How cPFence protects your Enhance API key
cPFence v4+ uses your Enhance API key only on your own servers. It never sends the key to cPFence or to anyone else. You can limit, replace or revoke it in Enhance at any time.
Where is the key stored?
Section titled “Where is the key stored?”Only on your main control panel server, in the cPFence configuration file /etc/cpfcli/config.conf.
- The key is saved in encrypted form, never as plain text.
- cPFence accepts the file only when it is owned by root and readable by root alone (mode
600). Website users and other accounts on the server cannot read it. - Secondary servers never receive the key. Restoring settings on a secondary server does not copy it there either.
Does the key ever leave my server?
Section titled “Does the key ever leave my server?”No. cPFence sends the key only to your own Enhance control panel API:
- normally through your control panel’s domain, over HTTPS with full certificate checks;
- if that domain cannot be used from the main control panel server, through the panel’s local API on the same server (
127.0.0.1). cPFence uses it only when the listener belongs to root, so no other program on the server can receive the key.
cPFence never sends the key to cPFence servers. License checks, updates, malware signature downloads and support reports work without it.
Who can see the key?
Section titled “Who can see the key?”Nobody, through cPFence. After you save it, the WebUI shows only whether a key is set and whether it works (Test saved key). Neither the WebUI nor the CLI ever shows the key again. To change it, save a new key.
Like any secret on a server, root on the main control panel server can still reach it. Keep root and SSH access limited to people you trust.
Do settings backups contain the key?
Section titled “Do settings backups contain the key?”Settings backups can contain the stored key, still encrypted. They are saved on the server under /var/cpf_backups/ and do not leave it unless you copy them. Store your copies privately.
How do I keep the key under my control?
Section titled “How do I keep the key under my control?”- Restrict it by IP. Turn on IP restricted for the token in Enhance so it works only from your main control panel server (steps).
- Revoke it at any time. Delete the token in Enhance under Settings → Access tokens. cPFence protection keeps working; only the tools that need the key stop until you save a new one.
- Skip it if you do not need it. The key is used only for ApiMachine bulk tools and single sign-on into Enhance from the WebUI. Firewall, WAF and malware protection do not need it.