Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

"WHM/cPanel root access alert" from DNS cluster servers

Discussion in 'Security' started by Bdzzld, Oct 31, 2011.

  1. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    386
    Likes Received:
    4
    Trophy Points:
    168
    Hi,

    I've recently set up a new cPanel servers and have added the server to four other servers in an already present DNS cluster. After doing this I always receive an "WHM/cPanel root access alert" e-mail from every server in this DNS cluster as soon as a log onto WHM. Is this normal behaviour?

    I've setup CSF/LFD on all servers, but only receive these alerts from this new server.

    Now I know I can add the IP-addresses of these servers to the csf.allow file, but I just wanted to know if this new server is setup correctly as I've never seen this kind of behaviour before.

    Thanks.
     
    #1 Bdzzld, Oct 31, 2011
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,309
    Likes Received:
    393
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Is cPHulk Brute Force Protection enabled? This will also send out an email when: "Send a notification upon successful root login when the IP is not whitelisted:"
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 Infopro, Oct 31, 2011
  3. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    386
    Likes Received:
    4
    Trophy Points:
    168
    Hi InfoPro,

    Thanks for your suggestion. cPHulk was indeed enabled. I've just diabled it as CSF/LFD will do a far better job i.m.o.

    The alerts are actually send out by LFD :

    Code:
    lfd on server.domainname.xxx: WHM/cPanel root access alert from xxx.xx.xxx.xxx
     
    #3 Bdzzld, Oct 31, 2011
  4. k-planethost

    k-planethost Well-Known Member

    Joined:
    Sep 22, 2009
    Messages:
    199
    Likes Received:
    8
    Trophy Points:
    68
    Location:
    Athens Greece
    thats normal since they sync the changes.
    did you press sync changes or standalone server?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 k-planethost, Oct 31, 2011
  5. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    386
    Likes Received:
    4
    Trophy Points:
    168
    Three of the four servers are used as DNS server (sync) and the other one is only using it (standalone).
    The funny thing is all servers create the alert; also the standalone one. Besides that, only this new server generates these alerts and not also the other servers in the DNS cluster...
     
    #5 Bdzzld, Oct 31, 2011
  6. garrettp

    garrettp Well-Known Member
    PartnerNOC

    Joined:
    Jun 18, 2004
    Messages:
    312
    Likes Received:
    0
    Trophy Points:
    166
    cPanel Access Level:
    DataCenter Provider
    Are all of the servers running 11.30? If not this may explain the differences as 11.28 -> 11.30 was a major update.

    My suggestion would be to add each of the clustered servers to the csf.ignore file since they are each a trusted source.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 garrettp, Oct 31, 2011
  7. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    386
    Likes Received:
    4
    Trophy Points:
    168
    All servers are running the latest release version of cPanel. So, that's not it.
    The ony thing I can think of is the difference in the version of BIND.
    This new server is running CentOS 6 with its newest version of BIND and the other servers are much older running CentOS 4.x and 5.x.
     
    #7 Bdzzld, Oct 31, 2011
(You must log in or sign up to post here.)
Loading...
Similar Threads - cPanel root access
  1. ayonilari

    Root WHM access disallowed after User WHM access from Cpanel

    ayonilari, Jul 25, 2017, in forum: General Discussion
    Replies:
    6
    Views:
    457
    ayonilari
    Jul 25, 2017
  2. Posterum

    Cpanel user have access to root

    Posterum, Sep 28, 2016, in forum: General Discussion
    Replies:
    1
    Views:
    917
    cPanelMichael
    Sep 29, 2016
  3. Akhil K Aniyan

    How to access a cPanel account using root?

    Akhil K Aniyan, Sep 4, 2016, in forum: General Discussion
    Replies:
    3
    Views:
    1,551
    Akhil K Aniyan
    Sep 6, 2016
  4. codermjb

    How to have a root SSL Letsencrypt for cPanel hostname

    codermjb, Jul 7, 2018, in forum: Security
    Replies:
    2
    Views:
    120
    cPanelFelipe
    Jul 8, 2018
  5. shrawaaan

    cPanel on AWS Change the root directory?

    shrawaaan, May 13, 2018, in forum: General Discussion
    Replies:
    4
    Views:
    162
    cPanelMichael
    May 15, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice