Backup Tarball Contents | cPanel & WHM Documentation

Valid for versions 102 through the latest version

Version: 102

Last modified: November 5, 2024

Overview

Warning: cPanel & WHM does not recommend using this file as an integration endpoint. The contents of this file are subject to change at any time.

When a backup is initiated, the system generates a tarball (.tar.gz) file. This file contains compressed versions of an account’s files, formatted as USERNAME.tar.gz, where USERNAME corresponds to the cPanel account’s username. To inspect the contents of this file, you can:

• Download the tar.gz file and extract its contents.
• Utilize the command line with tar -tvf USER.tar.gz, replacing USER with the account username. This command will display all contents of the backup file without extracting them.

Note: The backup process operates under the permissions of the cPanel user whose data is being backed up. The system includes all files owned by the account in the backup file. It also incorporates any files that the account does not own but has access to. However, the system will not back up any files that the account neither owns nor can access.

Creating a Backup in WHM

An account backup file can be generated in WHM using one of the following methods:

• Through WHM’s Backup Configuration interface (WHM » Home » Backup » Backup Configuration).
• By executing WHM’s backup script.
• Via WHM API 1’s Backup functions.

Creating a Backup in cPanel

An account backup file can be generated in cPanel using one of the following methods:

• Within cPanel’s Backup interface (cPanel » Home » Files » Backup).
• By utilizing UAPI’s Backup functions.

Directories

The following section details the file directories found within an account's backup file:

authnlinks

The /authnlinks directory contains the account’s external authentication data. This directory is present only if the account utilizes external authentication.

apache_tls

The /apache_tls directory holds the account’s domain files. The files within this directory contain the private keys and SSL certificates for each domain associated with the account.

bandwidth

While the system creates the /bandwidth directory in the backup file, it does not store any data within it. Bandwidth information is instead stored in the bandwidth.json file.

bandwidth_db

The system creates the /bandwidth_db directory in the backup file, but it does not store any data within it. Bandwidth information is instead stored in the bandwidth_db.json file.

counters

The /counters directory contains a copy of any file owned by the account within the /var/cpanel/Counters/ directory. Each of these files contains the current count for webpage hit counters; for example, the USER.dat file, where USER is the account’s username.

cp

The /cp directory contains the account’s user file from the /var/cpanel/users directory. This file includes the account’s information and settings.

cron

The /cron directory contains the account’s cron table file data.

ccs

The /ccs directory contains data from the account’s Calendar and Contacts Server (CCS) plugin, if applicable.

customizations

The /customizations directory contains JSON files generated when a reseller uses the WHM API update_customizations function to customize the cPanel interface within the Jupiter theme.

dnssec_keys

The /dnssec_keys directory contains the DNSSEC keys for all domains associated with the account. The system creates a subdirectory for each domain, within which copies of the domain’s DNSSEC key files are stored. These files are saved in keytag_keytype.key format, where keytag represents the key’s tag ID, and keytype denotes the type of DNSSEC key.

dnszones

The /dnszones directory contains copies of the account’s DNS zone files. These files are stored in DOMAIN.db format, where DOMAIN represents the account’s domain.

domainkeys

The /domainkeys directory contains the account’s private and public domain key files. The private file includes the private keys for each domain on the cPanel account, while the public file contains the corresponding public keys.

homedir

The /homedir directory contains a copy of the account’s /home directory. This file is created using the getpwnam command. It encompasses the contents of the account’s /home directory.

Note: The /home directory typically includes the public_html folder, which serves as the default document root for the account’s primary domain.

httpfiles

The /httpfiles directory contains the account’s custom virtual host templates.

ips

The /ips directory contains the related_ips file, which lists the IPv6 addresses present on the account’s server.

locale

The /locale directory contains an account’s custom locale settings.

logs

The /logs directory contains copies of the account’s log files from the /usr/local/apache/domlogs directory. These files contain data tracked by the log file.

mm

The /mm directory contains the account’s Mailman mailing list files. Each mailing list has its own subdirectory within this directory.

mma

The /mma directory contains all Mailman files for the account’s domains. The copied files are organized into subdirectories corresponding to each type of mailing list:

• pub/ — This directory contains all Mailman files from the /usr/local/cpanel/3rdparty/mailman/archives/public directory for the account’s domains.
• priv/ — This directory contains all Mailman files from the /usr/local/cpanel/3rdparty/mailman/archives/private directory for the account’s domains.

mms

The /mms directory contains files from the account’s /usr/local/cpanel/3rdparty/mailman/suspended.lists directory.

mysql

The /mysql directory contains the account’s MySQL® dumps for any of its MySQL databases. These files are stored in USER_database.sql format, where USER is the account’s username.

