Root password is being changed

tomjung

Member
Jul 21, 2014
8
0
1
cPanel Access Level
Root Administrator
Hi, I tried logging in with my WHM root password today and it did not work. I contacted my hosting company to have them reset it. They did, I was able to login. About an hour later I went to log back in and it no longer worked. I had to have them reset the password again. Now I'm wondering what might be causing the password to change.

Is there a log somewhere I can look at and what should I be looking for to tell me why this is happening?
 

quizknows

Well-Known Member
Oct 20, 2009
1,008
87
78
cPanel Access Level
DataCenter Provider
It's probably just cphulk locking you out. Disable it, it's worthless if you have a real firewall with brute force detection like CSF/LFD.

99% of the tickets I get for "root PW changed" are actually "CPHulk locked out root logins for everyone"
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,228
463
Hello :)

Yes, you can review the cPHulk log at:

/usr/local/cpanel/logs/cphulkd.log

Look to see if the "root" account was locked, as that's likely the reason authentication failed.

Thank you.