Cant login in as root - help!

AusDataHost

Member
Feb 18, 2006
8
0
151
Hello all

I have a server running Centos and cpanel.

I logged in as root to remove an IP from a black list on sunday no problems yet today i can't login - saying incorrect password.

Server is quite well protected and i have not had any unusual emails regarding suss logins etc

Loads are low.

Any ideas? server is in a data centre so its a bit tricky to diagnose with no access :(

thanks
Luke
 

AusDataHost

Member
Feb 18, 2006
8
0
151
Got it booted into single user mode and could login via ssh and su to root

any suggestions why that would work but not in normal mode?

- - - Updated - - -

reset pw in single user mode and now its working

Little unnerving though - still concerned its compromised
 

SS-Maddy

Well-Known Member
Mar 28, 2009
128
15
68
cPanel Access Level
Root Administrator
Please run rkhunter or chkrootkit in your server to ensure the server is safe. I hope you have patched the server for heartbleed though.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,218
463
Hello :)

Do you have cPHulk brute force detection enabled? If so, check the "Login/Brute Force History Report" to see if the "root" account was locked out.

Thank you.