Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Stop brute force email logins?

Discussion in 'E-mail Discussion' started by aeroweb, Apr 20, 2019.

  1. aeroweb

    aeroweb Well-Known Member

    Joined:
    Jun 4, 2004
    Messages:
    67
    Likes Received:
    0
    Trophy Points:
    156
    CPHulk is showing many failed email login attempts from local host 127.0.0.1 and country ZZ (see attached screenshot). I am assuming these are webmail login attempts? Is there a way to stop these or at the very minimum change the configuration somehow for it to display the IP address of the offending user?
     

    Attached Files:

  2. ES - George

    ES - George Well-Known Member PartnerNOC

    Joined:
    Jun 12, 2011
    Messages:
    175
    Likes Received:
    22
    Trophy Points:
    68
    Location:
    UK
    cPanel Access Level:
    Root Administrator
    Twitter:
    The only way to make it impossible to bruteforce would be to limit the service to only trusted IPs. Bruteforcing is unfortunately "normal", and something that will always happen. You can't stop it, but you can stop the effects it (i.e. a successful intrusion) by maintaining good password policies, and whilst blocking an offending IP address is helpful, a good, strong password will keep you safe.

    I'd recommend reading over the cPHulk documentation if you haven't done so already: cPHulk Brute Force Protection - Version 78 Documentation - cPanel Documentation
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    cPanelLauren likes this.
  3. cPanelLauren

    cPanelLauren Forums Analyst II Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    5,815
    Likes Received:
    443
    Trophy Points:
    233
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. aeroweb

    aeroweb Well-Known Member

    Joined:
    Jun 4, 2004
    Messages:
    67
    Likes Received:
    0
    Trophy Points:
    156
    We are very familiar with brute force attacks and various distributed attacks, that was not my question. We have been using a combination of CSF and other features for years which has helped mitigate most attacks against IMAP, SMTP, SSH etc...

    What I am concerned about is that all the attacks showed the local IP address 127.0.0.1 rather than the offenders IP address (see previous attachment). Is there any way to get CpHulk to the attackers IP instead of 127.0.0.1? Or is there a log file I can view that shows who is accessing the webmail login page?

    Thanks
     
  5. cPanelLauren

    cPanelLauren Forums Analyst II Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    5,815
    Likes Received:
    443
    Trophy Points:
    233
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @aeroweb

    Unfortunately, when the IP address is obfuscated like this (which is done on purpose) it's beyond cPhulk's capability to identify. cPhulk is registering the IP address that the system sees the attack from. You can see the IP being used in /var/log/maillog in most cases as a webmail login attempt would be noted there.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    1,209
    Likes Received:
    77
    Trophy Points:
    28
    cPanel Access Level:
    Root Administrator
    Would adding a rule in Host Access Control work.

    Although I'm not sure of the implications of blocking 127.0.0.1
     
  7. cPanelLauren

    cPanelLauren Forums Analyst II Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    5,815
    Likes Received:
    443
    Trophy Points:
    233
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    That wouldn't work, you would deal with a ton of unintended side effects if you blocked localhost.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice