How come my WHM was accessed using root by one who doesn't have password?

[frankhsu]

My WHM has been accessed using root by our branch office in other country, they only have FTP's account and password, there's no any way for them to get root's password.

It happend once last month, and i already change root's password.

But my WHM sent an e-mail of WHM root access alert just few minutes ago.

Is there any possible for them to access WHM with their ftp password or what?


our branch office is using a different ip from us, and we don't have any VPN between us.

[sharmaine001]

My WHM has been accessed using root by our branch office in other country, they only have FTP's account and password, there's no any way for them to get root's password.

It happend once last month, and i already change root's password.

But my WHM sent an e-mail of WHM root access alert just few minutes ago.

Is there any possible for them to access WHM with their ftp password or what?

There can be 2 things from what Ive observed:

1. You have a cached WHM where you didnt log out and your branch office was able to access the cached session
2. I observe that when one IP has successfully logged in to WHM and then an attempt to log in using the same IP was made even if it is not successful, WHM sends out an email that it has logged in the server as root. I dont know why such that so to check if they were really able to log in to the server, check your logs.

[cPanelDon]

WHM does not send out an e-mail upon someone logging-in; the e-mail would have been generated by a non-stock modification or third-party software.

I recommend checking the following two log files and cross-referencing similar entries (e.g., those with a matching IP address) to help determine specific information about the login attempts and what, if anything, was accessed beyond the attempted login:

/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/login_log

If using cPHulk the following log file may also be checked:

/usr/local/cpanel/logs/cphulkd.log