Skip to main content

Server Preparation & API Tokens

Before connecting StackConsole CMP to WebHost Manager (WHM), the WHM server must be prepared with appropriate security settings, network firewalls, and dedicated API credentials. This guide walks through the required server-side configurations.

1. Security Architecture & Least Privilege​

Connecting CMP to WHM does not require exposing the root shell password. Instead, CMP leverages WHM's API Token architecture.

Adhere to the following operational security standards:

  1. Dedicated API User: Where possible, configure a dedicated reseller or administrative user with scoped permissions rather than using root credentials directly.
  2. Encrypted Storage: CMP encrypts all stored API credentials at rest using AES-256-GCM.
  3. No Credential Echoing: CMP API responses and UI fields mask tokens and secrets. Never paste raw tokens into support tickets, public chats, or git commits.
  4. TLS Enforcement: Always enable SSL certificate verification in production.

2. Generating a WHM API Token​

Follow these steps on your WHM server to generate an API token for CMP:

Step 1: Open Manage API Tokens​

  1. Log in to the WHM interface as root (or as a reseller with administrative privileges) at https://<whm-server>:2087.
  2. In the top-left navigation search bar, type Manage API Tokens (under the Development section).

Step 2: Create a New Token​

  1. Click + Generate Token.
  2. Token Name: Enter a descriptive name identifying the integration — for example, cmp-integration-token or StackConsole-Production.
  3. Expiration: Choose an appropriate token expiration policy based on your organization's security guidelines (e.g., 1 year or No Expiration).

Step 3: Configure Required ACL Privileges​

Under the Privileges list, ensure the following checkboxes are enabled:

Account Management​

  • Basic WebHost Manager Setup (basic-whm-functions)
  • Create Accounts (create-acct)
  • Modify Accounts (modify-acct)
  • Suspend and Unsuspend Accounts (suspend-acct)
  • Terminate Accounts (kill-acct / removeacct)
  • Manage Account Passwords (passwd)

Package Management​

  • List Packages (list-pkgs)
  • Edit Packages / Change Package (edit-pkg)

Security & Authentication​

  • Single Sign-On / User Session Creation (create-user-session)
  • Account Information Summary (accountsummary)

Step 4: Save & Copy the Token​

  1. Click Save at the bottom of the page.
  2. WHM will display the generated API token once.
  3. Copy the token string immediately and store it securely in your password vault until entered into CMP.
One-Time Display

WHM will never show the full API token again. If you lose the token, you must revoke it and generate a new one.

3. Firewall Configuration & Whitelisting​

If your WHM host runs ConfigServer Security & Firewall (CSF) or Linux iptables, ensure port 2087 is accessible from the CMP instances.

CSF Configuration (/etc/csf/csf.conf)​

Open the CSF configuration file on your WHM server:

nano /etc/csf/csf.conf

Verify that port 2087 is present in the inbound TCP port list (TCP_IN):

TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087"

Whitelisting CMP Application Nodes​

Add the outbound IP addresses of all CMP application nodes, queue worker instances, and the StackConsole jump host to CSF's allowlist (/etc/csf/csf.allow):

# StackConsole CMP Application Nodes
198.51.100.10 # CMP Web App
198.51.100.11 # CMP Queue Worker 1
198.51.100.12 # CMP Queue Worker 2

# StackConsole Jump Host
14.192.19.227

Restart CSF to apply changes:

csf -r

4. Default Server Mail & DNS Settings​

CMP allows administrators to specify default settings for newly created cPanel accounts during provider configuration. To ensure consistency, align your WHM server defaults:

Mail Routing Configuration​

In WHM under Email → Mail Routing Configuration:

  • Automatically Detect Configuration: Default recommended option. Automatically chooses local, backup, or remote mail routing depending on MX records.
  • Apache SpamAssassin: Enable SpamAssassin globally under Service Configuration → Apache SpamAssassin Configuration if you plan to activate spam filtering defaults for new customer accounts.
  • Spam Box: Verify that Spam Box functionality is enabled server-wide so spam emails can be automatically routed to a dedicated junk folder.

DNS & Nameserver Settings​

In WHM under Server Configuration → Basic WebHost Manager Setup:

  • Enter your authoritative primary and secondary nameservers (e.g., ns1.examplecloud.com, ns2.examplecloud.com).
  • These nameservers will be automatically assigned to all customer domains created through CMP.

5. Verifying Server Preparation​

Before moving to the CMP Admin Portal, run this verification command from an external machine (or CMP host):

curl -k -H "Authorization: whm root:YOUR_API_TOKEN" \
     https://<whm-server-ip>:2087/json-api/listpkgs?api.version=1

Success Response​

{
  "metadata": {
    "command": "listpkgs",
    "result": 1,
    "version": 1
  },
  "package": [
    {
      "name": "basic hosting",
      "QUOTA": "10240",
      "BWLIMIT": "102400"
    }
  ]
}

If the response returns "result": 1, your WHM server is ready to be registered in StackConsole CMP.

Next Steps​

Proceed to Connecting CMP to WHM to register your WHM instance using the 4-step wizard.

Was this page helpful?
Found something that could be improved?