The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

cphulkd internal errors

Discussion in 'General Discussion' started by Mysticeti, Apr 14, 2015.

  1. Mysticeti

    Mysticeti Well-Known Member

    Joined:
    Sep 16, 2002
    Messages:
    49
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Southern NH
    I've been seeing this error in logwatch emails since about December 12th 2014:

    Code:
    dovecot: auth: Error: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@example.com from IP 'x.x.x.x' for service smtp.: 2 Time(s)
    Is this expected?

    Thanks.
     
    #1 Mysticeti, Apr 14, 2015
  2. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi,

    That is an interesting error. I assume it is not encountered when cPHulk is disabled? Have you tried flushing the database at WHM > Security Center > cPHulk?

    Thanks,
     
    #2 madmanmachines, Apr 14, 2015
  3. Mysticeti

    Mysticeti Well-Known Member

    Joined:
    Sep 16, 2002
    Messages:
    49
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Southern NH
    > I assume it is not encountered when cPHulk is disabled?

    Not sure. I haven't tried that yet.

    > Have you tried flushing the database at WHM > Security Center > cPHulk?

    I've just flushed the DB. We'll see what happens. :) Thanks.
     
    #3 Mysticeti, Apr 14, 2015
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,700
    Likes Received:
    1,138
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Internal case number 184113 is open to address an issue where Dovecot failure messages for login authentication appear in /var/log/maillog when cphulkd user cannot connect to cphulkd database or when MySQL itself is down. There's currently no time frame for a resolution, but you can monitor the change log for this case number at:

    cPanel - Change Logs

    Thank you.
     
    #4 cPanelMichael, Apr 15, 2015
  5. hostingmundial

    hostingmundial Registered

    Joined:
    Mar 9, 2006
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    151
    We have same issue with Courier WHM 11.50.0 (build 27)

    Aug 3 10:12:58 servidor authdaemond: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@example.com from IP 'x.x.x.x' for service pop3.

    Aug 3 10:09:01 servidor authdaemond: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@example.com from IP 'x.x.x.x' for service imap.
     
    #5 hostingmundial, Aug 3, 2015
    Last edited by a moderator: Aug 3, 2015
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,700
    Likes Received:
    1,138
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello :)

    Could you run the "mysqlcheck cphulkd" command on your system to verify the database is functioning as expected and not corrupted?

    Thank you.
     
    #6 cPanelMichael, Aug 4, 2015
  7. Mysticeti

    Mysticeti Well-Known Member

    Joined:
    Sep 16, 2002
    Messages:
    49
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Southern NH
    Code:
    Repairing cphulkd

cphulkd.auths                                      OK
cphulkd.blacklist                                  OK
cphulkd.brutes                                     OK
cphulkd.good_logins                                OK
cphulkd.ip_lists                                   OK
cphulkd.known_netblocks                            OK
cphulkd.login_track                                OK
cphulkd.logins                                     OK
cphulkd.report                                     OK
cphulkd.whitelist                                  OK
Done.
    Still seeing the errors though, e.g.

    Code:
    dovecot: auth: Error: Cpanel::MailAuth: Internal Error: cphulkd request failed to process account@domain.com from IP '89.248.169.61' for service smtp.: 2 Time(s)
     
    #7 Mysticeti, Aug 19, 2015
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,700
    Likes Received:
    1,138
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    My previous response on this thread was for the user referencing the Courier mail server. You are using Dovecot based on the output, so it's likely related to the case mentioned earlier. Internal case number FB-184113 is addressed in cPanel version 11.50.1.1.

    Thank you.
     
    #8 cPanelMichael, Aug 19, 2015
  9. Mysticeti

    Mysticeti Well-Known Member

    Joined:
    Sep 16, 2002
    Messages:
    49
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Southern NH
    Woops. Sorry about that.

    Looking forward to 11.50.1.1!
     
    #9 Mysticeti, Aug 19, 2015
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,700
    Likes Received:
    1,138
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    It's currently available on the "Current" build tier. There's no specific timeline available on when it will make it's way to the "Release" and "Stable" tiers, but you can monitor our change logs at:

    cPanel - Change Logs

    Thank you.
     
    #10 cPanelMichael, Aug 19, 2015
  11. Mysticeti

    Mysticeti Well-Known Member

    Joined:
    Sep 16, 2002
    Messages:
    49
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Southern NH
    Well I'm at 11.50.1 (build 3) but I'm still seeing errors like these:
    Code:
    dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process “account@example.com” from “IP '95.215.0.203'” for the “smtp” service.: 1 Time(s)
dovecot: auth: Error: Cpanel::MailAuth: Internal Error: cphulkd request failed to process example@domain.com from IP '95.215.0.203' for service smtp.: 1 Time(s)
    :-(
     
    #11 Mysticeti, Sep 25, 2015
    amh5514 likes this.
  12. amh5514

    amh5514 Registered

    Joined:
    Sep 30, 2015
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    ERIE
    cPanel Access Level:
    Root Administrator
    I can verify that 11.50.1 (build 3) is still showing this error. Also, it's not just deceptive. It appears our clients are being blocked due to the failed process.

    Code:
    Sep 29 10:23:33  dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process “user@example.org” from “IP xxx.xxx.xx.xxx” for the “pop3” service.

