Major Scurity Problem....

[JeanGenie]

Hi all

I have taken over a server from a failing company so am a newbie I suppose....

Anyhow have been plodding along and each time I have a problem do some research and get it sorted but this one has me stumped...

If you take any domain of my clients on my server and add /cpanel at the end a box appears asking for user and passowrd. If you enter admin and changeme you get access to all the accounts on my server.... I have even asked the server suppliers and they havent got a clue how I reset it to something a lot more secure...

Does anyone know how I reset it please, I dont want any of my clients to find out..

Thanks
JG

[cPanelDavidG]

Hi all

I have taken over a server from a failing company so am a newbie I suppose....

Anyhow have been plodding along and each time I have a problem do some research and get it sorted but this one has me stumped...

If you take any domain of my clients on my server and add /cpanel at the end a box appears asking for user and passowrd. If you enter admin and changeme you get access to all the accounts on my server.... I have even asked the server suppliers and they havent got a clue how I reset it to something a lot more secure...

Does anyone know how I reset it please, I dont want any of my clients to find out..

Thanks
JG

Do you have a reseller or user on the system whose username is admin and their password is changeme?

[JeanGenie]

Do you have a reseller or user on the system whose username is admin and their password is changeme?

I dont belive so but I do have a demo account with the user name admin, but the password I have changed, tho it wasnt changeme in the first place....

[Infopro]

Click the Password Modification icon in your cPanel and change the accounts password. Logout and close your browser then go back and try it again using admin and changeme.

admin is a bad username to begin with. The "box that appears" is htaccess password protected directory and should be secure if the username and password are not so easy to guess.
http://httpd.apache.org/docs/1.3/how...cess.html#what

[JeanGenie]

Click the Password Modification icon in your cPanel and change the accounts password. Logout and close your browser then go back and try it again using admin and changeme.

admin is a bad username to begin with. The "box that appears" is htaccess password protected directory and should be secure if the username and password are not so easy to guess.
http://httpd.apache.org/docs/1.3/how...cess.html#what

I just complete deleted the account and it seems to have stopped it.. Thnaks for your help and the first beer is on me, if ever I get over the pond that is..... thanks

[Infopro]

If I understand you correctly you've taken over an entire server and that server had the cPanel demo enabled? If so I'd disable it via WHM. On the left menu in WHM, at top type in Demo and you'll find the option there. (of course deleting the account would work in the same way I guess)