Reserved, Invalid, and Misconfigured Usernames

Overview

This document explains cPanel & WHM’s username restrictions and what to do if you encounter an invalid, reserved, or misconfigured username.

Basic restrictions

cPanel & WHM applies the following rules when you create or modify a cPanel or WHM username:

Usernames may only use lower letters (a–z) and digits (0–9).

  • Usernames cannot contain more than 16 characters.
  • Usernames cannot begin with a digit (0–9) or the string test.
  • Usernames cannot end with the string assword.

Special cases

  • You cannot create a username with the hyphen character (-), but you can change an account’s name to use a hyphen when you transfer that account to another system.
  • To allow usernames over eight characters in length, set the LONGUSERS: 1 environment variable in the /var/cpanel/whm/nvdata/root.yaml file.
  • If you plan to use MySQL® or PostgreSQL® as a database engine, the first eight characters must be unique on the system.
    Note:

    You can disable database prefixing with the Add prefix to names of new databases and database users option in the SQL section of WHM’s Tweak Settings interface (WHM >> Home >> Server Configuration >> Tweak Settings).

  • To allow leading digits in a username, create the /etc/allowstupidstuff touch file.

Reserved usernames

Important:
During TSR-2017-0006, we expanded the list of reserved usernames to include email aliases listed in the /etc/aliases and /etc/localaliases files. The system will also reserve usernames that are aliased to a reserved username.

cPanel & WHM reserves some usernames for the system’s use, and you cannot use them for cPanel or WHM accounts. This list of reserved usernames can grow over time, and new versions of cPanel & WHM may add to this list.

cPanel & WHM checks the following files to determine whether to reserve or restrict a username or alias:

  • /usr/local/cpanel/Cpanel/Validate/Username/Core.pm
  • /etc/aliases
  • /etc/localaliases

Reserved aliases

By default, the system reserves the following list of aliases:

Username Alias
root abuse, adm, amandabackup, apache, bin, canna, daemon, dbus, decode, desktop, dovecot, dumper, fax, ftp, games, gdm, gopher, halt, hostmaster, ident, ingres, ldap, lp, mail, mailnull, manager, mysql, named, netdump, news, nfsnobody, nobody, noc, nscd, ntp, nut, operator, pcap, postfix, postgres, postmaster, privoxy, pvm, quagga, radiusd, radvd, root, rpc, rpcuser, rpm, security, shutdown, smmsp, squid, sshd, sync, system, toor, uucp, vcsa, webalizer, webmaster, wnn, xfs
postmaster info, mailer-daemon, marketing, sales, support
news newsadm, newsadmin, usenet
ftp ftp-adm, ftp-admin, ftpadm, ftpadmin
webmaster www

Resolve problems

To resolve issues with invalid, reserved, or restricted usernames or aliases, perform run the following command as the root user to rename the account: 

whmapi1 modifyacct user=username newuser=newusername
Note:

In this example, username represents the current (restricted) username, and newusername represents the new username that you wish to assign to the account.

Remove username aliases

You can also remove reserved aliases from the /etc/aliases and /etc/localaliases files.

Misconfigured usernames

Misconfigured usernames do not possess some information or exist in an incomplete state. To fix a misconfigured username, run the following command as the root user: 

/usr/local/cpanel/scripts/updateuserdomains --force