Your IP : 10.1.126.163

Current Path : /proc/thread-self/root/proc/self/root/opt/cpguard/cpglfd/configs/jails.available/
Upload File :
Current File : //proc/thread-self/root/proc/self/root/opt/cpguard/cpglfd/configs/jails.available/cpanel.yaml

jails:
  - name: "cpanel-auth"
    enabled: true
    log_paths:
      - "/usr/local/cpanel/logs/access_log" # Access Logs (Standard path)

    rules:
      # 1. cPanel App Log (Explicit Failure)
      # Matches: FAILED LOGIN cpaneld: ... ip=1.2.3.4
      - regexp: "FAILED LOGIN cpaneld: .* ip=(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)"

      # 2. WHM App Log (Root Failure)
      # Matches: FAILED LOGIN whostmgrd: ... ip=1.2.3.4
      - regexp: "FAILED LOGIN whostmgrd: .* ip=(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)"

      # 3. Access Log (HTTP 401 - The Missing Rule)
      # Matches: 1.2.3.4 - - ... "POST /login/..." 401
      # Catches bots that fail HTTP auth before hitting the application log
      - regexp: "^(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+) - - .* \"POST /login/.* HTTP/\\d\\.\\d\" 401"
      - regexp: "^(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+) .*\"POST /login.*HTTP/[\\d\\.]+\" 401"

    max_retries: 5
    find_time: "1m"
    ban_time: "1h"

    actions:
      - name: "cpgblock-cpanel"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"