Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

"WHM/cPanel root access alert" from DNS cluster servers

Discussion in 'Security' started by Bdzzld, Oct 31, 2011.

  1. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    391
    Likes Received:
    4
    Trophy Points:
    168
    Hi,

    I've recently set up a new cPanel servers and have added the server to four other servers in an already present DNS cluster. After doing this I always receive an "WHM/cPanel root access alert" e-mail from every server in this DNS cluster as soon as a log onto WHM. Is this normal behaviour?

    I've setup CSF/LFD on all servers, but only receive these alerts from this new server.

    Now I know I can add the IP-addresses of these servers to the csf.allow file, but I just wanted to know if this new server is setup correctly as I've never seen this kind of behaviour before.

    Thanks.
     
    #1 Bdzzld, Oct 31, 2011
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,457
    Likes Received:
    417
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Is cPHulk Brute Force Protection enabled? This will also send out an email when: "Send a notification upon successful root login when the IP is not whitelisted:"
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 Infopro, Oct 31, 2011
  3. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    391
    Likes Received:
    4
    Trophy Points:
    168
    Hi InfoPro,

    Thanks for your suggestion. cPHulk was indeed enabled. I've just diabled it as CSF/LFD will do a far better job i.m.o.

    The alerts are actually send out by LFD :

    Code:
    lfd on server.domainname.xxx: WHM/cPanel root access alert from xxx.xx.xxx.xxx
     
    #3 Bdzzld, Oct 31, 2011
  4. k-planethost

    k-planethost Well-Known Member

    Joined:
    Sep 22, 2009
    Messages:
    199
    Likes Received:
    8
    Trophy Points:
    68
    Location:
    Athens Greece
    thats normal since they sync the changes.
    did you press sync changes or standalone server?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 k-planethost, Oct 31, 2011
  5. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    391
    Likes Received:
    4
    Trophy Points:
    168
    Three of the four servers are used as DNS server (sync) and the other one is only using it (standalone).
    The funny thing is all servers create the alert; also the standalone one. Besides that, only this new server generates these alerts and not also the other servers in the DNS cluster...
     
    #5 Bdzzld, Oct 31, 2011
  6. garrettp

    garrettp Well-Known Member
    PartnerNOC

    Joined:
    Jun 18, 2004
    Messages:
    312
    Likes Received:
    0
    Trophy Points:
    166
    cPanel Access Level:
    DataCenter Provider
    Are all of the servers running 11.30? If not this may explain the differences as 11.28 -> 11.30 was a major update.

    My suggestion would be to add each of the clustered servers to the csf.ignore file since they are each a trusted source.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 garrettp, Oct 31, 2011
  7. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    391
    Likes Received:
    4
    Trophy Points:
    168
    All servers are running the latest release version of cPanel. So, that's not it.
    The ony thing I can think of is the difference in the version of BIND.
    This new server is running CentOS 6 with its newest version of BIND and the other servers are much older running CentOS 4.x and 5.x.
     
    #7 Bdzzld, Oct 31, 2011
(You must log in or sign up to post here.)
Loading...
Similar Threads - cPanel root access
  1. ayonilari

    Root WHM access disallowed after User WHM access from Cpanel

    ayonilari, Jul 25, 2017, in forum: General Discussion
    Replies:
    6
    Views:
    497
    ayonilari
    Jul 25, 2017
  2. Joel Espinosa

    Pending Publication [CPANEL-22229] You must choose a docroot that the system does not reserve error

    Joel Espinosa, Sep 6, 2018, in forum: General Discussion
    Replies:
    3
    Views:
    184
    cPanelLauren
    Sep 20, 2018
  3. Alan Lehman

    numerous /opt/cpanel/ea-php56/root/usr/bin/php-cgi

    Alan Lehman, Aug 31, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    74
    cPanelLauren
    Aug 31, 2018
  4. Gastón

    Problem after mysql root change CPANEL 74 / MySQL Server

    Gastón, Aug 29, 2018, in forum: Database Discussion
    Replies:
    3
    Views:
    614
    steven_h
    Sep 17, 2018
  5. Anupam SG

    cPanel User logging in as Root

    Anupam SG, Aug 29, 2018, in forum: General Discussion
    Replies:
    2
    Views:
    72
    Anupam SG
    Aug 29, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice