When managing web servers, the best cybersecurity practice is to keep password-based root access disabled. However, this poses a challenge when using the WHM Transfer Tool, as the destination server needs to connect to the source server to extract the data.
To keep security intact and avoid leaving permanent private keys that could be exploited in the future, the safest method is to use ephemeral SSH keys (temporary). This process creates a secure bridge that exists only during the minutes the migration takes.
Below, we explain how to perform this process in 4 simple steps.
The server receiving the accounts will initiate the connection, so it needs to generate the private key.
Log in to the WHM of the Destination server.
In the left-hand menu, look for the Security Center section and click on Manage root’s SSH Keys.
Click the Generate a New Key button.
Assign an easy-to-identify name, for example: migration_server1_to_server2.
You can leave the passphrase field empty or set a password you can easily remember.
Click on Generate Key.
Now we must tell the source server to trust the key we just created.
On the Destination server (where you generated the key), go to your key list and click on View/Download Key under the Public Keys column of your new temporary key. Copy the entire text of the public key.
Log in to the WHM of the Source server.
Go to Security Center > Manage root’s SSH Keys and click on Import Key.
Assign a name to the key (e.g., migration_server1_to_server2) and paste the text you copied into the lower box designated for the public key. Leave the private key box empty and click Import.
Return to the key list on the Source server, find the newly imported key, click on Manage Authorization and then press Authorize.
With the communication bridge established, you can now perform the migration smoothly.
Return to the WHM of the Destination server and open the Transfer Tool.
In the Remote Server Address field, enter the IP of the Source server.
In the Authentication section, select SSH Public Key.
In the keys dropdown menu, select the temporary key you created in Step 1 ( migration_server1_to_server2 ).
Click on Fetch Account List. Select the packages or cPanel accounts you want to migrate and execute the transfer normally.
This is the most important step of the methodology. Once you confirm the migration has finished successfully, you must destroy the communication bridge to avoid long-term risks.
On the Source server, go to Manage root’s SSH Keys and delete the temporary public key you authorized in Step 2.
On the Destination server, go to Manage root’s SSH Keys and delete both the public and private keys you generated in Step 1.
By deleting these keys, you ensure that no server retains direct access to other nodes in your infrastructure, keeping the architecture isolated and protected against lateral movement.