cPHulk blocking IP address despite being in csf.allow

Trane Francks

• August 06, 2026 21:19
• Edited

This morning during our server's update to cPanel  v110.0.138, my Thunderbird began generating a whole bunch of login errors on my various e-mail accounts. Despite the IP address being in csf.allow, cPHulk decided to refuse any logins from the IP address, even with correct credentials presented in WHM root and cPanel user account logins.

The result was a panicky kerfuffle of thinking the server had been compromised. Do I need to manually whitelist IP addresses in cPHulk and CSF? In all my years of administering cPanel servers, I've never seen cPHulk block something independently from the firewall. Feedback is welcome.

Editing to add…

A review of the logs shows that the block triggers occurred upon completion of the 'postupcp' script. I also noted that CSF seems to have been updated to v16.30, coinciding with the cPanel update. Very concerning.

• 

  Trane Francks

  • August 06, 2026 23:11

  Following up, it appears that my mail client was attempting to authenticate with dovecot, but the connections were refused, leading to the full-on block per below:
  
  

  maillog:Aug  6 14:08:34 <name> dovecot: auth-worker(1461587): Error: conn unix:auth-worker (pid=1441970,uid=97): auth-worker<1>: dict(email@address,ip address,<hwStxmRY2qR+QlsU>): Failed to lookup key shared/dovecot_userdb-imap/email@address: net_connect_unix(/usr/local/cpanel/var/cpdoveauthd.sock) failed: Connection refused (reply took 0.000 secs (0.000 in dict wait, 0.000 in other ioloops, 0.000 in locks))
  
  maillog:Aug  6 14:08:36 <name> dovecot: imap-login: Disconnected: Aborted login by logging out (auth service reported temporary failure): user=<email@address>, method=PLAIN, rip=remote IP, lip=local IP, TLS, session=<zPmrxmRYDop+QlsU>

  Something very funky about that cPanel/firewall update, from the look of it. Probably not security-related after all.

  0

Please sign in to leave a comment.