WebHost Manger on Linux (WHM)

Disturbing question

[lizzie]

I have a reseller account that used WHM interface. Everytime I go to login to it I am automatically entered into it without having to enter my username and password. What is going on? There is no way to logout that I can see. I think anyone who goes to this URL can automatically enter my reseller account.

[dmorison]

Haver you _ever_ had to give your username/pw? Don't know WHM, but are you sure it is not just using cookies to persist your login?

Try exiting all instances of your browser; deleting cached files and any cookies relating to that domain, and try again...

[percentages]

WHM should be setup to demand the username/password on every attempt to access it from a unique browser session. Even if remember password is checked.

If you have a reseller account this has to be a mistake on the setup with your hosting company.

This is a very serious problem as all someone needs to do is trace the IP address (easily done) to gain access and run havoc with your accounts.

I would contact the hosting company immediately and get this fixed. Until it is resolved I wouldn't setup anything additional on this reseller account.

[edited by: percentages at 6:41 am (utc) on Jan. 5, 2004]

[lizzie]

I was hoping that was the case so I erased my cached files and all cookies and it still does it. I go to http:// domain name of hosting service:XXXX (4 numbers) and just like that I am inside my WHM.

[lukasz]

Percentages: how can someone mess up with the account by tracing IP address?

[percentages]

I have the ability to resell WHM v2.1.1 on a dedicated server. I just checked all the root account functions looking for one that would disable the login request for reseller's.....couldn't find anything that would allow this!

I also don't remember seeing anything in versions previous to WHM v2.1.1

The owner your server has something seriously messed up here. They must have installed some additions that are allowing this to occur.

[lizzie]

What I don't understand is this: If someone enters http:// host domain name: XXXX, these four numbers at the end, they must be associated with MY account since I always end up at MY WHM, not someone elses. So if I enter a different set of 4 numbers I may get into someone else's account? In other words, it is always my own account I get into. Is this how it identifies which account to get into, by the 4 numbers at the end?

[1][[b]edited by[/b]: lizzie at 6:57 am (utc) on Jan. 5, 2004][/1]

[percentages]

>Percentages: how can someone mess up with the account by tracing IP address?

If you can access Web Host Manager without logging in then

[ip:2086...]

should give you access to WHM? Try it with your ip address inserted where ip is written above!

If that allows access to WHM then anyone can delete accounts, sites, install spamming scripts, do just about anything they want. Total disaster waiting to happen!

[lizzie]

What I meant was: I go to http:// domain name of MY HOST:XXXX and it is always MY WHM, not someone else's. How is it that I am always going into MY WHM?

[lizzie]

That is why at first I assumed it must be a cookie. Because it only went to MY WHM panel. Because I am using the hosting company name as the domain name in this URL it is not identified with my account at all and yet I always enter MY OWN WHM.

[percentages]

If it is [yourhosturl:2086...] that you are using it should be asking for a login, that is how it knows which reseller account to go to.

I don't know of anyway to get around that login screen.

If your reseller account has its own IP address, which I suspect it does, then what happens if you replace the yourhosturl in the above example with that IP address? Do you get a login screen now?

[lizzie]

Percentages: Yes, when I put in my IP as in:
http://XXX.XX.XXX.X:2086 then I get the login screen. What do you think this means?

[lizzie]

I entered my username and password after getting this login screen, went to my WHM account. Then came back here and again went to http://XXX.XX.XXX.X:2086 and this time went right into my W.H.M. without having to login. I don't understand why this is happening. Once I login, then after the first time I don't have to login again.

[percentages]

>What do you think this means?

I think it means you are infinately better off than I thought you were 30 minutes ago :)

Now the chances of you being hacked seem much more remote.

The question now is how is your PC is remembering the login when you use [yourhostdomain:2086?...]

I'm guessing now as I don't know for sure how this can be done. Try a few of these:

1. Have you definately closed all browsers?

2. Are you using some type of autofill software on your PC?

3. Have you tried accessing it from another PC?

4. Try accessing it using a different brand of browser.

Any of those throw any light on how this is occuring?

If you got the login I think you are safe unless your PC is shared.

[percentages]

lizzie,

You have to close the browser completely. It will remember the login until it is terminated. Try it again having closed the browser first.....then see what happens.

[lizzie]

Yes I closed the browser completely. I had to login again to this site. All cookies were deleted. But still I didn't have to login to the W.H.M. Let me see if I can do it with Netscape.

[lizzie]

I just went there with Netscape. It was the same routine. I had to enter my password and username the first time, then after that it would automatically open it without having me login. What does this mean?

[percentages]

lizzie,

I think it means you have a perfectly normal setup which is secure and nothing to worry about.

As a final test, reboot your PC after each access to WHM. Does it ask you to login each time after a reboot? If so, have a great night and sleep easy, you are perfectly okay :)