Unable to login to the WHM

If there are many failed login attempts, your account may get locked by WHM. You will get the following message in the browser after the account blocked in the WHM.

—————-

This account is currently locked out because a brute force attempt was detected. Please wait 10 minutes and try again. Attempting to login again will only increase this delay. If you frequently experience this problem, we recommend having your username changed to something less generic.

—————-

This lock was created by the “cphulkd”- Cpanel Brute Force Protection service.

cphulkd: Cpanel Brute Force Protection service. This service monitors failed authentication attempts and locks out accounts after the threshold is met.

To re-enable your account, login via ssh and disable cphulkd using the command below.

# /usr/local/cpanel/bin/cphulk_pam_ctl –disable

This should allow you to login to WHM and double check your cphulk settings.

You can view IP addresses that have been blocked via the WHM interface: WHM -> Security -> Security Center -> cPHulk Brute Force Protection in the Brutes table. On that screen, you can also customize brute force protection settings.

Flush DB will remove all blocked IPs:

WHM -> Security Center -> cPHulk Brute Force Protection -> Click on Flush DB