{"id":214,"date":"2021-02-19T23:27:51","date_gmt":"2021-02-19T23:27:51","guid":{"rendered":"https:\/\/hoganhost.com.ng\/blog\/?p=214"},"modified":"2024-08-12T13:35:53","modified_gmt":"2024-08-12T12:35:53","slug":"configuring-cphulk-via-whm-command-line","status":"publish","type":"post","link":"https:\/\/hoganhost.com.ng\/blog\/cpanel\/configuring-cphulk-via-whm-command-line\/","title":{"rendered":"Configuring cPHulk via WHM & command line"},"content":{"rendered":"

Now-a-days Brute force attacks to servers\/websites are frequent. Brute force attack is generally a password guessing technique. It is a type of attack in which trying every possible combination of characters or data in order to find the decrypted message. A brute force guarantees finding the key \u2013 it\u2019s trying every possible combination and does not rely on any potentially incomplete dictionaries or lists of possible keys.<\/p>\n

cPHulk \u00a0Brute force Protection<\/b>\u00a0is an inbuilt protection used in WHM for preventing brute force attack. cPHulk Brute force<\/strong> Protection \u00a0will detect and will block continuous failed login IP address.<\/p>\n

cPHulk<\/strong>\u00a0is a brute force protection system developed by the cPanel team and is exclusive to cPanel \/ WHM control panels. It has been integrated with cPanel version 11. With cPHulk, you can set a threshold for authentication attempts on services like POP3, cPanel, WHM, FTP, etc. After a certain amount of attempts, the attacker will no longer be able to authenticate<\/p>\n

We can enable\/disable cPhulk via WHM and command line.<\/span><\/p>\n

1] Steps to enable cPHulk via WHM<\/strong><\/p>\n

Enabling cPHulk is pretty easy. Simply log into your WHM control panel as root. From the main menu on the left, click on\u00a0Security Center<\/strong>\u00a0from the Security section. When youre done, simply click on the\u00a0Enable<\/strong>\u00a0button at the top.<\/p>\n

Click on the\u00a0cPHulk Brute Force Detection<\/strong>\u00a0link at the top of the page. Now you may want to configure cPHulk before you enable it. The configuration parameters are pretty much self-explanatory. Basically you set the number of failed attempts before an IP or an account is blocked and you set how long you want it to be blocked.<\/p>\n

>> \u00a0Login to WHM.<\/p>\n

>> \u00a0Navigate to Home -> Security Center -> cPHulk Brute Force Protection.<\/p>\n

> \u00a0Click the toggle ON\/OFF option to enable or disable the cPHulk.\"\"<\/p><\/blockquote>\n

Configuration settings<\/strong><\/p>\n

We can configure cPHulk settings in WHM as per the image below. We can change limits of failed login attempts and temporary blocks duration using this tab.\"\"<\/p>\n

Whitelist Management<\/strong><\/p>\n

We can also whitelist an IP address from cPHulk interface. The whitelist specified IP address for which cPHulk always allows login to our server.We can enter the IP address in the New Whitelist Records field and click the Add button. We can add desired comments in the comment text box. These comments will help you for quick reference. When clicking on the whitelist management tab you will get a screen that looks like the picture below.\"\"<\/p>\n

Blacklist Management<\/strong><\/p>\n

Blacklist management is opposite of the whitelist tab. This tab help you to block specific IP address and ranges.If you found repeated failed attempts to login your server from an unauthorized IP address you can add it to your blacklist to prevent any future attempts.<\/p>\n

We can remove the blocked IP address by clicking the Delete button to the right of the IP address\"\"<\/p>\n

History Reports<\/strong><\/p>\n

The History Reports tab shows all the failed attempts to access our server. We can clear the log \u00a0details using this tab and it will release any current lock outs.\"\"<\/p>\n

    \n
  1. \u00a0\u00a0 Steps to enable cPHulk via Command line<\/strong><\/li>\n<\/ol>\n

    cPHulk status<\/strong><\/p>\n

    To check the cPHulk status , run this command \u00a0:<\/p>\n

    # ps aux | grep \u2013i cphulk<\/i><\/strong><\/p>\n

    Output : \u00a0\u00a0\u00a0<\/i><\/p>\n

    root \u00a0<\/i>\u00a0\u00a0\u00a0\u00a0<\/i>8196 \u00a00.0 \u00a00.2 \u00a041088 \u00a02120 ? \u00a0\u00a0\u00a0<\/i>\u00a0\u00a0\u00a0\u00a0<\/i>S<\/i>\u00a0\u00a0\u00a0\u00a0<\/i>Feb05 \u00a0\u00a02:38 cPhulkd \u2013 processor<\/i><\/p>\n

    This output shows that cPHulk is enabled.<\/p>\n

    Restart cPHulk<\/strong><\/p>\n

    To restart cPHulk daemon, perform either one of the commands.<\/p>\n

    Perform a soft restart.<\/p>\n

    # \/scripts\/restartsrv_cphulkd<\/i><\/strong><\/p>\n

    Perform a hard restart and force the system to flush the daemon\u2019s memory.<\/p>\n

    # \/scripts\/restartsrv_cphulkd \u2013stop; \/scripts\/restartsrv_cphulkd \u2013start<\/i><\/p>\n

    Disable cPHulk<\/strong><\/p>\n

    To disable cPHulk<\/p>\n

    # \/usr\/local\/cpanel\/etc\/init\/stopcphulkd<\/i><\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/i>\u00a0\u00a0\u00a0\u00a0<\/i>Or<\/i><\/p>\n

    \u00a0\u00a0\u00a0\u00a0<\/i># \/usr\/local\/cpanel\/bin\/cphulk_pam_ctl \u2013disable<\/i><\/p>\n

    To disable cPHulk to keep it offline, even after a restart of cPanel &WHM, remove the cPHulk touch file with the following command:<\/p>\n

    # rm \u00a0\/var\/cpanel\/hulkd\/enabled<\/i><\/p>\n

    Enable cPHulk<\/strong><\/p>\n

    To enable cPHulk<\/p>\n

    # \/usr\/local\/cpanel\/etc\/init\/startcphulkd<\/i><\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/i>\u00a0\u00a0\u00a0\u00a0<\/i>Or<\/i><\/p>\n

    \u00a0\u00a0\u00a0\u00a0<\/i># \/usr\/local\/cpanel\/bin\/cphulk_pam_ctl \u2013enable<\/i><\/p>\n

    IP address Management via command line<\/strong><\/p>\n

    Add IP address to whitelist<\/p>\n

    To add IP addresses to the whitelist from the command line, run this command\u00a0 \/scripts\/cphulkdwhitelist IP<\/strong> \u00a0where IP shows the IP address that you wish to whitelist.<\/p>\n

    # \/scripts\/cphulkdwhitelist x.x.x.x<\/strong> \u00a0\u00a0<\/i>(Note: x.x.x.x denotes your IP address)<\/p>\n

    Add IP address to Blacklist<\/strong><\/p>\n

    We can also use the command \/scripts\/cphulkdblacklist IP<\/strong> for blacklisting an IP address in cphulk.<\/p>\n

    # \/scripts\/cphulkdblacklist x.x.x.x<\/i><\/strong><\/p>\n

    IP address management via MYSQL<\/strong><\/p>\n

    cPHulk stores all of its information in a database called cphulkd. There are two tables of interest: \u00a0\u00a0\u201dlogins\u201d and \u201cbrutes\u201d.The logins table stores login authentication failure.The brutes table stores excessive authentication failures indicative of a brute force attack.<\/p>\n

    Whitelisting through MySQL prompt<\/strong><\/p>\n

    >> Login to your server via SSH as the root user and run the following commands.<\/p>\n

    >>\u00a0mysql<\/i><\/p>\n

    To access the cPHulk database<\/p>\n

    >>\u00a0use cphulkd<\/i><\/p>\n

    To show the list of tables under cPHulk\u2019s database.<\/p>\n

    >>\u00a0show tables;<\/i><\/p>\n

    To check if your IP address is in brutes tables.<\/p>\n

    >>\u00a0select * from brutes where IP =\u2019X.X.X.X\u2019;\u00a0<\/i>\u00a0(Note: X.X.X.X represents your IP address)<\/p>\n

    If IP address found in brutes table, then remove the IP address using the following command.<\/p>\n

    >>\u00a0delete from brutes where IP =\u2019X.X.X.X\u2019;<\/i><\/p>\n

    Or we can delete the IP address from logins table<\/p>\n

    >>\u00a0delete from logins where IP = \u2018X.X.X.X\u2019;<\/i><\/p>\n

    >>exit<\/p>\n

    cPHulk Log files<\/strong><\/p>\n

    The log files are first contributor on all the IT environment when we troubleshooting the problem. The cPHulk log file are located under \/usr\/local\/cpanel\/logs\/ directory and you can use less, cat, more or tail command to check the logs messages.<\/p>\n

    These are the log files of cPHulk Brute Force Protection :<\/p>\n

    >> \/usr\/local\/cpanel\/logs\/cphulkd.log<\/i><\/p>\n

    > \/usr\/local\/cpanel\/logs\/cphulkd_errors.log<\/i><\/p><\/blockquote>\n

    If you require help,\u00a0contact HoganHost.com.ng<\/a>
    \n