[CPANEL-25503] cPHulk is one-day blocking whitelisted address for maximum failed authentications

rahnev

• March 26, 2019 05:38

I have the following problem: - server ip added to whitelist in cPHulk - even though cPHulk blocked the IP for one day in iptables Here is a log entry: [2019-03-26 07:45:42 +0100] info [cPhulkd] Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[1.1.1.1] [Local Port]=[143] [Remote IP Address]=[2.2.2.2] [Remote Port]=[34169] [Authentication Database]=[mail] [Username]=[info@domain.com] (30/30 failures) (blocked until [Wed Mar 27 06:45:42 2019 UTC/Wed Mar 27 07:45:42 2019 LOCAL]) How this is possible. Is there a way to understand why cPHulk blocked a whitelited IP? Have a nice day.

• 

  cPanelMichael

  • March 27, 2019 18:51

  Hello @rahnev, Can you confirm if the whitelisted IP address continues to appear in WHM >> cPHulk Brute Force Protection >> Whitelist Management? Or, was it automatically removed from the whitelist?

  0
• 

  rahnev

  • March 28, 2019 10:09

  Hi @cPanelMichael, yes the whitelisted IP continues to appear in WHM >> cPHulk Brute Force Protection >> Whitelist Management.

  0
• 

  cPanelMichael

  • March 28, 2019 19:11

  Hello @rahnev, Can you open a

  0
• 

  rahnev

  • March 29, 2019 11:01

  Hi @cPanelMichael, I opened a support ticket. Your support request ID: 11791183 Thanks.

  0
• 

  cPanelMichael

  • April 08, 2019 15:23

  Hello @rahnev, Thank you for opening the support ticket. Internal case CPANEL-26633 CPANEL-25503 was opened to report an issue where cPHulk adds one-day blocks when whitelisted IP addresses reach the maximum number of authentication failures. I'll monitor this case and update this thread with more information as it becomes available. Thank you.

  0
• 

  cPanelMichael

  • July 09, 2019 19:49

  Hello, To follow-up, this was fixed in cPanel & WHM version 80 as part of case CPANEL-25503: Fixed case CPANEL-25503: Fix memory issues with cphulkd and brute force attacks. The full change log is available at:

  0

Please sign in to leave a comment.