Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Locked out of WHM

[Joomla]

I got locked out from WHM... but I can login through SSH.

----
Brute Force Protection
This account is currently locked out because a brute force attempt was detected. Please wait 10 minutes and try again. Attempting to login again will only increase this delay. If you frequently experience this problem, we recommend having your username changed to something less generic.
----

Where can I bypass this so I can log in WHM?

Thanks.

[THAMAN]

Contact your data center, have them login and whitelist your IP

[Joomla]

This is not configured somewhere in WHM? Like I said, I can ssh as root. So I think, it's not in the datacenter level, otherwise I shouldn't be able to login in shh.

[THAMAN]

Originally Posted by Joomla

This is not configured somewhere in WHM? Like I said, I can ssh as root. So I think, it's not in the datacenter level, otherwise I shouldn't be able to login in shh.

No its not, the only way for you to get it is to login from a different IP, thats why i suggested you have your data center do it for you!

[boxer]

run this from ssh as 1 command

su;replace -v "referrersafety=1" "referrersafety=0" -- /var/cpanel/cpanel.config;/usr/local/cpanel/whostmgr/bin/whostmgr2 --updatetweaksettings

delete your cookies and relogin

Cheers !

[Joomla]

I figured it out. cphulkd blocked my ip. I can login now. Thanks for your suggestions though. And Just like I thought, I don't have to deal with the datacenter.

Sep 23 16:30:20 localhost cphulkd[18236]: Connection service=system ip=24.xx.xxx.xxx port= user=<user> blocked by cphulkd (IP Address listed as brute)
Sep 23 16:30:20 localhost pure-ftpd: (?@24.xx.xxx.xxx) [WARNING] Authentication failed for user [user]
Sep 23 16:31:17 localhost cphulkd[18599]: Connection service=system ip=24.xx.xxx.xxx port= user=<user> blocked by cphulkd (IP Address listed as brute)

Now I just have to whitelist my ip.

[boxer]

you used csf ?

[Joomla]

Originally Posted by boxer

run this from ssh as 1 command

su;replace -v "referrersafety=1" "referrersafety=0" -- /var/cpanel/cpanel.config;/usr/local/cpanel/whostmgr/bin/whostmgr2 --updatetweaksettings

delete your cookies and relogin

Cheers !

Thanks on this. WHM already cleared me after 10 minutes. But the user is still blacklist from FTP login from my ip by cphulkd. I just need to clear it.

[Joomla]

Originally Posted by boxer

you used csf ?

Yeah. I think I already know what to do. That is NOT to call my data center for sure. =D

[Tim Greer]

Right, not data center or cfs related. This is a setting in WHM, for those that don't know. Too many login failures from one IP within a specified time frame, will block that IP from access for an additional specified time. This is to prevent password guessing/brute force. The above solution works, and for SSH, you can reload/restart/clear the service as well.

[boxer]

Tim ..

as u said this problem i faced before ...

the solution is in TweakSetting .

he should to update his ip in Tweaksetting through this command

su;replace -v "referrersafety=1" "referrersafety=0" -- /var/cpanel/cpanel.config;/usr/local/cpanel/whostmgr/bin/whostmgr2 --updatetweaksettings


and am sure after this he can access it !

regards

[Tim Greer]

I believe the OP had stated they were able to gain access again already. I've not looked at the Cpanel config file to see what setting or variable (argument) it takes for this feature, but the "referrersafety" name is a poorly chosen one if that's related to brute force settings. Several quick solutions can resolve the issue, but be sure to to re-enable it after clearing it, if you allow the world to access the WHM ports.

[Joomla]

I got locked out because of this one web account that won't go through FTP login. All other accounts can go though except for this one...

---
Sep 23 17:18:28 localhost pure-ftpd: (?@24.xx.xxx.xxx) [INFO] New connection from 24.xx.xxx.xxx
Sep 23 17:18:30 localhost pure-ftpd: (?@24.xx.xxx.xxx) [WARNING] Authentication failed for user [account]
Sep 23 17:18:35 localhost pure-ftpd: (?@24.xx.xxx.xxx) [INFO] Logout.
---

And I still can't login to FTP using this one web account. I know the password is right because I can login though CPANEL. But on FTP it won't.

Any ideas?

[Tim Greer]

Are you sure the passwords are synced for Cpanel and FTP? Check the encrypted password in the /etc/proftpd/passwd.vhosts and /etc/proftpd/username files against the encrypted (using the same salt) password you think it is. Is this just an issue for the one account, or FTP altogether?

[Joomla]

Originally Posted by Tim Greer

Are you sure the passwords are synced for Cpanel and FTP? Check the encrypted password in the /etc/proftpd/passwd.vhosts and /etc/proftpd/username files against the encrypted (using the same salt) password you think it is. Is this just an issue for the one account, or FTP altogether?

I FTP to my main domain using all my web accounts. It's just a problem with this one account. I can login fine with the others.

The encrypted passwords are the same.