cPanel

Sell web hosting and reseller hosting on your cPanel & WHM servers.

When an order is activated, BAMCS creates the cPanel account from your WHM package, applies the product's limits and emails the client their login details. Clients sign in to cPanel, Webmail and WHM with one click, and manage their mailboxes, databases, domains, DNS, SSL and backups from the BAMCS client area. Staff manage the account from the service page.

Features

Account lifecycle

• Create: when a service is activated, the account is created on a WHM server with the product's package, the order's domain and the client's email as contact address. The product's limits are then applied on top of the package.
• Usernames: built the way WHMCS builds them, from the first eight letters and digits of the domain (example.co.uk becomes examplec). When the name is taken, the last characters are replaced by a number (example1, example2, …). Each name is checked with WHM before it is used. You can set the length, put a prefix in front, or use random names instead. Clients can ask for a username with a custom field.
• Passwords: a random password, 16 characters by default, stored encrypted.
• Suspend and unsuspend follow the service status in BAMCS, with the service's suspension reason. For example, an overdue service is suspended and unsuspended once it is paid.
• Terminate removes the account, optionally keeping its DNS zone.
• Upgrades and downgrades move the account to the new product's package, apply its limits, shell and CGI settings again, grant or remove reseller privileges and assign or release a dedicated IP address.
• Safe to retry:
  • The username and password are stored before the account is created. If the request times out, a retry finds the account WHM made anyway and only finishes the steps that are missing.
  • Suspending, unsuspending or removing an account that is already in that state, or already gone, counts as done.
  • An account that another active service on the same server uses is never taken over or removed.
• Protected accounts: the module never suspends, removes, changes or signs in to root or the WHM user of the connection itself.
• Failures: failed actions are retried automatically. If they still fail, staff get an alert that quotes WHM's reason and can retry from the service page.

Resellers

• Reseller accounts: a product can grant reseller privileges (WHM access) after the account is created, with a saved WHM ACL list.
• Reseller limits: the number of accounts, disk space and bandwidth the reseller may hand out, with optional overselling.
• Ownership: the reseller can own its own account.
• Suspend, unsuspend and terminate act on the reseller together with the accounts it owns. Turning off Terminating a reseller removes its accounts removes only the reseller's own account.
• Upgrades can turn a hosting account into a reseller and back. Removing reseller privileges is refused while the reseller still owns other accounts.

Configurable options

Clients can choose limits, the package and extras at checkout through configurable options. The WHMCS cPanel option names work unchanged, so options copied from WHMCS keep working:

Each option also answers to its variable name (disk_space|Disk) and a few other spellings, listed on the Field Variables page. Case, spaces, dashes and underscores are ignored when names are matched.

Client area tools

The client's service page shows a hosting panel with:

• Overview: the domain, username, IP address, package and nameservers; disk space, bandwidth and file (inode) usage with a Refresh button; Log in to cPanel, Webmail and, for resellers, Log in to WHM; and one-click shortcuts into cPanel screens such as File Manager, Email Accounts, phpMyAdmin, Zone Editor, SSL/TLS and Cron Jobs.
• Email accounts: mailboxes with their disk usage and quota. Create and delete mailboxes, change their password and quota, and open Webmail for one mailbox without its password.
• Forwarders: list, add and delete email forwarders per domain.
• FTP: FTP accounts with their usage. Create them with a quota and home directory, change their password and quota, and delete them (their files stay).
• Databases: MySQL databases and users. Create and delete them, give a user all privileges on a database or take them away, change a user's password, and open phpMyAdmin.
• Domains: add and remove subdomains, addon domains and aliases.
• DNS: the records of every main, addon and alias domain. A, AAAA, CNAME, TXT and MX records can be added, edited and deleted.
• Cron jobs: add, edit and delete cron jobs, with presets for common schedules, and set the notification email address.
• SSL: the certificate of every domain, marked valid, expiring within 14 days, expired, self-signed or missing. Clients can run an AutoSSL check and follow its progress.
• Backups: backup archives in the home directory and the server's restore points. Clients can start a full backup to the home directory, at most one every 10 minutes, and be emailed when it is done.
• PHP: the PHP version of each website, or of all of them at once.
• Password: change the cPanel password. MySQL passwords are changed to match.

Each tool can be switched off per product. Every change is checked against the client's own account first, and changes are rate limited per service: 30 a minute, and 5 a minute for passwords. When staff are signed in as the client, their changes are recorded in the audit log, and changing the account password is refused.

