cPHulk Ban Questions

workingl

• November 15, 2016 15:20

I've got over a hundred login attempts on some IP's - but I thought I got cphulk set up to limit how many attempts before ban... I have Maximum Failures per IP Address in cphulk set to defualt: 5 Maximum Failures per IP Address before the IP Address is Blocked for One Day: 30 Typical in my login_log file is to see way more than 30 or 5 of the same lines: [2016-11-11 15:41:55 +0000] info [cpsrvd] 198.71.86.113 - [username] "POST /login/?login_only=1 HTTP/1.1" DEFERRED LOGIN cpaneld: brute force attempt (user [username]) has locked out IP 198.71.86.113 (2) If they've been locked out trying to brute force with the same IP and [username] why isn't cphulk banning the ip?

• 

  cPanelMichael

  • November 16, 2016 11:19

  Hello @workingl, cPHulk will only block the IP address at the firewall level when the following option is enabled under "One-Day Blocks" or "IP Address-based Protection": "Block IP addresses at the firewall level if they trigger brute force protection" Note this option is not available on Virtuozzo environments. Documentation on cPHulk Brute Force Protection is available at: cPHulk Brute Force Protection - Documentation - cPanel Documentation Thank you.

  0

Please sign in to leave a comment.