The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

User has access to ALL accounts of server

Discussion in 'General Discussion' started by ruber, Feb 26, 2008.

  1. ruber

    ruber Member

    Joined:
    Jun 5, 2007
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151
    An user of my server, when it access cPanel, opens the "root" cPanel, with all features and the list to choose any account of the server. I had tested other accounts, but happens only with this customer. What can I do to solve this? It's a critical security hole on my cPanel, I changed the customer's password to avoid the access until I can fix this...
     
    #1 ruber, Feb 26, 2008
  2. BianchiDude

    BianchiDude Well-Known Member
    PartnerNOC

    Joined:
    Jul 2, 2005
    Messages:
    619
    Likes Received:
    0
    Trophy Points:
    166
    Do they have UID 0? Is there password the same as your root pass?
     
    #2 BianchiDude, Feb 26, 2008
  3. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    15,445
    Likes Received:
    285
    Trophy Points:
    433
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Sounds like you made the account a master reseller.
     
    #3 Infopro, Feb 26, 2008
  4. cPanelKenneth

    cPanelKenneth cPanel Development
    Staff Member

    Joined:
    Apr 7, 2006
    Messages:
    4,486
    Likes Received:
    29
    Trophy Points:
    308
    cPanel Access Level:
    Root Administrator
    If you changed the password and that disabled the behavior, then it sounds like his password was the same as the root password. If that is the case, then the following tweak setting is what is causing this:


    Disable login with root or reseller password into the users' cPanel interface. Also disable switch account dropdown in themes with switch account feature.


    Otherwise it may be as Infopro stated.
     
    #4 cPanelKenneth, Feb 27, 2008
  5. ruber

    ruber Member

    Joined:
    Jun 5, 2007
    Messages:
    22
    Likes Received:
    0
    Trophy Points:
    151

    No, no...

    I changed the password until this is solved, and the customer is not accessing his account until I change the password back and tell him. The accounts still appears, even with other password. I changed the password of another account to the same of that, and cPanel works fine, accessing only its account, not any other.

    The problem occours only in ONE account, even changing password, recreating the account... How I can see this "Master Reseller" option? This account isn't a reseller.
     
    #5 ruber, Feb 28, 2008
  6. cPanelKenneth

    cPanelKenneth cPanel Development
    Staff Member

    Joined:
    Apr 7, 2006
    Messages:
    4,486
    Likes Received:
    29
    Trophy Points:
    308
    cPanel Access Level:
    Root Administrator
    What is the UID of this user?
     
    #6 cPanelKenneth, Feb 29, 2008
(You must log in or sign up to post here.)
Loading...
Similar Threads - User access accounts
  1. EneTar

    Custom non user accessible php.ini for some accounts suPHP

    EneTar, Dec 19, 2015, in forum: Security
    Replies:
    12
    Views:
    906
    EneTar
    Dec 26, 2015
  2. Googolicous

    Access multiple user directories from 1 SSH user without root permissions

    Googolicous, Jun 2, 2017, in forum: CloudLinux
    Replies:
    1
    Views:
    86
    cPanelMichael
    Jun 2, 2017
  3. Terry Bogard

    Mysql error : Access denied for user '[cpaneluser]'@'localhost' (using password: NO)

    Terry Bogard, May 8, 2017, in forum: Database Discussions
    Replies:
    1
    Views:
    197
    cPanelMichael
    May 9, 2017
  4. qtriangle

    Connecting to external MySQL db: "ERROR 1045 (28000): Access denied for user"

    qtriangle, Feb 26, 2017, in forum: Database Discussions
    Replies:
    5
    Views:
    627
    cPanelMichael
    Feb 28, 2017
  5. SSy

    Access denied for user 'leechprotect'@'localhost' (using password: YES)

    SSy, Feb 21, 2017, in forum: General Discussion
    Replies:
    3
    Views:
    396
    hbouma
    May 21, 2017

Share This Page