The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

"WHM/cPanel root access alert" from DNS cluster servers

Discussion in 'Security' started by Bdzzld, Oct 31, 2011.

  1. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    363
    Likes Received:
    2
    Trophy Points:
    168
    Hi,

    I've recently set up a new cPanel servers and have added the server to four other servers in an already present DNS cluster. After doing this I always receive an "WHM/cPanel root access alert" e-mail from every server in this DNS cluster as soon as a log onto WHM. Is this normal behaviour?

    I've setup CSF/LFD on all servers, but only receive these alerts from this new server.

    Now I know I can add the IP-addresses of these servers to the csf.allow file, but I just wanted to know if this new server is setup correctly as I've never seen this kind of behaviour before.

    Thanks.
     
    #1 Bdzzld, Oct 31, 2011
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    15,546
    Likes Received:
    291
    Trophy Points:
    433
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Is cPHulk Brute Force Protection enabled? This will also send out an email when: "Send a notification upon successful root login when the IP is not whitelisted:"
     
    #2 Infopro, Oct 31, 2011
  3. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    363
    Likes Received:
    2
    Trophy Points:
    168
    Hi InfoPro,

    Thanks for your suggestion. cPHulk was indeed enabled. I've just diabled it as CSF/LFD will do a far better job i.m.o.

    The alerts are actually send out by LFD :

    Code:
    lfd on server.domainname.xxx: WHM/cPanel root access alert from xxx.xx.xxx.xxx
     
    #3 Bdzzld, Oct 31, 2011
  4. k-planethost

    k-planethost Well-Known Member

    Joined:
    Sep 22, 2009
    Messages:
    199
    Likes Received:
    4
    Trophy Points:
    68
    Location:
    Athens Greece
    thats normal since they sync the changes.
    did you press sync changes or standalone server?
     
    #4 k-planethost, Oct 31, 2011
  5. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    363
    Likes Received:
    2
    Trophy Points:
    168
    Three of the four servers are used as DNS server (sync) and the other one is only using it (standalone).
    The funny thing is all servers create the alert; also the standalone one. Besides that, only this new server generates these alerts and not also the other servers in the DNS cluster...
     
    #5 Bdzzld, Oct 31, 2011
  6. garrettp

    garrettp Well-Known Member
    PartnerNOC

    Joined:
    Jun 18, 2004
    Messages:
    312
    Likes Received:
    0
    Trophy Points:
    166
    cPanel Access Level:
    DataCenter Provider
    Are all of the servers running 11.30? If not this may explain the differences as 11.28 -> 11.30 was a major update.

    My suggestion would be to add each of the clustered servers to the csf.ignore file since they are each a trusted source.
     
    #6 garrettp, Oct 31, 2011
  7. Bdzzld

    Bdzzld Well-Known Member

    Joined:
    Apr 3, 2004
    Messages:
    363
    Likes Received:
    2
    Trophy Points:
    168
    All servers are running the latest release version of cPanel. So, that's not it.
    The ony thing I can think of is the difference in the version of BIND.
    This new server is running CentOS 6 with its newest version of BIND and the other servers are much older running CentOS 4.x and 5.x.
     
    #7 Bdzzld, Oct 31, 2011
(You must log in or sign up to post here.)
Loading...
Similar Threads - cPanel root access
  1. Posterum

    Cpanel user have access to root

    Posterum, Sep 28, 2016, in forum: General Discussion
    Replies:
    1
    Views:
    348
    cPanelMichael
    Sep 29, 2016
  2. Akhil K Aniyan

    How to access a cPanel account using root?

    Akhil K Aniyan, Sep 4, 2016, in forum: General Discussion
    Replies:
    3
    Views:
    460
    Akhil K Aniyan
    Sep 6, 2016
  3. Legeni

    Cannot access cPanel with root user

    Legeni, Apr 5, 2016, in forum: General Discussion
    Replies:
    1
    Views:
    544
    cPanelMichael
    Apr 5, 2016
  4. ameran

    WHM/cPanel root access alert from unrecognizable IP address.

    ameran, Feb 20, 2016, in forum: Security
    Replies:
    9
    Views:
    719
    24x7server
    Feb 22, 2016
  5. EneTar

    New Thread Define default values for /opt/cpanel/ea-php70/root/etc/php-fpm.d/*.conf

    EneTar, Jul 21, 2017 at 2:04 AM, in forum: EasyApache
    Replies:
    0
    Views:
    17
    EneTar
    Jul 21, 2017 at 2:04 AM

Share This Page