SECURITY ALERT: Full-access API token “InstallHostnameSSL” created for root

thai tu

• March 10, 2026 15:23

Hello,

Today i received this email from my server (email header is send from my server's IP)

I check the API section in WHM but don't see any API name InstallHostnameSSL.

What is this, please help me.

 

• 

  quietFinn

  • March 10, 2026 16:09
  • Edited

  Apparently that Api token was greated but lated revoked.

  if you do:
  grep -i "InstallHostnameSSL" /usr/local/cpanel/logs/api_tokens_log

  you see if it's ever used.

  And if you didn't do it already, change the root password.

   

  0
• 

  thai tu

  • March 10, 2026 16:36

  Hello quietFinn,

  Thank you for your reply. 

  The log have multiple lines look like this:

  [2026-03-02 10:36:15 +0700] info [whostmgrd] Host: ['127.0.0.1'] HTTP Status: ['200'], User: ['root'], Token Name: ['InstallHostnameSSL'], Request: ['GET /json-api/install_service_ssl_certificate?api.version=1&service=exim&crt=-----BEGIN+CERTIFICATE-----%0AMIIE%2FjCCA%2......

  Last use is from last week. Is this normal?

  I also change my root password.

  Thank you.

  0
• 

  cPRex Jurassic Moderator

  • March 11, 2026 15:02

  It's definitely odd that there was a token created that you aren't aware of, as that should be a red flag for any server admin.

  However, it seems it was only used to install an SSL certificate on the hostname of the machine, based on the URL being used.

  I would do two things:

  -check WHM >> Manage Service SSL Certificates to make sure everything on that page looks normal
  and
  -check /var/log/secure and /usr/local/cpanel/logs/access_log to ensure there wasn't any unauthorized access to the server

  0

Please sign in to leave a comment.