Email: Too many failed attempts; WHM: Invalid login; SSH: Permission Denied

WisTex

• July 17, 2023 13:48

I just got completely locked out of my server.

• Email: Too many failed attempts
• WHM: Invalid Login
• SSH: Permission denied, please try again

It might have been because an email password changed, and my email apps kept retrying too many times with the old password. Or it could be something worse, since I can't log in even with SSH. Most posts I see say if you can't login using WHM, try SSH. If you can't login via SSH, try WHM. But what if you can't log in via either of them?

• 

  WisTex

  • July 17, 2023 18:51

  Okay, I am not sure what just happened, but suddenly I can log into WHM and email again, but not SSH for some reason.

  0
• 

  WisTex

  • July 17, 2023 18:56

  Since I got into WHM, I whitelisted my IP, and I could login via SSH again. What happened? Did I trigger the brute force attack mechanism?

  0
• 

  ffeingol

  • July 17, 2023 19:37

  Do you have cPHulk enabled or CSF/LFD installed? Either of those could block you from the server.

  0
• 

  cPanelWilliam

  • July 18, 2023 16:48

  Hello! As @ffeingol stated, the login failures were likely caused by cPHulk or CSF/LFD. I recommend reviewing the cPHulk logs ( /usr/local/cpanel/logs/cphulkd.log
  ) and the LFD log ( /var/log/lfd.log
  ) if CSF is installed. These logs should state whether your IP was blocked earlier.

  0

Please sign in to leave a comment.