{"id":328,"date":"2021-07-23T12:27:53","date_gmt":"2021-07-23T12:27:53","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/cphulk-management-on-the-command-line\/"},"modified":"2021-07-23T12:27:53","modified_gmt":"2021-07-23T12:27:53","slug":"cphulk-management-on-the-command-line","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/cphulk-management-on-the-command-line\/","title":{"rendered":"cPHulk Management on the Command Line"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Overview<\/h2>\n

This document describes how to manage cPHulk from the command line. You can also manage cPHulk with WHM\u2019s cPHulk Brute Force Protection<\/em> interface (WHM >> Home >> Security Center >> cPHulk Brute Force Protection<\/em>).<\/p>\n

\n
Note:<\/div>\n
\n
    \n
  • \n

    This feature requires that you use SSH to access your server as the root<\/code> user.<\/p>\n<\/li>\n

  • \n

    In cPanel & WHM version 62 and later, cPHulk uses an SQLite database.<\/p>\n<\/li>\n

  • \n

    In cPanel & WHM version 72 and later, you can use cPanel\u2019s Terminal<\/em> interface (cPanel >> Home >> Advanced >> Terminal<\/em>) or WHM\u2019s Terminal<\/em> interface (WHM >> Home >> Advanced >> Terminal<\/em>) to access the command line from within the interface.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n

    Manage cPHulk<\/h2>\n

    Use the following methods to manage the cPHulk service (cphulkd<\/code>) on your server.<\/p>\n

    Enable cPHulk<\/h3>\n
    \n
    Important:<\/div>\n
    \n

    The system requires<\/strong> several configuration changes to properly enable cPHulk. Do not<\/strong> enable it from the command line.<\/p>\n<\/p><\/div>\n<\/div>\n

    To enable cPHulk, use WHM\u2019s cPHulk Brute Force Protection<\/em> interface (WHM >> Home >> Security Center >> cPHulk Brute Force Protection<\/em>).<\/p>\n

    Enable and disable debug mode<\/h3>\n

    To enable debug mode, perform the following steps:<\/p>\n

      \n
    1. \n

      Create the debug<\/code> touch file in the \/var\/cpanel\/hulkd<\/code> directory:\n<\/p>\n

