Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

SOLVED cPanel account receiving login notifications

Discussion in 'General Discussion' started by Havri, Jun 15, 2018.

  1. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    A client of ours is receiving some notifications about logins:

    Code:
    Successful Login as "contact@my-domain.tld" from a Known Network
    
    
    Domain: my-domain.tld
    Service: dovecot
    Local IP Address: 172.23.23.23
    Local Port: 993
    Remote IP Address: 222.222.222.222
    Remote Port: 6601
    Authentication Database: mail
    Username: contact@my-domain.tld
    Known Network †: Yes ✔
    I've looked in the Contact information section in their cPanel, but the contact addresses do not match the email address that is receiving these notifications. For example, the email account that is receiving the notifications is "contact@my-domain.tld", but in the cPanel -> Contact Information section there are other 2 email accounts "office@another-domain.tld" and "someuser@gmail.com".

    How can these notifications be disabled? Is this a cPanel account setting or some specific webmail configuration (roundcube, horde, etc.).?

    Let me know if you need any other info

    Thank you.
     
  2. webhostuk

    webhostuk Well-Known Member

    Joined:
    Sep 11, 2013
    Messages:
    142
    Likes Received:
    14
    Trophy Points:
    18
    Location:
    UK
    cPanel Access Level:
    Website Owner
    Twitter:
    Is this user also have WHM access, if so the email alert setting for this domain will be setup in his WHM and not Cpanel.
    I am just trying to confirm if he has WHM as well.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    No, the user isn't a reseller so it doesn't have access to WHM. It's a simple cPanel account.

    Thank you.
     
  4. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,530
    Likes Received:
    253
    Trophy Points:
    193
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @Havri

    Does the user have any forwarders on the account? If the mail is sent to a different email address than what's on file that would be the only explanation that I can think of. If you're able to access the server via SSH the email transaction details at /var/log/exim_mainlog would be extremely useful in explaining what occurred as well.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    The account does have a forwarder set up, but the contact@my-domain.tld address is the sender and someuser@gmail.com is the address that all mails are being forwarded to. Not the other way around.

    Here's an entry from exim_mainlog that captures the SMTP transaction:

    Code:
    2018-06-15 22:26:08 1fTuMK-00CgNR-4v <= cpanel@my-domain.tld H=(localhost.localdomain) [127.0.0.1]:41301 I=[127.0.0.1]:25 P=esmtp S=39592 id=1529090768.QMxvesMMjnnYF8YW@abc07.octosquid.com T="[my-domain.tld] \342\234\224 Login as contact@my-domain.tld from a Known Network IP Address 92.82.230.198" from <cpanel@my-domain.tld> for contact@my-domain.tld someuser@gmail.com
    2018-06-15 22:26:08 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1fTuMK-00CgNR-4v
    2018-06-15 22:26:08 1fTuMK-00CgNR-4v SMTP connection identification H=localhost A=127.0.0.1 P=41301 M=1fTuMK-00CgNR-4v U=root ID=0 S=root B=authenticated_local_user
    2018-06-15 22:26:08 1fTuMK-00CgNR-4v Sender identification U=root D=-system- S=root
    2018-06-15 22:26:08 1fTuMK-00CgNR-4v SMTP connection identification H=localhost A=127.0.0.1 P=41301 M=1fTuMK-00CgNR-4v U=root ID=0 S=root B=authenticated_local_user
    2018-06-15 22:26:08 1fTuMK-00CgNR-4v Sender identification U=root D=-system- S=root
    2018-06-15 22:26:08 1fTuMK-00CgNR-4v => contact <contact@my-domain.tld> F=<cpanel@my-domain.tld> R=virtual_user T=dovecot_virtual_delivery S=40434 C="250 2.0.0 <contact@my-domain.tld> yMFPHNASJFv8Hy4AXL/IpQ Saved"
    2018-06-15 22:26:10 1fTuMK-00CgNR-4v => someuser@gmail.com (contact@my-domain.tld) <contact@my-domain.tld> F=<cpanel@my-domain.tld> R=lookuphost T=remote_smtp S=40752 H=gmail-smtp-in.l.google.com [74.125.133.26] I=[122.122.122.122] X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes DN="/C=US/ST=California/L=Mountain View/O=Google LLC/CN=mx.google.com" C="250 2.0.0 OK 1529090772 g30-v6si7950367wrd.88 - gsmtp"
    2018-06-15 22:26:10 1fTuMK-00CgNR-4v Completed
    
    I am also sending an attachment with the contact info settings from the account. As you can see, the option "Someone logs in to my account." isn't checked, so there shouldn't be any login notifications.

    Let me know if you need any other info to get this solved.

    Thank you.
     

    Attached Files:

  6. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,530
    Likes Received:
    253
    Trophy Points:
    193
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @Havri


    The mail transaction clearly shows a forwarder from contact@my-domain.tld ->> someuser@gmail.com

    Does this user have root/whm access to the server? If so can you let me know what is set at WHM>>Server Contacts>>Edit System Mail Preferences?


    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    Exactly, it shows entries with contact@my-domain.tld and someuser@gmail.com as the recipients of the mails from
    cpanel@my-domain.tld. The problem is that this contact@my-domain.tld mail address isn't put as a contact address in any cPanel forms (cPanel -> Contact Information, WHM>>Server Contacts>>Edit System Mail Preferences, etc.). It is just a simple email account. This account shouldn't get a notification from cpanel@my-domain.tld as per current settings.

    Regarding the account, this is just a simple cPanel account, not a reseller.

    Thank you.
     
  8. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,530
    Likes Received:
    253
    Trophy Points:
    193
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @Havri

    Could you please open a ticket using the link in my signature? Once open please update this thread with the ticket ID so that we can follow up here with the outcome.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    I tried to open a ticket but it shows me an error saying that the IP or Support Access ID is not correct. Also, I saw that your license check page does not work. Please see the 2 attachments. The server has a cPanel license.

    Thank you.
     

    Attached Files:

  10. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,518
    Likes Received:
    425
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    cPanel System Administration is aware of an issue related to the ticket system and is working to resolve it as quickly as possible. Please check back later.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,530
    Likes Received:
    253
    Trophy Points:
    193
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    HI @Havri

    I'm so sorry about that, it looks like we had some issues overnight. The issue should be resolved now can you please try again?

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    I just did:

    Your support request ID: 9768251

    Thank you.
     
  13. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,530
    Likes Received:
    253
    Trophy Points:
    193
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @Havri

    Thanks! I'm watching that ticket and I've added a note to check this thread for information as well. I'll update here as soon as we know the outcome of the ticket.


    Thank you,
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  14. Havri

    Havri Well-Known Member

    Joined:
    Oct 28, 2013
    Messages:
    81
    Likes Received:
    17
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hello,

    Well, this is a bit embarrassing on my part. I thought that login notifications can only be activated at a cPanel account level, not for each individual email account login.

    For those that don't know, you can set a per email account login notifications in -> Email Accounts -> office@my-domain.tld -> Access Webmail ->
    In the upper right corner click on the email address that is just to the left of the Logout button so that a dropdown menu shows -> Contact Information.

    Thank you for your support.

    Best regards.
     
  15. cPanelLauren

    cPanelLauren Forums Analyst II
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    3,530
    Likes Received:
    253
    Trophy Points:
    193
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @Havri

    Please don't be embarrassed, I think you've helped many others today! Thank you for updating the thread as to the result of the ticket and how to resolve the issue.

    Thank you!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice