1

I have recently set up a managed VPS and it came per-installed with CentOs and WHM.

I have configured SSH logins to use private keys and i can SSH into the server with root privileges.

I realize that i lack a great deal of knowledge on how to look after a server properly but at the moment i can not afford a professional. And as such my approach might be extremely foolish and if so i would be grateful for any advice.

Here is what has been troubling me: I can access WHM panel as well as cpanel over HTTP but so can anyone if they tried (hackers and bots) and try to brute force into the backend. Now i was thinking whether it is advisable to block the ports used by WHM on the server to disable the web login, through SSH. And when i need to use the WHM backend i can first log in to my VPS through SSH and unblock the ports.

q1: Can such an arrangement ever result in me being locked out of my server?

q2: Will this provide any real security?

q3: Is this an overkill?

AS i said i am total beginner when it comes to server security and i am probably approaching the issue the wrong way. Any advice or link to a related resource will be much appreciated.

1

Q1: As far as you only block the panel ports (you are not filtering the ssh port by error, for instance). As far as you still can ssh in, and don't forget how to and reenable the panel, it shouldn't lock you out of the panel.

Q2 & Q3: You are reducing the exposure surface, so yes you will improve your security. If everything works as it should, you won't ever need it. But things don't always work that way :)

There's another step you can take for limiting the access to cPanel. ssh supports tunneling connections, so you can make WHM/cPanel available only on the loopback device (127.0.0.1), in this way it can only be reached from the machine, and when needing to access, you would connect to the box with a ssh tunnel, and point your browser to the port at your machine where you "redirected" the server port (details on how to perform the ssh tunnel vary depending on your ssh client).

PS: Remember that even if you are logging in with, root can still log in with its -hopefully secure- password unless PermitRootLogin is set to without-passwordin sshd config.

1
  • SSH Tunneling is the way to go. OP shouldn't connect to those services over HTTP anyway. SSH Tunneling will reduce the attack surface and protect against sniffing. – amccormack Mar 11 '15 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.