Teadmistebaas

This article provides a guide demonstrating how to copy a cPanel account with SSH keys. This guide is intended for users of cPanel VPS or cPanel dedicated servers.

Migrating a cPanel account to a new server is a common task for web hosting providers, system administrators, and developers. While cPanel's Transfer Tool can migrate nearly everything automatically, there are situations where you may need to manually copy an account while preserving SSH access. Examples include migrating between providers, moving a single account without WHM root access, or cloning an account for development purposes.

This guide demonstrates how to safely copy a cPanel account—including the user's SSH keys—to another cPanel server while maintaining correct ownership and permissions.

Prerequisites

Before beginning, ensure the following:

• Root SSH access to both source and destination servers
• Both servers are running cPanel & WHM
• The destination server has sufficient disk space
• SSH connectivity between servers
• The same cPanel username exists (or will exist) on the destination server
• DNS changes are planned after migration

How to Copy a cPanel Account with SSH Keys

1. Verify the Existing Account

   On the source server:

   whmapi1 accountsummary user=username
   

   or

   grep "^USERNAME=" /var/cpanel/users/username
   

   Verify:

   • Username
   • Domain
   • Package
   • Home directory

   Typically:

   /home/username
   

2. Enable SSH Access (If Necessary)

   If the user already has SSH enabled, verify:

   grep username /etc/passwd
   

   Check the shell:

   /bin/bash
   

   or

   /usr/local/cpanel/bin/noshell
   

   To enable SSH:

   WHM

   Manage Shell Access

   or

   whmapi1 modifyacct user=username shell=/bin/bash
   

3. Verify the SSH Keys

   SSH keys reside in:

   /home/username/.ssh/
   

   List them:

   ls -la /home/username/.ssh
   

   Typical output:

   authorized_keys
   id_rsa
   id_rsa.pub
   known_hosts
   config
   

   Verify permissions:

   stat /home/username/.ssh
   

4. Create a Full cPanel Backup (Recommended)

   Although this guide covers manual migration, always create a backup first.

   /scripts/pkgacct username
   

   Result:

   /home/cpmove-username.tar.gz
   

5. Copy the Account

   If using rsync:

   rsync -avz \
   /home/username \
   root@destination:/home/
   

   Or with SCP:

   scp -r /home/username \
   root@destination:/home/
   

6. Copy SSH Keys Separately (Recommended)

   Although they are inside the home directory, verify separately.

   Using rsync:

   rsync -avz \
   /home/username/.ssh \
   root@destination:/home/username/
   

7. Restore Ownership

   On the destination server:

   chown -R username:username /home/username
   

   Verify:

   ls -ld /home/username
   

   Example:

   drwx--x--- username username
   

8. Restore SSH Permissions

   SSH is extremely strict about permissions.

   Set:

   chmod 700 /home/username/.ssh
   

   chmod 600 /home/username/.ssh/authorized_keys
   

   chmod 600 /home/username/.ssh/id_rsa
   

   chmod 644 /home/username/.ssh/id_rsa.pub
   

   chmod 644 /home/username/.ssh/known_hosts
   

9. Restore SELinux Contexts (If Applicable)

   If SELinux is enabled:

   restorecon -Rv /home/username/.ssh
   

   or

   restorecon -Rv /home/username
   

10. Verify SSH Configuration

    Confirm OpenSSH allows public key authentication.

    Check:

    /etc/ssh/sshd_config
    

    Verify:

    PubkeyAuthentication yes
    
    AuthorizedKeysFile .ssh/authorized_keys
    
    PasswordAuthentication yes
    

    Restart SSH if modified:

    systemctl restart sshd
    

11. Verify Authorized Keys

    Inspect:

    cat /home/username/.ssh/authorized_keys
    

    Example:

    ssh-ed25519 AAAAC3Nza...
    

    or

    ssh-rsa AAAAB3Nza...
    

12. Test SSH Login

    From your workstation:

    ssh username@example.com
    

    Or explicitly specify a key:

    ssh \
    -i ~/.ssh/id_ed25519 \
    username@example.com
    

    If successful:

    Last login:
    

13. Verify cPanel's SSH Key Management

    Log into cPanel.

    Navigate:

    Security
        SSH Access
    

    Confirm:

    • Authorized Keys
    • Private Keys
    • Imported Keys

    appear correctly.

    If keys are missing in the interface, use:

    Manage SSH Keys
    

    to import them.

    Note: cPanel's SSH Access interface primarily manages key pairs stored under the user's home directory. Simply copying the .ssh directory preserves authentication, but imported private keys may not appear in the interface unless they follow cPanel's expected naming and metadata.

14. Verify Git Repositories

    If the account uses Git:

    find /home/username -name ".git"
    

    Test cloning:

    git pull
    

    or

    git fetch
    

15. Verify Deployment Keys

    Many users rely on SSH keys for:

    • GitHub
    • GitLab
    • Bitbucket
    • Private package repositories
    • Backup servers
    • Remote rsync targets

    Test each connection:

    ssh -T git@github.com
    

    Example:

    Hi username! You've successfully authenticated.
    

16. Verify Cron Jobs

    Some cron jobs use SSH.

    Inspect:

    crontab -u username -l
    

    Look for:

    ssh
    

    scp
    

    rsync
    

    Run manually.

17. Verify File Ownership

    Run:

    find /home/username \
    ! -user username
    

    No files should be returned.

18. Verify SSH Agent Usage

    Some applications depend on an SSH agent.

    Check:

    env | grep SSH
    

    If using systemd services, ensure:

    IdentityFile
    

    paths remain valid.

Common Problems

Permission denied (publickey)

Usually caused by:

• Incorrect permissions
• Wrong ownership
• Wrong authorized_keys
• Incorrect home directory permissions

Verify:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Bad owner or permissions

Run:

chown -R username:username ~/.ssh

SSH key ignored

Check:

tail -f /var/log/secure

or

journalctl -u sshd

Wrong shell

Verify:

grep username /etc/passwd

Expected:

/bin/bash

Home directory permissions

OpenSSH rejects insecure home directories.

Typical:

chmod 711 /home/username

or

chmod 750 /home/username

depending on your hosting policy.

Best Practices

• Prefer Ed25519 keys over RSA for new deployments.
• Always use rsync -a to preserve permissions, ownership, timestamps, symlinks, and extended attributes when migrating home directories.
• Perform migrations over a trusted network or through encrypted SSH tunnels.
• Test SSH authentication before updating DNS or decommissioning the source server.
• Keep a full pkgacct backup until the migration has been validated.
• Rotate SSH keys if there is any concern they may have been exposed during the migration process.
• If using WHM's Transfer Tool or restoring a cpmove backup with restorepkg, SSH keys stored in the user's home directory are generally preserved automatically. A manual copy of the .ssh directory is most useful for selective migrations or when you are not using cPanel's built-in migration tools.

Summary

You now know how to copy a cPanel account with SSH keys.

Migrating a cPanel account with SSH keys is largely a matter of preserving the user's home directory correctly and ensuring ownership and permissions are restored exactly as expected. By copying the .ssh directory, validating authorized_keys, restoring proper file permissions, and testing authentication before cutover, you can provide a seamless migration with minimal downtime and no interruption to Git deployments, automation scripts, or other SSH-based workflows.