WHM and Locked Out

[GaryT]

Three times this has happened to me !

Time: Mon Jul 5 13:08:27 2010 -0600
IP: 200.13.251.158 (CO/Colombia/-)
Failures: 10 (pop3d)
Interval: 300 seconds
Blocked: Permanent Block

Log entries:

Jul 5 13:04:53 hosting pop3d: LOGIN FAILED, user=spam, ip=[::ffff:200.13.251.158]
Jul 5 13:04:59 hosting pop3d: LOGIN FAILED, user=nospam, ip=[::ffff:200.13.251.158]
Jul 5 13:05:03 hosting pop3d: LOGIN FAILED, user=spam, ip=[::ffff:200.13.251.158]
Jul 5 13:05:04 hosting pop3d: LOGIN FAILED, user=spamuser, ip=[::ffff:200.13.251.158]
Jul 5 13:05:09 hosting pop3d: LOGIN FAILED, user=nospam, ip=[::ffff:200.13.251.158]
Jul 5 13:05:10 hosting pop3d: LOGIN FAILED, user=mailscanner, ip=[::ffff:200.13.251.158]
Jul 5 13:05:14 hosting pop3d: LOGIN FAILED, user=spamuser, ip=[::ffff:200.13.251.158]
Jul 5 13:05:16 hosting pop3d: LOGIN FAILED, user=pop3-login, ip=[::ffff:200.13.251.158]
Jul 5 13:05:20 hosting pop3d: LOGIN FAILED, user=mailscanner, ip=[::ffff:200.13.251.158]
Jul 5 13:05:22 hosting pop3d: LOGIN FAILED, user=mailman, ip=[::ffff:200.13.251.158]

Yeah its doing a fine JOB but it locks me out. Its starting to p**s me off now - Any suggestions - I can still get SSH access though !

[Miraenda]

Is it cPHulk Brute Force Protection locking you out of the machine? If so, you can add your IP into WHM > CPHulk Brute Force Protection area's Trusted IP List (it's a link on that page). If your IP is trusted, you shouldn't be locked out again by it.

If this isn't cPHulk but LFD via CSF blocking you on the machine, then you simply would again whitelist your IP on it using this command in root SSH:

csf -a IP#

You'd replace IP# with your actual IP number. If you aren't certain which IP you are connecting from, you can visit a site like http://whatismyip.com and it will show you what your IP happens to be.

[GaryT]

Thank you for the VERY FAST reply / support.

I will try this now but MY Ip changes daily

[Miraenda]

If your IP changes daily but stays in a similar range, you could whitelist the range instead:

74.74.74.0/24

Something like that should probably work there if your IP were normally in the 74.74.74. range but only the last octet keeps changing.

[GaryT]

That command worked a treat - So I guess judging by that brute force is working fine - But yes I did get that on WHM screen - It says brute force was detected.

[Miraenda]

Great to hear that worked for you

Yes, it is definitely working well to block out the users who aren't whitelisted trying to hit that set account.

[GaryT]

shame WHM root user cant be changed

Your fast help towards me was highly appreciated !

[Miraenda]

You are very welcome. I'm glad I could be of assistance