Skip to main content

[CPANEL-33967] dovecot warnings, - lookup mail user

Comments

32 comments

  • Paul Shultz
    It would be nice to know because I am seeing a ton of these
    0
  • keat63
    Hi Paul. Since when did these start for you ? I don't recall seeing any of these prior to Tuesday, where I updated on Monday evening.
    0
  • cPanelLauren
    Hi @keat63 Can you show me the output of the following: grep "solyomchabachira" /var/log/maillog |tail
    I believe these mail be the result of failed login attempts which occur frequently on servers for non-existent as well as existing accounts.
    0
  • keat63
    The grep line doesn't reveal anything. I'm guessing that these are related to spammers trying to send to a non existant address. : No such person at this address." However, I don't recall seeing errors like the one below, prior to Monday evening where I updated to V90. I'm finding lots of these in my hourly email report. /usr/local/cpanel/logs/error_log: [2020-08-25 20:30:59 +0100] warn [cpsrvd] lookup_mail_user() failed: You do not have a user named "solyomchabachira@domain2.co.uk". at /usr/local/cpanel/Cpanel/Server.pm line 2251, line 2. Cpanel::Server::__ANON__(__CPANEL_HIDDEN__...) called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 197 Cpanel::Server::Dovecot::_handle_dovecot_userdb(Cpanel::Server::Dovecot=HASH(0x2145280), "shared", "dovecot_userdb", "solyomchabachira\@domain2.co.uk") called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 144 Cpanel::Server::Dovecot::_dovecot_request_handler(Cpanel::Server::Dovecot=HASH(0x2145280), "Lshared/dovecot_userdb/solyomchabachira\@domain2.co.uk") called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 90 eval {...} called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 75 Cpanel::Server::Dovecot::handle_cpdoveauthd_request(Cpanel::Server::Dovecot=HASH(0x2145280)) called at /usr/local/cpanel/Cpanel/Server.pm line 2258 Cpanel::Server::handle_cpdoveauthd_connection(Cpanel::Server=HASH(0x1eb8788)) called at cpsrvd.pl line 1778 cpanel::cpsrvd::_handle_unix_socket_connection("handle_cpdoveauthd_connection") called at cpsrvd.pl line 1090 cpanel::cpsrvd::script() called at cpsrvd.pl line 431
    is it possible to suppress these from my hourly report ?
    0
  • Paul Shultz
    It would be nice to know because I am seeing a ton of these

    For me they started on [2020-08-21 13:11:04 +1000]
    0
  • Paul Shultz
    For me they started on [2020-08-21 13:11:04 +1000]

    Actually straight after cPanel & WHM was updated to Version 90
    0
  • cPanelLauren
    The only other report I have of this is a result of failed login attempts. The one thing that is concerning though is the error being output in the cPanel error logs. I would suggest that if you are experiencing this issue that you open a ticket so that our analysts can investigate this further.
    0
  • jdpuglisi
    Ditto here on my install. my cPanel error_log is littered with them. Maybe disabling Dovecot might be in order.
    0
  • jdpuglisi
    Here's the odd warning from my cPanel error_log [2020-08-29 08:45:56 -0400] warn [cpsrvd] lookup_mail_user() failed: This system does not have a domain named "inmotionhosting.com". at /usr/local/cpanel/Cpanel/Server.pm line 2251, line 2. Cpanel::Server::__ANON__(__CPANEL_HIDDEN__...) called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 197 Cpanel::Server::Dovecot::_handle_dovecot_userdb(Cpanel::Server::Dovecot=HASH(0x26fbc08), "shared", "dovecot_userdb", "willem\@inmotionhosting.com") called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 144 Cpanel::Server::Dovecot::_dovecot_request_handler(Cpanel::Server::Dovecot=HASH(0x26fbc08), "Lshared/dovecot_userdb/willem\@inmotionhosting.com") called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 90 eval {...} called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 75 Cpanel::Server::Dovecot::handle_cpdoveauthd_request(Cpanel::Server::Dovecot=HASH(0x26fbc08)) called at /usr/local/cpanel/Cpanel/Server.pm line 2258 Cpanel::Server::handle_cpdoveauthd_connection(Cpanel::Server=HASH(0x26e0af8)) called at cpsrvd.pl line 1778 cpanel::cpsrvd::_handle_unix_socket_connection("handle_cpdoveauthd_connection") called at cpsrvd.pl line 1090 cpanel::cpsrvd::script() called at cpsrvd.pl line 431
    That's my VPS host. I'd understand the warning if it was my domain's email address but the host's????
    0
  • keat63
    I'll maybe look at opening a ticket when I'm back in the office on Tuesday.
    0
  • keat63
    I'm not convinced that CPanel staff will be able to gain access, but here goes 93654054
    0
  • keat63
    So I had Cpanel look into this, and it appears that it's been implemented by design. It looks like we might have to live with this.
    0
  • jdpuglisi
    So I had Cpanel look into this, and it appears that it's been implemented by design. It looks like we might have to live with this.

