Last modified: May 18, 2022

Overview

This document outlines some of the best practices that you can follow to avoid email abuse on your cPanel & WHM server.

Password Strength Configuration

If you increase the minimum password strength for your users’ mail accounts, you can decrease the chance that a hacker will correctly guess their passwords.

To define minimum password strength for all of your users’ authenticated features, use WHM’s Password Strength Configuration interface (WHM » Home » Security Center » Password Strength Configuration).

Enable cPHulk

cPHulk provides protection for your server against brute force attacks (a hacking method that uses an automated system to guess passwords). If you enable cPHulk, you can decrease the chance that a hacker can use a brute force attack to gain access to your server’s mail accounts.

To enable this feature, navigate to WHM’s cPHulk Brute Force Protection interface (WHM » Home » Security Center » cPHulk Brute Force Protection) and click Off to toggle the feature’s status.

Enable Greylisting

Greylisting is a service that protects your server against unwanted email or spam. When enabled, the mail server will temporarily reject any email from a sender that the server does not recognize. If the email is legitimate, the originating server tries to send it again after a delay. After sufficient time passes, the server accepts the email.

To enable this feature, navigate to WHM’s Greylisting interface (WHM » Home » Email » Greylisting) and click Off to toggle the feature’s status.

SMTP restrictions

If you enable the SMTP Restrictions feature, spammers cannot directly interact with remote mail servers or work around mail security settings.

• This feature restricts outgoing email connection attempts to the mail transfer agent (MTA), the mailman system user, and the root user.

• This feature forces both scripts and users to use Exim’s sendmail binary, which helps to prevent direct access to the socket.

To enable this feature, navigate to WHM’s SMTP Restrictions interface (WHM » Home » Security Center » SMTP Restrictions) and click Enable.

Exim Configuration Manager

WHM’s Exim Configuration Manager interface (WHM » Home » Service Configuration » Exim Configuration Manager) provides a large number of spam and abuse prevention options.

We strongly recommend that you read the Exim Configuration Manager documentation for each option in that interface.

Tweak Settings

The following settings in the Mail section of WHM’s Tweak Settings interface (WHM » Home » Server Configuration » Tweak Settings) can help to prevent email abuse:

Max hourly emails per domain

This setting specifies the maximum number of emails that each domain can send per hour.

This setting defaults to Unlimited.

Account specific Max hourly emails per domain settings

Use WHM’s Edit a Package interface (WHM » Home » Packages » Edit a Package) or WHM’s Modify an Account interface (WHM » Home » Account Functions » Modify an Account) to specify values for an individual package or an individual account.

To enable this setting from the command line, you must perform the following steps to manually edit the cpuser file:

1. From the command line, open the /var/cpanel/users/username file, where username represents the desired account username.

2. In this file, add the MAX_EMAIL_PER_HOUR key and specify the value for the selected username:

   MAX_EMAIL_PER_HOUR=500

3. Run the /usr/local/cpanel/scripts/updateuserdomains script.

Prevent nobody from sending mail

This setting denies the nobody user the ability to send mail to a remote address.

The setting defaults to On.

The percentage of email messages above the account hourly maximum to queue and retry for delivery

This setting specifies whether to queue outgoing messages for later delivery after a domain reaches its limit for outgoing messages per hour.

For example, with the default value of 125%, after the domain reaches its hourly limit Exim queues any additional messages, up to 125% of the Max hourly emails per domain value. After the account reaches 125% of the Max hourly emails per domain value, any additional outgoing messages will fail.

This setting defaults to 125%.

Maximum percentage of failed or deferred messages a domain may send per hour

This setting allows you to specify a maximum percentage of failed or deferred messages that your domain may send per hour. Your server temporarily blocks outgoing mail from a domain if both of the following conditions are true:

• The percentage of failed or deferred messages, out of the total number of sent messages, is equal to or greater than the specified percentage.

• The domain has sent at least the number of failed or deferred messages that the Number of failed or deferred messages a domain may send before protections can be triggered setting specifies.

The system examines all outgoing and local mail over the previous hour to determine whether these conditions are true. If only one of these conditions is true, the system does not block outgoing mail.

For more information, read our Mail Limiting Features documentation.

This setting defaults to Unlimited.

Initial default/catch-all forwarder destination

This setting specifies the initial forwarding destination for new accounts’ default (catch-all) email addresses. The cPanel account default address handles email that nonexistent users on your server’s domains receive.

This setting changes the default setting for newly-created accounts. To change this setting for an existing account, perform the following steps:

1. Log in to the desired cPanel account or use WHM’s List Accounts interface (WHM » Home » Account Information » List Accounts) to access it.

2. Navigate to cPanel’s Default Address interface (cPanel » Home » Email » Default Address).

3. From the Send all unrouted email for the following domain menu, select the domain for which you wish to set a default address.

4. Select the Discard the email while your server processes it by SMTP time with an error message setting. This setting will send an error message to the sender.

5. Enter an error message in the Failure Message (seen by sender) text box.

6. Click Change.

PHP configuration

If you configure PHP with suEXEC, ModRuid2, or suPHP, you can see which users run which processes on the system. The ModRuid2, suEXEC, and suPHP PHP modules force CGI and PHP processes to run as the cPanel account user.

If these processes create email messages, the system sends them as the cPanel user instead of as the nobody user. This makes it easier to track if a compromised account is sending spam.

EXPERIMENTAL Rewrite From header to match actual sender

Any local cPanel user can use the 127.0.0.1 IP address to send mail without authentication. This can make it difficult for system administrators to determine which cPanel account sent the mail, especially when a malicious user spoofs an email address to disguise the origin of the email.

To require cPanel & WHM to put the actual sender in the header, enable the Experimental: Rewrite From: header to match actual sender option in WHM’s Exim Configuration Manager interface (WHM » Home » Service Configuration » Exim Configuration Manager).

After you enable this feature, you will see output that is similar to the following in the /var/log/exim_mainlog file:

2014-04-23 08:09:52 1Wcwvu-0000On-Sb From: header (rewritten was: [[email protected]], actual sender is not the same system user) original=[[email protected]] actual_sender=[[email protected]]

The actual_sender portion of the log entry shows that spammer is the cPanel account that sent the email. This information allows the system administrator to take action against the account to prevent additional spam.