cPanel Forums - E-mail Discussions

internal users spoofing

landm — Thu, 23 May 2013 15:46:29 GMT

Hi,

I would like to forbid my users send mails with different from than the authenticated user. Yes, it is not RFC, but some users "forget" their passwords and spammers use them.
I think the piece of code is:
deny
authenticated = *
condition = ${if eq {$authenticated_id}{${lc:$sender_address}}\
{no}{yes}}
message = rejected: You must send as the ID you authenticate with.

But I don't know where should be or whether I would use system filter.

Thank you in advanced,
LandM

Security problem with exim

ciberplay — Thu, 23 May 2013 07:16:11 GMT

Hello we have a problem, our whm server use exim, it allow send anonymous mail from whatever email address and we dont know how to avoid it, if you configure an email client with no authentication server for outgoing mails, it allow send mails only writing and address of an existing domains in our server.

we have two servers and in only one happen....

they have the same tweaksetting and the same exim configuration...

Thankyou for all, and sorry for my english....

Dovecot Authentication Timeout Problem

jamesterror — Wed, 22 May 2013 21:44:07 GMT

Hi,

Have been trying to hold off posting on the forum and find a solution myself but I'm struggling now.

We have been trying to resolve an issue this week that is occurring with Dovecot on IMAP connections regarding to timeout and problems by external email clients, I believe the error has been going on longer than a week though, I've only just switched my mail account from POP3 to IMAP.

In Outlook every 6 hours I am prompted for the passwords of my three email accounts on separate domains setup on our main web server. I've Googled / searched the cPanel forums but am still struggling to find an answer. I have increased authentication process under Mail Configuration on cPanel bit still the errors persist, here is the latest occurance taken from /var/log/maillog -

Code:

May 22 21:36:20 dovecot: IMAP(festivals@domain.co.uk): Disconnected: Logged out bytes=63/550

May 22 21:36:22 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*

May 22 21:36:22 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*, TLS

May 22 21:36:23 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*

May 22 21:36:25 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*

May 22 21:36:25 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*, TLS

May 22 21:36:29 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*, TLS

May 22 21:36:46 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*, TLS

May 22 21:36:55 dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*, TLS

May 22 21:36:55 dovecot: IMAP(festivals@domain.co.uk): Disconnected: Logged out bytes=576/5346

May 22 21:36:56 dovecot: IMAP(festivals@domain.co.uk): Disconnected: Logged out bytes=417/4461

May 22 21:36:57 dovecot: IMAP(festivals@domain.co.uk): Disconnected: Logged out bytes=569/5231

May 22 21:36:57 dovecot: IMAP(festivals@domain.co.uk): Disconnected: Logged out bytes=63/550

I also spotted the line below, and came across this thread - cpHulkd is up to date -

Code:

May 22 21:35:33 chocolate dovecot: imap-login: Login: user=, method=PLAIN, rip=81.*.*.*, lip=93.*.*.*, TLS

May 22 21:35:45 chocolate dovecot: auth(default): cphulkd rejected registration attempt for dovecot with: -1

Any help would be greatly appreciated - Thanks in advance.

James

Separate mail and web servers

goodmove — Wed, 22 May 2013 14:20:25 GMT

Hi All,

We want to use a separate server to handle the user emails and use another server for website and database hosting. Can Cpanel integrate to an external mail server for webmail, IMAP, POP3, etc.? If that's possible, do we have to have Cpanel installed on both servers? And how would user quotas work?

Thanks for any info.

Courier to Dovecot and folder subscriptions

nino — Tue, 21 May 2013 15:00:06 GMT

Hi,

First, I'm sorry if this questions have already been answered before, but I just have to be extra sure before doing anything on my server.

We have a server suffering from overloads and I believe it's related to Courier Imap. When the loads goes up (sometimes above 150) I see lot's of processes related to imap. The courier imapd itself, lots of "php-cgi" called from webmaild and so.

