Grant cPanel Support Access adds IPv6 records into /etc/hosts.allow incorrectly

Symptoms

After authorizing cPanel support to access a server, cPanel support is unable to access as a /etc/hosts.allow entry was added with the following:

CONFIG_TEXT: sshd : 208.74.123.98 , 35.161.131.175 , 184.94.197.2 , 184.94.197.3 , 184.94.197.4 , 184.94.197.5 , 184.94.197.6 , 23.111.175.214 , 157.90.174.91 , 104.30.179.199 , 104.30.174.141 , 2a09:bac0:1001:68e::/64 , 2a09:bac0:1000:16c2::/64 : ALLOW

Cause

The IPv6 records are added without being wrapped in square brackets, leading to the connection bring rejected.

We have opened an internal case with our developers with case ID CPANEL-55544 to review this behavior further.

Resolution

Either remove the IPv6 records from the /etc/hosts.allow, or wrap the IPV6 records in Square brackets, as so:

CONFIG_TEXT: sshd : 208.74.123.98 , 35.161.131.175 , 184.94.197.2 , 184.94.197.3 , 184.94.197.4 , 184.94.197.5 , 184.94.197.6 , 23.111.175.214 , 157.90.174.91 , 104.30.179.199 , 104.30.174.141 , [2a09:bac0:1001:68e::/64] , [2a09:bac0:1000:16c2::/64] : ALLOW

The perl command here will perform this action:

# perl -i.bak -pe 's{(?<![\[\w:])([0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4}){2,7}(?:/\d{1,3})?)(?!\])}{[$1]}g' /etc/hosts.allow