Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Cant login in as root - help!

Discussion in 'Security' started by AusDataHost, Apr 14, 2014.

  1. AusDataHost

    AusDataHost Member

    Joined:
    Feb 18, 2006
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    151
    Hello all

    I have a server running Centos and cpanel.

    I logged in as root to remove an IP from a black list on sunday no problems yet today i can't login - saying incorrect password.

    Server is quite well protected and i have not had any unusual emails regarding suss logins etc

    Loads are low.

    Any ideas? server is in a data centre so its a bit tricky to diagnose with no access :(

    thanks
    Luke
     
  2. AusDataHost

    AusDataHost Member

    Joined:
    Feb 18, 2006
    Messages:
    8
    Likes Received:
    0
    Trophy Points:
    151
    Got it booted into single user mode and could login via ssh and su to root

    any suggestions why that would work but not in normal mode?

    - - - Updated - - -

    reset pw in single user mode and now its working

    Little unnerving though - still concerned its compromised
     
  3. SS-Maddy

    SS-Maddy Well-Known Member

    Joined:
    Mar 28, 2009
    Messages:
    104
    Likes Received:
    6
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    Please run rkhunter or chkrootkit in your server to ensure the server is safe. I hope you have patched the server for heartbleed though.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,363
    Likes Received:
    1,855
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    Do you have cPHulk brute force detection enabled? If so, check the "Login/Brute Force History Report" to see if the "root" account was locked out.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice