(Quote)

they even shared this website's Wordpress admin password

We've spun up a non TLS/SSL FTP on port 8231 on us1 for those that want to test.

Do you have 2FA enabled? it kicking back a 401 means the login/password is bad, or that you have 2FA I guess.

We've spun up a non TLS/SSL FTP on port 8231 on us1 for those that want to test.

The post was about cpanel, and its working fine.. i dont have da hosting..

* CloudLinux + cPanel

No you're not wrong hetzner by default does this they ask after ssh to change the password it's forced.

Doesn't work. Most humans are lazy (I hope I am wrong but here we are). I prefer doing passwd -e root as it actually enforces password change policy. Below is a snippet from man passwd:

Thing is i would just send out an email with the password and ask in the email to change immediately the password or at least don't save the initial password in the database (not sure if virtualizor d

(Quote)

Technically speaking, VirtFusion does also in email log. Thus I highly recommend to enforce a policy of password reset on first login for all providers seeing this.

(Quote)

So virtualizor stores new provisioned servers password in the database??

(Quote)

(Quote)

Not the best - user should rely on SSH public keys instead. In such case there would be no need for a root password (from a control panel perspective) at all

But we are not talking about the log in password to the panel, but the root password of the installed VPS - I am not sure why you would want to store the root password of the VPS in the panel at all,

(Quote)

Is Softaculous (FTP method) on cPanel an option?