Shell access allows users to connect to your server remotely and run commands directly from the command line. In cPanel, you can control which accounts have shell access and choose between normal shell, jailed shell (recommended for security), or disabled shell access. This guide explains how to manage these permissions safely and effectively.
Understanding Shell Access Types
When managing shell access in cPanel, you have three main options to choose from:
- Normal Shell: Grants unrestricted command-line access to the user with no limitations on commands they can execute
- Jailed Shell: Provides command-line access within a restricted environment that prevents harmful commands from being executed (recommended for security)
- Disabled Shell: Completely denies shell access to the user account
The jailed shell option uses VirtFS technology to create a virtualized file system that limits what users can access and execute. This significantly reduces security risks while still providing necessary command-line functionality.
How to Modify Shell Access Settings
To manage shell access for your server accounts in cPanel:
- Navigate to the Manage Shell Access interface in your cPanel dashboard
- To change access for all accounts simultaneously, click the appropriate button at the top of the interface
- To modify access for specific users, locate the user's row and select the desired shell type from the dropdown menu
- The changes take effect immediately once you make your selection
Important: When you change a user's shell access permission, the system sets the package value to undefined in that account's userdata file. This is normal behavior and doesn't affect the account's functionality.
Security Best Practices for Shell Access
Shell access provides powerful control over your server, but it also introduces security risks if not managed properly. Follow these recommendations:
- Use jailed shell by default: Always grant jailed shell access instead of normal shell unless there's a specific technical requirement for unrestricted access
- Limit who has access: Only provide shell access to users who genuinely need it for their work
- Monitor usage: Regularly review which accounts have shell access enabled
- Consider SFTP implications: Remember that accounts with disabled shell can still use SFTP if it's enabled on your server
If you're running CloudLinux on your server and enable jailed shell, you must also enable link traversal protection to prevent security vulnerabilities related to symlinks pointing outside the caged directory.
Disabling SFTP Access Completely
By default, even accounts with disabled shell access can still connect via SFTP (Secure File Transfer Protocol). If you need to completely disable both shell and SFTP access for a user, you'll need to take an additional step.
To fully disable SFTP, you must set the user's shell to /bin/false. Connect to your server as the root user and run this command, replacing "username" with the actual account name:
usermod -s /bin/false username
This sets a non-functional shell that prevents both SSH and SFTP connections for that account.
Frequently Asked Questions
What's the difference between jailed shell and normal shell?
Normal shell provides unrestricted command-line access with no limitations, while jailed shell restricts users to a virtualized environment that prevents them from executing potentially harmful commands or accessing files outside their designated directory. Jailed shell is significantly more secure and is the recommended option for most users.
Will disabling shell access affect my website's functionality?
No, disabling shell access only prevents users from connecting to the server via SSH or command-line tools. Your website, email, and all cPanel functions will continue working normally. Most website operations don't require shell access at all.
Can I grant temporary shell access to a user?
Yes, you can enable shell access for a user whenever needed and disable it afterward. Simply return to the Manage Shell Access interface and change the user's setting from jailed or normal shell back to disabled shell when you want to revoke access.
Why does my account package show as undefined after changing shell access?
This is expected behavior in cPanel. When you manually override the shell access setting for an account, the system sets the package value to undefined in the userdata file because the account no longer matches its original package configuration. This doesn't cause any problems with account functionality.
If you need assistance managing shell access or have questions about security best practices for your hosting environment, our support team is available 24/7. Visit https://www.obhost.net/contact or email support@obhost.org for help.
