Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › cPanel login behind Cloudflare?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

cPanel login behind Cloudflare?

ZweiTigerZweiTiger Member
in Help

Hey,

I checked their wiki and 2083 port is open for https. So actually cloudflare should work with cPanel login page. Is there anybody who tried this? I think againts brutalforce should be very good..

«1

Comments

  • century1stopcentury1stop Member

    you can even have cloudflare in cPanel frontend UI, definitely supports.

  • GM2015GM2015 Member

    Wouldn't that mean that customers' login details would be passed via a third party?

  • ZweiTigerZweiTiger Member

    @GM2015 said:
    Wouldn't that mean that customers' login details would be passed via a third party?

    FULL SSL should do the work , aint?

  • vladka24vladka24 Member

    @ZweiTiger said:
    FULL SSL should do the work , aint?

    Mhm

  • oneilonlineoneilonline Member, Host Rep

    Yes, I've heard of people doing this with SSL cpanel login so I'm pretty sure it's possible.

  • ZweiTigerZweiTiger Member

    Thanks :) We shall see.. :)

  • ClouviderClouvider Member, Patron Provider
    edited October 2015

    @ZweiTiger said:
    FULL SSL should do the work , aint?

    Not really, no.

    Because the SSL is terminated on the Cloudflare server and then another SSL session is created to your server, so Cloudflare processes unencrypted data.

    Thanked by 1wych
  • ZweiTigerZweiTiger Member

    @Clouvider said:

    Well hm. What about STRICT SSL? I got a valid cert. Cloudflare website says thats the most secure option. What do you think?

  • singsingsingsing Member

    ZweiTiger said: Cloudflare website says thats the most secure option. What do you think?

    It's the most secure option but it's not really secure for the reasons @Clouvider gave you.

  • ZweiTigerZweiTiger Member

    @singsing said:
    It's the most secure option but it's not really secure for the reasons Clouvider gave you.

    Then all website who use cloudflare free ssl , actually not secure? If they use strict or full.

  • singsingsingsing Member
    edited October 2015

    ZweiTiger said: Then all website who use cloudflare free ssl , actually not secure? If they use strict or full.

    They are not secure from CF spying even if they use the Enterprise Keyless SSL. CF insists on MITM capability, apparently.

    Of course, there's a decently good reason for this, without MITM there can be no caching either. So it would make no sense whatsoever to use CF other than inflating bandwidth bills.

  • ZweiTigerZweiTiger Member

    @singsing said:
    They are not secure from CF spying even if they use the Enterprise Keyless SSL. CF insists on MITM capability, apparently.

    Well i thought CF is safe to use , and better to use then a simple valid ssl cert. I thought cloudflare + valid cert = Better protection.

  • singsingsingsing Member
    edited October 2015

    ZweiTiger said: Well i thought CF is safe to use , and better to use then a simple valid ssl cert. I thought cloudflare + valid cert = Better protection.

    Well you were wrong then, weren't you? ;)

    CF (and anyone who can break CF's security) can always spy and inject data into HTTPS pages.

  • ZweiTigerZweiTiger Member

    @singsing said:
    CF (and anyone who can break CF's security) can always spy and inject data into HTTPS pages.

    Well. I will rethink then. But for now i use CF with STRICT..

  • ClouviderClouvider Member, Patron Provider

    Login details is nothing. I've seen several hosts taking card payments through CF. How they file in their PCI DSS self-assessment or how they pass their audits - I don't know.

    Thanked by 2wych vimalware
  • ZweiTigerZweiTiger Member

    @Clouvider said:
    Login details is nothing. I've seen several hosts taking card payments through CF. How they file in their PCI DSS self-assessment or how they pass their audits - I don't know.

    So for login detals are okay? I dont think card payments are could be secure with cloudflare...

  • HybridHybrid Member

    Only one that can spy on you is CF. Whether they get hacked, by their own will or a request from NSA or whatever authority.... Otherwise you're secure.

  • ClouviderClouvider Member, Patron Provider
    edited October 2015

    @Hybrid said:
    Only one that can spy on you is CF. Whether they get hacked, by their own will or a request from NSA or whatever authority.... Otherwise you're secure.

    Or someone who can maliciously access their servers and steal the data. No system is perfect.

    @ZweiTiger I wouldn't trust anyone with mine. My Client handed me the details, it's my responsibility to protect them.

    Thanked by 1vimalware
  • singsingsingsing Member

    Clouvider said: How they file in their PCI DSS self-assessment

    Is there anything in there precludes use of CF?

    verify that cardholder data is encrypted during transit -- CHECK

    Verify that only trusted keys and/or certificates are accepted -- CHECK

    For SSL/TLS implementations:

    Verify that HTTPS appears as a part of the browser Universal
    Record Locator (URL) -- CHECK

    Verify that no cardholder data is required when HTTPS does
    not appear in the URL -- CHECK

  • linuxthefishlinuxthefish Member

    I don't see the point, cPanel includes it's own brute force protection and the connecting IP's will show as cloudflare IP's

  • century1stopcentury1stop Member

    however, cPanel brute force protection always detect false positives and lock you out :)

  • ZweiTigerZweiTiger Member

    @linuxthefish said:
    I don't see the point, cPanel includes it's own brute force protection and the connecting IP's will show as cloudflare IP's

    Actually.. i want to try this cloudflare protection for Directadmin login page.

    @century1stop said:
    however, cPanel brute force protection always detect false positives and lock you out :)

    Yes :)..

  • linuxthefishlinuxthefish Member

    @century1stop said:
    however, cPanel brute force protection always detect false positives and lock you out :)

    You have the settings wrong then, change the number of brute force attempts for account lockout to 9999999 if you are using cphulk and don't use an easy to guess (root) username for WHM

    Thanked by 1jar
  • jarjar Patron Provider, Top Host, Veteran
    edited October 2015

    @linuxthefish said:
    You have the settings wrong then, change the number of brute force attempts for account lockout to 9999999 if you are using cphulk and don't use an easy to guess (root) username for WHM

    Ha, worst idea cPanel ever had... "I know, if root gets brute force attacked 15 times by anyone, lock out EVERYONE!"

    Would love to see stats on ticket volumes around the industry before and after.

  • linuxthefishlinuxthefish Member

    Jar said: Ha, worst idea cPanel ever

    It's crazy, after tons of cpanel installs it still gets me nearly every time when i come back the next day and didn't set SSH keys...

    Thanked by 1jar
  • century1stopcentury1stop Member
    edited October 2015

    I've switched to csf and things are great :D @linuxthefish

  • NixtrenNixtren Member

    Are you guys talking about that NSA-sponsored global MITM proxy??

    Thanked by 1linuxthefish
  • ZweiTigerZweiTiger Member
    edited October 2015

    @linuxthefish @jar @century1stop

    Got one idea. Seems not the worst but who know. Give me a reason if this could work or nope.

    -Will it work? As i know cloudflare open cPanel ports , (and 443 for phpmyadmin) , but i think this shoud be good.

    Hm?

  • singsingsingsing Member

    ZweiTiger said: But we got thousands tries to login with users or with root , admin blabla.. this should stop it.

    Why worry about that? You have a long, randomly-generated password, right?

  • PremiumNPremiumN Member

    @ZweiTiger

    all these questions are worrying me considering you are a provider.

    Thanked by 1Amitz
Sign In or Register to comment.