The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Cphulk question

Discussion in 'General Discussion' started by classical, Mar 25, 2011.

  1. classical

    classical Active Member

    Joined:
    Dec 16, 2010
    Messages:
    27
    Likes Received:
    0
    Trophy Points:
    1
    I have been facing long amount of brurteforce attack against my cpanel servers. Its seems that cphulk did not block bruteforce by Ip address it was only blocked by account.
    Now i have following configuration in Cphulk:
    [​IMG]
    do i need to lower or increase the values ?

    Where does blocked ip goes ? does it blocks via iptables ?
    The reason why i think think that brute force attack is not blocked by ip is, attacking is still performing there was thousand of attempts with non exist username. The ip must be blocked about 2 week of period but instead of it's blocked about 2 - 4 minutes By account:
    [​IMG]

    why is the beginning and expiration date same: ?
    [​IMG]

    I have received Mail asking to blacklist the ip it's seems Cphulk does not blacklist ip address by itself ?
     
    #1 classical, Mar 25, 2011
    Last edited: Mar 25, 2011
  2. garconcn

    garconcn Well-Known Member

    Joined:
    Oct 29, 2009
    Messages:
    98
    Likes Received:
    1
    Trophy Points:
    8
    I think the IP was blocked to access the cpanel account, not the server. If you want to block the IP to access the server, you can use iptables.
     
Loading...

Share This Page