mysql-timestamps

The /mysql-timestamps directory contains log files indicating when an account created a MySQL database. These files are stored in .txt format and contain the MySQL database creation timestamp in Unix time format.

psql

The /psql directory contains the account’s PostgreSQL® database files, in .tar file format. It also includes the following files:

• 1psql_users.sql — This file lists all PostgreSQL users for the account.
• psql_grants.sql — This file details all PostgreSQL grants for the account.

resellerconfig

The /resellerconfig directory contains a reseller account’s reseller file. This file includes data from the account’s /var/cpanel/resellers file, such as the account’s username and all its access control list (ACL) privileges. Additionally, the /resellerconfig directory contains the resellers-nameservers file, which holds the account’s entry from the /var/cpanel/resellers-nameservers file.

resellerfeatures

The /resellerfeatures directory contains a reseller account’s custom feature lists.

resellerpackages

The /resellerpackages directory contains a reseller account’s custom packages.

ssl

The contents of the /ssl directory are found within the backup file’s /homedir/ssl directory.

sslcerts

Note: The contents of this directory are located in the backup file’s /homedir/ssl directory.

The /sslcerts directory contains the certificate files for each of the account’s domains. This directory includes the following files, where DOMAIN is the account’s domain name:

• DOMAIN.crt — The domain certificate file.
• DOMAIN.cabundle — A copy of the domain’s Certificate Authority (CA) bundle.
• DOMAIN.csr — A copy of the certificate-signing request (CSR).

These files are copied from the following directories:

• /usr/share/ssl/certs
• /etc/ssl/certs
• /var/cpanel/ssl/installed/certs
• /usr/local/ssl/certs

sslkeys

Note: The contents of this directory are located in the backup file’s /homedir/ssl directory.

The /sslkeys directory contains all SSL keys for the account’s domains. This file is copied in DOMAIN.key format, where DOMAIN represents the account’s domain name.

suspended

The /suspended directory contains a copy of the file from the account’s /var/cpanel/suspended directory. Files are copied in USER or USER.lock format, where USER is the account username. Each file indicates the reason for the account suspension, if applicable.

suspendinfo

The /suspendinfo directory contains a copy of the files from the account’s /var/cpanel/suspendinfo directory.

userconfig

The /userconfig directory contains a copy of the files from the /var/cpanel/userconfig directory. This file includes symlinks from the account’s public_html directory.

userdata

The /userdata directory contains the user data for the account’s subdomain or domain. Files in this directory are copied from the /var/cpanel/userdata/USER directory, where USER is the account’s username.

va

The /va directory contains any of the account’s autoresponders. This file is copied from the /etc/valiases/ directory.

vad

The /vad directory contains a copy of the account’s virtual domain aliases. This file is copied from the /etc/vdomainaliases directory.

vf

The /vf directory contains a copy of the user’s Exim filters. The system creates copies of the filters owned by the user from the /etc/vfilters directory.

Files without a Directory

The following files are found directly within the tarball, not residing within a specific directory:

addons

The addons file contains a hash of the account’s addon domains and their corresponding subdomains.

autossl.json

The autossl.json file contains the account’s AutoSSL run preferences. This file also includes any AutoSSL run restrictions set by the system administrator.

bandwidth_db.json

The bandwidth_db.json file contains the account’s bandwidth data information.

bandwidth_db.data.json

The bandwidth_db.data.json file contains the account’s bandwidth usage data.

digestshadow

The digestshadow file contains the passwords for the account’s DAV digest authentication for cPanel’s Web Disk feature (cPanel » Home » Files » Web Disk).

has_sslstorage

The has_sslstorage file is a touch file that indicates the account utilizes WHM’s SSL Storage Manager feature (WHM » Home » SSL/TLS » SSL Storage Manager). It is stored in crtindex.txt format.

homedir_paths

The homedir_paths file contains the full path to the account’s /home directory.

mysql.sql

The mysql.sql file contains the account’s MySQL database grants.

mysql_host_notes.json

The mysql_host_notes.json file contains user-provided description information for the account’s MySQL database hosts, if available.

nobodyfiles

The nobodyfiles file contains a list of files in the account’s /home directory that are owned by the nobody system user.

pds

The pds file contains a list of the account’s parked domains (aliases).

proftpdpasswd

The proftpdpasswd file contains a copy of the account’s ProFTPd file from the /etc/proftpd directory.

quota

The quota file contains the account’s quota size, measured in bytes.

sds

The sds file contains a list of the account’s subdomains.

sds2

The sds2 file contains a hash of subdomains and their respective document roots.

shadow

The shadow file contains a copy of the account’s password, as returned by the getpwnam command.

shell

The shell file contains the account’s login shell.

version

The version file contains the account’s pkgacct version number and its archive version number.

webcalls.json

The webcalls.json file contains the account’s web call data, such as its dynamic DNS domains.