      \n
      echo 3<\/span> > touch \/var\/cpanel\/hulkd\/debug<\/code><\/pre>\n<\/div>\n<\/li>\n
    2. \n
      Restart cPHulk:\n<\/p>\n
      \n
      \/usr\/local\/cpanel\/scripts\/restartsrv_cphulkd<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ol>\n
      To disable debug mode, perform the following steps:<\/p>\n
        \n
      1. \n
        Remove the debug<\/code> touch file:\n<\/p>\n
        \n
        rm \/var\/cpanel\/hulkd\/debug<\/code><\/pre>\n<\/div>\n<\/li>\n
      2. \n
        Restart cPHulk:\n<\/p>\n
        \n
        \/usr\/local\/cpanel\/scripts\/restartsrv_cphulkd<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ol>\n
        Check cPHulk\u2019s status<\/h3>\n
        To check the status of cPHulk, perform one of the following actions:<\/p>\n
          \n
        • \n
          Call WHM API 1\u2019s cphulk_status<\/code> function.<\/p>\n<\/li>\n
        • \n
          Run the following command:\n<\/p>\n
          \n
          ps aux | grep -i cphulk<\/code><\/pre>\n<\/div>\n
          The system will return output that resembles the following example:<\/p>\n
          \n
          root 1501<\/span> 0<\/span>.0 0<\/span>.4 34816<\/span> 5076<\/span> ? S 07<\/span>:58 0<\/span>:00 cPhulkd - processor<\/code><\/pre>\n<\/div>\n
          In this example, the output indicates that cPHulk is enabled.<\/li>\n<\/ul>\n
          Restart cPHulk<\/h3>\n
          To restart cPHulk, perform one of the following actions:<\/p>\n
            \n
          • \n
            Call WHM API 1\u2019s configureservice<\/code> function. This also rebuilds and restarts Dovecot. To do this, run the following commands:\n<\/p>\n
            \n
            \n\n\n
            \n
            1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
            		\n
            whmapi1 configureservice service=<\/span>cphulkd enabled=<\/span>0<\/span> monitored=<\/span>0<\/span>\nwhmapi1 configureservice service=<\/span>cphulkd enabled=<\/span>1<\/span> monitored=<\/span>1<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n
          • \n
            Perform a soft restart. Then, rebuild and then restart Dovecot. To do this, run the following scripts:\n<\/p>\n
            \n
            \n\n\n
            \n
            1\n<\/span>2\n<\/span>3\n<\/span><\/code><\/pre>\n<\/td>\n
            		\n
            \/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>cpanel<\/span>\/<\/span>scripts<\/span>\/<\/span>restartsrv_cphulkd<\/span>\n\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>cpanel<\/span>\/<\/span>scripts<\/span>\/<\/span>builddovecotconf<\/span>\n\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>cpanel<\/span>\/<\/span>scripts<\/span>\/<\/span>restartsrv_dovecot<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n
          • \n
            Perform a hard restart and force the system to flush the service\u2019s memory. Then, rebuild and restart Dovecot. To do this, run the following commands:\n<\/p>\n
            \n
            \n\n\n
            \n
            1\n<\/span>2\n<\/span>3\n<\/span><\/code><\/pre>\n<\/td>\n
            		\n
            \/usr\/local\/cpanel\/scripts\/restartsrv_cphulkd --stop; \/scripts\/restartsrv_cphulkd --start\n\/usr\/local\/cpanel\/scripts\/builddovecotconf\n\/usr\/local\/cpanel\/scripts\/restartsrv_dovecot<\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n
            Disable cPHulk<\/h3>\n
            To disable cPHulk, perform one of the following actions:<\/p>\n
              \n
            • \n
              Call WHM API 1\u2019s disable_cphulk<\/code> function.<\/p>\n<\/li>\n
            • \n
              Call WHM API 1\u2019s configureservice<\/code> function. For example:\n<\/p>\n
              \n
              whmapi1 configureservice service=<\/span>cphulkd enabled=<\/span>0<\/span> monitored=<\/span>0<\/span><\/code><\/pre>\n<\/div>\n<\/li>\n
            • \n
              Run the following commands:\n<\/p>\n
              \n
              \n\n\n
              \n
              1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
              		\n
              \/usr\/local\/cpanel\/etc\/init\/stopcphulkd\n\/usr\/local\/cpanel\/bin\/cphulk_pam_ctl --disable<\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n
              Keep cPHulk offline<\/h4>\n
              To disable cPHulk so that it remains offline, even after a restart of cPanel & WHM, perform the following steps:<\/p>\n
                \n
              1. \n
                Remove the enabled<\/code> touch file:\n<\/p>\n
                \n
                rm \/var\/cpanel\/hulkd\/enabled<\/code><\/pre>\n<\/div>\n<\/li>\n
              2. \n
                Edit the \/etc\/dovecot\/dovecot.conf<\/code> file to remove the following line:\n<\/p>\n
                \n
                auth_policy_server_url =<\/span> http:\/\/127.0.0.1:579\/dovecot-auth-policy<\/code><\/pre>\n<\/div>\n<\/li>\n
              3. \n
                Rebuild Dovecot\u2019s configuration file. To do this, run the following script:\n<\/p>\n
                \n
                \/usr\/local\/cpanel\/scripts\/builddovecotconf<\/code><\/pre>\n<\/div>\n<\/li>\n
              4. \n