Single sign-on

• Clients sign in to cPanel, Webmail or WHM (resellers only) without a password, straight from the client area, or straight into one cPanel screen through the shortcuts.
• Mailboxes: the Email accounts tab opens Webmail for a single mailbox.
• Staff sign in to cPanel, Webmail or WHM from the service page. Each staff sign-in is written to the service log with the staff member's name.
• Login links are made for each click and are never logged or stored.

Admin panel

The Details tab of the service page shows a cPanel card with:

• The username, domain, server, IP address, package and state, with the usage from the last sync.
• Fetch live data: reads the account from WHM and highlights where the server differs from what BAMCS has stored.
• Sync from server: stores the server's domain, IP address, package, suspension state and usage, and writes the differences to the service log.
• cPanel, Webmail and WHM sign-in buttons.
• Change password, with a generator. MySQL passwords are changed to match.
• Change domain and Change username, optionally renaming databases and database users to the new prefix. Before the account exists, these set the domain and username it will be created with.
• Dedicated IP: move the account to a free dedicated IP, or back to the shared IP. When the product has no dedicated IP, an IP you assign here is kept through upgrades, downgrades and Re-apply until you choose Revert to shared IP. Once the product includes a dedicated IP, the product manages it, and a later change to a product without one moves the account back to the shared IP.
• Re-apply package & limits: runs the upgrade action again. A dedicated IP staff assigned outside the product is kept.

Every change is written to the service log with the staff member's name.

Usage sync

Every hour, BAMCS reads all accounts from each WHM server with two API calls. It stores each account's disk space, bandwidth and file usage, and notices changes made directly in WHM. See Usage sync and drift.

Import and link

• Link one account: a service can take over an account that already exists on the server, instead of creating a new one.
• Bulk import: Modules → cPanel → Import accounts lists every account on a server and creates linked services for the ones you select, like the WHMCS "Sync Accounts" tool.

Nothing is created or changed on the server either way. See Import and linking.

Welcome email

The module adds a cPanel Hosting Welcome email template. It includes the login details, the cPanel and Webmail addresses, the nameservers to point the domain at, the FTP details and the mail server name.

Requirements

• cPanel & WHM 96 or later.
  • Creating, suspending and removing accounts works from version 62.
  • The client area tools need version 86, as they run through WHM's uapi_cpanel function, and the DNS tab needs 96.
  • Backup archives show their status from version 136. Older servers list the archives without one.
• The PHP tab needs EasyApache 4 (MultiPHP). Without it the tab says choosing a PHP version isn't available.
• A WHM API token for the server's root user or for a reseller. Create it in WHM under Development → Manage API Tokens. A root token can do everything. A reseller token only reaches the accounts that reseller owns, and can't use reseller products or dedicated IP addresses, as those need root.
• Network access from your BAMCS server to WHM over HTTPS, on port 2087 by default.
• The BAMCS queue worker and scheduler running. Provisioning runs in the background, and the health check and usage sync run on the scheduler.

API token permissions

A token with All features (root) works for everything. A token with limited permissions (ACLs) needs:

These need root: reseller products (setupreseller, unsetupreseller, setacls, listacls, setresellerlimits, suspendreseller, unsuspendreseller, terminatereseller, listresellers) and dedicated IP addresses (listips, setsiteip). Moving an account back to the shared IP also uses get_shared_ip (basic-system-info).

Test connection (and the hourly health check) fails when the token can't call one of the functions every service needs: createacct, suspendacct, unsuspendacct, removeacct, passwd, changepackage, modifyacct, accountsummary, listaccts, listpkgs, create_user_session, verify_new_username, uapi_cpanel and showbw. Functions only some features use don't fail it. Test connection and the servers page Check name them as warnings instead, with what will fail: disk and bandwidth limits (editquota, limitbw), reseller products, dedicated IP addresses, the Cron jobs and Domains tools (cpanel, ACL cpanel-api) and nameservers from WHM.

Installation

1. In BAMCS, go to Modules → Marketplace and install cPanel. Alternatively, upload the module .zip under Upload a module package.
2. Under Installed Modules, click Activate. This creates the module settings and the cPanel Hosting Welcome email template.

