Skip to main content

.lastlogin

Zecamaral
Hello. In .lastlogin file only appears the logins in the cpanel? Thanks

Comments

15 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey there! Yes, the /home/username/.lastlogin file is specific to that user's cPanel account, and only tracks successful logins to the cPanel interface.
    0
  • Zecamaral
    I have different ips in all my sites, with different dates. In one of then i have changed all my passwords, cpanel inclusive, and the same happens.
    0
  • Zecamaral
    And in .lastlogin file the last login is one, and in the cpanel dashboard the last login is another one.
    0
  • cPRex Jurassic Moderator
    The dashboard will be different from the command line as it doesn't instantly update - you'll need to complete your session for that file to be written to. If you're seeing several IPs there you don't recognize, especially if they are from countries you don't think should be accessing your system, your account could be compromised. Do you have root access to the server, or only access to the cPanel account?
    0
  • Zecamaral
    Only cpanel account.
    0
  • cPRex Jurassic Moderator
    You'll want to reach out to your hosting provider or datacenter and have them check for security issues on your account.
    0
  • Zecamaral
    I'll do that, but I don't know if it's in the contract as they say.
    0
  • cPRex Jurassic Moderator
    Providers that sell cPanel licenses should be offering some level of support, although they may not be able to confirm specifically how a compromise happened. We wouldn't be able to guarantee we could find that on our end either. They should be able to see if they user accessed cPanel through a regular login, which would indicate a compromised password, so that would at least give you something to work from.
    0
  • Zecamaral
    I already changed the password of CPanel twice.
    0
  • cPRex Jurassic Moderator
    There could be a vulnerability on your account causing the issue, or there could be password-stealing malware on your local machine.
    0
  • Zecamaral
    This vulnerability is the responsibility of the hosting or I can do something. I have Imunify360 and no malware was found in my account.
    0
  • Zecamaral
    I have this issue in all my accounts. It's very strange.
    0
  • cPRex Jurassic Moderator
    Have you scanned your local workstation for any malware?
    0
  • cPRex Jurassic Moderator
    If it is happening with multiple accounts you definitely want to reach out to your host.
    0
  • Zecamaral
    I'll do a scan to my local workstation for malware now.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post