    Not sure what value this "feature" delivers other than it makes it very difficult to find actual issues in a bloated error_log.
    0
  • keat63
    Agreed, in fact, I said something very similar. The tech who dealt with my ticket has asked if this feature can be configurable in a future release.
    0
  • keat63
    Tech support filed a new case regarding the notification/log messages in CPANEL-33967 for the developers to consider making this something that can be disabled to prevent the log noise.
    0
  • jdpuglisi
    Tech support filed a new case regarding the notification/log messages in CPANEL-33967 for the developers to consider making this something that can be disabled to prevent the log noise.

    Nice. I did a quick search for this case but didn't find anything quite yet. I'd like to follow it when I can find the case URL.
    0
  • cPanelLauren
    I checked in on this today and added some notes to the case. They are indeed there by design with the note being as follows: [QUOTE] These are intentionally thrown exceptions when we fail to lookup a mail user. They could be useful for diagnosing login issues.
    I noted in the new case that was opened the following: [QUOTE]To add, for failed login attempts, both the maillog and the cpanel error log are being written to. The error noted, in this case, is what is output in the cPanel error log. This feels like it would be better suited to the maillog only but also if it's going to be output to the cPanel error logs maybe rather than a toggle for on/off - include this in a verbose or debug logging option similar to what we do for DNS syncing in Tweak Settings.
    I'll update here if I get any feedback on that or if there are any updates for that case. Thanks for opening the ticket @keat63
    0
  • jdpuglisi
    I checked in on this today and added some notes to the case. They are indeed there by design with the note being as follows: I noted in the new case that was opened the following: I'll update here if I get any feedback on that or if there are any updates for that case. Thanks for opening the ticket @keat63

    Thank you. In my case, I'm not sure why it's logging errors to the host's root domain name. Again, I would understand logging a hit against the HELO address which is different from my domain but that's not the case.
    0
  • cPanelLauren
    Thank you. In my case, I'm not sure why it's logging errors to the host's root domain name. Again, I would understand logging a hit against the HELO address which is different from my domain but that's not the case.

    I'd assume that's because someone is attempting to log in to webmail on your server with that email address. Are there corresponding /var/log/maillog
    login attempts? I'd use the timestamp in the error logs to correlate: 2020-08-29 08:45
    0
  • jdpuglisi
    I'd assume that's because someone is attempting to log in to webmail on your server with that email address. Are there corresponding /var/log/maillog
    login attempts? I'd use the timestamp in the error logs to correlate: 2020-08-29 08:45

    No correlation between the cPanel error_log and maillog using the timestamps. As an aside, my cPanel error log has more than tripled in size since 90.0.5.
    0
  • cPanelLauren
    Can you open a ticket in that case and please let me know the ticket ID so I can make a note of the differences between it and @keat63's issue?
    0
  • jdpuglisi
    Can you open a ticket in that case and please let me know the ticket ID so I can make a note of the differences between it and @keat63's issue?

