Skip to content

cPanel WHM Course

WHM SETUP - Basic server setup field changes apply to file "/etc/wwwacct.conf"

  • /etc/localaliases: Updates the email address for root, defining where mail sent to the root account should be directed to.

Apache conf

  • /etc/apache2/conf/httpd.conf

  • Root system email forwarder file /var/cpanel/userhomes/cpanel/.forward /root/.forward

  • Process based monitoring

  • tailwatchd will check if the command is in ps output

Conection based monitoring

  • It checks if it can connect to specified port
  • in /etc/chkserv.d/ run grep -Ri -E 'QUIT,|220' to check services with this type of monitoring

Authentication-based check

  • Location folder - /var/cpanel/serviceauth

find -name 'recv'

./dnsadmin/recv ./cpsrvd/recv ./cpdavd/recv ./icontact/recv ./imap/recv ./exim/recv

SOCKET BASED

find -name 'port'
./cpsrvd/port

List of Built in monitored Services

  • Apache - connection based
  • PHP-FPM - Process based and Connection based
  • FTP server - Process - Connection and Authenticationb based
  • cPanel DAV Daemon - Process based - Authentication-based
  • DNS server Process BASED

Feature files

/var/cpanel/features/

Packages file

ls /var/cpanel/packages/

ls /var/cpanel/resellers

ls /var/cpanel/users/

cPanel Interface

Global Email Filters

/home/$user/.cpanel/filter.yaml

Forwarders file

/etc/valiasess/$domain

Email Filters

/home/$user/etc/$domain/$emailuser/filter.yaml

/home/$user/etc/$domain/$emailuser/filter

Autoresponders

/home/$user/.autorespond/$emailuser\@$domain

/home/$user/.autoresponse/$emailuser\@$domain.json

Character Set - utf-8
Interval - 3600 (1 hour)
Email - susie (the email user it is sending FROM)
Domain - @mcgowanmedia.xyz (the domain it is sending from)
From - The "name" of the user sending
Subject - The subject line of the email sent
Body - The full body of the email.

Spam Filters

file - /home/$cpaneluser/.spamassassinenable

score threshhold /home/$user/.spamassassin/user_prefs

Databases

file for database permissions/grants /var/cpanel/databases/grants_$user.yaml You can perform both of these with commands in the CLI as well!

mysqlcheck mcgowanm_test

mysqlcheck --repair mcgowanm_test

MysQL/MariaDB Configuraitons

  • Check my.cnf file for issues /usr/local/cpanel/scripts/check_users_my_cnf

  • Backup all databases mysqldump --opt -AER | gzip > /root/alldatabases.sql.gz

-A, --all-databases Dump all the databases. This will be same as --databases -E, --events Dump events. -R, --routines Dump stored routines (functions and procedures)

  • Stop MySQL /scripts/restartsrv_mysql --stop

MyISAM files are portable, while InnoDB files are not.

Logs

https://mariadb.com/kb/en/slow-query-log-overview/ slow_query_log_file slow_query_log = 1 log-slow-queries = /var/log/mysql-slow.log long_query_time = 2

Database mapping

  • info is stored in /var/cpanel/databases/

  • View Json files python -m json.tool vladmincp.json

MySQL Profiles

Database Access & Grants

  • Show all variables SHOW VARIABLES; SHOW VARIABLES LIKE '%char%';

  • Semicolon prints results in a table when \G prints statements line by line `SHOW VARIABLES LIKE '%char%' \G'

  • Wildcars % show databases like "mysql%";

  • Limit output of rows LIMIT 5

select option_name from fWyzp1V9_options LIMIT 5;

  • Where statements

SELECT last_name FROM employees WHERE last_name LIKE “A%”;

Restoring MySQL root user privileges

WHM >> MySQL Root Password? This will attempt a reset of the MySQL root user password on the system, and may be enough to get that resolved for you. If, it is not resolved try the below steps too.
Stop the MySQL server.
Start the MySQL server with the --skip-grant-tables option.
Log into MySQL without a password.
Update the root password using SQL commands.
Restart the MySQL server normally

Error log files

cat /var/lib/mysql/10-2-70-173.cprapid.com.err
  • Check mysql databases for errors
mysqlcheck wp_db_name

InnoDB repair

  • Backup data from /var/lib/mysql and all tables 
    mysql < mysql/animals_fish.create 
mysql < mysql.sql
mysql -u animals -p animals_fish < mysql/animals_fish.sql

PHP FPM

cat /opt/cpanel/ea-php81/root/etc/php-fpm.conf
  • php-fpm error log /opt/cpanel/ea-php81/root/usr/var/log/php-fpm/error.log

Domain PHP FPM FILES

opt/cpanel/ea-php81/root/etc/php-fpm.d/

Named and DNS WHM/cPanel

  • in most cases pdns is using named config files but named is not active so rndc.key and rndc.conf wont work

Options

  • instruct bind to send queries over port 53 or another 
query-source address 1.2.3.4 port 53;

DOCS

  • Common directories for named files
cat /etc/named.conf | grep directory
    // Put files that named is allowed to write in the data/ directory:
    directory                "/var/named"; // the default
root@10-2-32-93 ~$ cat /etc/named.conf | grep pid-file
    pid-file                 "/var/run/named/named.pid";
  • Recursion

  • allow-transfer { "none"; }; - Protection against ddos not allowing zone transfer

  • Matchlists DOCS

Match Recursion

  • Zone Types

DOCS

Quiz

What BIND/named considers "local" is defined by an address match list that is referenced by the name localnets

External View

  • External Zone

  • Differences are 

    recursion no;
additional-from-cache no;

  • It doesn't use recursion nor dns cache

DNS Filesystem, Scripts, and Tools

  • Application Paths
/etc/nsswitch.conf 
A list of the files and services that are responsible for various types of DNS lookups.

Severity Levewls

  • name.conf versions parameter means how many log files can exist

  • Example: 

    logging {
23:        channel default_log {
24-                file "/var/log/named/named.log" versions 5 size 128M;
25-                print-time yes;

  • Enabling debugging mode by changin the severity type

  • Default - severity warning;
  • Changing to debug severity debug;
sed -i s/warning/debug/ /etc/named.conf

Named logging categories

- guess, this presentation should answer your question:

- categories define what should be written to the logs

- channel define where the log data should be written

- multiple categories can be written into the same channel

  • one category can be written to multiple channels

spam email

  • Criteria used to mark email as spam 
    Header
Subject Line
Sender Information
Recipient Information
Links and URLs
Attachments
Keywords and Phrases
Formatting
Metadata
Reputation of Sender Domain/IP
Authentication (SPF, DKIM, DMARC)
Behavior and Sending Patterns
Image-to-Text Ratio
Previous Engagement History
Blacklist/Whitelist Status
Spam Triggers and Flags

```Hey team. I have a client to which I suggested using 360 monitoring as he has issues with the server, but the plugin is not initializing . I removed all .ini files .360monitoring folder as well reinstalled cpanel-monitoring-plugin and cpanel-monitoring-agent-plugin but without any change. As error this is all I get

/scripts/initialize_360monitoring info [initialize_360monitoring] Initializing the server. warn [initialize_360monitoring] The 360 Monitoring cannot be setup in this server. Since last update it seems to be unable to initialize . The log entry is this info [post_snapshot] server_monitoring - Running plugin task /var/cpanel/snapshot_prep.d/whm.server-monitoring.json post stage [2025-03-21 13:21:07 +0000] info [post_snapshot] + /usr/local/cpanel/scripts/initialize_360monitoring ```