{"id":644,"date":"2021-07-23T12:34:41","date_gmt":"2021-07-23T12:34:41","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/best-practices-for-cpanel-virtualization-templates\/"},"modified":"2021-07-23T12:34:41","modified_gmt":"2021-07-23T12:34:41","slug":"best-practices-for-cpanel-virtualization-templates","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/best-practices-for-cpanel-virtualization-templates\/","title":{"rendered":"Best Practices for cPanel Virtualization Templates"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Overview<\/h2>\n
\n
Warning:<\/div>\n
\n

cPanel, L.L.C. no longer supports or recommends using the practices outlined in this document. Use this document at your own risk.<\/strong><\/p>\n<\/p><\/div>\n<\/div>\n

While we recommend and support the use of the usual cPanel & WHM installation process, it may require more time than is necessary for Virtual Private Server (VPS) and Virtual Machine (VM) hosts. Instead, you can provision VPS or VM systems with a templated cPanel & WHM environment.<\/p>\n

\n
Note:<\/div>\n
\n

If you offer template installations of cPanel & WHM, we recommend that you become a cPanel Partner.<\/p>\n

    \n
  • \n

    cPanel Partners can use our API to automatically provision their own cPanel & WHM, CloudLinux\u2122, and KernelCare licenses through their billing system.<\/p>\n<\/li>\n

  • \n

    cPanel Partners can also enable or disable some very specific options within WHM.<\/p>\n<\/li>\n

  • \n

    For more information, see our Partner NOC requirements.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n

    Get a development license<\/h2>\n

    Before you begin, apply for a free development license via our Developer License Application.<\/p>\n

      \n
    • \n

      Apply for one license per template.<\/p>\n<\/li>\n

    • \n

      IP addresses are specific to each template.<\/p>\n<\/li>\n<\/ul>\n

      Create a minimal installation for templating<\/h2>\n

      When you create templates<\/strong>, we recommend:<\/p>\n

        \n
      • \n

        Creating only 64-bit templates. cPanel & WHM does not<\/strong> support 32-bit systems.<\/p>\n<\/li>\n

      • \n

        Keeping templates small (virtual disks of 10 GB or smaller). After you convert the template for a customer\u2019s VPS, use your virtualization software to automatically expand its virtual disk capacity to a 20 GB minimum.<\/p>\n<\/li>\n<\/ul>\n

        Pre-installation configuration files<\/h3>\n
        \n
        More:<\/div>\n
        \n
          \n
        • \n

          We provide extensive documentation on preconfiguring cPanel & WHM. For more information, read our Installation Guide.<\/p>\n<\/li>\n

        • \n

          In most cases, preconfiguring these files removes the need to log in to the VPS or VM before you grant access to your customer.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n

          We recommend that you customize the following files:<\/p>\n

          \n
          \n

          Update configuration settings \u2014 \/etc\/cpupdate.conf<\/p>\n

          \n
          \n

          This file allows you to configure cPanel & WHM\u2019s release tier and other update settings.<\/p>\n

            \n
          • \n

            Users can change these settings within WHM at any time. Most of these settings appear in WHM\u2019s Update Preferences<\/em> interface (WHM >> Home >> Server Configuration >> Update Preferences<\/em>)<\/p>\n<\/li>\n

          • \n

            You cannot<\/strong> downgrade major versions, and you cannot change a server\u2019s release tier to circumvent this restriction.<\/p>\n<\/li>\n

          • \n

            For more information, read our Product Versions and the Release Process and The cPanel & WHM Update Configuration File \u2014 cpupdate.conf documentation.<\/p>\n<\/li>\n<\/ul><\/div>\n

            \n <\/div>\n<\/div>\n

            \n

            Update download location settings \u2014 \/etc\/cpsources.conf<\/p>\n

            \n
            \n

            This file determines the locations that your server downloads updates from.<\/p>\n

              \n
            • \n

              By default, cPanel & WHM servers retrieve updates directly from cPanel, L.L.C. through our httpupdate.cpanel.net<\/code> pool of update servers.<\/p>\n<\/li>\n

            • \n

              If you are a cPanel Partner with your own FastUpdate server, you can edit the HTTPDUPDATE<\/code> setting to only update from that FastUpdate server:\n<\/p>\n