Many people suggests that we change the imap server from Courier to Dovecot. The problem is that most of our users, if not all of them, uses folders subscriptions and there lies my questions.

Question 1 - If I change the option on cPanel to use Dovecot will it convert the folder subscriptions or will I get my phone ringing with customers asking "Where's my folder"?

Courier uses a file called "courierimapsubscribed" inside each mail foder. Will cPanel convert this file to Dovecots format? Which I don't know how it is our how it works...

Question 2 - If cPanel does not care about converting anything and just changes the "imap authenticator", what will happen to these Courier files? "courierimapsubscribed" and the folders will be wiped out?

Question 3 - What exactly does cPanel do when we change these options?

Thanks.

550 Access Denied - Invalid HELO

mechcomdotnet — Tue, 21 May 2013 14:04:23 GMT

We recently stopped hosting our own email and domains on our own servers and went to a hosting company (webhostingpad.com) to host all of it for us and our customers. The hosting company uses the cpanel software (cPanel Version 11.36.1 build 6) and we have been with them now for over a month and besides some glitches with frontpage extensions for our customers' domains all has been well. Last Wednesday near the end of the day I was unable to access my cpanel log in and all of my domains and customers' domains and email were down because the server was down. Since then I have been unable to send mail from my billing program. I use a sinple billing program that worked fine via SMTP until that day the cpanel burped. Now I am getting "550 access denied - invalid HELO name (See RFC2821 4.1.1.1)" And when I submitted a support ticket to the hosting company they say it is my billing program. The program worked for over a month until the day the webhosting server with cpanel burped?

Here are the server logs of the mail server rejecting the mail:

Code:

2013-05-20 07:46:42 SMTP connection from [98.103.36.30]:1071 (TCP/IP connection count = 8)

2013-05-20 07:46:43 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1071)

2013-05-20 07:46:43 H=(dc10) [98.103.36.30]:1071 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 07:46:43 SMTP connection from (dc10) [98.103.36.30]:1071 closed by DROP in ACL

2013-05-20 09:19:53 SMTP connection from [98.103.36.30]:1123 (TCP/IP connection count = 4)

2013-05-20 09:19:53 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1123)

2013-05-20 09:19:54 H=(dc10) [98.103.36.30]:1123 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 09:19:54 SMTP connection from (dc10) [98.103.36.30]:1123 closed by DROP in ACL

2013-05-20 09:21:35 SMTP connection from [98.103.36.30]:1125 (TCP/IP connection count = 8)

2013-05-20 09:21:35 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1125)

2013-05-20 09:21:36 H=(dc10) [98.103.36.30]:1125 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 09:21:36 SMTP connection from (dc10) [98.103.36.30]:1125 closed by DROP in ACL

2013-05-20 09:22:05 SMTP connection from [98.103.36.30]:1126 (TCP/IP connection count = 10)

2013-05-20 09:22:06 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1126)

2013-05-20 09:22:06 H=(dc10) [98.103.36.30]:1126 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 09:22:06 SMTP connection from (dc10) [98.103.36.30]:1126 closed by DROP in ACL

2013-05-20 09:33:37 SMTP connection from [98.103.36.30]:1136 (TCP/IP connection count = 11)

2013-05-20 09:33:38 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1136)

2013-05-20 09:33:38 H=(dc10) [98.103.36.30]:1136 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 09:33:38 SMTP connection from (dc10) [98.103.36.30]:1136 closed by DROP in ACL

2013-05-20 09:38:55 SMTP connection from [98.103.36.30]:1137 (TCP/IP connection count = 9)

2013-05-20 09:38:55 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1137)

2013-05-20 09:38:56 H=(dc10) [98.103.36.30]:1137 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 09:38:56 SMTP connection from (dc10) [98.103.36.30]:1137 closed by DROP in ACL

2013-05-20 10:10:47 SMTP connection from [98.103.36.30]:1143 (TCP/IP connection count = 5)

2013-05-20 10:10:47 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1143)

