Change Database Server Name

[Naila]

Hi,

Previously I had a server that was hacked, and I saw a lot of mysql hostnames using huffingtonpost.co.za. And now I'm moving it to a 3x new server, but some cpanel accounts still display the huffingtonpost text on cPanel => Server Information (Server Name).

Where can I edit the text? and should delete from mysql ? but i am unable to find them.

MariaDB [(none)]> show variables where Variable_name like '%host%';
+-------------------------------+----------------------+
| Variable_name | Value |
+-------------------------------+----------------------+
| host_cache_size | 643 |
| hostname | server1.unisystemadmin.com |
| performance_schema_hosts_size | -1 |
| report_host | |
+-------------------------------+----------------------+
4 rows in set (0.001 sec)

MariaDB [(none)]> select host from information_schema.processlist;
+-----------+
| host |
+-----------+
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
| localhost |
+-----------+
11 rows in set (0.001 sec)

MariaDB [(none)]>

I found huffingtonpost.co.za in some file /var/cpanel/databases/

Example from grants_longsuluy.cache grants_longsuluy.yaml

{"MYSQL":{"myuser":{"myuser":["GRANT USAGE ON *.* TO 'myuser'@'202.73.26.218' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'202.73.26.218'","GRANT USAGE ON *.* TO 'myuser'@'huffingtonpost.co.za' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'huffingtonpost.co.za'","GRANT USAGE ON *.* TO 'myuser'@'server1.unisystemadmin.com' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'server1.unisystemadmin.com'","GRANT USAGE ON *.* TO 'myuser'@'localhost' IDENTIFIED BY PASSWORD '*37BB867C7FE82AADDEB781D352BE903DEBBBE2F7'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser'@'localhost'"],"myuser_opensid":["GRANT USAGE ON *.* TO 'myuser_opensid'@'202.73.26.218' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'202.73.26.218'","GRANT USAGE ON *.* TO 'myuser_opensid'@'huffingtonpost.co.za' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'huffingtonpost.co.za'","GRANT USAGE ON *.* TO 'myuser_opensid'@'server1.unisystemadmin.com' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'server1.unisystemadmin.com'","GRANT USAGE ON *.* TO 'myuser_opensid'@'localhost' IDENTIFIED BY PASSWORD '*3C6B92622D978DC8B1D710C42106D344B783F6CE'","GRANT ALL PRIVILEGES ON `myuser\\_sid`.* TO 'myuser_opensid'@'localhost'"]}},"PGSQL":{"myuser":{"myuser":["CREATE USER \"myuser\" WITH PASSWORD E'md5757c20a5114a59170e83bb063f6e0448';"]}}}

Another found

/usr/local/cpanel/Cpanel/iContact.pm: $email_args_hr->{'subject'} =~ s/huffingtonpost.co.za/server1.unisystemadmin.com/g;
/usr/share/cagefs-skeleton/usr/local/cpanel/Cpanel/iContact.pm: $filesys_safe_subject_header =~ s/huffingtonpost.co.za/server1.unisystemadmin.com/g;

I have tried 3 fresh server installation but huffingtonpost.co.za still exist when i migrating cpanel account to new server.

 

[cPRex]

Hey there! That page wouldn't be pulling data from MySQL, but from somewhere else on the system. Can you check /etc/hosts and /etc/hostname to see if that name is present in either of those files?

 

[Naila]

Not present in both @cPRex

Post thread updated with more detail

And cPanel => Server Information (Server Name) read data from?

 

[cPRex]

It looks like we read this from the "uname" value on the server. Can you try running "uname -n" to see what that reports on your machine?

 

[cPRex]

While investigating this issue I noticed that the cPanel >> Server Information area only shows the first portion of the hostname. For example, if your hostname is host.domain.com, that interface only shows "host"

I've created case CPANEL-41660 for our team to adjust that to show the entire hostname, so you can watch for that in our changelogs here:

108 Change Log | cPanel & WHM Documentation

This document lists the cases and bugs worked on during the version 108 release cycle.

docs.cpanel.net

 

[Naila]

It looks like we read this from the "uname" value on the server. Can you try running "uname -n" to see what that reports on your machine?

uname -n showing result origin hostname @cPRex

 

[cPRex]

At this point it would be best to create a ticket so we can determine where that value is coming from. Can you do that, and then paste the ticket number here so I can follow along?

 

[Naila]

Since I'm in the stage of becoming a system admin, I want to learn how to solve it, relying on support tickets only for instant will not increase my knowledge. I'm relying on clues from here.

I did a search with grep and find found huffingtonpost.co.za on the following mysql file. Even though I'm migrating to a new server huffingtonpost.co.za always shows up after some accounts I've migrated.

/var/lib/mysql/mysql/db.MAD
/var/lib/mysql/mysql/db.MAI
/var/lib/mysql/mysql/global_priv.MAD

/usr/share/cagefs-skeleton/var/lib/mysql/mysql/db.MAD
/usr/share/cagefs-skeleton/var/lib/mysql/mysql/db.MAI
/usr/share/cagefs-skeleton/var/lib/mysql/mysql/global_priv.MAD

I don't know where I can edit the above files, because I changed via database root but their text domains still show up in the files. And it always appears in /usr/local/cpanel/Cpanel/iContact.pm

Note: The Server Name "huffingtonpost" only apper when using jupiter themes, swicth to themes paper_lantern Server Name showing correct hostname.

 

[cPRex]

The issue isn't with the database. While there may be entries for that hostname in the database as well, cPanel doesn't use any MySQL data to pull information for the interface. That's why I mentioned creating a ticket, as something seems to be actually wrong with cPanel itself. It's not that we don't want to help through the Forum, but when you stumble across something new we just may not have enough detail to guide you without examining it ourselves.

For the entries you found, I have two thoughts. The first, is that you can never directly edit data inside /usr/share/cagefs. More details on the function of CageFS can be found here:

CloudLinux OS components

Reseller limits LVE-Stats 2 CageFS MySQL Governor PHP Selector Python Selector Ruby Selector Node.js Selector Apache mod_lsapi PRO Additional integration components Apache suexec module

docs.cloudlinux.com

The first three entries you found are actual databases, which you wouldn't be able to edit directly. You can use the PHPMyAdmin tool at the WHM level to search the records on the server and then edit or remove the entries accordingly.