Fix cphulkd brute force protection so blocks attacker IP instead of blocking everyone

[tian]

Hi,

Right now when cphulkd brute force protection detects a brute force attack, it blocks access to the account for everyone rather than just blocking the IP address that is doing the attack.

Since any server running services on the Internet will routinely have scans/attacks on it, it doesn't make sense to block everyone (including legitimate customers) from accessing their site when somebody is trying to do a brute force attack.

Also, if they're trying to brute force the root account, you're locked out of your server until the brute force block expires. I know there is a whitelist but customers won't always be connecting from the same IP addresses.

Tian

[cPanelDon]

Hi,

Right now when cphulkd brute force protection detects a brute force attack, it blocks access to the account for everyone rather than just blocking the IP address that is doing the attack.

Since any server running services on the Internet will routinely have scans/attacks on it, it doesn't make sense to block everyone (including legitimate customers) from accessing their site when somebody is trying to do a brute force attack.

Also, if they're trying to brute force the root account, you're locked out of your server until the brute force block expires. I know there is a whitelist but customers won't always be connecting from the same IP addresses.

Tian

An IP address will be locked-out when the "per IP" or IP-based threshold is reached, such as that of "Maximum Failures Per IP" and "Maximum Failures Per IP before IP is blocked for two week period"; both of these configuration options can be customized using WebHost Manager (WHM). I recommend reviewing our documentation to help further clarify specific usage of cPHulk as configured via WHM.

Reference menu path and documentation: WHM: Main >> Security Center >> cPHulk Brute Force Protection

[cPanelDavidG]

This seems to be a configuration flaw on that particular server than a lack of functionality in cPanel/WHM. I will close this thread and archive it. If you believe I am doing this in error, please send me a PM.