2013-05-20 10:10:47 H=(dc10) [98.103.36.30]:1143 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 10:10:47 SMTP connection from (dc10) [98.103.36.30]:1143 closed by DROP in ACL

2013-05-20 10:28:14 SMTP connection from [98.103.36.30]:1144 (TCP/IP connection count = 8)

2013-05-20 10:28:14 no IP address found for host dc1.mechcom.net (during SMTP connection from [98.103.36.30]:1144)

2013-05-20 10:28:15 H=(dc10) [98.103.36.30]:1144 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

2013-05-20 10:28:15 SMTP connection from (dc10) [98.103.36.30]:1144 closed by DROP in ACL

The hosting company suggested we have a DNS entry point to DC10.... I don't understand why since it is just a computer sending email billing via SMTP, but we did this in the cpanel as advised. Still no luck.

The email of error logs still says this:

Error log shows ;

2013-05-21 07:48:46 SMTP connection from [98.103.36.30]:1044 (TCP/IP connection count = 10)
2013-05-21 07:48:47 H=dc1.mechcom.net (dc10) [98.103.36.30]:1044 rejected MAIL : Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
2013-05-21 07:48:47 SMTP connection from dc1.mechcom.net (dc10) [98.103.36.30]:1044 closed by DROP in ACL

It has been almost a week and we still cannot send billing to our customers? Nothing has changed on the computer that has the billing software on it. Nothing changed in the billing software. The only thing that happened was the hosting company's server with our access to cpanel burped and all of our domains and mail were down for an hour.
Any help would be appreciated.
Sam

can not receive email from gmail

esultanzada — Tue, 21 May 2013 07:28:57 GMT

Hello,

its two days that i cant receive email from gmail, i receive email from yahoo and send , but in gmail just i can send email from my server but didnt receive.
when i send to my server an email from gmail its successfully send and no error. but my server cant receive.
please give me advise to solve this problem.

Thanks

Change in spam behaviour since upgrade

serichards — Mon, 20 May 2013 18:45:58 GMT

There was an automatic upgrade of cpanel last week. I noticed that since that upgrade occurred I've had problems with endless emails being marked as spam and bounced that shouldn't be. One was even in a user level white list.

Just about all forum reply updates stopped. Various auto responders stopped and on checking the Mail Reports thing in WHM nothing is in there, only a list of rejected ips. I'd have expected all the rejected emails to be listed there or is this telling me that the user level spam checking has been altered and become more aggressive when I haven't even touched it?

Is there a good way of permanently turning off all the user level spam checking so that it is only server side where it can be monitored via the mail reports system in WHM rather than having to mess around going into a user level control panel?

I also notice the automatically whitelist mobile providers option also got turned back on. I turn it off.

Is there a good way of setting it up and making sure that it stays put eg running a cron job to put back anything it messes with?

How to sell email only account without domain?

pcatlast — Mon, 20 May 2013 05:45:23 GMT

Hi guys,

I've invested in a suite of geo domain names, and am gearing up to offer a range of geo specific services. Key among these are email addresses. Using a system like WHMCS, I can sell anything that can be at up as plan under WHM, but the X3 email only template doesn't do what I want.

I want to offer addresses in the form name@location.com but as far as I can see, WHM restricts me to selling something@name.location.com. I can set them up manually of course, as I don't want to give 100 clients access to the same cPanel account for location.com, but that would be an unrealistic workload for the expected return.

I don't need to offer cPanel access : clients can be restricted to pop3, smtp, and webmail only.

Is there a way to do it?

Thanks in anticipation.

Email Forwarded to cPanel Username

jimhermann — Sun, 19 May 2013 17:00:57 GMT

cPanel Community,

When email is forwarded to a cPanel username (no @domain-name.tld) or sent to email address username@server-name.tld, the email server stores the email in /home/username/new.

How is the user supposed to access this email?

Is it supposed to be forwarded to username@domain-name.tld?

Thanks,

Jim