cPHulk Brute Force Protection

[Flatliner]

Can anyone advise me with these settings please? Should I enable/Disable?

IP Based Brute Force Protection Period in minutes: Brute Force Protection Period in minutes: Maximum Failures By Account: Maximum Failures Per IP: Maximum Failures Per IP before IP is blocked for two week period: Extend account lockout time upon additional authentication failures:

[Flatliner]

Anyone know anything about cPHulk Brute Force Protection ? Anyone using it?

[Flatliner]

It is in my whm panel Security Center Section. I am running WHM 11

[gflamerich]

Never heard about "cPHulk Brute Force Protection" .... but it's not only me, neither google does ....

Do you have any link where we may found it?

[gflamerich]

Yeap, it's in the changelog,

11.1.0 (build 45) - EDGE Tree Thu Jan 18 22:34:36 2007
Added cphulkd, the cPanel Brute Force Protection service. This service monitors failed authentication attempts and locks out accounts after the threshold is met.

Seems that will need to wait for someone from cpanel to explain this new feature.
Maybe Chirpy has news regarding this, as he developed the csf.

[ramprage]

Yeap, it's in the changelog,

Seems that will need to wait for someone from cpanel to explain this new feature.
Maybe Chirpy has news regarding this, as he developed the csf.

I dont' see how Chripy will know more than anyone else after using it or reading the change log. He's not a cPanel developer

It sounds like a service daemon which actively monitors failed logins.

[sampride]

From the chagelog it said:
"Added cphulkd, the cPanel Brute Force Protection service. This service monitors failed authentication attempts and locks out accounts after the threshold is met."

[ramprage]

Test server using Edge, Security Center shows:

cPHulk Brute Force Protection

cPHulk Brute Force Protection prevents malicious forces from trying to access your server's services by guessing the login password for that service.

Log apparently is in: /usr/local/cpanel/logs/cphulkd_errors.log
Daemon is: /usr/local/cpanel/cphulkd.pl

[norelidd]

Does cphulkd replace csf/lfd or does it augment it? How should we have the two set up, or do we choose one over the other?

[chirpy]

It uses a different method/measure for blocking. It's another layer of security and should live happily with csf+lfd.

[gorilla]

it does live happily with csf + lfd

[Kelmas]

Very nice tool, have it enabled

[Mindlash]

I've been using it for a little over a week now.

Had one client call me about being 'locked out' -- but then they realized it was their fault -- and I simply said "It's an added measure of security" which they quickly appreciated.

At any rate... my log file is filled with hundreds/thousands of simliar lines:

Timeout while waiting for response at /usr/local/cpanel/Cpanel/Hulkd.pm line 182, <GEN102589> line 2.
Timeout while waiting for response at /usr/local/cpanel/Cpanel/Hulkd.pm line 182, <GEN102640> line 2.
Timeout while waiting for response at /usr/local/cpanel/Cpanel/Hulkd.pm line 182, <GEN102691> line 2.
Timeout while waiting for response at /usr/local/cpanel/Cpanel/Hulkd.pm line 182, <GEN102726> line 2.
Timeout while waiting for response at /usr/local/cpanel/Cpanel/Hulkd.pm line 182, <GEN102759> line 2.
Timeout while waiting for response at /usr/local/cpanel/Cpanel/Hulkd.pm line 182, <GEN102790> line 2.


Thoughts?

[brendanrtg]

Since most of us already have csf + lfd installed, why the need for CPHulk when its basically doing the same thing?

Wont this slow the server down?

[Un Area]

well if you dont use csf lfd the tool is handy anyways.