              \n
              HTTPUPDATE=<\/span>fastupdate.<\/span>example.<\/span>com<\/code><\/pre>\n<\/div>\n<\/li>\n
            • \n
              For more information, read our Customize Your Installation documentation.<\/p>\n<\/li>\n<\/ul><\/div>\n
              \n    <\/div>\n<\/div>\n
              \n
                      Basic server settings \u2014 \/etc\/wwwacct.conf<\/p>\n
              \n
              \n
              This file contains basic server information for cPanel & WHM, including the IP address, nameservers, and home directory.<\/p>\n
                \n
              • \n
                This includes most of the settings that appear in WHM\u2019s Basic WebHost Manager Setup<\/em> interface (WHM >> Home >> Server Configuration >> Basic WebHost Manager\u00ae Setup<\/em>).<\/p>\n<\/li>\n
              • \n
                For more information, read our Customize Your Installation documentation.<\/p>\n<\/li>\n<\/ul><\/div>\n
                \n    <\/div>\n<\/div>\n
                \n
                        cPanel & WHM configuration settings \u2014 \/var\/cpanel\/cpanel.config<\/p>\n
                \n
                \n
                This file contains extensive configuration options for cPanel & WHM.<\/p>\n
                  \n
                • \n
                  This includes most of the settings that appear in WHM\u2019s Tweak Settings<\/em> interface (WHM >> Home >> Server Configuration >> Tweak Settings<\/em>) as well as other settings throughout cPanel & WHM.<\/p>\n<\/li>\n
                • \n
                  For more information, read our The cpanel.config File documentation.<\/p>\n<\/li>\n<\/ul><\/div>\n
                  \n    <\/div>\n<\/div>\n<\/div>\n
                  cPanel & WHM installation<\/h3>\n
                  After you finish preconfiguring your installation, you can install cPanel & WHM. For more information, read our Installation Guide.<\/p>\n
                  Post-installation tasks<\/h3>\n
                  After you have successfully installed cPanel & WHM, you can set new defaults. You can also secure SSH or update your security configuration.<\/p>\n
                  \n
                  Warning:<\/div>\n
                  \n
                    \n
                  • \n
                    We recommend that you do not<\/strong> log in to WHM while making the template. If you do, remove the \/etc\/.whostmgrft<\/code> file before publishing the template.<\/p>\n<\/li>\n
                  • \n
                    Do not<\/strong> shut down the VM to create the template until after you perform these steps.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n
                    Prevent locked licenses<\/h4>\n
                    To ensure that cPanel, L.L.C. doesn\u2019t<\/strong> lock your development license, we strongly<\/strong> recommend creating one VM per template and maintaining it. This will:<\/p>\n
                      \n
                    • \n
                      Require one license and one IP address per templating VM.<\/p>\n<\/li>\n
                    • \n
                      Ensure that cPanel, L.L.C. doesn\u2019t lock your license or licenses.<\/p>\n<\/li>\n
                    • \n
                      Allow you to start the VM again to perform updates.<\/p>\n<\/li>\n<\/ul>\n
                      Run the following commands to ensure that cPanel, L.L.C. does not lock your license:<\/p>\n
                        \n
                      • \/scripts\/restartsrv_chkservd --stop<\/code><\/li>\n
                      • \/scripts\/restartsrv_cpsrvd --stop<\/code><\/li>\n
                      • rm -f \/usr\/local\/cpanel\/cpanel.lisc<\/code><\/li>\n<\/ul>\n
                        The following BASH script runs these commands:<\/p>\n
                        \n
                                Click to view the post-template.sh script…<\/p>\n
                        \n
                        \n
                        \n
                        \n\n\n
                        \n
                         1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span>17\n<\/span>18\n<\/span>19\n<\/span>20\n<\/span>21\n<\/span>22\n<\/span>23\n<\/span>24\n<\/span>25\n<\/span>26\n<\/span>27\n<\/span>28\n<\/span><\/code><\/pre>\n<\/td>\n
                        		\n