Sep 29 10:23:35  dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<user@example.org>, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=< >

Sep 29 10:23:50  dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process “user@example.org” from “IP xxx.xxx.xx.xxx” for the “pop3” service.

Sep 29 10:23:52  dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<user@example.org>, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=</ >

Sep 29 10:24:08  dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process “user@example.org” from “IP xxx.xxx.xx.xxx” for the “pop3” service.

Sep 29 10:24:10  dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<user@example.org>, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=< >

Sep 29 10:24:45  dovecot: auth: Error: Cpanel::MailAuth: Brute force checking was skipped because cphulkd failed to process “user@example.org” from “IP xxx.xxx.xx.xxx” for the “pop3” service.

Sep 29 10:24:47  dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<user@example.org>, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS, session=< >

Sep 29 10:24:50  spamd[5635]: spamd: connection from localhost.localdomain

Sep 29 10:24:50  spamd[5635]: spamd: setuid to <user> succeeded

Sep 29 10:24:50  spamd[5635]: spamd: checking message < > for <user:uid>

Sep 29 10:24:56  spamd[5635]: spamd: clean message (0.3/5.0) for <user:uid> in 6.4 seconds, 4399 bytes.

Sep 29 10:24:56  spamd[5635]: spamd: result: . 0 -,T_REMOTE_IMAGE scantime=6.4,size=4399,user=<user>

Sep 29 10:24:56  spamd[24679]: prefork: child states: I

Sep 29 10:25:55  dovecot: pop3(user@example.org): Disconnected: Logged out top=0/0, retr=0/0, del=0/341, size=115611829, bytes=18/7708

Sep 29 10:25:55  dovecot: pop3(award@example.org): Disconnected: Logged out top=0/0, retr=0/0, del=0/3, size=13940, bytes=18/112

Sep 29 10:25:55  dovecot: pop3(info@example.org): Disconnected: Logged out top=0/0, retr=0/0, del=0/1219, size=353715376, bytes=18/28432

Sep 29 10:26:08  dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__...>, method=PLAIN

Sep 29 10:26:08  dovecot: imap(__cpanel__service__auth__imap__): Disconnected: Logged out in=11, out=434, bytes=11/434

Sep 29 10:26:26  dovecot: pop3-login: Login: user=<info@example.org>, method=PLAIN, rip=xxx.xxx.xx.xxx

Sep 29 10:26:27  dovecot: pop3(info@example.org): Disconnected: Logged out top=0/0, retr=1/6025, del=0/1220, size=353721384, bytes=35/47931

Sep 29 10:26:28  dovecot: auth: Error: Cpanel::MailAuth: cphulk blocked login for user '<user@example.org>' to access service 'mail' from IP xxx.xxx.xx.xxx

Sep 29 10:26:30  dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<user@example.org>, method=PLAIN, rip=xxx.xxx.xx.xxx, TLS: Disconnected, session=<+ >
     
    #12 amh5514, Sep 30, 2015
    Last edited by a moderator: Sep 30, 2015
  13. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,700
    Likes Received:
    1,138
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    An additional case, CPANEL-1754, is open to address an issue where when mail authentication fails using a valid domain on the server, the cPHulkd error in the Dovecot mail log can cause confusion. The error is misleading because administrators can still connect to the cPHulk database using the password in /var/cpanel/hulkd/password and there is no corruption with the cphulkd database. The latest update to this case indicates it should be resolved in cPanel version 11.54. Note the error message does not indicate an issue with cPHulk itself, other than adding misleading information to the logs.

    Thank you.
     
    #13 cPanelMichael, Oct 7, 2015
    Mysticeti likes this.
  14. stevenvsi

    stevenvsi Member

    Joined:
    Sep 20, 2014
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Hi,

    Nothing about this yet?
    I have the same logs but it does not seems to hinder clients.

    Still I wonder what it means.

    Regards,
     
    #14 stevenvsi, Apr 7, 2016
  15. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    35,700
    Likes Received:
    1,138
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Could you verify which version of cPanel is installed on your system? EX:

    Code:
    cat /usr/local/cpanel/version
    Thank you.
     
    #15 cPanelMichael, Apr 8, 2016
(You must log in or sign up to post here.)
Loading...
Similar Threads - cphulkd internal errors
  1. Jason Silver

    cPHulkd internal error

    Jason Silver, Apr 1, 2016, in forum: General Discussion
    Replies:
    1
    Views:
    471
    cPanelMichael
    Apr 4, 2016
  2. Lethe

    SOLVED cphulkd much too agressive

    Lethe, Jun 17, 2017, in forum: Security
    Replies:
    4
    Views:
    69
    Lethe
    Jun 19, 2017
  3. ddaddy

    SOLVED cphulkd service is down

    ddaddy, May 9, 2017, in forum: General Discussion
    Replies:
    4
    Views:
    220
    cPanelMichael
    May 24, 2017
  4. urgido

    cphulkd table marked as crashed and should be repaired

    urgido, Jan 6, 2017, in forum: Database Discussions
    Replies:
    1
    Views:
    469
    cPanelMichael
    Jan 9, 2017
  5. uadm

    Remote access denied for cphulkd

    uadm, Jul 6, 2016, in forum: Database Discussions
    Replies:
    5
    Views:
    540
    cPanelMichael
    Jul 11, 2016

Share This Page