WHM [host] cPHulk Brute Force Protection

Configuration Settings

Username-based Protection

ON OFF

Username-based protection tracks login attempts for user accounts. When disabled, cPHulk will not lock user accounts, but existing account locks will remain.

Brute Force Protection Period (in minutes)

Maximum Failures by Account

Apply protection to local addresses only

Apply protection to local and remote addresses

Allow username protection to lock the “root” user.

IP Address-based Protection

ON OFF

IP Address-based protection tracks login attempts from specific IP addresses. When disabled, cPHulk will not block IP addresses, but existing blocks will remain.

IP Address-based Brute Force Protection Period (in minutes)

Maximum Failures per IP Address

Command to Run When an IP Address Triggers Brute Force Protection

Warning: The command must complete within 15 seconds to avoid a timeout.

The following variables may be used in commands:

%exptime% - The Unix time when brute force protection will release the block
%max_allowed_failures% - Maximum allowed failures to trigger this type (excessive or non-excessive failures)
%current_failures% - Number of current failures
%excessive_failures% - 0 (not an excessive login failure) or 1 (an excessive login failure)
%reason% - The reason for the block
%remote_ip% - The blocked IP address
%authservice% - The last service to request authentication (for example, webmaild)
%user% - The last username to request authentication
%logintime% - The time of the request
%ip_version% - The IP version (4 or 6)

Block IP addresses at the firewall level if they trigger brute force protection

One-day Blocks

Maximum Failures per IP Address before the IP Address is Blocked for One Day

Command to Run When an IP Address Triggers a One-Day Block

Warning: The command must complete within 15 seconds to avoid a timeout.

The following variables may be used in commands:

%exptime% - The Unix time when brute force protection will release the block
%max_allowed_failures% - Maximum allowed failures to trigger this type (excessive or non-excessive failures)
%current_failures% - Number of current failures
%excessive_failures% - 0 (not an excessive login failure) or 1 (an excessive login failure)
%reason% - The reason for the block
%remote_ip% - The blocked IP address
%authservice% - The last service to request authentication (for example, webmaild)
%user% - The last username to request authentication
%logintime% - The time of the request
%ip_version% - The IP version (4 or 6)

Block IP addresses at the firewall level if they trigger a one-day block

Duration for Retaining Failed Logins (in minutes)

Notifications

Send a notification upon successful root login when the IP address is not on the whitelist

Send a notification upon successful root login when the IP address is not on the whitelist, but from a known netblock

Send a notification when the system detects a brute force user

Note: Users can enable login notifications in the Contact Information area inside of cPanel.

Whitelist

Note: IP addresses on the whitelist can always log in to your server.

New Whitelist Records

You may include an optional comment with each IP address.

Example: 169.254.1.1 # Comment for this IP address.

You can also paste in the contents of a previously downloaded whitelist.

IP Address

Comment

Page Size

Displaying 0 to 0 out of 0 records.

Displaying 0 records out of 0 records.

	IP Address	Comment	Actions	Select All Clear Selection Download All Download Selected Delete All Delete Selected Reload Whitelist from Server
Loading whitelist data … The whitelist is empty. No whitelist entries match the filter.

Blacklist

Note: IP addresses on the blacklist can never log in to your server.