cpaneleximfilter is empty or non-existent

[sehh]

My cpanel error log (/usr/local/cpanel/logs/error_log) is full of the following errors:

 warn [whostmgr2] User file '/var/cpanel/users/webadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/mailman' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/clamav' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanel-horde' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanel-phpmyadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanel-phppgadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelhorde' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelphpmyadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelphppgadmin' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpanelroundcube' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106
 warn [whostmgr2] User file '/var/cpanel/users/cpaneleximfilter' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 106

Is this something serious? what is this file all about?

Any help would be appreciated.

Thank you.

 

[cPanelTristan]

I'm uncertain what would be calling /var/cpanel/users files for these various services, since they would not have cPanel account files at /var/cpanel/users

What are you specifically doing in WHM when this error presents itself?

 

[sehh]

I have no idea, I just found them in the error log file while I was looking for something else.

Here is a more complete log:

warn [whostmgr2] User file '/var/cpanel/users/cpaneleximfilter' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFil
e.pm line 106
        Cpanel::Config::LoadCpUserFile::_load('cpaneleximfilter', undef, 0) called at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 25
        Cpanel::Config::LoadCpUserFile::load('cpaneleximfilter') called at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 259
        Cpanel::Config::LoadCpUserFile::loadcpuserfile('cpaneleximfilter') called at whostmgr/bin/whostmgr2 line 6965
        main::listbwdescp() called at whostmgr/bin/whostmgr2 line 877

 

[cPanelTristan]

cpaneleximfilter is a file on the system normally at /etc location, so it shouldn't be showing anything about /var/cpanel/users location. The location for that user is /var/cpanel/userhomes/cpaneleximfilter instead.

What does this show?

grep cpaneleximfilter /etc/passwd

It should have this as the line:

[email protected] [/]# grep cpaneleximfilter /etc/passwd
cpaneleximfilter:x:32007:32009::/var/cpanel/userhomes/cpaneleximfilter:/usr/local/cpanel/bin/noshell

 

[sehh]

here is what I get:

# grep cpaneleximfilter /etc/passwd
cpaneleximfilter:x:512:512::/var/cpanel/userhomes/cpaneleximfilter:/usr/local/cpanel/bin/noshell

 

[cPanelTristan]

It appears correct. When you go to /var/cpanel/userhomes, do you show this for ownership on that folder?

[email protected] [/var/cpanel/userhomes]# ls -ld cpaneleximfilter
drwx--x--x 3 cpaneleximfilter cpaneleximfilter 4096 Mar  8  2011 cpaneleximfilter/

Also, do you have any actual file named /var/cpanel/users/cpaneleximfilter on the system? If you do, you likely shouldn't have that on the system.

 

[sehh]

This is what I get:

# ls -ld cpaneleximfilter
drwx--x--x  3 cpaneleximfilter cpaneleximfilter 4096 Jan 11  2011 cpaneleximfilter/

Could this be a remote access attempt? Maybe someone is trying system/service accounts via the cPanel or WHM login process?

 

[cPanelTristan]

It is possible that someone is trying to log into non-existing accounts using the WHM or cPanel interface. You could test that idea by trying to log into one of the accounts noted in both locations to see the error message it reports while you tail the error log:

tail -fn0 /usr/local/cpanel/logs/error_log

You could also add a piped grep for your IP to ensure it is just your IP where you get the results:

tail -fn0 /usr/local/cpanel/logs/error_log | grep IP#

Please replace IP# with your IP, which you can find using What Is My IP Address - Shows Your IP Address site if you aren't certain of your local machine's IP number.