Overview:
Shell Fork Bomb Protection is a security feature in WHM designed to prevent Telnet/SSH users from consuming all server resources by creating an excessive number of processes (also known as a fork bomb). This type of attack can cause the server to become unresponsive, even disabling basic commands like ps.
By enabling Shell Fork Bomb Protection, WHM applies a set of user-level resource limits to help safeguard the server from such misuse.
Steps to Enable Shell Fork Bomb Protection via WHM
-
Log in to WHM using the root user.
-
Navigate to “Security Center”.
-
Click on “Shell Fork Bomb Protection”.
-
Click the “Enable Protection” button.
Once enabled, the system will apply the following limits to user accounts:
| Limit Value | Option | Description |
|---|---|---|
| 200000 | -c | Maximum size of core files created. |
| 200000 | -d | Maximum size of a process’s data segment. |
| 200000 | -m | Maximum resident set size. |
| 100 | -n | Maximum number of open file descriptors. |
| 8192 | -s | Maximum stack size. |
| 35 | -u | Maximum number of processes per user. (Default shell users are limited.) |
| 200000 | -v | Maximum amount of virtual memory available to a process. |
Note: The
-uflag is particularly important as it restricts each shell user to a maximum of 35 processes, which helps prevent system overloads.
Enable Shell Fork Bomb Protection via Command Line
You can also enable this feature directly from the command line:
-
Log in via SSH as root.
-
Run the following command to enable protection:
perl -I/usr/local/cpanel -MCpanel::LoginProfile -le 'print [Cpanel::LoginProfile::install_profile("limits")]->[1];' -
Restart the cPanel service to apply the changes:
service cpanel restart
Disable Shell Fork Bomb Protection via Command Line
If needed, you can disable the protection by running:
-
Disable the limits:
perl -I/usr/local/cpanel -MCpanel::LoginProfile -le 'print [Cpanel::LoginProfile::remove_profile("limits")]->[1];' -
Restart the cPanel service again:
service cpanel restart
Recommended: Use WHM API
For automated or advanced deployments, enabling Shell Fork Bomb Protection via the WHM API is a preferred and scalable approach.
