Table of Contents

Restricting cPanel Access to HTTPS

The default way for restricting cPanel or WHM access to HTTPS with Apache requires proxying to a backend via HTTPS. LSWS does not allow this. If you try to redirect traffic through LSWS to cPanel on the backend via HTTPS, you will get 500 errors and entries like the following in your error log: 

[ERROR] [REWRITE] Absolute URL with leading 'http://' is required for proxy, URL: https://127.0.0.1:2083/

Instead, we recommend that you use iptables to block access on the necessary ports. This wiki will take you through the steps for setting this up.

Step 1: Remove HTTPS Proxy Settings

You are going to need to remove the old rules and settings that asked LSWS to proxy to a backend via HTTPS.

Update Your cPanel Templates

Under /var/cpanel/templates/apache2_2/main.default comment out the following rewrite rules: 

RewriteCond %{HTTP_HOST} ^cpanel\.
RewriteCond %{HTTPS} on
RewriteRule ^/(.*) https://127.0.0.1:2083/$1 [P]
RewriteCond %{HTTP_HOST} ^webmail\.
RewriteCond %{HTTPS} on
RewriteRule ^/(.*) https://127.0.0.1:2096/$1 [P]
RewriteCond %{HTTP_HOST} ^whm\.
RewriteCond %{HTTPS} on
RewriteRule ^/(.*) https://127.0.0.1:2087/$1 [P]
RewriteCond %{HTTP_HOST} ^webdisk\.
RewriteCond %{HTTPS} on
RewriteRule ^/(.*) https://127.0.0.1:2078/$1 [P]

Don't Redirect to SSL

In WHM, turn off Always redirect to SSL (WHM Home > Server Configuration > Tweak Settings).

Step 2: Use iptables to Limit Access to HTTPS Ports

If we block off the ports that allow HTTP access to cPanel services, we thus require users to use HTTPS. The following iptables settings will block HTTP access to different cPanel services except from 127.0.0.1 (which is probably safe to allow). Place these rules in /etc/rc.d/rc.local to have them apply automatically every time the server reboots: 

#cPanel is accessed via HTTP through port 2082 
iptables -A INPUT -p tcp --dport 2082 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 2082 -j DROP

#WHM is accessed via HTTP through port 2086 
iptables -A INPUT -p tcp --dport 2086 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 2086 -j DROP

#Webmail is accessed via HTTP through port 2095 
iptables -A INPUT -p tcp --dport 2095 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 2095 -j DROP

#Web Disk is accessed via HTTP through port 2077 
iptables -A INPUT -p tcp --dport 2077 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 2077 -j DROP

Now users will only be able to access cPanel (and other services) via HTTPS.