Root Login to WHM

[bamaster]

I've searched without success. And I think there's a simple answer for this, so excuses my ignorance.

When logging into WHM, is it normal to be given a dialog box for entering a username and password?

For some reason, I cannot remember if this is correct. When entering my root username and password, I cannot get in. If I click Escape, then it sends me to the web-based login screen. Which does accept my credentials.

I've recently been hacked and I fear that a password may have been compromised. So I am in the middle of changing all my passwords and locking down the server. (Which by the way, I would appreciate any links to good how-to's in this area).

Thank you in advance!

[driverC]

Yes, when you visit the WHM address: https://IP.IP.IP.IP:2087 a log in screen pops up asking for your usernamed and password. If you can not log in using your root password you are using the wrong password, the password was changed or your /etc/shadow file is corrupted. Maybe the hacker changed the password. The DC can fix it by booting the server into single user mode and changing the root password using the passwd command.

I had a similar problem with a hacker recently. He kept changing the root password. What I did was to blacklist all IPs on all ports except for the IP of another server of mine. Then I used SSH to transfer the accounts to this server. I used SSH on the other server to log in to the hacked server (as I couldn't connect from my computer since all IPs were blocked)

[jayh38]

ALso see if your DC offers KVM then take down the network and clean up.

[UBERHOST]

So I am in the middle of changing all my passwords and locking down the server. (Which by the way, I would appreciate any links to good how-to's in this area).

Here are some good basics and beyond to review:

• Securing CPanel
• Using John the Ripper
• Disable commonly abused PHP functions for increased security
• Strategies for Keeping a Secure Server
• Exploit Removal
• To check for possible hack/shell attempts
• Securing MySQL

Hope there is something useful to you in those links.

Cheers,
Rick