Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is frustrating. I am often able to login with a root password. Then I cannot login again. However, I am still logged in. Hence my password must be correct.

I changed the root password with passwd. It works again. Then sometimes latter this happens again.

It's as if the root password changes all the time automatically. Did someone hack my server?

share|improve this question
Just a short note: a password change does not close the existing sessions. The fact you're still logged in does not mean that the password at any given time is the same that you have used to log in. – Leonid Jan 4 '13 at 5:21
It's not that the password keeps changing. It seems that server reject all root login for a few hours and stuff. – Jim Thio Sep 27 '13 at 12:03
/var/messages are indeed full with so many failed login attempt. – Jim Thio Sep 27 '13 at 12:03
up vote 3 down vote accepted

Assuming someone is playing around with your box or some kind of practical joke, and they did not cover their track.

Check login history

Via Command Line


Via Log Files

/var/log/auth.log (debian/ubuntu)
/var/log/secure (RedHat/CentOS/Fedora?)

Other Possibilities

  1. Your box is a virtual machine and some how keep getting roll back to previous state(snapshot).
  2. Many VPS actually reset your root password. You have to use the vendor/hosting web interface to change the root password. Otherwise it will just keep changing back to the previous one.
share|improve this answer
how do I know my server's IP? Maybe I am logged in to a different machine – Jim Thio Jan 4 '13 at 4:12
Login in as root, type command ifconfig. If you are using a windows machine, go to website whatismyip.com – John Siu Jan 4 '13 at 4:19
@JimThio I have the following command readily available; it will print the external IP address that you are using to make outbound connections, thus taking into account NAT etc. wget -qO- http://ipecho.net/plain That's just one service to obtain one's IP address; there are numerous others. -q means use quiet mode, and -O- means print the content of the response to - (standard output) rather than saving it to a file. – Michael Kjörling Jan 4 '13 at 12:32

I just want to share what's going on.

I am the one that make the question and this is a very old recurring problems.

The issue can be seen here:


I am using cpanel.

Cpanel has cphulk that protects machines from brute force loging.

The problem is,

Many people have had the same problem. THe solution is to ensure that your IP is white listed by cphulk. Also rebooting the machine may sometimes work for a while. There is no easy solution.

share|improve this answer

My guess is there's another machine on the network with the same IP address and they're fighting. Sometimes you login to your server, sometimes to the rogue.

share|improve this answer
If you use ssh to log in, then you should be able to tell if this is happening from the host key changing. – kasperd Oct 16 '14 at 10:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.