    Ticket 93664434
    0
  • jdpuglisi
    Ticket 93664434

    Resolved with some excellent work from the cPanel support team. I recently migrated servers and did not have cPHulk activated. Not sure what I was thinking but there were clear mail server bot attacks that were accurately logged in the cPanel error_log. I've activated cPHulk and blacklisted the major offending IPs. I'm sure the other ones will eventually be blacklisted based on the cPHulk settings I have. Thanks all!!
    0
  • cPanelLauren
    I'm really glad to hear that this was able to be resolved so quickly. Thanks for updating here as well.
    0
  • Hedloff
    So you didn't get any solution other than blocking IP's in the firewall? I don't call that a solution from cPanel at all. I just got over the same on one of our servers: [2020-10-20 12:29:10 +0200] warn [cpsrvd] lookup_mail_user() failed: This system does not have a domain named "domainforcustomer.com". at /usr/local/cpanel/Cpanel/Server.pm line 2251, line 1. Cpanel::Server::__ANON__(__CPANEL_HIDDEN__...) called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 203 Cpanel::Server::Dovecot::_handle_dovecot_userdb(Cpanel::Server::Dovecot=HASH(0x1a6a958), "", "dovecot_userdb", undef, "email\@domainforcustomer.com") called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 150 Cpanel::Server::Dovecot::_dovecot_request_handler(Cpanel::Server::Dovecot=HASH(0x1a6a958), "L/dovecot_userdb/email\@domainforcustomer.com") called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 90 eval {...} called at /usr/local/cpanel/Cpanel/Server/Dovecot.pm line 75 Cpanel::Server::Dovecot::handle_cpdoveauthd_request(Cpanel::Server::Dovecot=HASH(0x1a6a958)) called at /usr/local/cpanel/Cpanel/Server.pm line 2258 Cpanel::Server::handle_cpdoveauthd_connection(Cpanel::Server=HASH(0x1a4ac30)) called at cpsrvd.pl line 1778 cpanel::cpsrvd::_handle_unix_socket_connection("handle_cpdoveauthd_connection") called at cpsrvd.pl line 1090 cpanel::cpsrvd::script() called at cpsrvd.pl line 431
    Why is it logging to the /usr/local/cpanel/logs/error_log file if it is just email login attempts? Makes no sense at all? Should be possible for cPanel to fix this. This domain domainforcustomer.com was a customer that had an account on that server over 1 year ago.
    0
  • Secmas
    I am joining to the group. I have the same issue on my servers and with another lot of lines like these ones that are annoying: warn [xml-api] Failed to fetch cPStore products list: Cpanel::Exception::Market::Disabled/(XID yh3sn2) "cPanel Store"" indicated that the Market has been disabled by the license holder. at /usr/local/cpanel/Cpanel/Exception/External.pm line 106. Cpanel::Exception::External::create("Market::Disabled", HASH(0x2f05ba8)) called at /usr/local/cpanel/Cpanel/Market/Provider/cPStore/ProductsCache.pm line 94 Cpanel::Market::Provider::cPStore::ProductsCache::__ANON__(Cpanel::Exception::cPStoreError=HASH(0x16ef448)) called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 118 Try::Tiny::try(CODE(0x30350e0), Try::Tiny::Catch=REF(0x2f84660)) called at /usr/local/cpanel/Cpanel/Market/Provider/cPStore/ProductsCache.pm line 96 Cpanel::Market::Provider::cPStore::ProductsCache::_LOAD_FRESH("Cpanel::Market::Provider::cPStore::ProductsCache") called at /usr/local/cpanel/Cpanel/CacheFile.pm line 242 Cpanel::CacheFile::load("Cpanel::Market::Provider::cPStore::ProductsCache") called at /usr/local/cpanel/Cpanel/Market/Provider/cPStore/ProductsCache.pm line 139 Cpanel::Market::Provider::cPStore::ProductsCache::load_with_short_name("Cpanel::Market::Provider::cPStore::ProductsCache") called at /usr/local/cpanel/Cpanel/Market/Provider/cPStore/ProductsCache.pm line 104 