A fork bomb is a type of denial-of-service attack where a process rapidly creates copies of itself, exhausting system resources and crashing the server. Shell Fork Bomb Protection in WHM prevents users with terminal (SSH) access from triggering fork bombs by placing resource limits on each user’s processes.
Step 1: Log in to WHM
Log in to your WHM interface at https://your-server-ip:2087 with your root credentials.
Step 2: Navigate to Shell Fork Bomb Protection
Go to Home » Security Center » Shell Fork Bomb Protection.
Step 3: Enable Protection
Click Enable Protection. This will activate resource limits for all users with shell (terminal) access on your server.
Step 4: Verify the protection is active
The page should now display Disable Protection instead of Enable, confirming that the protection is active. The system applies the following ulimit restrictions per user:
- Core file size: 200,000 KB
- Data segment size: 200,000 KB
- Maximum resident set size: 200,000 KB
- Open file descriptors: 100
- Maximum stack size: 8,192 KB
- Maximum processes per user: 35
- Virtual memory: Unlimited
Important Notes
- This protection limits cPanel users with bash shell access to a maximum of 35 processes each. The root user and system processes are not affected.
- If a legitimate user reports that their applications are being terminated unexpectedly, the 35-process limit may be too restrictive for their workload. Consider whether that user truly needs shell access.
- Shell Fork Bomb Protection is valid for WHM version 82 and later.
- Disabling the protection will remove all resource limits for shell users, making the server vulnerable to fork bomb attacks.
Troubleshooting
- User reports “fork: resource temporarily unavailable”: This indicates the user has hit their 35-process limit. Check if they have runaway processes or if their application legitimately requires more processes. If needed, you may need to disable this protection or adjust limits manually via SSH.
- Changes not taking effect: Users must start a new SSH session for the new limits to apply. Existing sessions will continue using their original limits.