Configuration

Step 1: Add your WHM servers

Go to System → Server Inventory → Add Server:

Then save the server, open it again with Edit, and fill in the cPanel settings if you need them:

Click Test connection to check the host, the token and its permissions. New orders go to a server in the product's server group that is active, isn't failing its hourly health check and still has room. Modules → cPanel → Servers shows every server with its health, services and last usage sync.

Module settings

Modules → cPanel → Settings has a fallback WHM connection, with the same fields and a Test saved connection button. It is only used for services without a cPanel server in the inventory, so with the inventory set up you can leave it empty.

The same page sets how new accounts are named and protected:

Step 2: Create a product

Go to System → Services Catalog and create or edit a product.

1. On the Free Domain tab, turn on Require a domain name. The account is created for the domain the client registers, transfers or enters at checkout, and isn't created without one.
2. On the Module Settings tab, choose cPanel as the module and select the Server Group.
3. Set Auto Setup to control when the account is created:
   • Payment: once the first invoice is paid.
   • Invoice Created: as soon as the order's invoice exists.
   • Manual: when staff activate the service.
4. Fill in the cPanel fields. Packages and ACL lists are loaded from WHM.

Package and limits. Leave a limit blank to keep the package's value. -1 is unlimited. For the counts (email accounts, FTP accounts, databases, subdomains, alias and addon domains, mailing lists), 0 allows none (but see Limitations for addon domains and mailing lists); for disk space, bandwidth, emails per hour and the mailbox quota, 0 is unlimited.

Reseller. These need a root token.

Termination, passwords and the client area.

Step 3: Welcome email

On the product's Details tab, set Welcome Email to cPanel Hosting Welcome. You can edit the template under the email templates like any other. It is sent once the account has been created. Without it, BAMCS sends the standard "service activated" email.

The template can use these variables, besides the usual {{name}}, {{product}}, {{service_id}}, {{access_details}} and {{url}}:

{{access_details}} lists the username, the password (when shown to the client), the domain, the IP address, the cPanel, Webmail and WHM addresses and the nameservers.

The variables the shipped template uses (cpanel_username, cpanel_domain, cpanel_ip, cpanel_url, webmail_url, nameservers and server_hostname) are always set. If one is unknown, for example when the server has no nameservers configured, it reads "please contact our support team". The others are left out when empty, so only use {{cpanel_password}}, {{whm_url}} and {{ns1}} to {{ns5}} where they apply.

Client choices

Configurable options can override the package, every limit, the dedicated IP, shell and CGI access, and the reseller limits. Name the option after the WHMCS name or the variable, variable|Label, and name each dropdown or radio choice value|Label. For example, a "Disk Space" option with the choices 10240|10 GB and 20480|20 GB, or a package|Plan option with the choices starter|Starter and business|Business.

• Limits are whole numbers in MB or a count, without a unit. A choice named 10000MB is ignored.
• -1 or a choice named unlimited makes the limit unlimited. 0 or an empty value keeps the product's limit.
• Yes/no options pass 1 or 0, and only work for Dedicated IP, Shell Access and CGI Access.
• The reseller switch, the ACL list, the account language, termination, password and client area settings can only be set on the product.

Custom fields let the client type a value at checkout. Two are supported:

Custom fields never change the package or a limit, so a typed value can't buy more resources.

Modules → cPanel → Field Variables lists every variable with where it can be set and the option names it answers to.

A configurable option wins over the product setting.

Usage sync and drift

Every hour, at 17 minutes past, BAMCS reads all accounts from each active WHM server, and from the module settings connection when services use it. That is two API calls per server (listaccts and showbw), however many accounts it has. Turn it off with Hourly usage sync in the module settings.

For each service whose account exists, the sync stores:

• disk space, bandwidth this month and file (inode) usage, with their limits, shown to the client and on the service page;
• the domain, IP address and package;
• whether the account is suspended on the server.

Drift: when the domain, IP address or package changes on the server, or the account is suspended or unsuspended in WHM so it no longer matches the service status, the change is written to the service log once. BAMCS never changes the service status because of it.

Missing accounts: an account that is no longer on the server is logged on its service once, and staff with the Manage services permission get one alert per server. The alert closes by itself once a sync finds no missing accounts. Nothing is terminated automatically.

Modules → cPanel → Servers shows each server's last sync, its missing accounts, and two buttons:

• Check shows the WHM version, the load average, the number of accounts and packages, and any API functions the token can't call.
• Sync usage now runs the sync for that server straight away, even when the hourly sync is off.