                        #!\/bin\/bash\n<\/span><\/span>\nreadonly PROGNAME=<\/span>$(<\/span>basename $0)<\/span>\nreadonly PROGDIR=<\/span>$(<\/span>readlink -m $(<\/span>dirname $0))<\/span>\nreadonly ARGS=<\/span>\"<\/span>$@\"<\/span>\n\nis_file()<\/span> {<\/span>\n    local file=<\/span>$1\n    [[<\/span> -f $file  ]]<\/span>\n}<\/span>\n\nis_dir()<\/span> {<\/span>\n    local dir=<\/span>$1\n    [[<\/span> -d $dir  ]]<\/span>\n}<\/span>\n\nmain()<\/span> {<\/span>\n    is_dir \/usr\/local\/cpanel \n<\/span><\/span>    &&<\/span> \/scripts\/restartsrv_cpsrvd --stop \n<\/span><\/span>    &&<\/span> \/scripts\/restartsrv_chkservd --stop\n    is_file \/usr\/local\/cpanel\/cpanel.lisc \n<\/span><\/span>        &&<\/span> rm -f \/usr\/local\/cpanel\/cpanel.lisc\n    is_file \/etc\/.whostmgrft \n<\/span><\/span>        &&<\/span> rm -f \/etc\/.whostmgrft\n    echo \"You should now shut down this instance and generate the template.\"<\/span>\n}<\/span>\n\nmain<\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n
                        Avoid security vulnerabilities<\/h4>\n
                        To avoid security issues before you finalize your template:<\/p>\n
                          \n
                        • \n
                          Remove the generated SSH host keys and temporary files.<\/p>\n<\/li>\n
                        • \n
                          Clear the hostname from within the operating system and the \/etc\/wwwacct.conf<\/code> file.<\/p>\n<\/li>\n<\/ul>\n
                          Finalize your template<\/h2>\n
                          Your templates must<\/strong> meet, and we recommend that they exceed, our system requirements. Most providers offer a few different templates.<\/p>\n
                          \n
                          Note:<\/div>\n
                          \n
                          Each VPS or VM needs a SWAP file or partition. Partitions must have at least<\/strong> 256 MB.<\/p>\n<\/p><\/div>\n<\/div>\n
                          Finalization tasks<\/h3>\n
                          After you finish the post-installation tasks, and before you deploy your VPS or VM, finalize your template. Make certain to perform each of the following actions:<\/p>\n
                            \n
                          • \n
                            Update the ADDR<\/code> value in the \/etc\/wwwacct.conf<\/code> file with the main IP address for the VPS or VM.<\/p>\n<\/li>\n
                          • \n
                            Automatically run the \/usr\/local\/cpanel\/bin\/set_hostname<\/code> script on the first boot of the image before any cPanel & WHM services start. You can either randomize the hostname or set the hostname based on your customer\u2019s choice.<\/p>\n<\/li>\n
                          • \n
                            If you run a 1:1 NAT environment, run the \/scripts\/build_cpnat<\/code> script to build your NAT file.<\/p>\n<\/li>\n
                          • \n
                            Run the \/scripts\/rebuildhttpdconf<\/code> script to rebuild your Apache configuration with the correct addresses.<\/p>\n<\/li>\n<\/ul>\n
                            The following BASH script performs all of these tasks except<\/strong> for updating the ADDR<\/code> value:<\/p>\n
                            \n
                                    Click to view the cust-deploy.sh script…<\/p>\n
                            \n
                            \n
                            \n
                            \n\n\n
                            \n
                             1\n<\/span> 2\n<\/span> 3\n<\/span> 4\n<\/span> 5\n<\/span> 6\n<\/span> 7\n<\/span> 8\n<\/span> 9\n<\/span>10\n<\/span>11\n<\/span>12\n<\/span>13\n<\/span>14\n<\/span>15\n<\/span>16\n<\/span>17\n<\/span>18\n<\/span>19\n<\/span>20\n<\/span>21\n<\/span>22\n<\/span>23\n<\/span>24\n<\/span>25\n<\/span>26\n<\/span>27\n<\/span>28\n<\/span>29\n<\/span>30\n<\/span>31\n<\/span>32\n<\/span>33\n<\/span>34\n<\/span>35\n<\/span>36\n<\/span>37\n<\/span>38\n<\/span>39\n<\/span>40\n<\/span>41\n<\/span>42\n<\/span>43\n<\/span>44\n<\/span>45\n<\/span>46\n<\/span>47\n<\/span>48\n<\/span>49\n<\/span>50\n<\/span><\/code><\/pre>\n<\/td>\n
                            		\n
