The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Renaming /cpanel and /whm to something else

Discussion in 'General Discussion' started by bls24, May 6, 2008.

  1. bls24

    bls24 Well-Known Member

    Joined:
    May 12, 2007
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    Is this possible? It would be a lot harder for attempted intrusions to run their scripts and whatnot.
     
  2. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    The scripts wouldn't run on /cpanel and /whm (Apache-based redirections), they would run on cpsrvd (ports 2082, 2083, 2086, 2087 etc.). If you're that worried about it, you could turn on XSRF protection by going to Tweak Settings and checking Only permit cpanel/whm/webmail to execute functions that have a referrer that matches one of the domains/ip on this server. This will help prevent XSRF attacks, but may break integration with other systems, login applications, and billing software.
     
  3. bls24

    bls24 Well-Known Member

    Joined:
    May 12, 2007
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6
    I didn't think any script would run under /cpanel or /whm

    What I meant was thwart the brute attacks, without having to use cphulk. If a hacker can't guess your login directories it would be pretty hard for them to try anything sneaky. :)

    The tweak settings fix, wouldn't this be rendered useless if somebody was to gain access to my /cpanel and simply head to file manager to upload their stuff and then my site is compromised?

    and for the record: I have an extremely long and indecipherable password, I am not worried about anyone guessing it. A hole has to exist in order for cpanel to fix it, who's to say that hole won't be used against /cpanel before a patch is known to cpanel.

    Not trying to be over-paranoid or anything, it's just that with other administrative programs a main suggestion is always to take the default "/admin" folder and rename it to something else.
     
  4. nickp666

    nickp666 Well-Known Member

    Joined:
    Jan 28, 2005
    Messages:
    770
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    /dev/null
    changing the apache aliases wont help you much because they all redirect to fixed ports that wont change, relatively pointless exercise IMO
     
  5. bls24

    bls24 Well-Known Member

    Joined:
    May 12, 2007
    Messages:
    78
    Likes Received:
    0
    Trophy Points:
    6

    That is not something I considered, good point.
    I suppose it is not possible to change the port then?
     
  6. nickp666

    nickp666 Well-Known Member

    Joined:
    Jan 28, 2005
    Messages:
    770
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    /dev/null
    not presently, you could try putting a feature request in but its unlikely that they will change them given the nature of what the ports are used for
     
Loading...

Share This Page