Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I tried to login into a cpanel account that hasn't been accessed for a few months and discovered that my login details no longer worked. When I reset the password and gained access into my domains control panel, my email password also didn't work. Upon that first attempt I was given a message reading "Brute force attempt..."

So, does cpanel keep a list of logins? or login attempts?

Thanks for any help!

share|improve this question
add comment

2 Answers

I know this is an old topic but for future readers, check

/usr/local/cpanel/logs/login_log

That log shows a list of failed login attempts and deferred login attempts.

share|improve this answer
    
Confirmed on my VPS. Thanks for the tip! –  Royce Williams Jan 8 '12 at 16:23
add comment

check under /usr/local/cpanel/logs/access_log

share|improve this answer
    
But logs file shows all connections, what do you search in it to find out login attempts? –  Marco Demaio Aug 19 '10 at 13:15
1  
@Marco Demaio you should grep the log for logins like user@domain.tld –  Mr Shunz Aug 20 '10 at 9:36
    
it works I searched for the user name that can login. Interesting, thanks! But what about the login attempts jeff is asking for? How do I look for login attempt that maybe failed? –  Marco Demaio Aug 20 '10 at 15:55
    
@Marco Demaio actually there's another logfile: /usr/local/cpanel/logs/login_log which contains all auth attempts, you can find something like this: X.X.X.X - [06/18/2010:20:48:43 -0000] "POST /login/ HTTP/1.1" FAILED LOGIN webmaild: user name not specified or invalid user –  Mr Shunz Aug 21 '10 at 9:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.