cPanel Users can "cd .." to the server root..

Suleiman Boutzamat

• August 10, 2016 13:46

I have a fresh cPanel / WHM dedicated server with root previliges. I have created a normal cPanel account for my first client - No reseller, just a normal account. To test security, i tried to "ssh cpaneluser@clientdomain.tld" and entered the accounts password, and logged in successfully, showing the users home directory. But i then tried the "cd .." command a couple of times with no limitations until i reached the servers root folder. Very critical issue, i hope someone knows the answer.

• 

  Suleiman Boutzamat

  • August 10, 2016 19:02

  I think i found the solution. Under "Manage Shell Access", the permissions was set to "Normal". I changed it to "Jailed". I am still able to go to the root folder, but now i can't "ls" the content, which is okay. Is it possible to limit to the initial folder?

  0
• 

  Infopro

  • August 10, 2016 19:20

  You might do better to select "Disabled Shell" instead. I would think most Hosting Providers wouldn't want to provide shell access at all unless the customer had a specific need for it to be enabled.

  0
• 

  Suleiman Boutzamat

  • August 10, 2016 19:22

  Good and secure advice. Thank you.

  0
• 

  Infopro

  • August 10, 2016 19:23

  Happy to help. :)

  0

Please sign in to leave a comment.