Skip to main content

cphulkd internal errors

Mysticeti
I've been seeing this error in logwatch emails since about December 12th 2014:
dovecot: auth: Error: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@example.com from IP 'x.x.x.x' for service smtp.: 2 Time(s)
Is this expected? Thanks.

Comments

14 comments

Date Votes
  • madmanmachines
    Hi, That is an interesting error. I assume it is not encountered when cPHulk is disabled? Have you tried flushing the database at WHM > Security Center > cPHulk? Thanks,
    0
  • Mysticeti
    > I assume it is not encountered when cPHulk is disabled? Not sure. I haven't tried that yet. > Have you tried flushing the database at WHM > Security Center > cPHulk? I've just flushed the DB. We'll see what happens. :) Thanks.
    0
  • cPanelMichael
    Hello, Internal case number 184113 is open to address an issue where Dovecot failure messages for login authentication appear in /var/log/maillog when cphulkd user cannot connect to cphulkd database or when MySQL itself is down. There's currently no time frame for a resolution, but you can monitor the change log for this case number at:
    0
  • hostingmundial
    We have same issue with Courier WHM 11.50.0 (build 27) Aug 3 10:12:58 servidor authdaemond: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@example.com[/EMAIL] from IP 'x.x.x.x' for service pop3. Aug 3 10:09:01 servidor authdaemond: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@example.com[/EMAIL] from IP 'x.x.x.x' for service imap.
    0
  • cPanelMichael
    Cpanel::MailAuth: Internal Error: cphulkd request failed to process

    Hello :) Could you run the "mysqlcheck cphulkd" command on your system to verify the database is functioning as expected and not corrupted? Thank you.
    0
  • Mysticeti

    Repairing cphulkd cphulkd.auths OK cphulkd.blacklist OK cphulkd.brutes OK cphulkd.good_logins OK cphulkd.ip_lists OK cphulkd.known_netblocks OK cphulkd.login_track OK cphulkd.logins OK cphulkd.report OK cphulkd.whitelist OK Done.
    Still seeing the errors though, e.g.
    dovecot: auth: Error: Cpanel::MailAuth: Internal Error: cphulkd request failed to process account@domain.com from IP '89.248.169.61' for service smtp.: 2 Time(s)
    0
  • cPanelMichael
    Still seeing the errors though, e.g.

    My previous response on this thread was for the user referencing the Courier mail server. You are using Dovecot based on the output, so it's likely related to the case mentioned earlier. Internal case number FB-184113 is addressed in cPanel version 11.50.1.1. Thank you.
    0
  • Mysticeti
    My previous response on this thread was for the user referencing the Courier mail server. You are using Dovecot based on the output, so it's likely related to the case mentioned earlier. Internal case number FB-184113 is addressed in cPanel version 11.50.1.1. Thank you.

    Woops. Sorry about that. Looking forward to 11.50.1.1!
    0
  • cPanelMichael
    Looking forward to 11.50.1.1!

    It's currently available on the "Current" build tier. There's no specific timeline available on when it will make it's way to the "Release" and "Stable" tiers, but you can monitor our change logs at:
    0
  • Mysticeti
    Woops. Sorry about that. Looking forward to 11.50.1.1!

    Well I'm at 11.50.1 (build 3) but I'm still seeing errors like these:
    dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process "account@example.com" from "IP '95.215.0.203'" for the "smtp" service.: 1 Time(s) dovecot: auth: Error: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@domain.com from IP '95.215.0.203' for service smtp.: 1 Time(s)
    :-(
    0
  • amh5514
    I can verify that 11.50.1 (build 3) is still showing this error. Also, it's not just deceptive. It appears our clients are being blocked due to the failed process.
    Sep 29 10:23:33 dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process "user@example.org" from "IP xxx.xxx.xx.xxx" for the "pop3" service. Sep 29 10:23:35 dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=< > Sep 29 10:23:50 dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process "user@example.org" from "IP xxx.xxx.xx.xxx" for the "pop3" service. Sep 29 10:23:52 dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session= > Sep 29 10:24:08 dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process "user@example.org" from "IP xxx.xxx.xx.xxx" for the "pop3" service. Sep 29 10:24:10 dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=< > Sep 29 10:24:45 dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process "user@example.org" from "IP xxx.xxx.xx.xxx" for the "pop3" service. Sep 29 10:24:47 dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=< > Sep 29 10:24:50 spamd[5635]: spamd: connection from localhost.localdomain Sep 29 10:24:50 spamd[5635]: spamd: setuid to succeeded Sep 29 10:24:50 spamd[5635]: spamd: checking message < > for Sep 29 10:24:56 spamd[5635]: spamd: clean message (0.3/5.0) for in 6.4 seconds, 4399 bytes. Sep 29 10:24:56 spamd[5635]: spamd: result: . 0 -,T_REMOTE_IMAGE scantime=6.4,size=4399,user= Sep 29 10:24:56 spamd[24679]: prefork: child states: I Sep 29 10:25:55 dovecot: pop3(user@example.org): Disconnected: Logged out top=0/0, retr=0/0, del=0/341, size=115611829, bytes=18/7708 Sep 29 10:25:55 dovecot: pop3(award@example.org): Disconnected: Logged out top=0/0, retr=0/0, del=0/3, size=13940, bytes=18/112 Sep 29 10:25:55 dovecot: pop3(info@example.org): Disconnected: Logged out top=0/0, retr=0/0, del=0/1219, size=353715376, bytes=18/28432 Sep 29 10:26:08 dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__...>, method=PLAIN Sep 29 10:26:08 dovecot: imap(__cpanel__service__auth__imap__): Disconnected: Logged out in=11, out=434, bytes=11/434 Sep 29 10:26:26 dovecot: pop3-login: Login: user=, method=PLAIN, rip=xxx.xxx.xx.xxx Sep 29 10:26:27 dovecot: pop3(info@example.org): Disconnected: Logged out top=0/0, retr=1/6025, del=0/1220, size=353721384, bytes=35/47931 Sep 29 10:26:28 dovecot: auth: Error: Cpanel::MailAuth: cphulk blocked login for user '' to access service 'mail' from IP xxx.xxx.xx.xxx Sep 29 10:26:30 dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS: Disconnected, session=<+ >
    0
  • cPanelMichael
    An additional case, CPANEL-1754, is open to address an issue where when mail authentication fails using a valid domain on the server, the cPHulkd error in the Dovecot mail log can cause confusion. The error is misleading because administrators can still connect to the cPHulk database using the password in /var/cpanel/hulkd/password and there is no corruption with the cphulkd database. The latest update to this case indicates it should be resolved in cPanel version 11.54. Note the error message does not indicate an issue with cPHulk itself, other than adding misleading information to the logs. Thank you.
    0
  • stevenvsi
    Hi, Nothing about this yet? I have the same logs but it does not seems to hinder clients. Still I wonder what it means. Regards,
    0
  • cPanelMichael
    Nothing about this yet?

    Could you verify which version of cPanel is installed on your system? EX:
    cat /usr/local/cpanel/version
    Thank you.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post