SecureLinks Setup: Stop Symbolic Link Attacks in cPanel

The sysctl --system command reads every file in /etc/sysctl.d/ and applies the values immediately.

Configuring cPanel to Respect SecureLinks

cPanel’s internal file manager and PHP handlers need to be aware that symlink checks are in place. CloudLinux provides a WHM plugin that automatically adjusts the necessary configuration files.

Install the CloudLinux cPanel Plugin

# yum install cloudlinux-cpanel-plugin
# /usr/local/cpanel/scripts/install_cloudlinux_plugin

The first command pulls the plugin package, and the second runs the installer script. The plugin performs three actions:

1. Enables kernel.securelinks for the cPanel environment.
2. Updates the php.ini directive open_basedir to include the new security checks.
3. Sets the SecureLinks flag in /var/cpanel/users/* so each account inherits the policy.

Verify the Configuration

After the plugin finishes, you can verify that each cPanel account has the flag enabled:

# grep securelinks /var/cpanel/users/* | wc -l
# cat /var/cpanel/users/username | grep securelinks

The first command should return a line count equal to the number of accounts, confirming the flag exists for each. The second command shows the actual flag line (e.g., securelinks=1).

Testing the Protection

Before relying on SecureLinks in production, perform a controlled test with two dummy cPanel accounts: user1 and user2.

1. Log in as user1 via SSH (or use su - user1).
2. Create a test file in user1’s home:

# su - user1
$ echo "Secret data" > ~/secret.txt
$ chmod 600 ~/secret.txt

1. Switch to user2 and attempt to create a symlink pointing to user1’s file:

# su - user2
$ ln -s /home/user1/secret.txt ~/link.txt
ln: failed to create symbolic link ‘/home/user2/link.txt’: Permission denied

The Permission denied error demonstrates that SecureLinks blocked the operation. If the link is created successfully, double‑check that the sysctl values are set to 1 and that the cPanel plugin has been applied.

Managing Exceptions and Compatibility

Some legacy applications may rely on cross‑account symlinks (e.g., shared libraries in a custom setup). CloudLinux allows you to create a whitelist of directories that are exempt from SecureLinks checks.

Creating a Whitelist

# echo "/opt/shared" > /etc/securelinks/whitelist
# sysctl -w kernel.securelinks_whitelist="/opt/shared"

This tells the kernel to skip ownership checks for symlinks whose target resides under /opt/shared. After adding entries, reload the sysctl configuration:

# sysctl --system

Use whitelisting sparingly and document each entry, as it reduces the isolation guarantee that SecureLinks provides.

Conclusion

Enabling CloudLinux SecureLinks adds a robust, kernel‑level barrier against symbolic link attacks across cPanel accounts. By installing the cloudlinux-sysctl package, setting the appropriate sysctl values, and using the CloudLinux cPanel plugin, you can protect each user’s data without altering application code. Always test the configuration on non‑production accounts, and keep any whitelist entries to a minimum. With SecureLinks in place, your shared hosting environment gains an extra layer of security that aligns with CloudLinux’s core mission: keeping multiple users safely isolated on a single server.