In this article I'm going to show you how you can fix a cPHulk Brute Force Protection lock out that you might have accidentally triggered.

It's my server, why would cPHulk block me?

If you've read my previous article on how to enable cPHulk Brute Force Protection, then you should already know that cPHulk blocks login access to core cPanel services for a set amount of time. In some cases you might have kept trying to type in your password incorrectly, and inadvertently got yourself blocked by cPHulk.

Of course you can add your own IP address to the cPHulk white list to prevent failed login attempts coming from your IP to trigger a cPHulk blocking. But if you've already gotten yourself blocked, then you'd need to wait the amount of time you've set for a block to expire.

In this article I'm going to explain how to SSH directly to your server to reset the cPHulk data, so that you can regain access again.

Just like it's required to enable cPHulk Brute Force Protection, you also need root access to your server in order to reset the cPHulk data.

Reset cPHulk data to regain access

  1. Login to your server via SSH as the root user.
  2. Run the following command to see login attempts that have happened:

    mysql -e "select * from cphulkd.logins;"

    In this case we can see that we had some login attempts to an email account user@example.com from the IP address 123.123.123.123:

    +------------------+---------------+---------+--------+---------------------+
    | USER | IP | SERVICE | STATUS | LOGINTIME |
    +------------------+---------------+---------+--------+---------------------+
    | user@example.com | 123.123.123.123 | mail | 0 | 2013-02-27 13:04:25 |
    | user@example.com | 123.123.123.123 | mail | 0 | 2013-02-27 13:04:29 |
    | user@example.com | 123.123.123.123 | mail | 0 | 2013-02-27 13:04:39 |
    | user@example.com | 123.123.123.123 | mail | 0 | 2013-02-27 13:04:41 |
    | user@example.com | 123.123.123.123 | mail | 0 | 2013-02-27 13:04:48 |
    | user@example.com | 123.123.123.123 | mail | 0 | 2013-02-27 13:04:54 |
    +------------------+---------------+---------+--------+---------------------+

  3. Next run the following command to find detected bruce force attempts:

    mysql -e "select * from cphulkd.brutes;"

    Here we can see that those email account login attempts cause a brute force block on the IP:

    +---------------+--------------------------------------------------------------------------------------------------------------------+---------------------+---------------------+
    | IP | NOTES | BRUTETIME | EXPTIME |
    +---------------+--------------------------------------------------------------------------------------------------------------------+---------------------+---------------------+
    | 123.123.123.123 | 5 failed login attempts to account user@example.com (mail) -- Large number of attempts from this IP: 123.123.123.123 | 2013-02-27 13:04:54 | 2013-02-27 13:09:54 |
    +---------------+--------------------------------------------------------------------------------------------------------------------+---------------------+---------------------+

    If you wanted to, you could simply wait until the EXPTIME which is the expiration time that the block will expire, and then you'll be able to login again.

  4. If you wanted to go ahead and clear out the block, and regain access right away, then you can run the following commands to re-allow access for the 123.123.123.123 IP address:

    mysql -e "delete from cphulkd.logins where IP='123.123.123.123';"
    mysql -e "delete from cphulkd.brutes where IP='123.123.123.123';"

You should now understand how you can reset your cPHulk data so that you can regain access to your core cPanel services in the event you accidentally got yourself locked out.

Did you find this article helpful?

We value your feedback!

Why was this article not helpful? (Check all that apply)
The article is too difficult or too technical to follow.
There is a step or detail missing from the instructions.
The information is incorrect or out-of-date.
It does not resolve the question/problem I have.
How did you find this article?
Please tell us how we can improve our Support Center:
Email Address
Optional, but our team may contact you for more information.
Like this Article?

Post a Comment

Name:
Email Address:
Comment:
Are you a bot?
Submit

Please note: Your name and comment will be displayed, but we will not show your email address.

Related Questions

Here are a few questions related to this article that our customers have asked:
Ooops! It looks like there are no questions about this page.
Would you like to ask a question about this page? If so, click the button below!
Ask a Question

Need more Help?

Search

Ask the Community!

Get help with your questions from our community of like-minded hosting users and InMotion Hosting Staff.

Current Customers

Chat: Click to Chat Now E-mail: support@InMotionHosting.com
Call: 888-321-HOST (4678) Ticket: Submit a Support Ticket

Not a Customer?

Get web hosting from a company that is here to help. Sign up today!