Cpanel::Market::Provider::cPStore::ProductsCache::load("Cpanel::Market::Provider::cPStore::ProductsCache") called at /usr/local/cpanel/Cpanel/Market/Provider/cPStore.pm line 178 Cpanel::Market::Provider::cPStore::_get_products_list_for_validation() called at /usr/local/cpanel/Cpanel/Market/Provider/cPStore.pm line 165 Cpanel::Market::Provider::cPStore::get_products_list() called at /usr/local/cpanel/Cpanel/Config/ConfigObj/Driver/Market/META.pm line 117 Cpanel::Config::ConfigObj::Driver::Market::META::__ANON__() called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 97 eval {...} called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 88 Try::Tiny::try(CODE(0x301f450), Try::Tiny::Catch=REF(0x2df1378)) called at /usr/local/cpanel/Cpanel/Config/ConfigObj/Driver/Market/META.pm line 122 Cpanel::Config::ConfigObj::Driver::Market::META::can_be_enabled() called at /usr/local/cpanel/Cpanel/Config/ConfigObj/Driver/Market/META.pm line 146 Cpanel::Config::ConfigObj::Driver::Market::META::auto_enable("Cpanel::Config::ConfigObj::Driver::Market::META") called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 106 Cpanel::Config::ConfigObj::_unload_if_auto_enabled("Cpanel::Config::ConfigObj::Driver::Market", "Cpanel::Config::ConfigObj::Driver::Market::META") called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 160 Cpanel::Config::ConfigObj::get_available_drivers(undef, 0, 0) called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 563 Cpanel::Config::ConfigObj::_get_drivers(Cpanel::Config::ConfigObj=HASH(0x2d6df20)) called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 707 Cpanel::Config::ConfigObj::call_all(Cpanel::Config::ConfigObj=HASH(0x2d6df20), "acl_desc") called at /usr/local/cpanel/Whostmgr/ACLS.pm line 110 Whostmgr::ACLS::_dynamic_acl_items() called at /usr/local/cpanel/Whostmgr/ACLS.pm line 131 Whostmgr::ACLS::_get_dynamic_acl_lists() called at /usr/local/cpanel/Whostmgr/ACLS.pm line 178 Whostmgr::ACLS::_dynamic_acl_update() called at /usr/local/cpanel/Whostmgr/ACLS.pm line 115 Whostmgr::ACLS::get_dynamic_acl_lists() called at /usr/local/cpanel/Whostmgr/API/1/ACLS.pm line 25 Whostmgr::API::1::ACLS::myprivs(HASH(0x18b5510), Whostmgr::API::1::Utils::Metadata=HASH(0x18ad848), HASH(0x2c2d9d8)) called at whostmgr/bin/xml-api.pl line 3870 whostmgr::bin::xml_api::__ANON__(Whostmgr::API::1::Utils::Metadata=HASH(0x18ad848), HASH(0x18b5510), HASH(0x2c2d9d8), CODE(0x2c27878)) called at /usr/local/cpanel/Whostmgr/API/1/Data/Wrapper.pm line 238 Whostmgr::API::1::Data::Wrapper::__ANON__() called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 97 eval {...} called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 88 Try::Tiny::try(CODE(0x2c52820), Try::Tiny::Catch=REF(0x2c57820)) called at /usr/local/cpanel/Whostmgr/API/1/Data/Wrapper.pm line 257 Whostmgr::API::1::Data::Wrapper::execute_internal(CODE(0x2c29b08), HASH(0x18b5510), HASH(0x2c2d9d8), HASH(0x2c28d70), CODE(0x2c27878)) called at whostmgr/bin/xml-api.pl line 4047 whostmgr::bin::xml_api::runapp("myprivs", HASH(0x2c2d9d8), HASH(0x17a2500), 0, CODE(0x2c27878)) called at whostmgr/bin/xml-api.pl line 3738 whostmgr::bin::xml_api::script(CODE(0x2c27878), "-json", "./myprivs") called at whostmgr/bin/xml-api.pl line 3681 at /usr/local/cpanel/Cpanel/Config/ConfigObj/Driver/Market/META.pm line 121. Cpanel::Config::ConfigObj::Driver::Market::META::__ANON__(Cpanel::Exception::Market::Disabled=HASH(0x3431db8)) called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 118 Try::Tiny::try(CODE(0x301f450), Try::Tiny::Catch=REF(0x2df1378)) called at /usr/local/cpanel/Cpanel/Config/ConfigObj/Driver/Market/META.pm line 122 Cpanel::Config::ConfigObj::Driver::Market::META::can_be_enabled() called