Root password is being changed

[tomjung]

Hi, I tried logging in with my WHM root password today and it did not work. I contacted my hosting company to have them reset it. They did, I was able to login. About an hour later I went to log back in and it no longer worked. I had to have them reset the password again. Now I'm wondering what might be causing the password to change.

Is there a log somewhere I can look at and what should I be looking for to tell me why this is happening?

 

[quizknows]

It's probably just cphulk locking you out. Disable it, it's worthless if you have a real firewall with brute force detection like CSF/LFD.

99% of the tickets I get for "root PW changed" are actually "CPHulk locked out root logins for everyone"

 

[cPanelMichael]

Hello

Yes, you can review the cPHulk log at:

/usr/local/cpanel/logs/cphulkd.log

Look to see if the "root" account was locked, as that's likely the reason authentication failed.

Thank you.

 

[tomjung]

Thanks yal, just setup CSF and disabled CPHulk. Hopefully I won't have anymore issues.

 

[Mckenzielaa]

have you checked to see if Any otterrete users have root privs? Might be an idea while you Wait to see if turning cphulk helps.