IMAP failed

[seizart]

I ve also imap failed (happened at the same moment), it actually happened just after i tried to install ffmpeg from this : /http://www.9xphp.com/Thread-FFMPEG-ffmpeg-PHP-centos-5-6-easy-install]

Here is the error message:

imap failed @ Wed May 29 01:40:02 2013. A restart was attempted automagically.

Service Check Method:  [socket connect]

Reason: TCP Transaction Log:
<< * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] Dovecot ready.
>> A001 LOGIN __cpanel__service__auth__imap__6N0hI3bVBhAdsk6hBmZKXIbrUEL5qlsPgmbuecKcL97Ay0c6OlQPejm1w4rMNFg8 r3Vrgqffv5DMz7XTfcYWnQVNGqOgsT6Il7RVEhLtwyjwhvYzE0dmhSoDoOc9JSZw
<< A001 NO [AUTHENTICATIONFAILED] Authentication failed.
imap: ** [A001 NO [AUTHENTICATIONFAILED] Authentication failed. != A001 OK]
: Died at /usr/local/cpanel/Cpanel/TailWatch/ChkServd.pm line 689, <$socket_scc> line 2.

Syslog Messages: May 28 23:30:08 myname dovecot: master: Warning: Killed with signal 15 (by pid=3577 uid=0 code=kill)
May 28 23:30:08 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 28 23:40:05 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__sbcYP0VEaqLfp_2p_7bLw9yUg3R9D0gFSk2MZ85D_xsQM7...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 28 23:40:05 myname dovecot: master: Warning: Killed with signal 15 (by pid=4849 uid=0 code=kill)
May 28 23:40:06 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 28 23:45:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__vngDIllyix3KKEwgojT_snatSn0lKald60MtnRD5gO47sH...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 28 23:45:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=5351 uid=0 code=kill)
May 28 23:45:06 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 28 23:50:07 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__eHuDOfeIgSse0l7Wy9J8zHkmtZzmfZnz5pw7ChCt1WYk9A...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 28 23:50:07 myname dovecot: master: Warning: Killed with signal 15 (by pid=5787 uid=0 code=kill)
May 28 23:50:08 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:00:05 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__0mvBwIaeo40xFlmpIP__CV3IvVGF6vt9lylvbpY2wN2GH4...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:00:05 myname dovecot: master: Warning: Killed with signal 15 (by pid=6717 uid=0 code=kill)
May 29 00:00:05 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:05:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__Hlmx6qLvLFGfYL3Hs66izuqB_UVP08UHw0VpNGjrGAB940...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:05:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=7347 uid=0 code=kill)
May 29 00:05:06 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:10:07 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__Sf4siZq4v_njL93w7cYa5RYx0YC9TvvlSwWZiN5vwuIlBZ...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:10:07 myname dovecot: master: Warning: Killed with signal 15 (by pid=7731 uid=0 code=kill)
May 29 00:10:08 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:20:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__Qvlld0Qp7SlEs3191OfpTcl69wtchkflCbNihLUkDTmTW7...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:20:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=8559 uid=0 code=kill)
May 29 00:20:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:25:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__Q5MKSpwPRCTW5LUabUgFYAnDyH6pOeRfZhpWOTKzxXX8GX...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:25:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=8957 uid=0 code=kill)
May 29 00:25:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:30:07 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__BSj6xnL8cKENCM6dUuZrl2ELSJj50DPazlg7v9nJSa43Wk...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:30:07 myname dovecot: master: Warning: Killed with signal 15 (by pid=9493 uid=0 code=kill)
May 29 00:30:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:40:05 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__m3RLB0sRJBcQ6XQr9j6ktMgHuR_ACZP2sC8QhRstCu_lgl...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:40:05 myname dovecot: master: Warning: Killed with signal 15 (by pid=10401 uid=0 code=kill)
May 29 00:40:06 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:45:07 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__SDgVon1Qv1xMcEYgq3GvlWyMy97cFH12rs86ponCphAC3u...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:45:07 myname dovecot: master: Warning: Killed with signal 15 (by pid=10859 uid=0 code=kill)
May 29 00:45:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 00:55:05 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__or5BHBbv1TT8MxqySEafPMGBmb7itvKzr8RC3NS8Ldqf3e...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 00:55:05 myname dovecot: master: Warning: Killed with signal 15 (by pid=12434 uid=0 code=kill)
May 29 00:55:06 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:00:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__FQWDCpSHvyPKe4PZZwT8rbwOdsf3ZB4n7fSjuPb0kBwLje...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 01:00:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=12933 uid=0 code=kill)
May 29 01:00:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:05:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__figM8IEU7FKGV2DuPSZttrSt0DZSIfkXcBTjlTKqjEFu8E...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 01:05:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=13622 uid=0 code=kill)
May 29 01:05:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:11:57 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__8Fl3zSz9K9gF4R3Y4OfU1sOKWdjUxO1bFun8kw1UpWCwPt...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 01:11:57 myname dovecot: master: Warning: Killed with signal 15 (by pid=14180 uid=0 code=kill)
May 29 01:11:58 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:20:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__QQgdSSY2RmnvnsJAKT6KdPzBeX4NhJWsqN_0hctGBOobjx...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 01:20:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=14834 uid=0 code=kill)
May 29 01:20:07 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:25:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__6xt3heqvWycMq49X6kwMjoI3fXKO43MoGigpX7nH4O9gKj...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 01:25:06 myname dovecot: master: Warning: Killed with signal 15 (by pid=15292 uid=0 code=kill)
May 29 01:25:06 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:30:08 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__44bcUIzP_bcqQTXpcNlVc2CTPu4_ZiAb_PcckdN5qZOacE...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
May 29 01:30:08 myname dovecot: master: Warning: Killed with signal 15 (by pid=15731 uid=0 code=kill)
May 29 01:30:08 myname dovecot: master: Dovecot v2.0.9 starting up (core dumps disabled)
May 29 01:40:06 myname dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<__cpanel__service__auth__imap__6N0hI3bVBhAdsk6hBmZKXIbrUEL5qlsPgmbuecKcL97Ay0...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured

 

[cPanelMichael]

Hello

Are you able to receive email through IMAP? Or, is it simply the cPanel service check that is failing? If it's just the service check that is failing, please let us know if removing the following files helps:

/var/cpanel/serviceauth/imap/recv
/var/cpanel/serviceauth/imap/send

They will be regenerated on the next Chkservd test of the IMAP service.

Thank you.

 

[seizart]

i m not using cpanel for my email i m using google but i m switching soon to cpanel

i m going to give a try

 

[karlos.vanger]

Hello,

I'm having the same issue. I've checked the issue after removing /var/cpanel/serviceauth/imap/recv
/var/cpanel/serviceauth/imap/send, also increased Courier authentication daemon. Can you help me?

Errors:

imapd: LOGIN FAILED, user=__cpanel__service__auth__imap__JcjBkhEtYodIgasdasSFG_ForujlSzw9GpJ2eIpBWg_DVL4Zjf, ip=[::ffff:127.0.0.1]
imapd: authentication error: Input/output error
pop3d: LOGIN FAILED, [email protected], ip=[::ffff:xx.xx.xx.xx]
Jun 16 05:00:17 server-hostname pop3d: authentication error: Input/output error

Thanks

 

[cPanelMichael]

Jun 16 05:00:17 server-hostname pop3d: authentication error: Input/output error

This can indicate a lack of available authentication daemons available to accept a username/password. You can try increasing the "Number of Authentication Daemons"in "WHM Home » Service Configuration » Mailserver Configuration". However, it's also important that you check and block IP addresses that are attempting excessive logins (possible brute force attempts). You can determine the IP addresses with excessive logins with a command such as:

# grep 'LOGIN FAILED' /var/log/maillog|awk '{print $9}'|sort|uniq -c

Use your firewall to block IP addresses with excessive access attempts. EX:

5000 ip=[::ffff:1.2.3.4]

The "5000" number here represents the number of failed logins from this IP address.

Thank you.

 

[karlos.vanger]

Hello,

thank you. Previously I was following the thread http://forums.cpanel.net/f43/imap-keeps-failing-261081.html as per the suggestion I've blocked couple of users who got high number of failed logins, also increased the authentication daemon from 10 to 15. However the issue still persist.

Thank you,

 

[cPanelMichael]

I've blocked couple of users who got high number of failed logins, also increased the authentication daemon from 10 to 15. However the issue still persist.

Are you receiving the same error message as the user who first opened this thread? If so, what specific entries are found in your /var/log/maillog file related to this error? Are you experiencing this issue often?

Thank you.