How to work with cPHulk

1. General information
2. How to enable/disable cPHulk
3. cPHulk settings
4. Whitelist/Blacklist management
5. cPHulk logs


1. General information

cPHulk is a service that provides protection for your server against brute force attacks. A brute force attack is a hacking method that uses an automated system to guess the password to your web server or services.

When cPHulk blocks an IP address or account, it does not identify itself as the source of the block. Instead, the login page displays the same message as if you were trying to use incorrect access details: The login is invalid.

So if you were able to log in with the same login details before but now getting The login is invalid error, most likely you triggered cPHulk block.

cPhulk is monitoring login attempts to the following services:

  • WHM/cPanel
  • POP3/IMAP/SMTP connections including email clients and webmail
  • FTP/SFTP, WebDisk
  • SSH (cPHulk does not affect public key authentication)

cPHulk can automatically block:

  • IP addresses from which too many failed login attempts were noticed (to a single or several services at the same time)
  • accounts which are being actively abused by failed login attempts

3 types of block can be issued by cPHulk:

  • Temporary block - such block will expire after a specific amount of time set in the cPHulk configuration
  • One-day block - will occur specifically for 24 hours when a specific number of failed login attempts from a certain IP address was reached
  • Permanent block - will occur after triggering several temporary blocks. Can only be lifted manually.


2. How to enable cPHulk

You can enable cPHulk in WHM > cPHulk Brute Force Protection menu:



Once enabled, you will be able to adjust its configuration and monitor failed login activity.


3. cPHulk settings

In this tab you can change limits of failed login attempts and temporary blocks duration:



You can be find the detailed explanation of all settings in the official cPanel guide.

4. Whitelist/Blacklist management

For some reason, you may want to block certain IP addresses or whitelist them in order to avoid blocking. For these purposes, you can use Whitelist/Blacklist Management tabs in the cPHulk menu:



You can whitelist/blacklist multiple IP addresses at the same time or even full networks specified in the CIDR format.

NOTE: It is highly recommended to whitelist your own IP address in order to avoid a lockout from the server.


5. cPHulk logs

cPHulk provides useful blocking logs for your convenience. There you can check which IP addresses/users were blocked and for which period:



A raw explanation of the entry log shown at the screenshot above can be the following:

There were too many failed login attempts via the SMTP protocol to the guest@ncsupport.info email account from some device with an external IP address 31.210.124.242. It led to a 360-minute block (such period of time is specified in the Configuration tab). The block was issued at 05:04.22 and will expire in 345 minutes from now (or specifically at 11:04:22).

With these logs, you can troubleshoot the cause of the blocks and, for example, if suspicious log entries were found, blacklist the abuser’s IP address.

If you have Configure Server Firewall installed, it is also possible to enable automatic firewall IP blocks apart from cPHulk ones. The main difference between these blocks is that the firewall block will not allow server access at all. Make sure you whitelist your own IP address before enabling the automatic possibility of being locked out from your own server.

It is also possible to manage cPHulk from the command line interface via SSH. We suggest checking a corresponding cPanel manual as well.

Feel free to contact us if you require your IP address to be whitelisted in case of a false positive block.


That's it!

              
                      Need any help? Contact our HelpDesk

Comments

We welcome your comments, questions, corrections and additional information relating to this article. Your comments may take some time to appear. Please be aware that off-topic comments will be deleted.

If you need specific help with your account, feel free to contact our Support Team. Thank you.

Need help? We're always here for you.

× Close