Clients can refresh their own usage twice a minute from the overview.

Import and linking

Link one account

To let a service manage an account that already exists:

1. Open the service in BAMCS.
2. On the Panel Server card, choose Link existing server.
3. Search the server for the account by username or domain, and pick it.

BAMCS stores the account's username, domain, IP address, package, reseller state and dedicated IP, and skips provisioning, so nothing is created or changed in WHM. Suspend, unsuspend, terminate and upgrades then act on the linked account. A dedicated IP the account already has counts as assigned by staff when the product has no dedicated IP, so package changes keep it. An account another active service already manages can't be linked twice.

BAMCS doesn't know a linked account's password, unless the service already managed that account, so usually none is shown to the client. The client can set one on the Password tab, or staff can with Change password on the service page.

Bulk import

Modules → cPanel → Import accounts takes over many accounts at once:

1. Choose the WHM server. Its accounts are listed with their domain, email, package, owner, suspension state and disk usage. The list is kept for 10 minutes; Reload from server fetches it again.

2. Select the accounts to import. For each one, BAMCS suggests:

   • the client whose email matches the account's contact email;
   • the cPanel product whose WHM package matches the account's package;
   • a monthly cycle, when the product is priced for it, and a next due date one cycle from today;
   • Suspended when the account is suspended on the server, otherwise Active.

   Change any of these with Configure.

3. Click Import selected. Up to 20 accounts are imported per click.

Each import creates the service with the product's price in the client's currency and links it to the account. No welcome email or invoice is sent; the service is invoiced as usual for its next due date. Accounts that are already linked, root and the WHM connection user can't be imported.

The page also lists Missing on server: services on that server whose account no longer exists.

Limitations

• No usage billing: BAMCS has no metric or overage billing, so the usage the sync reads is shown, not charged.
• Softaculous and WP Toolkit: there are no tools for them in the BAMCS client area. Clients reach them in cPanel through Log in to cPanel.
• Not included: unblocking IP addresses in CSF or cPHulk, moving accounts between servers, autoresponders, spam filters and mailing lists. Clients manage the last three in cPanel; autoresponders and spam filters have shortcuts.
• English only: the module ships English texts only.
• DNS: only A, AAAA, CNAME, TXT and MX records can be changed in the client area. Other records, such as CAA and SRV, are shown read-only.
• Backups: clients download and restore backups in cPanel, through the File Manager and Backups shortcuts.
• Cron: the cron notification email address can be changed, but not cleared.
• Upgrades: the account language is only applied when the account is created. A limit removed from a product stays on existing accounts until their package changes.
• Reseller tokens: a reseller's API token can't create reseller accounts or assign dedicated IP addresses. Test connection warns about this but still passes.
• Server capacity: the inventory's Disk Capacity counts each service's disk quota in MB: the product's, or a configurable option's when the option is named exactly disk_space. A "Disk Space" option and unlimited quotas count as nothing. Memory Capacity doesn't apply to cPanel.
• Sync summaries: the last sync shown on the servers page is kept in the cache. After the cache is cleared, it shows "Never synced" until the next hourly run.
• Not confirmed on a live server: these WHM behaviours aren't documented clearly. Where it can, the module works around them:
  • Whether WHM applies the package or explicit limits when createacct gets both. The module sends only the package and applies every limit afterwards.
  • The unit of modifyacct's bandwidth limit. The module sets bandwidth with limitbw, in MB.
  • What 0 addon domains or mailing lists means. BAMCS treats 0 as none, but WHM documents 0 as unlimited for these two limits. Check the result on your server before you sell a plan with 0 of them.
  • The format of disk usage in account lists, with or without an M suffix. Both are read.
  • Whether terminatereseller still needs its old confirmation text. It is always sent.
  • Whether Mysql::create_database adds the account prefix itself. Names are always sent in full, prefix included.
  • The line number Cron::remove_line expects. After deleting a cron job the list is read again, and the delete is reported as failed if the job is still there.
  • Where the zone serial sits in a DNS zone. When cPanel rejects the serial, the zone is reloaded with a warning instead of failing.
  • Whether System default is accepted for a website's PHP version through UAPI.
  • The paths behind the Domains and Zone Editor shortcuts.
  • Whether applist reflects a token's limited permissions. If it doesn't, Test connection passes and the first call the token can't make fails with "Access denied", which staff see in the alert.