SSH access lets customers use Git, Composer, WP-CLI and other tools directly on the server. It is also a powerful entry point if an account is compromised. WHM lets you choose per account whether there is shell access at all and what kind.
MdmHost decides shell policy on its hosting plans. This guide is for administrators of their own cPanel server.
Before you start
- Root access to WHM.
- A policy: which plans include SSH, and whether users need key-based login only.
Shell types
| Type | What the user sees | Use for |
|---|---|---|
| Disabled | No SSH login | Most basic hosting plans |
| Jailed shell | A restricted environment with limited view of the system | Standard servers without CloudLinux |
| Normal shell | Full shell as the user | Trusted users; on CloudLinux, CageFS still isolates them |
On CloudLinux servers, CageFS provides strong isolation for any shell type (see managing CageFS).
Change shell access per account
- Go to WHM → Account Functions → Manage Shell Access.
- Find the account and choose Disabled, Jailed Shell or Normal Shell.
- The change applies immediately.
Also make sure the package's feature list includes or excludes SSH Access and Terminal accordingly (see Feature Manager).
Default for new accounts
In Create a New Account and in packages, the Shell Access option sets the default. Tweak Settings controls whether jailed shell is used by default for new accounts (see Tweak Settings).
Warning: Resellers should not grant shell access freely. Restrict the reseller privilege for shell accounts to trusted resellers (see the reseller ACL guide).
Secure SSH for users
- Encourage SSH keys (users add them in cPanel → Security → SSH Access).
- Keep brute-force protection active (see cPHulk).
- Consider disabling password logins server-wide once users use keys (see Security Advisor).
Troubleshooting
User has shell access but login fails
The IP may be blocked, the user may be connecting to the wrong port, or the key is not authorised in cPanel.
Tools missing in the shell
Jailed shells and CageFS show only selected tools. Add safe tools to CageFS, or use normal shell with CageFS.
Frequently asked questions
Is the cPanel Terminal the same as SSH?
Terminal in cPanel opens a shell in the browser with the same permissions as the user's SSH access.
Can I allow SFTP without shell?
cPanel ties SFTP to shell access. FTPS is the alternative for users without shell.
Does shell access affect CloudLinux limits?
Processes started from the shell run inside the user's LVE and count toward their limits.
How do I list accounts with shell access?
Manage Shell Access in WHM shows each account's shell type. From SSH, check the login shell in /etc/passwd.
Should resellers get shell?
Only if they need it for their own work. Their customers' shell access is controlled separately per account.