Access To SSH, Root Password not working for whm!

[jaytay]

Hi,
I am new here so please be kind, that said i need help with a couple things.

I have tried getting access to my WHM/cPanel.

I have used a proxy server and now can pull the WHM/cPanel up.

I have full (ROOT) access, and have turned off ICF & Brute force.
I can ping my server with out any issues.

----TRIED LOGGING IN FROM VPN-----

With out any success I have gained access to the WHM login page. I have changed my root password 4 times.
However that password will not let me in!

It did for a minute yesterday it said login successful, I have already white-listed my ip before turning of the firewalls and all.

I am in need of help asap.

 

[jaytay]

I still cannot access, I get a blank white page.

I can pull up websites on the server no problem!

 

[cPanelMichael]

Hello

Please review the following log file:

/usr/local/cpanel/logs/login_log

Do you notice any specific error messages in this log file during the failed access attempts?

Thank you.

 

[nibb]

Are you sure the server is not compromised? To change the root password and for it to work only for a couple of minutes, and then not again means usually you are hacked.

Also, the proxy? Is the proxy one you control or trust? If not I would not use it to enter logins on any website.

 

[jaytay]

CP-
2**.54.**.*** - frie**** [01/10/2014:03:58:29 -0000] "GET /logout/?locale=en HTTP/1.1" FAILED LOGIN cpaneld: cookie ip check: IP address has changed

This is all that is in their from just now.


**MODERATED BY ME FOR SERVER SAFETY!


nibb-
I dont use a proxy I use my personal Tunnel.
And I have changed my root password 5 times. So i don't think i'm hacked.

 

[nibb]

CP-
2**.54.**.*** - frie**** [01/10/2014:03:58:29 -0000] "GET /logout/?locale=en HTTP/1.1" FAILED LOGIN cpaneld: cookie ip check: IP address has changed

This is all that is in their from just now.


**MODERATED BY ME FOR SERVER SAFETY!


nibb-
I dont use a proxy I use my personal Tunnel.
And I have changed my root password 5 times. So i don't think i'm hacked.

The problem is with your tunnel that keeps changing your IP address. cPanel logs you out, since you load the login page with one IP then try to log in with another one.

 

[jaytay]

I have reformatted, my server and this issues still remains after i use Soluslabs VPS control panel. To re'install the OS, I choose "Centos 6.3 64bit with Cpanel" fresh install, but the root password for the server still does not work!! **STUMPED**

 

[cPanelPeter]

Hello,

Are you by any chance using CloudFlare? I've seen instances in the past where CloudFlare is logging people out with the exact error you're reporting (IP address changed). Disabling CloudFlare solved the problem. If you're not using CloudFlare, please open a support ticket using the link in my signature so that one of our analysts can take a look at this for you.

 

[cPanelMichael]

I have reformatted, my server and this issues still remains after i use Soluslabs VPS control panel. To re'install the OS, I choose "Centos 6.3 64bit with Cpanel" fresh install, but the root password for the server still does not work!! **STUMPED**

Did you review the response from the other poster on this thread? It states:

The problem is with your tunnel that keeps changing your IP address. cPanel logs you out, since you load the login page with one IP then try to log in with another one.

Did you verify that's not the case here?

Thank you.

 

[jaytay]

Hi, Im at work, no tunnel no nothing.

& yes i use cloud flare, have been for the past 4 years. sense it was launched. Let me check those settings I will get back to you thanks for your replies :D

 

[jaytay]

(I HAVE REBUILT THE SERVER FROM SCRATCH) and replaced adapters. All fixed now thanks anyways