to create a reseller account with minimum permissions?
     
    #12 Miguel G, Mar 14, 2018
  13. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #13 cPanelMichael, Mar 14, 2018
  14. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    I haven´t upgraded to version 70 yet, I´m at 68 right now. Can I still do this?
     
    #14 Miguel G, Mar 14, 2018
  15. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Yes, the same feature is available in cPanel version 68.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #15 cPanelMichael, Mar 14, 2018
  16. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    #16 Miguel G, Mar 16, 2018
  17. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello Miguel,

    Please keep in mind that we currently only support the use of API tokens with the following features:
    • WHM API functions.
    • DNS Clusters.
    • Configuration Clusters
    This is documented at:

    Manage API Tokens - Version 70 Documentation - cPanel Documentation

    The URL you are using in your custom script is not a cPanel or WHM API function. For instance, notice in the example script the URL is:

    Code:
    https://127.0.0.1:2087/json-api/listaccts?api.version=1
    In particular, note the use of "json-api/listaccts?api.version=1", as that's indicating the use of a WHM API 1 function. In your custom script, you use the following:

    Code:
    https://127.0.0.1:2087/cgi/configserver/csf.cgi?action=kill&ip=XXX.XXX.XXX.XXX
    Notice how your link is just a direct link that you would use in a web browser as opposed to an actual WHM API 1 function. While this is technically possible with CGI scripts when the application is registered as a plugin with the AppConfig system, it's up to the third-party developer to verify their specific application supports usage in this manner. As I understand, CSF is only guaranteed to work via the normal access to Web Host Manager in a browser per their quote in that thread:

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #17 cPanelMichael, Mar 16, 2018
  18. Miguel G

    Miguel G Well-Known Member

    Joined:
    Jun 4, 2015
    Messages:
    85
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    Spain
    cPanel Access Level:
    Root Administrator
    Twitter:
    So, as a WHM API function, is there any way to accomplish this?
     
    #18 Miguel G, Jul 20, 2018
  19. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    45,183
    Likes Received:
    1,935
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    No, we don't provide any direct WHM API 1 functions to manage CSF because CSF is not a feature of cPanel & WHM. It's a third-party application and thus would require it's own separate API. Additionally, note the following quote from CSF on this forum post:

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #19 cPanelMichael, Jul 23, 2018
(You must log in or sign up to post here.)
Loading...
Similar Threads - Minimal permissions managing
  1. Nicola Urbinati

    File permissions problems

    Nicola Urbinati, Nov 6, 2018, in forum: General Discussion
    Replies:
    5
    Views:
    91
    cPanelMichael
    Nov 9, 2018 at 11:18 AM
  2. durangod

    Tar archive with clamav and cpaneldemo permissions

    durangod, Oct 21, 2018, in forum: Security
    Replies:
    1
    Views:
    88
    cPanelLauren
    Oct 23, 2018
  3. jndawson

    After update to EA4, permissions error

    jndawson, Oct 19, 2018, in forum: EasyApache
    Replies:
    1
    Views:
    92
    cPanelLauren
    Oct 23, 2018
  4. Andee

    Permissions on files links not working

    Andee, Sep 29, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    76
    cPanelLauren
    Oct 5, 2018
  5. CanadaGuy

    Zone Ownership and API Permissions

    CanadaGuy, Sep 28, 2018, in forum: cPanel Developers
    Replies:
    6
    Views:
    136
    CanadaGuy
    Oct 9, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice