Ability to receive an e-mail every time I log in to my cPanel account
As a cPanel user, I would like the ability to receieve an e-mail every time I log in to my cPanel account, so that I can react quicker in the event that my account becomes compromised.
Some of our customers have requested the ability to be able to be warned every time someone logs into their cPanel account.
We don't want this e-mail to be sent when a root/reseller user logs in, only when the user logs in.
This would help cPanel users feel more secore about their accounts and help them react faster if someone gets their user password.
I like this idea 
cPanel, WebHost Manager and WHM are registered trademarks of cPanel, L.L.C. for providing its computer software that facilitates the management and configuration of Internet web servers.
This is now available in 11.48+
We are adding two new notification options in 11.48. This project was completed and merged into 11.48 on 10/16.
Please see the attached screenshot of the implementation. Please note that the wording of these new options has not been approved or reviewed by our documentation department at this time and it may change.
The internal case for tracking this feature is case 121893.
This is now available in 11.48+
We are adding two new notification options in 11.48. This project was completed and merged into 11.48 on 10/16.
Please see the attached screenshot of the implementation. Please note that the wording of these new options has not been approved or reviewed by our documentation department at this time and it may change.
The internal case for tracking this feature is case 121893.
Perhaps it would nice to have this also listed as a login-log on the web despite if the user gets an email or not.
Just as a simple list with the username, IP address (with a GeoIP flag) and a timestamp. It could be used to compare it with the list of your customers, since most customers will ignore or be suspicious about all the e-mails they don't fully understand what they say.
Perhaps it would nice to have this also listed as a login-log on the web despite if the user gets an email or not.
Just as a simple list with the username, IP address (with a GeoIP flag) and a timestamp. It could be used to compare it with the list of your customers, since most customers will ignore or be suspicious about all the e-mails they don't fully understand what they say.
I agree, we would like to have both a login log and an optional e-mail sent if the user whishes to be informed everytime he logs in. The e-mail should be optional and sent to the accounts e-mail address.
I agree, we would like to have both a login log and an optional e-mail sent if the user whishes to be informed everytime he logs in. The e-mail should be optional and sent to the accounts e-mail address.
This feature is provided by 3rd party plugin CSF.
This feature is provided by 3rd party plugin CSF.
It's true that CSF provides that, but just for the root user, I believe he meant that each user get's a notification to their cpanel registred email when he logs in.
It's true that CSF provides that, but just for the root user, I believe he meant that each user get's a notification to their cpanel registred email when he logs in.
In CSF there is an option to send an alert for all cPanel user logins but I don't think it can send an e-mail to the users themselves.
The request here is so that users can be warned when someone logs into their account, root user does not need this as CSF already does this.
In CSF there is an option to send an alert for all cPanel user logins but I don't think it can send an e-mail to the users themselves.
The request here is so that users can be warned when someone logs into their account, root user does not need this as CSF already does this.
Why let the attacker get in in the first place? Two-factor authentication is better: http://features.cpanel.net/responses/two-factor-authentication-is-a-must
Why let the attacker get in in the first place? Two-factor authentication is better: http://features.cpanel.net/responses/two-factor-authentication-is-a-must
Another email, please no!
Another email, please no!
This should obviously be an option, that users can select.
As a host we want to provide our customers the tools they need to keep their account secure. Allowing users to request an e-mail be sent to them when they log in (or someone else logs in) to their account seems very important.
To satisfy everyone, this feature would need to be a feature in the feature list (to give or deny access to this setting) to users. And the admin should also be able to set the serverwide default setting to on or off. When turned on the e-mails would be sent to the account owner's e-mail and secondary e-mail too.
Now that we're thinking about moving from CSF to Atomic Secure Linux we would also like to have the ability to choose to send an e-mail to the server root user when a user or administrator logs in with an opt-in list when deactivated and an opt-out list when activated.
This should obviously be an option, that users can select.
As a host we want to provide our customers the tools they need to keep their account secure. Allowing users to request an e-mail be sent to them when they log in (or someone else logs in) to their account seems very important.
