Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

SOLVED cPHulk with CSF?

Discussion in 'Security' started by net@work, Apr 26, 2017.

Tags:
  1. net@work

    net@work Well-Known Member

    Joined:
    Aug 3, 2016
    Messages:
    45
    Likes Received:
    5
    Trophy Points:
    8
    Location:
    Everywhere
    cPanel Access Level:
    Root Administrator
    I want to make 2 questions:

    1- Is good tactic to have both cPHulk and CSF enable?
    I setup csf to block SMTP, IMAP, POP3 attempts! So is good choice to have also cPHulk run?

    2- If cPHulk blogs a bruteforce attack for an email is possible no one (include legitimate users) can't login to emails because of that bruteforce attack?

    Example:

    I have 3 emails: test@example.com , test2@example.com , test3@example.com

    If someone makes a bruteforce attack to test@example.com and cPHulk stops that attack then no one can't login to test@example.com , test2@example.com , test3@example.com ?


    Any help is highly appreciated!!
     
    #1 net@work, Apr 26, 2017
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,145
    Likes Received:
    1,754
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    One advantage to using both CSF and cPHulk for brute force protection is that CSF can automatically block the offending IP addresses, whereas cPHulk only does that if you enable an option to block the IP address at the firewall level.

    As far as access to the accounts that are brute force, you can review the documentation for "Username-based Protection" versus
    "IP Address-based Protection" at:

    cPHulk Brute Force Protection - Documentation - cPanel Documentation

    Let us know if that helps.

    Thank you.
     
    #2 cPanelMichael, Apr 27, 2017
  3. net@work

    net@work Well-Known Member

    Joined:
    Aug 3, 2016
    Messages:
    45
    Likes Received:
    5
    Trophy Points:
    8
    Location:
    Everywhere
    cPanel Access Level:
    Root Administrator
    Thank you for the response @cPanelMichael !

    I read the documentation and if I can understand clearly if someone bruteforce an email account then all legitimate users are blocked also with the stranger who made the bruteforce!

    I have a client that says all users are blocked from receive/send/login to email server!

    I see the cPHulk history and I see that someone from other country has made a bruteforce attack to one email account!

    That result makes also legitimate users has no access to all the email accounts of that cPanel account!!

    How is that possible? cPHulk also deny legitimate IP's/User's from login? My client has right?
     
    #3 net@work, Apr 28, 2017
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,145
    Likes Received:
    1,754
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    cPHulk blocks logins from any IP addresses to an account that is under a brute force attack, regardless of the attackers' IP address or addresses, when "Username-based Protection" is enabled. If you prefer to avoid this behavior, you can disable "Username-based Protection" and instead use "IP Address-based Protection". This will block logins the IP addresses making the attack, as opposed to the entire account username. The downside to only using "IP Address-based Protection" is that attackers may keep using different IP addresses after getting blocked.

    Thank you.
     
    #4 cPanelMichael, Apr 28, 2017
    net@work likes this.
  5. net@work

    net@work Well-Known Member

    Joined:
    Aug 3, 2016
    Messages:
    45
    Likes Received:
    5
    Trophy Points:
    8
    Location:
    Everywhere
    cPanel Access Level:
    Root Administrator
    Hello @cPanelMichael !

    Thank you for this answer! Now I can understand fully how cPHulk works!!! :)
     
    #5 net@work, May 2, 2017
    cPanelMichael likes this.
(You must log in or sign up to post here.)
Loading...
Similar Threads - cPHulk
  1. willke

    Thanks for cPHulk Countries Management!

    willke, May 18, 2018 at 4:54 AM, in forum: Security
    Replies:
    3
    Views:
    39
    rpvw
    May 20, 2018 at 1:51 AM
  2. dcusimano

    Add country to cPHulk History Reports

    dcusimano, May 14, 2018 at 2:33 PM, in forum: Security
    Replies:
    2
    Views:
    55
    cPanelMichael
    May 16, 2018 at 10:42 AM
  3. dcusimano

    cPHulk whitelist/blacklist precedence

    dcusimano, May 14, 2018 at 2:22 PM, in forum: Security
    Replies:
    5
    Views:
    75
    cPanelLauren
    May 17, 2018 at 8:30 AM
  4. NotNulled

    SOLVED cphulk country whitelist using cli?

    NotNulled, May 14, 2018 at 10:14 AM, in forum: Security
    Replies:
    1
    Views:
    36
    cPanelMichael
    May 15, 2018 at 11:49 AM
  5. linux4me2

    cPHulk Countries Management: Any Performance Penalty?

    linux4me2, May 10, 2018, in forum: Security
    Replies:
    5
    Views:
    90
    cPanelMichael
    May 15, 2018 at 11:40 AM

Share This Page