Cant login in as root - help!

[AusDataHost]

Hello all

I have a server running Centos and cpanel.

I logged in as root to remove an IP from a black list on sunday no problems yet today i can't login - saying incorrect password.

Server is quite well protected and i have not had any unusual emails regarding suss logins etc

Loads are low.

Any ideas? server is in a data centre so its a bit tricky to diagnose with no access

thanks
Luke

 

[AusDataHost]

Got it booted into single user mode and could login via ssh and su to root

any suggestions why that would work but not in normal mode?

- - - Updated - - -

reset pw in single user mode and now its working

Little unnerving though - still concerned its compromised

 

[SS-Maddy]

Please run rkhunter or chkrootkit in your server to ensure the server is safe. I hope you have patched the server for heartbleed though.

 

[cPanelMichael]

Hello

Do you have cPHulk brute force detection enabled? If so, check the "Login/Brute Force History Report" to see if the "root" account was locked out.

Thank you.