Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Root was logged into pam using following authentication service: system (sudo)

Discussion in 'General Discussion' started by fomistoklus, Jan 15, 2015.

  1. fomistoklus

    fomistoklus Member

    Joined:
    Aug 16, 2012
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi there,
    every 30 minutes cpanel alerts me to email about root login.
    I'm using RAID on the server and nagios plugin for monitoring it.
    So, each nagios check performs script execution via sudo.
    About what I can see in /var/log/secure log file.

    I found the corresponding thread, but an old one, from 2012
    http://forums.cpanel.net/f185/keep-getting-root-login-emails-268701.html

    Yesterday I've upgraded cpanel up to WHM 11.44.2 (build 3), but I keep getting these messages to my inbox.
    How I can stop these alerts?

    Thank you!
     
  2. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,802
    Likes Received:
    1,896
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello :)

    You can browse to "WHM Home » Security Center » cPHulk Brute Force Protection" and ensure the option to receive a notification when root successfully logs in from an IP address that is not white listed is disabled.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. fomistoklus

    fomistoklus Member

    Joined:
    Aug 16, 2012
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hello cPanel Staff ,

    logins are without IP address, they are from system users.
     
  4. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,802
    Likes Received:
    1,896
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Does the issue persist after disabling the option referenced in my last post?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. fomistoklus

    fomistoklus Member

    Joined:
    Aug 16, 2012
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hello Michael,

    yes :(

    Thank you.
     
  6. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,802
    Likes Received:
    1,896
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. caisc

    caisc Well-Known Member

    Joined:
    Oct 5, 2011
    Messages:
    71
    Likes Received:
    2
    Trophy Points:
    58
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Is CSF firewall installed and running on your server?
     
  8. Ben A. Hilleli

    Ben A. Hilleli Registered

    Joined:
    Jan 16, 2015
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Toronto, Ontario, Canada
    cPanel Access Level:
    Root Administrator
    Yes we do (note: it's my server, fomistoklus is a contractor who keeps it on "good behaviour")

    I'm almost certain we've had cpHulk on for ages and did not always recieve these incessant, every 30 minute alert -- which is why it's somewhat concerning.
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice