Locked out of your server

This guide is for cloud servers and dedicated servers with cPanel, where you have root access. If you have shared or reseller hosting and can't reach cPanel, WHM, email or FTP, see Imunify360 website protection, or open a support ticket and include your IP address.

Most lockouts happen after too many failed logins, a firewall rule or a mistake in the SSH configuration. Before you start, find your IP address by searching "what is my IP" in a search engine. In the commands below, replace 203.0.113.10 with your IP address.

Get in through the console

If you can't reach your server over SSH or WHM, use the console. It shows the server's screen in your browser and doesn't depend on the network, the firewall or SSH.

• Cloud server: in the Client Area, open your server and click VNC Access, then log in as root. If you've forgotten the root password, use Reset Root Password. See Manage your cloud server.
• Dedicated server: please open a support ticket in the Technical Support department.

Then find the cause below and fix it.

Blocked after failed logins (cPHulk)

cPHulk is cPanel's brute force protection. It blocks an IP address after too many failed logins to WHM, cPanel, SSH, email or FTP.

If you can log in to WHM from another IP address, go to Security Center > cPHulk Brute Force Protection. The History Reports tab shows what's blocked, and Whitelist Management lets you add your IP address so it's never blocked.

From the console, remove the block and add your IP address to the whitelist:

whmapi1 flush_cphulk_login_history_for_ips ip=203.0.113.10
/scripts/cphulkdwhitelist 203.0.113.10

Only add IP addresses that are yours and don't change, such as your office's IP address.

Blocked by the firewall

Which commands to use depends on the firewall on your server.

Imunify360 (allows the IP address and lifts its blocks):

imunify360-agent ip-list local add --purpose white 203.0.113.10 --comment "Office"

CSF:

csf -g 203.0.113.10
csf -dr 203.0.113.10
csf -tr 203.0.113.10
csf -a 203.0.113.10 "Office"

The first command shows any rule that matches the IP address. The next two remove a permanent and a temporary block, and the last allows the IP address.

firewalld (AlmaLinux and other RHEL-based systems), if you removed SSH by mistake:

firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

If SSH runs on a different port, use --add-port=2222/tcp with your port instead of --add-service=ssh.

ufw (Ubuntu):

ufw allow OpenSSH

Don't run iptables -F to clear the firewall. If the firewall's default policy is to drop traffic, clearing its rules blocks all access to your server, including your websites.

A mistake in the SSH configuration

If SSH stopped working after you edited /etc/ssh/sshd_config, test the configuration from the console:

sshd -t

It shows the line with the error, if there is one. Also check settings such as Port, PermitRootLogin and PasswordAuthentication, including in any files in /etc/ssh/sshd_config.d/. Fix the problem, then restart SSH:

systemctl restart sshd

On Ubuntu, use systemctl restart ssh.

If you turned off password logins and lost your SSH key, add a new key in WHM under Security Center > Manage root's SSH Keys, or turn password logins back on under Security Center > SSH Password Authorization Tweak.

Avoid getting locked out

• Whitelist your own fixed IP addresses in cPHulk and your firewall.
• When you change the SSH or firewall configuration, keep your current SSH session open and test the change from a second session before you log out.
• Use SSH keys, and keep the root password in a password manager.
• Know how to open the console before you need it.

For more ways to protect your server, see Secure your cPanel server.