                            #!\/bin\/bash\n<\/span><\/span>\nreadonly PROGNAME=<\/span>$(<\/span>basename $0)<\/span>\nreadonly PROGDIR=<\/span>$(<\/span>readlink -m $(<\/span>dirname $0))<\/span>\nreadonly ARGS=<\/span>\"<\/span>$@\"<\/span>\nreadonly HOSTNAME=<\/span>$(<\/span>hostname --fqdn)<\/span>\nreadonly CPHULKPASS=<\/span>$(<\/span>\/usr\/local\/cpanel\/3rdparty\/bin\/perl -MCpanel::PasswdStrength::Generate -e 'print Cpanel::PasswdStrength::Generate::generate_password(14)'<\/span>)<\/span>\nreadonly MSECPASS=<\/span>$(<\/span>\/usr\/local\/cpanel\/3rdparty\/bin\/perl -MCpanel::PasswdStrength::Generate -e 'print Cpanel::PasswdStrength::Generate::generate_password(14)'<\/span>)<\/span>\nreadonly ESTATSPASS=<\/span>$(<\/span>\/usr\/local\/cpanel\/3rdparty\/bin\/perl -MCpanel::PasswdStrength::Generate -e 'print Cpanel::PasswdStrength::Generate::generate_password(14)'<\/span>)<\/span>\nreadonly LPROTPASS=<\/span>$(<\/span>\/usr\/local\/cpanel\/3rdparty\/bin\/perl -MCpanel::PasswdStrength::Generate -e 'print Cpanel::PasswdStrength::Generate::generate_password(14)'<\/span>)<\/span>\nreadonly RCUBEPASS=<\/span>$(<\/span>\/usr\/local\/cpanel\/3rdparty\/bin\/perl -MCpanel::PasswdStrength::Generate -e 'print Cpanel::PasswdStrength::Generate::generate_password(14)'<\/span>)<\/span>\nreadonly MYSQLPASS=<\/span>$(<\/span>\/usr\/local\/cpanel\/3rdparty\/bin\/perl -MCpanel::PasswdStrength::Generate -e 'print Cpanel::PasswdStrength::Generate::generate_password(14)'<\/span>)<\/span>\n\nis_file()<\/span> {<\/span>\n    local file=<\/span>$1\n    [[<\/span> -f $file  ]]<\/span>\n}<\/span>\n\nis_dir()<\/span> {<\/span>\n    local dir=<\/span>$1\n    [[<\/span> -d $dir  ]]<\/span>\n}<\/span>\n\nmain()<\/span> {<\/span>\n    is_dir \/usr\/local\/cpanel \n<\/span><\/span>        &&<\/span> \/usr\/local\/cpanel\/bin\/set_hostname ${<\/span>HOSTNAME}<\/span> \n<\/span><\/span>        &&<\/span> \/usr\/local\/cpanel\/bin\/checkallsslcerts --allow-retry \n<\/span><\/span>        &&<\/span> \/scripts\/build_cpnat \n<\/span><\/span>        &&<\/span> \/scripts\/rebuildhttpdconf \n<\/span><\/span>        &&<\/span> \/scripts\/mysqlpasswd root ${<\/span>MYSQLPASS}<\/span> \n<\/span><\/span>    is_file \/var\/cpanel\/hulkd\/password \n<\/span><\/span>        &&<\/span> \/scripts\/mysqlpasswd cphulkd ${<\/span>CPHULKPASS}<\/span> \n<\/span><\/span>        &&<\/span> echo -e \"user=\"cphulkd\"npass=\"<\/span>${<\/span>CPHULKPASS}<\/span>\"\"<\/span>>\/var\/cpanel\/hulkd\/password \n<\/span><\/span>        &&<\/span> \/scripts\/restartsrv_cphulkd\n    is_file \/var\/cpanel\/modsec_db_pass \n<\/span><\/span>        &&<\/span> \/scripts\/mysqlpasswd modsec ${<\/span>MSECPASS}<\/span> \n<\/span><\/span>        &&<\/span> echo ${<\/span>MSECPASS}<\/span> >\/var\/cpanel\/modsec_db_pass\n    is_file \/var\/cpanel\/roundcubepass \n<\/span><\/span>        &&<\/span> \/scripts\/mysqlpasswd roundcube ${<\/span>RCUBEPASS}<\/span> \n<\/span><\/span>        &&<\/span> echo ${<\/span>RCUBEPASS}<\/span> >\/var\/cpanel\/roundcubepass\n    is_file \/var\/cpanel\/eximstatspass \n<\/span><\/span>        &&<\/span> \/scripts\/mysqlpasswd eximstats ${<\/span>ESTATSPASS}<\/span> \n<\/span><\/span>        &&<\/span> echo ${<\/span>ESTATSPASS}<\/span> >\/var\/cpanel\/eximstatspass \n<\/span><\/span>        &&<\/span> \/scripts\/restartsrv_eximstats\n    is_file \/var\/cpanel\/leechprotectpass \n<\/span><\/span>        &&<\/span> \/scripts\/mysqlpasswd leechprotect ${<\/span>LPROTPASS}<\/span> \n<\/span><\/span>        &&<\/span> echo ${<\/span>LPROTPASS}<\/span> >\/var\/cpanel\/leechprotectpass\n}<\/span>\n\nmain<\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n
                            Deployment tasks<\/h3>\n
                            When you deploy the customer\u2019s VPS, you must<\/strong> automatically update some files.<\/p>\n
                              \n
                            • \n
                              If you use the libguestfs virt-sysprep<\/code> command, you can do this via the --firstboot<\/code> or --firstboot-command<\/code> options.<\/p>\n
                              \n
                              Warning:<\/div>\n
                              \n
                              If you use a tool such as libguestfs virt-sysprep<\/code> to help finalize your template, ensure that you do not accidentally remove any user accounts or cron jobs.<\/p>\n<\/p><\/div>\n<\/div>\n<\/li>\n
