Tips WHM/cPanel: WHM Access Restriction for Certain IP
One of the common problems while managing WHM/CPanel based hosting is blacklist access into WHM/CPanel due to CPHulk plugins. CPHulk activated by default on WHM (if you choose Yes while initial setup) and serves as a blacklisted software just like Fail2ban or Denyhost to prevent logon services from spammers/crackers.
The problem is that CPHulk can’t often decide which access is normal and which aren’t. Consequently, due to so many failures, even our valid IP could be blacklisted or could not be logged in as root. Why? Because cracker will try to select a random password, and after a few logins attempt CPHulk will automatically reject root login.
In addition to closing the recommended port, there is also the easiest way to anticipate this kind of problem, by doing WHM access limit/WHM login page access protection.
To do so, run the following procedure :
1. Login to WHM login page, enter your user name and password.
2. In the Security Center group menu, click Host Access Control menu.
3. On the Daemon, select Whostmgrd daemon. It is a daemon application for WHM. We can also choose to protect SSH (SSHD) daemon or CPaneld daemon for CPanel.
4. In the Access List, enter the IP or IP range that allows accessing. Write down the full subnet, for example, to network segment 122.201.98.70/29 means to enter the IP 122.201.98.64/255.255.255.248. Configure it as 122.201.98.64/29 will not work because WHM will only accept full network subnet. If you asked, why using 122.201.98.64/255.255.255.248 and not 122.201.98.70/255.255.255.248 instead, then you should take the IP subnet course.
5. In the Action section select “Allow”.
6. Do the same thing to another IP segment which will be allowed.
7. At the bottom, Select Daemon = Whostmgrd, Access List = ALL and Action = Deny. Means that other than registered IP will not be allowed.
8. When finished, click the “Save Host Access List”.
9. Perform WHM access from the allowed IP and from outside registered IP list.
For those who are accustomed to dealing with Linux servers, the above process basically does limit access by adding a rule in the file /etc/hosts.