What is CPHulk and why is it blocking me from my server?
CPHulk is the inbuilt protection in cPanel to prevent a server falling victim to brute force login attempts. To understand why CPHulk can block you, you need to know what a brute force attack is.Brute Force Attacks
Simply put a brute force is a password guessing technique that consists of trying to login with a user name and password over and over, changing either the username and/or the password if not successful.
Given enough time even a moderately secure, random character password can fall victim to this as some attackers will try every combination they can if given the chance.
CPHulk will detect and block these attacks by checking for failed login attempts. This can affect you if the failed logins are originating from your internet connection. The steps below will guide you on how to unblock yourself depending on the access you have.
Unblocking in WHM
If you still have access to WHM, you can unblock an IP address using the steps below.
You can also Whitelist your IP in the 'Whitelist Management' tab, by adding your 'IP' and clicking 'Add'.
- Login to WHM
- Search for 'cphulk'
- Click on the 'History Reports' tab and then 'Remove Blocks and Clear Reports'.
Unblocking in Console
If you are blocked from WHM, you can unblock an IP address using the steps below.
- Login via SSH
- Run the following commands
- mysql -u root
- use cphulkd;
- SELECT * FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;
- DELETE FROM brutes WHERE `IP`=’xxx.xxx.xxx.xxx’;