                            • \n
                              If you do not<\/strong> use the libguestfs<\/code> command, consult your hypervisor\u2019s documentation for an alternative option to run scripts or commands upon first boot.<\/p>\n<\/li>\n<\/ul>\n
                              Updating your templates over time<\/h2>\n
                              As cPanel, L.L.C. releases updates, you will need to update your templates.<\/p>\n
                                \n
                              • \n
                                To avoid this situation, plan regular updates on all of your templates.<\/p>\n<\/li>\n
                              • \n
                                To run a cPanel & WHM update for your template, run the following commands:\n<\/p>\n
                                \n
                                \n\n\n
                                \n
                                1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
                                		\n
                                yum<\/span> update<\/span> -<\/span>y<\/span>\n\/<\/span>scripts<\/span>\/<\/span>upcp<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n
                                \n
                                Important:<\/div>\n
                                \n
                                Before you shut down the VM or VPS to recreate the template, run the same commands from the Prevent locked licenses section above. If you don\u2019t, your license may become locked.<\/p>\n<\/p><\/div>\n<\/div>\n
                                Common OpenVZ and Virtuozzo issues<\/h2>\n
                                You may experience some common issues when you use OpenVZ or Virtuozzo.<\/p>\n
                                Hostnames<\/h3>\n
                                On CentOS 7 or 8, CloudLinux 7 or 8, AlmaLinux 8, or Red Hat\u00ae Enterprise Linux\u00ae 7, your hostname may not meet the requirement for a Fully Qualified Domain Name (FQDN).<\/p>\n
                                  \n
                                • \n
                                  Virtuozzo controls the hostname via the VPS configuration (the --hostname<\/code> option for the vzctl<\/code> or prlctl<\/code> commands).<\/p>\n<\/li>\n
                                • \n
                                  If you set the hostname manually, Virtuozzo will reset the hostname on the next reboot. Make sure to set up the full hostname correctly after you provision the VM. cPanel & WHM requires<\/strong> an FQDN.<\/p>\n<\/li>\n<\/ul>\n
                                  Quotas<\/h3>\n
                                  OpenVZ and Virtuozzo require<\/strong> you to enable second-level quotas, which can cause quota-initiation issues. For more information, read:<\/p>\n
                                    \n
                                  • \n
                                    Our Initial Quota Setup documentation.<\/p>\n<\/li>\n
                                  • \n
                                    Virtuozzo\u2019s cPanel Quotas documentation.<\/p>\n<\/li>\n<\/ul>\n
                                    Jailshell<\/h3>\n
                                    Jailshell requires specific steps to enable a full proc<\/code> mount. For more information, read our How to Troubleshoot Jailshell Problems on a Virtuozzo or OpenVZ VPS documentation.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
                                    Overview Warning: cPanel, L.L.C. no longer supports or recommends using the practices outlined in this document. Use this document at your own risk. While we recommend and support the use of the usual cPanel & WHM installation process, it may require more time than is necessary for Virtual Private Server (VPS) and Virtual Machine (VM) …<\/p>\n","protected":false},"author":1,"featured_media":645,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/644"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=644"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/644\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/645"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=644"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}