at /usr/local/cpanel/Cpanel/Config/ConfigObj/Driver/Market/META.pm line 146 Cpanel::Config::ConfigObj::Driver::Market::META::auto_enable("Cpanel::Config::ConfigObj::Driver::Market::META") called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 106 Cpanel::Config::ConfigObj::_unload_if_auto_enabled("Cpanel::Config::ConfigObj::Driver::Market", "Cpanel::Config::ConfigObj::Driver::Market::META") called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 160 Cpanel::Config::ConfigObj::get_available_drivers(undef, 0, 0) called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 563 Cpanel::Config::ConfigObj::_get_drivers(Cpanel::Config::ConfigObj=HASH(0x2d6df20)) called at /usr/local/cpanel/Cpanel/Config/ConfigObj.pm line 707 Cpanel::Config::ConfigObj::call_all(Cpanel::Config::ConfigObj=HASH(0x2d6df20), "acl_desc") called at /usr/local/cpanel/Whostmgr/ACLS.pm line 110 Whostmgr::ACLS::_dynamic_acl_items() called at /usr/local/cpanel/Whostmgr/ACLS.pm line 131 Whostmgr::ACLS::_get_dynamic_acl_lists() called at /usr/local/cpanel/Whostmgr/ACLS.pm line 178 Whostmgr::ACLS::_dynamic_acl_update() called at /usr/local/cpanel/Whostmgr/ACLS.pm line 115 Whostmgr::ACLS::get_dynamic_acl_lists() called at /usr/local/cpanel/Whostmgr/API/1/ACLS.pm line 25 Whostmgr::API::1::ACLS::myprivs(HASH(0x18b5510), Whostmgr::API::1::Utils::Metadata=HASH(0x18ad848), HASH(0x2c2d9d8)) called at whostmgr/bin/xml-api.pl line 3870 whostmgr::bin::xml_api::__ANON__(Whostmgr::API::1::Utils::Metadata=HASH(0x18ad848), HASH(0x18b5510), HASH(0x2c2d9d8), CODE(0x2c27878)) called at /usr/local/cpanel/Whostmgr/API/1/Data/Wrapper.pm line 238 Whostmgr::API::1::Data::Wrapper::__ANON__() called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 97 eval {...} called at /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/Try/Tiny.pm line 88 Try::Tiny::try(CODE(0x2c52820), Try::Tiny::Catch=REF(0x2c57820)) called at /usr/local/cpanel/Whostmgr/API/1/Data/Wrapper.pm line 257 Whostmgr::API::1::Data::Wrapper::execute_internal(CODE(0x2c29b08), HASH(0x18b5510), HASH(0x2c2d9d8), HASH(0x2c28d70), CODE(0x2c27878)) called at whostmgr/bin/xml-api.pl line 4047 whostmgr::bin::xml_api::runapp("myprivs", HASH(0x2c2d9d8), HASH(0x17a2500), 0, CODE(0x2c27878)) called at whostmgr/bin/xml-api.pl line 3738 whostmgr::bin::xml_api::script(CODE(0x2c27878), "-json", "./myprivs") called at whostmgr/bin/xml-api.pl line 3681
    those lines are really annoying and makes the Log Scanner report from about 300 lines each hour to 4,000 lines every 6 hours. Why if the cPstore is disabled by the provider has to be shown in the Log Scanner report each 6 hours? That is non an error and we don't need to be reminded that it is disabled we already know that. Hope both of these error lines could be suppressed from the LOG SCANNER.
    0
  • cPanelLauren
    Though the AutoSSL logging is different and should be able to be disabled by disabling the AutoSSL service, I do agree that the log errors could be an issue. The internal case is still open and being monitored and this thread is tagged in it. I'll update here when there is more to report on the internal case.
    0
  • jdpuglisi
    If it wasn't for lookup_mail_user() and a disabled cPanel Store, my cPanel error log would be pretty empty and not 400mB (since April 2020).
    0
  • volex
    Has there been any progress on this issue, noticing a large amount of the mail user lookup failures as well which don't seem like they belong in the cPanel error_log.
    0
  • keat63
    I'm still seeing these. However, now that I know they are largely nonsense, I no longer investigate them, which sort of defeats the object of checking my logs daily.
    0

Please sign in to leave a comment.