                Restart Dovecot. To do this, run the following script:\n<\/p>\n
                \n
                \/usr\/local\/cpanel\/scripts\/restartsrv_dovecot<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ol>\n
                Log files<\/h2>\n
                cPHulk stores its logs in the following files:<\/p>\n
                  \n
                • \n
                  \/usr\/local\/cpanel\/logs\/cphulkd.log<\/code><\/p>\n<\/li>\n
                • \n
                  \/usr\/local\/cpanel\/logs\/cphulkd_errors.log<\/code><\/p>\n<\/li>\n<\/ul>\n
                  IP address management<\/h2>\n
                  You can use the following commands to add an IP address to cPHulk\u2019s whitelist and blacklist:<\/p>\n
                  \n
                  Note:<\/div>\n
                  \n
                    \n
                  • \n
                    If an IP address exists on both<\/strong> lists, the system will override the blacklist entry.<\/p>\n<\/li>\n
                  • \n
                    An IP address block in the iptables<\/code> application will override an IP address on the whitelist. To unblock an IP address, call WHM API 1\u2019s flush_cphulk_login_history_for_ips<\/code> function.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n
                    Whitelist an IP address<\/h3>\n
                    To add an IP address to the whitelist, run the following script. In this example, 192.0.2.0<\/code> represents an IP address or IP address range:<\/p>\n
                    \n
                    \/usr\/local\/cpanel\/scripts\/cphulkdwhitelist 192<\/span>.0.2.0<\/code><\/pre>\n<\/div>\n
                    Blacklist an IP address<\/h3>\n
                    To add an IP address to the blacklist, run the following script. In this example, 192.0.2.0<\/code> represents an IP address or IP address range:<\/p>\n
                    \n
                    \/usr\/local\/cpanel\/scripts\/cphulkdblacklist 192<\/span>.0.2.0<\/code><\/pre>\n<\/div>\n
                    Remove lockouts<\/h2>\n
                    If cPHulk locks you out of your cPanel account, perform the following steps:<\/p>\n
                      \n
                    1. \n
                      Log in to WHM.<\/p>\n<\/li>\n
                    2. \n
                      Append the following string to the WHM URL:\n<\/p>\n
                      \n
                      \/scripts2\/doautofixer?autofix=<\/span>disable_cphulkd<\/code><\/pre>\n<\/div>\n
                      The resulting URL may resemble the following example. In this example, www.example.com<\/code> is your server\u2019s hostname:<\/p>\n
                      \n
                      https:\/\/www.example.com:2087\/scripts2\/doautofixer?autofix=<\/span>disable_cphulkd<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ol>\n
                      If you enabled the following settings in WHM\u2019s cPHulk Brute Force Protection<\/em> interface (WHM >> Home >> Security Center >> cPHulk Brute Force Protection<\/em>), you must remove the iptables<\/code> rule that the system created:<\/p>\n
                        \n
                      • Block IP addresses at the firewall level if they trigger brute force protection<\/em><\/li>\n
                      • Block IP addresses at the firewall level if they trigger a one-day block<\/em><\/li>\n<\/ul>\n
                        To do this, run one of the following commands:<\/p>\n
                          \n
                        • \n
                          For cPanel & WHM version 62 and later<\/strong>, run:\n<\/p>\n
                          \n
                          iptables -F cphulk &&<\/span> \/usr\/local\/cpanel\/3rdparty\/bin\/sqlite3 \/var\/cpanel\/hulkd\/cphulk.sqlite \"DELETE FROM login_track;\"<\/span><\/code><\/pre>\n<\/div>\n<\/li>\n
                        • \n
                          For cPanel & WHM version 60 and earlier<\/strong>, run:\n<\/p>\n
                          \n
                          iptables -F cphulk &&<\/span> mysql -e \"Delete from cphulkd.login_track;\"<\/span><\/code><\/pre>\n<\/div>\n<\/li>\n<\/ul>\n
                          \n
                          Note:<\/div>\n
                          \n
                          These commands remove all<\/strong> of cPHulk\u2019s lockouts. To remove the lockout for a specific IP address on servers that run cPanel & WHM version 11.50 or later, call WHM API 1\u2019s flush_cphulk_login_history_for_ips<\/code> function.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"
                          Overview This document describes how to manage cPHulk from the command line. You can also manage cPHulk with WHM\u2019s cPHulk Brute Force Protection interface (WHM >> Home >> Security Center >> cPHulk Brute Force Protection). Note: This feature requires that you use SSH to access your server as the root user. In cPanel & WHM …<\/p>\n","protected":false},"author":1,"featured_media":329,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/328"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=328"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/328\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/329"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}