Configuring cPHulk via WHM & command line

Now-a-days Brute force attacks to servers/websites are frequent. Brute force attack is generally a password guessing technique. It is a type of attack in which trying every possible combination of characters or data in order to find the decrypted message. A brute force guarantees finding the key – it’s trying every possible combination and does not rely on any potentially incomplete dictionaries or lists of possible keys.

cPHulk  Brute force Protection is an inbuilt protection used in WHM for preventing brute force attack. cPHulk Brute force Protection  will detect and will block continuous failed login IP address.

cPHulk is a brute force protection system developed by the cPanel team and is exclusive to cPanel / WHM control panels. It has been integrated with cPanel version 11. With cPHulk, you can set a threshold for authentication attempts on services like POP3, cPanel, WHM, FTP, etc. After a certain amount of attempts, the attacker will no longer be able to authenticate

We can enable/disable cPhulk via WHM and command line.

1] Steps to enable cPHulk via WHM

Enabling cPHulk is pretty easy. Simply log into your WHM control panel as root. From the main menu on the left, click on Security Center from the Security section. When youre done, simply click on the Enable button at the top.

Click on the cPHulk Brute Force Detection link at the top of the page. Now you may want to configure cPHulk before you enable it. The configuration parameters are pretty much self-explanatory. Basically you set the number of failed attempts before an IP or an account is blocked and you set how long you want it to be blocked.

>>  Login to WHM.

>>  Navigate to Home -> Security Center -> cPHulk Brute Force Protection.

>  Click the toggle ON/OFF option to enable or disable the cPHulk.

Configuration settings

We can configure cPHulk settings in WHM as per the image below. We can change limits of failed login attempts and temporary blocks duration using this tab.

Whitelist Management

We can also whitelist an IP address from cPHulk interface. The whitelist specified IP address for which cPHulk always allows login to our server.We can enter the IP address in the New Whitelist Records field and click the Add button. We can add desired comments in the comment text box. These comments will help you for quick reference. When clicking on the whitelist management tab you will get a screen that looks like the picture below.

Blacklist Management

Blacklist management is opposite of the whitelist tab. This tab help you to block specific IP address and ranges.If you found repeated failed attempts to login your server from an unauthorized IP address you can add it to your blacklist to prevent any future attempts.

We can remove the blocked IP address by clicking the Delete button to the right of the IP address

History Reports

The History Reports tab shows all the failed attempts to access our server. We can clear the log  details using this tab and it will release any current lock outs.

2.    Steps to enable cPHulk via Command line

cPHulk status

To check the cPHulk status , run this command  :

# ps aux | grep –i cphulk

Output :    

root      8196  0.0  0.2  41088  2120 ?        S    Feb05   2:38 cPhulkd – processor

This output shows that cPHulk is enabled.

Restart cPHulk

To restart cPHulk daemon, perform either one of the commands.

Perform a soft restart.

# /scripts/restartsrv_cphulkd

Perform a hard restart and force the system to flush the daemon’s memory.

# /scripts/restartsrv_cphulkd –stop; /scripts/restartsrv_cphulkd –start

Disable cPHulk

To disable cPHulk

# /usr/local/cpanel/etc/init/stopcphulkd

           Or

    # /usr/local/cpanel/bin/cphulk_pam_ctl –disable

To disable cPHulk to keep it offline, even after a restart of cPanel &WHM, remove the cPHulk touch file with the following command:

# rm  /var/cpanel/hulkd/enabled

Enable cPHulk

To enable cPHulk

# /usr/local/cpanel/etc/init/startcphulkd

           Or

    # /usr/local/cpanel/bin/cphulk_pam_ctl –enable

IP address Management via command line

Add IP address to whitelist

To add IP addresses to the whitelist from the command line, run this command  /scripts/cphulkdwhitelist IP  where IP shows the IP address that you wish to whitelist.

# /scripts/cphulkdwhitelist x.x.x.x   (Note: x.x.x.x denotes your IP address)

Add IP address to Blacklist

We can also use the command /scripts/cphulkdblacklist IP for blacklisting an IP address in cphulk.

# /scripts/cphulkdblacklist x.x.x.x

IP address management via MYSQL

cPHulk stores all of its information in a database called cphulkd. There are two tables of interest:   ”logins” and “brutes”.The logins table stores login authentication failure.The brutes table stores excessive authentication failures indicative of a brute force attack.

Whitelisting through MySQL prompt

>> Login to your server via SSH as the root user and run the following commands.

>> mysql

To access the cPHulk database

>> use cphulkd

To show the list of tables under cPHulk’s database.

>> show tables;

To check if your IP address is in brutes tables.

>> select * from brutes where IP =’X.X.X.X’;  (Note: X.X.X.X represents your IP address)

If IP address found in brutes table, then remove the IP address using the following command.

>> delete from brutes where IP =’X.X.X.X’;

Or we can delete the IP address from logins table

>> delete from logins where IP = ‘X.X.X.X’;

>>exit

cPHulk Log files

The log files are first contributor on all the IT environment when we troubleshooting the problem. The cPHulk log file are located under /usr/local/cpanel/logs/ directory and you can use less, cat, more or tail command to check the logs messages.

These are the log files of cPHulk Brute Force Protection :

>> /usr/local/cpanel/logs/cphulkd.log

> /usr/local/cpanel/logs/cphulkd_errors.log

If you require help, contact HoganHost.com.ng