SOLVED What is the cpaneld service as reported by cPHulk?

[a305587]

Before the flame war starts over me not searching or Googling this first, I did.

Google thinks "cpaneld" = "cpanel". If you put the entire question in quotes "what is cpaneld", Google yields no results.

And this own forum's search for "cpaneld" yields a thousand results of folks pasting code that contains the word "cpaneld" without explaining what it is, just referencing it.

If I put that exact question "what is cpaneld?" in quotes in this forum's search, the forum strips out my question:

The following words were not included in your search because they are too short, too long, or too common: what, is​

Argh!

Anyway, I'd like to know what it is because someone or something keeps trying to access our server using this service (without our permission).

We've been seeing a lot of notifications come through via cPHulk on this cpaneld service of someone trying various usernames on different ports and I'm just trying to understand what they are attempting to do and what I need to do about it.

example:


A device at the “195.231.70.12” IP address has made a large number of invalid login attempts against the account “xxxxxxxx”. This brute force attempt has exceeded the maximum number of failed login attempts that the system allows. For security purposes, the system has temporarily blocked this IP address in order to prevent further attempts.

Service:

cpaneld

Local IP Address:

xxx.xxx.xxx.xxx

Local Port:

xxxx

Remote IP Address:

195.231.70.12

Remote Port:

44032

Authentication Database:

system

Username:

xxxxxxxx

Number of authentication failures:

5

Maximum number allowed:

5


We're seeing dozens of attempts per day. It seems extreme. Should I turn it off so this stops happening?

I'd be happy to read up on this "cpaneld" service if someone would send a link on what it is, I've been unable to find anything describing it. (cpanel's own documentation references it 51 times but I couldn't find a link actually describing what the service was)


Thank you!

 

[cPanelLauren]

Hi @a305587


Generally speaking the cpaneld or cPanel Daemon is essentially the cPanel service. Though, not cpsrvd. This email is telling you there's unauthorized login attempts to the cPanel UI (or anything related to that user's cPanel service) for that specific user from that specific IP address, this is NOT telling the cpaneld service is attempting to access the server.

 

[a305587]

Generally speaking the cpaneld or cPanel Daemon is essentially the cPanel service. Though, not cpsrvd. This email is telling you there's unauthorized login attempts to the cPanel UI (or anything related to that user's cPanel service) for that specific user from that specific IP address, this is NOT telling the cpaneld service is attempting to access the server.

Gotcha! Thank you very much Lauren, this makes sense. Obviously not something I want to turn off then, just something to keep an eye on.

I appreciate the response. Cheers.