1:1 NAT Configuration, Script Permission Best Practices, and cPanel PHP Module Overview

1. Understanding 1:1 NAT in cPanel & WHM

cPanel & WHM requires a 1:1 NAT configuration when installed in a NAT‑based environment. During installation, the system automatically detects NAT and maps private IP addresses to public IP addresses.

Warning: Only configure 1:1 NAT on a fresh installation. Do not apply NAT changes to a production server.

How the Mapping Works

The system sends outbound requests from each local IP to http://myip.cpanel.net/v1.0/. The service returns the public IP, and cPanel maps each private IP to its corresponding public IP.

Important: Do not map multiple private IPs to a single public IP.

Managing IP Addresses

You can manage NAT mappings using:

• WHM » IP Functions » Add a New IP Address
• WHM » IP Functions » Show or Delete Current IP Addresses
• WHM » IP Functions » IP Migration Wizard

If multiple private IPs match one public IP, only the first entry in /var/cpanel/cpnat is used.

Rebuilding the cpnat File

To use a custom IP lookup service:

echo "MYIP=https://ifconfig.me/ip" >> /etc/cpsources.conf
/usr/local/cpanel/scripts/build_cpnat

If cpnat is deleted or corrupted, rebuild it using the same script.

To disable NAT mode entirely, delete:

/var/cpanel/cpnat

2. Best Practices for Script and Code Permissions

Running code as a user other than the file owner creates serious security risks. In cPanel version 132, permissions on /etc/trueuserowners were restricted to prevent unauthorized access.

Common Errors You May See

• CGI scripts running as nobody may show incorrect contact information.
• Apache logs may show:
  [SCRIPT-NAME] /etc/trueuserowners is not readable as nobody

Why You Should Not Run Code as Other Users

• Privilege escalation risks
• Files must be world-readable, weakening security
• Modern applications expect to run as their owning user

Recommended Permission Practices

Use restrictive permissions such as:

chmod 640 filename
chmod 750 directory

Only run code as the file owner to prevent privilege escalation.

EasyApache 4 Behavior

EasyApache 4 runs Podman and Passenger apps as the file owner. Script execution depends on the handler:

• CGI scripts run as the user with: suexec, ruid2, ITK
• PHP scripts run as the user with: PHP-FPM, Ruid2

Handler limitations:

• suexec requires PHP CGI or lsapi
• suphp requires suphp + suexec
• ITK requires PHP-FPM

3. cPanel PHP Overview

cPanel & WHM includes internal PHP packages (PHP 8.4) with PEAR, PECL, and loaders.

Included PHP Modules

Modules include:

bcmath, bz2, Core, ctype, curl, date, dom, fileinfo, filter, ftp, gd, gettext, hash, iconv, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl, pcntl, pcre, PDO, pdo_mysql, pdo_pgsql, pdo_sqlite, pgsql, Phar, posix, random, Reflection, session, SimpleXML, soap, sockets, SPL, sqlite3, standard, sysvsem, sysvshm, tidy, tokenizer, xml, xmlreader, xmlwriter, xsl, zip, zlib

PEAR and PECL Modules

Includes modules such as:

Archive_Tar, Auth_SASL2, Cache, Console_Color, Date, Date_Holidays, File, HTML_Template_IT, HTTP, Log, Mail, MDB2, Net_DNS2, Net_FTP, Net_IMAP, Net_SMTP, Net_Socket, Net_URL, Services_Weather, XML_Parser, XML_RPC, XML_Serializer, XML_SVG

PHP Loaders

• ioncube
• sourceguardian

PHP and SQL Libraries

The PHP binary links to:

• PostgreSQL
• SQLite

The php.ini File

Important: Do not edit the internal php.ini directly. cPanel overwrites changes.

Use:

WHM » Server Configuration » Tweak Settings » PHP

This php.ini is separate from EasyApache 4’s PHP configuration.

Conclusion

This guide covers 1:1 NAT configuration, secure script permission practices, and a complete overview of cPanel’s internal PHP modules and loaders. Following these guidelines ensures a secure, stable, and fully compatible cPanel & WHM environment.