To satisfy everyone, this feature would need to be a feature in the feature list (to give or deny access to this setting) to users. And the admin should also be able to set the serverwide default setting to on or off. When turned on the e-mails would be sent to the account owner's e-mail and secondary e-mail too.
Now that we're thinking about moving from CSF to Atomic Secure Linux we would also like to have the ability to choose to send an e-mail to the server root user when a user or administrator logs in with an opt-in list when deactivated and an opt-out list when activated.
nice :)
I will give it a try on our pre production server asap !
nice :)
I will give it a try on our pre production server asap !
Not needed at all
Not needed at all
meh.... my inbox is busy enough as it is..... no need for additional automated emails.
Get yourself a logging server such as splunk and use that to monitor logins.
meh.... my inbox is busy enough as it is..... no need for additional automated emails.
Get yourself a logging server such as splunk and use that to monitor logins.
Use ConfigServer Security & Firewall (CSF). You can set it up to automatically ban IP addresses that repeatedly fail login. It can also detect distributed attacks, and ban all IPs that have failed logins for a certain account within a certain period of time. This actually prevents brute force attacks. Getting an email each time a legitimate user logs in would be annoying, and would do nothing to actually prevent the accounts from being compromised.
Use ConfigServer Security & Firewall (CSF). You can set it up to automatically ban IP addresses that repeatedly fail login. It can also detect distributed attacks, and ban all IPs that have failed logins for a certain account within a certain period of time. This actually prevents brute force attacks. Getting an email each time a legitimate user logs in would be annoying, and would do nothing to actually prevent the accounts from being compromised.
The real solution would be two-factor authentication: http://features.cpanel.net/responses/two-factor-authentication-is-a-must
The real solution would be two-factor authentication: http://features.cpanel.net/responses/two-factor-authentication-is-a-must
Don't see much point in this; and there are enough third party extensions that allow it. Shouldn't make cPanel so bloated and send out hundreds of emails.
Don't see much point in this; and there are enough third party extensions that allow it. Shouldn't make cPanel so bloated and send out hundreds of emails.
Can already be done.
Can already be done.
For those who are worried about cPanel sending to many e-mails, this would obviously be an option that root user would have to allow in tweak settings and choose if it's on or off by default and if users can change the status of this for their account. If you don't see the point for your usage then please don't complain, just don't vote for it :)
For those who say it can already be done, I'm not aware of an existing plugin that allows users to tick a box to say that they wish to recieve an e-mail every time someone logs into their account. Please don't mix this resquet up with CSF's ability to e-mail root on every login, I'm talking about the ability for cPanel users to choose to recieve an e-mail when they log in.
As for two factor authentification, some customers would find two factor authentication too complicated and would just like to be informed when someone logs into their account so they can feel safer that no one has.
For those who are worried about cPanel sending to many e-mails, this would obviously be an option that root user would have to allow in tweak settings and choose if it's on or off by default and if users can change the status of this for their account. If you don't see the point for your usage then please don't complain, just don't vote for it :)
For those who say it can already be done, I'm not aware of an existing plugin that allows users to tick a box to say that they wish to recieve an e-mail every time someone logs into their account. Please don't mix this resquet up with CSF's ability to e-mail root on every login, I'm talking about the ability for cPanel users to choose to recieve an e-mail when they log in.
As for two factor authentification, some customers would find two factor authentication too complicated and would just like to be informed when someone logs into their account so they can feel safer that no one has.
Should be easy just setting up a cron and read the raw access log | grep user and sent the email that match with the user, they UI should be more complicated
Should be easy just setting up a cron and read the raw access log | grep user and sent the email that match with the user, they UI should be more complicated
many thanks
many thanks
We would like this to be an opt in solution but it should be able to be disabled or enforced by admins too.
We would like this to be an opt in solution but it should be able to be disabled or enforced by admins too.
Honestly, if you're going to implement this feature then you may as well have full audit log of all cpanel activity. So not only are cpanel logins recorded (and optionally emailed to current address on file), but all cpanel activity is recorded/logged.
