Knowledgebase

Overview

1. Whitelist Managament

2. Blacklist Management

3. Countries Management

4. History Reports

Overview

This interface allows you to configure cPHulk, a service that provides protection for your server against brute force attacks. A brute force attack uses an automated system to guess the password of your web server or services.

cPhulk monitors the following web servers and services:

• cPanel services (Port 2083).

• WHM services (Port 2087).

• Mail services (Dovecot® and Exim).

• The PureFTPd service.

• Secure Shell (SSH) access.

When cPHulk blocks an IP address or account, it does not identify itself as the source of the block. Instead, the login page displays the following warning message: The login is invalid.

Enable cPHulk

To enable cPHulk on the server, set the toggle to On.

Configure cPHulk

Configuration settings

You can configure the following Configuration Settings options:

Username-based protection

• Username-based Protection — Whether to enable the username-based protection settings. Set the toggle to On to enable the Username-based Protection setting. Username-based protection tracks login attempts for user accounts. When you disable cPHulk, existing account locks will remain. This setting defaults to On.

  Note:

  • You must click Save to change this setting.
  • The server does not send notifications for username-based brute force attacks.

   

• Brute Force Protection Period (in minutes) — The number of minutes during which cPHulk measures all login attempts to a specific user’s account. This setting defaults to 5.

  • If several attackers attempt to log in, and they reach the account’s Maximum Failures by Account value within this period, cPHulk classifies this as a brute force attempt.

  • cPHulk blocks logins from any IP addresses to that account, regardless of the attackers’ IP address or addresses.

  • Enter a value between 1 and 1,440 for this setting.

• _Maximum Failures by Account_— The maximum number of failures that cPHulk allows per account within the Brute Force Protection Period (in minutes) time range. This setting defaults to 15.

  • If a brute force attack meets this number of attempts, the system locks the account, regardless of the attackers’ IP addresses.

  • cPHulk locks the account for one minute for each attempt that you allow with this setting. For example, if you set the Maximum Failures by Account setting to 15, after 15 login attempts cPHulk locks the account for 15 minutes.

  • When you set this value to 0, cPHulk blocks all login attempts (this includes the root account). To avoid this lock-out, you must whitelist your IP address.

• Apply protection… — Select one of the following options to control how cPHulk applies its protection:

  • Apply protection to local addresses only — Limit username-based protection to trigger only on requests that originate from the local system. This ensures that a user cannot brute force other accounts on the same server. This is the default setting.

  • Apply protection to local and remote addresses — Allow username-based protection to trigger for all requests, regardless of their origin.

• Allow username protection to lock the “root” user — Whether to apply username-based protection rules to the root user. This checkbox defaults to deselected.

IP Address-based protection

• IP Address-based Protection — Whether to enable the IP address-related protection settings. Set the toggle to On to enable the IP Address-based Protection setting. IP address-based protection tracks login attempts from specific IP addresses. When you disable cPHulk existing account locks will remain. This setting defaults to On.

  Note:

  You must click Save to implement any change to this setting.

   

• IP Address-based Brute Force Protection Period (in minutes) — The number of minutes during which cPHulk measures all login attempts from an attacker’s IP address. cPHulk classifies the following as a brute force attack:

  • Attackers on a specific IP address attempt to log in repeatedly with different usernames or passwords.

  • They reach the Maximum Failures per IP Address value.

    Note:

    • cPHulk measures the attacker’s IP address for the number of minutes that you specify.

      • cPHulk will not measure all IP addresses.

     

• Maximum Failures per IP Address — The maximum number of times that a potential attacker at a specific IP address can fail to log in before cPHulk blocks that IP address. When you set this value to 0, cPHulk blocks all login attempts (this includes the root account). To avoid this lock-out, you must whitelist your IP address. This setting defaults to 5.

• Command to Run When an IP Address Triggers Brute Force Protection — The full path to a command that you want the system to run when an IP address triggers brute force protection. For a list of variables to use in this command, read the Command variables section below.

• Block IP addresses at the firewall level if they trigger brute force protection —Whether you wish to automatically add IP addresses that trigger brute force protection to the firewall.

  Note:

  • This option writes a new iptables rule and requires iptables version 1.4 or higher to block IP addresses at the IP address-based level.

  • This option does not exist on Virtuozzo.

   

One-day blocks

• Maximum Failures per IP Address before the IP Address is Blocked for One Day — The maximum number of times that a potential attacker at a specific IP address can fail to log in before cPHulk blocks that IP address for a one-day period. This option defaults to 30.

• Command to Run When an IP Address Triggers a One-Day Block — The full path to a command that you want the system to run when the system blocks an IP address for a one-day period. For a list of variables to use in this command, read the Command variables section below.

• Block IP addresses at the firewall level if they trigger a one-day block — Whether you wish to automatically add IP addresses that trigger a one-day block to the firewall. This option writes a new iptables rule and requires iptables version 1.4 or higher. This checkbox defaults to selected.

  Note:

  • This option writes a new iptables rule and requires iptables version 1.4 or higher to block IP addresses at the IP address-based level.

  • This option does not exist on Virtuozzo.

   

Login History

• Duration for Retaining Failed Logins (in minutes) — This setting determines for how long the system displays failed login entries on the History Reports tab. It also determines the number of minutes that the system allows for an attacker to reach the following settings:

  • Maximum Failures by Account

  • Maximum Failures per IP Address

  • Maximum Failures per IP Address before the IP Address is Blocked for One Day

This setting defaults to 360.

Notifications

• Send a notification upon successful root login when the IP address is not on the whitelist — Whether you wish to receive a notification when the root user successfully logs in from an IP address that does not exist in the whitelist. This checkbox defaults to deselected.

  Note:

  The system only sends a notification once in any 24-hour window for a specific username, service, and IP address combination.

   

• Send a notification upon successful root login when the IP address is not on the whitelist, but from a known netblock — Whether you wish to receive a notification when the root user successfully logs in from an IP address that does not exist in the whitelist, but exists in a known netblock. This checkbox defaults to deselected.

• Send a notification when the system detects a brute force user — Whether you wish to receive a notification when cPHulk detects a brute force attack. This checkbox defaults to selected.

Last modified: May 13, 2020