false whm root login alert

This forum is only for reproducible bugs with csf and lfd (i.e. not iptables problems, lack of understanding how to use a feature, etc). Posts must be accompanied with full technical details of the problem and how it can be recreated. Any posts not adhering to this, or not considered bugs, will be moved to the General Discussion (csf) forum.
Post Reply
whwh1
Junior Member
Posts: 5
Joined: 03 Oct 2008, 00:28

false whm root login alert

Post by whwh1 »

Hi,

Minutes ago, i received a false positive.

root@X [~]# cat /usr/local/cpanel/logs/access_log |grep XXX.XXX.XXX.XXX
XXX.XXX.XXX.XXX - - [10/04/2009:02:46:19 -0000] "GET / HTTP/1.0" 401 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - root [10/04/2009:02:46:28 -0000] "GET / HTTP/1.0" 401 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:47:20 -0000] "GET /unprotected/cpanel/favicon.ico HTTP/1.0" 200 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:47:20 -0000] "GET /unprotected/cpanel/style.css HTTP/1.0" 200 0 "Xttp://YYY.YYY.YYY.YYY:2086/" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:47:20 -0000] "GET /unprotected/cpanel/images/log_02b.jpg HTTP/1.0" 200 0 "Xttp://YYY.YYY.YYY.YYY:2086/unprotected/cpanel/style.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:47:21 -0000] "GET /unprotected/cpanel/images/log_01_whm.jpg HTTP/1.0" 200 0 "Xttp://YYY.YYY.YYY.YYY:2086/unprotected/cpanel/style.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:47:21 -0000] "GET /unprotected/cpanel/images/button-bg.jpg HTTP/1.0" 200 0 "Xttp://YYY.YYY.YYY.YYY:2086/unprotected/cpanel/style.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:47:21 -0000] "GET /unprotected/cpanel/images/log_03.jpg HTTP/1.0" 200 0 "Xttp://YYY.YYY.YYY.YYY:2086/unprotected/cpanel/style.css" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - - [10/04/2009:02:50:48 -0000] "GET / HTTP/1.0" 401 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
XXX.XXX.XXX.XXX - root [10/04/2009:02:50:53 -0000] "GET / HTTP/1.0" 401 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"

Can you confirm it's a false positive ?
Top
chirpy
Moderator
Posts: 3537
Joined: 09 Dec 2006, 18:13

Post by chirpy »

XXX.XXX.XXX.XXX - root [10/04/2009:02:50:53 -0000] "GET / HTTP/1.0" 401 0 "" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ar; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) FirePHP/0.3"
That line suggests a failed root login from XXX.XXX.XXX.XXX which cause the trigger.
Top
whwh1
Junior Member
Posts: 5
Joined: 03 Oct 2008, 00:28

Post by whwh1 »

Hi chirpy,

Shouldn,t the alert be sent only when the root login is successfull ? Or else, be sent everytime a root login failed ? :)
Top
shenzy
Junior Member
Posts: 22
Joined: 11 Feb 2009, 23:59

Post by shenzy »

Hello!
This morning I've also received a false positive "WHM root login alert".
Never before had received false-positive, And how did not know if access had been achieved, I panic a bit and I decided immediately to change the root password and reboot the server :).
Then more calmly, review the logs and perform some tests...
In my case I did a test directly entering the url of phpmyadmin in cPanel. (httpxxx://wwwxxx.TestDomian.com:2082/frontend/x3/sql/PhpMyAdmin.html, and when he asked username and password, I enter "root" without password. Obviously the system will not let me login but I get an immediate email "WHM root login alert". :confused:

PDT: The "xxx" in the URL are for the antispam in forum.
Top
ForumAdmin
Moderator
Posts: 1523
Joined: 01 Oct 2008, 09:24

Post by ForumAdmin »

We'll have a fix for this in the next release.
Top
shenzy
Junior Member
Posts: 22
Joined: 11 Feb 2009, 23:59

Post by shenzy »

thank you very much!!
Top
whwh1
Junior Member
Posts: 5
Joined: 03 Oct 2008, 00:28

Post by whwh1 »

thanks to the devs for this.
Top
Post Reply

Return to “Report Bugs (csf)”