3

I have WHM hosted on a virtual-dedicated Linux Enterprise Centos 5 server hosted at iWeb.

Now and then my root password will stop working. I will get a red message saying: "The login is invalid."

The problem is that I know I have the right password. I can login via ssh and change the root password using "scripts/chpass root newpassword" and that won't solve the problem.

I suspected it might have to do with cpHulk brute force protection. So, again via SSH, I reset the brutes and logins MySQL tables. This does not solve the problem.

The ONLY way I found to solve the problem is to "re-initialize the smart layer" on my virtual-dedicated server.

Improve this question
1
  • 1
    I can confirm this random root password behavior -- Its happening on our servers from time to time as well. CentOS 6.6 with CloudLinux. Ive also had it happen a handful of times at SSH which is very strange. I thought we were exploited multiple times due to this. We have whitelisted IP's, set ACL's, etc...its just strange how random it is. The one thing i noticed is that a couple times it happened after a higher (host level) sysadmin was in there doing tasks. Perhaps its locked in some localnet session? Some higher level Cent/cPanel management trickery we are missing? Cpanel updates lockout?
    – dhaupin
    Jan 27, 2015 at 16:06

2 Answers 2

Reset to default
2

You are right. This behavior is very similar when cPHulk Brute Force Protection blocks your IP address or the account.

If only your IP address is blocked then it is easy to get access back by switching to another IP address. If that's not an option then another solution is to whitelist your IP address via SSH,

/scripts/cphulkdwhitelist x.x.x.x

Ref. cPHulk Brute Force Protection :: manage whitelists in the command line

I would also suggest you to go through your cpHulk settings and configure it by considering this kind of situation. Keep Maximum Failures By Account higher than Maximum Failures Per IP. So there are more chances to get the access back only by switching the IP address.

Improve this answer
2

The problem seems to have been resolved.

I was going through the logs and noticed the server was under constant root login attack.

I have installed DenyHosts and denied SSH login with passwords. The problem has not happened since then.

I was shocked to see how many foreign IP addresses (from Russia, China, etc.) were trying to root login to my server!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.