Cpaneldns only - changed host name but email still from old hostname?

[phez]

Hi Folks,

Have an interesting one here.

I changed my CpanelDNS only host name from ns3.abc.com to ns3.xyz.com. I changed the host name via CLI:

# hostname putnewnamehere

and also here:

/etc/hosts
/etc/sysconfig/network

But I am still receiving emails like the below, showing the old name. Where Can I change this to show the correct email address?

5 failed login attempts to account root (system) -- Large number of attempts from this IP: server1.3wholding.com

Reverse DNS: server1.3wholding.com

Origin Country: Germany (DE)

Please use the following links to add to the black list:

Single Ip: https://ns3.abc.com:2087/cgi/bl.cgi?ip=server1.3wholding.com
/24: https://ns3.abc.com:2087/cgi/bl.cgi?ip=server1.3wholding.com.0/24
/16: https://ns3.abc.com:2087/cgi/bl.cgi?ip=server1.3wholding.0.0/16

Thanks for your time.
Phez

 

[cPanelTristan]

Hello Phez,

Is the reverse DNS (rDNS) PTR of the IP for the server the right name as well?

dig -x IP#

Please replace IP# with the server's IP number.

From the email pasted, I'm not certain if that's cPHulk Brute Force Protection or LFD sending the emails.

Thanks!

 

[phez]

Thanks for the tip Tristan,

You got me thinking about the PTR record as I had request the VPS provider to add the record. The VPS provider also have a control panel which had the old host name listed. Also under cpaneldns ->> main >> service configuration >> manage service certificates , the current certificate was the old host name. I have since changed the host name via the VPS provider control panel and reissued the certificate which is now showing the new host name.

Dig is returning the correct PTR for the IP. I am waiting for an email to be generated from the server but is there a way to force email from cPHulk?

Thanks
Phez

 

[cPanelTristan]

You could try to brute force the machine for SSH login, but you'd end up getting locked out then for your IP for a set period of time. If you do that, you might want to have an SSH session already established to clear the cphulkd brutes database (or add yourself to the whitelist):

WHM locked out