This way, if there ever is a hack of the cpanel account it is very easy to see exactly what the hacker did. (Of course, the log should not be able to be deleted by the cpanel user.)
Honestly, if you're going to implement this feature then you may as well have full audit log of all cpanel activity. So not only are cpanel logins recorded (and optionally emailed to current address on file), but all cpanel activity is recorded/logged.
This way, if there ever is a hack of the cpanel account it is very easy to see exactly what the hacker did. (Of course, the log should not be able to be deleted by the cpanel user.)
While I agree with the full cpanel log visible by the user I think this would deserve it's own feature request as sending an email on successfull login is much easier to implement then a full log history available to the user. If you not post this feature request I think I will as it makes alot of sense for both admins and end users
While I agree with the full cpanel log visible by the user I think this would deserve it's own feature request as sending an email on successfull login is much easier to implement then a full log history available to the user. If you not post this feature request I think I will as it makes alot of sense for both admins and end users
+1 from me...
i do agree if cPanel provides this alert system to administrators for login attempts. CSF providing alerting mechanism for only failure attempts.
Perhaps, it is better to have this kind of alert system from WHM / cPanel interface itself.
+1 from me...
i do agree if cPanel provides this alert system to administrators for login attempts. CSF providing alerting mechanism for only failure attempts.
Perhaps, it is better to have this kind of alert system from WHM / cPanel interface itself.
It's a security measure for end-users, should be optional for anyone.
+1 for this feature
It's a security measure for end-users, should be optional for anyone.
+1 for this feature
This is now available in 11.48+
We are adding two new notification options in 11.48. This project was completed and merged into 11.48 on 10/16.
Please see the attached screenshot of the implementation. Please note that the wording of these new options has not been approved or reviewed by our documentation department at this time and it may change.
The internal case for tracking this feature is case 121893.
This is now available in 11.48+
We are adding two new notification options in 11.48. This project was completed and merged into 11.48 on 10/16.
Please see the attached screenshot of the implementation. Please note that the wording of these new options has not been approved or reviewed by our documentation department at this time and it may change.
The internal case for tracking this feature is case 121893.
This comment is in response to the "Official Answer" from cpanelnick:
Please be sure the server owner has the ability (in tweak settings?) so that login notification and pw change notification are *not* sent if those actions are completed by reseller owner or admin/root.
(ie: A notification email should not be sent to the end-customer's account email if the cpanel login or pw change was done by reseller or server admin/root.)
Thanks.
This comment is in response to the "Official Answer" from cpanelnick:
Please be sure the server owner has the ability (in tweak settings?) so that login notification and pw change notification are *not* sent if those actions are completed by reseller owner or admin/root.
(ie: A notification email should not be sent to the end-customer's account email if the cpanel login or pw change was done by reseller or server admin/root.)
Thanks.
Nice ! Thanks !
Nice ! Thanks !
Two questions:
1) These two new options will be enabled by default for every existing account, right?
2) What would be the content of the emails being sent for each option? I guess IP and geolocation at least would be tracked, right?
Thanks!
Two questions:
1) These two new options will be enabled by default for every existing account, right?
2) What would be the content of the emails being sent for each option? I guess IP and geolocation at least would be tracked, right?
Thanks!
I guess they will propose this when you log into WHM after the upgrade.
I agree, ip, hostname and country code could be nice to have in the e-mail.
I guess they will propose this when you log into WHM after the upgrade.
I agree, ip, hostname and country code could be nice to have in the e-mail.
Please see a sample notification from the latest EDGE build here: http://features.cpanel.net/attachments/871
Please note that the ip addresses and account information was removed from the screenshot.
Please see a sample notification from the latest EDGE build here: http://features.cpanel.net/attachments/871
Please note that the ip addresses and account information was removed from the screenshot.
Hello, this is NOT working with lantern_paper theme. There's no option for "Send notifications to your contact email address upon successful login" - See: http://pbrd.co/1Ep9tUd
Hello, this is NOT working with lantern_paper theme. There's no option for "Send notifications to your contact email address upon successful login" - See: http://pbrd.co/1Ep9tUd
Replies have been locked on this page!