SOLVED All login attempts going to one-day list blacklist

[norberto.nunez]

Hi
All login atemp from my country goes to one-day blacklist in our server.
The behavior is the same in WHM (root user) or whatever user account.
The client IP goes to the one-day blacklist at the first time, even if the password is correct.
On country management our country is not blaclisted.

 

[cPanelLauren]

Hello @norberto.nunez

Are you able to log in to the server via CLI without being blocked? If so can you check the cPHulk logs? You can find them here:

/usr/local/cpanel/logs/cphulkd_errors.log
/usr/local/cpanel/logs/cphulkd.log

You may also want to disable cPHulkd until this issue is resolved by running the following:

/usr/local/cpanel/bin/cphulk_pam_ctl --disable

 

[norberto.nunez]

Hi.
I login to server from internal network directly, 10.150.60/24 network, on CLI and GUI (WHM) as well without problem.
The issue is with the 190.104.128/18 IPs. This block and wahtever subblock is not in our blacklist.
When I disable CPhulk, there is not problem
Thank you

 

[cPanelLauren]

Hello @norberto.nunez

You did mention that the IP address wasn't listed on your blacklist for cPHulkd previously, what I requested was entries relating to these in the cPhulk logs for further information. Also, even though you note that your country is not blacklisted in CC blocking, what countries are blacklisted presently?

 

[norberto.nunez]

Hi @cPanelLauren
There is not explicitly country blacklisted in country management
As can you see in attached, the IP 190.104.xxx.xx was listed at the first attempt, and it was previusly not in blacklist

 

[cPanelLauren]

Hello,

Thank you for that. I also just noticed that it appears you have a ticket open for this. For resolving this situation the ticket is going to be the most efficient method as they have access to the server where we don't here in the forums. I'll update here when there are further updates to the ticket though.

 

[norberto.nunez]

OK, I saw it went to level 3 analysis

 

[cPanelLauren]

I saw that as well, I'm following the ticket too.

 

[norberto.nunez]

The issue has been solved with the ticket number 13303953

There was a malformed block (179.184.0.0-255.255.255.255) in blacklist that englobing our prefixes

Thank you for your support