osyrys14

Member
Jul 5, 2013
23
0
1
cPanel Access Level
DataCenter Provider
I was logged in using the admin (root login), was working fine since it finally got up and running, randomly this afternoon, it logged me out, and I can't log back into the GUI, but can still SSH with the same credentials. Any idea what caused that and how to fix it?

Osyrys
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,203
363
Hello :)

Check to see if the "root" user has been blocked by cPHulk brute force protection:

"WHM Home » Security Center » cPHulk Brute Force Protection"

The "Login/Brute History" report should include entries for "root" if it's been triggered recently. If it has, you may want to add your IP address to the white list to ensure it's excluded from the lockouts.

Thank you.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,203
363
Is there a way to do this manually from SSH, because now NONE of the accounts can log in, and root was the only administrator.
Do you receive any specific login failure messages? The fact that SSH access works for the same username indicates it may not be an issue with cPhulkd. That being said, you can disable it via:

Code:
for i in `ps aux | grep -i "cphulkd - process" | awk {'print $2'}` ;do kill -9 $i ;done
/usr/local/cpanel/bin/cphulk_pam_ctl --disable
Remember to enable it again when you have ruled it out as the cause of the problem.

Thank you.
 

osyrys14

Member
Jul 5, 2013
23
0
1
cPanel Access Level
DataCenter Provider
Kernow, definately not a browser issue caching anything, I've checked all 3 browsers and have only ever logged in through one.

Michael, see attached with the login error it gets, I will test your post and see if that makes a difference.
next cpanel error.png
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,203
363
You can browse to "WHM Home » Security Center » cPHulk Brute Force Protection" and see if there is any brute history for your IP address.

Thank you.
 

osyrys14

Member
Jul 5, 2013
23
0
1
cPanel Access Level
DataCenter Provider
I found the cause of this issue, it was DNS (kinda), I was using the FQDN cpanel.anttel.com.au, which is what our current host is using (we're looking to move it internally), so depending on which DNS it was hitting for authentication, was which server I was hitting trying to get to the GUI login, I changed what we're using for the name, and stopped the problem. I hadn't realised that it was being used by our host because their DNS doesn't list on our cPanel DNS list. Thanks for the help Michael!