The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

API or other empircal means for determining if IP is blocked by LSF or Hulk

Discussion in 'Security' started by willsherwood, Sep 18, 2013.

  1. willsherwood

    willsherwood Registered

    Joined:
    Jun 5, 2006
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    our cpanel servers use two types of firewalls CSF/LFD which completely blocks an IP address from any access (including viewing web pages), and
    "hulk" which just blocks logging in (to email, ftp, cpanel, prot dir, etc.)

    from our (separate) support site server, we have JS to test and ascertain if the IP address the customer is viewing from is blocked via LFD (a long equation that tries to dis-ambiguate server down and slow server). Unfortunately there are no APIs that we can find to test for an IP being on the "deny" list, so this empirical method gets us 99% there, and is good enough for the effort expended. (Anyone know of a better way?)

    However we've not been able to find a way to test for an IP being on the HULK (login) block list. (again, we cannot find any APIs that our support server can cURL-check for an IP address).
    Does anyone know of an (empirical) technique to test for Hulk blocking login from a given IP?
    we've tried to think of a way to have a generic test account (that doesn't do anything or have any privs in case a hacker finds out about it), but cannot find a way to have a cURL to attempt login and determine success.

    any ideas?

    thanks
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    675
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    cPhulk stores the blocked IP addresses in it's MySQL database. You could develop a script that queries the database for a list of IP addresses that have been blocked.

    Thank you.
     
Loading...

Share This Page