Mac Mail Cannot Connect

[alinford]

I am unable to setup and connect email with Mac Mail. I can telnet from the machine and login to webmail. I have tried both with and without SSL, but it will not connect. It was working until the most recent updates to 84.08 and 84.09.

 

[cPanelLauren]

Hello,

What is the output in the exim logs when you attempt to connect using mac mail? You can see this at /var/log/exim_mainlog

 

[alinford]

Lots of these, since I have tried dozens of times:
2019-11-18 11:07:06 SMTP connection from [IPREMOVED]:51128 (TCP/IP connection count = 97)
2019-11-18 11:08:07 SMTP connection from IPREMOVED.tukw.qwest.net [IPREMOVED]:51128 lost D=1m

 

[cPanelLauren]

What are the connection settings you're using in mac mail currently? (Please don't include any personally identifying information)

 

[alinford]

We have tried using every form of the login info, both SSL and non SSL, including allow insecure login.

Both IP's that show up are whitelisted.

This is the other log entry:
2019-11-18 12:00:13 dovecot_login authenticator failed for c-IPREMOVED.hsd1.wa.comcast.net ([<INTERNALIPREMOVED>]) [IPREMOVED]:62140: 535 Incorrect authentication data (set_id=[email protected])
2019-11-18 12:00:23 dovecot_login authenticator failed for c-IPREMOVED.hsd1.wa.comcast.net ([<INTERNALIPREMOVED]) [IPREMOVED]:62140: 535 Incorrect authentication data (set_id=[email protected])

 

[cPanelLauren]

We have tried using every form of the login info, both SSL and non SSL, including allow insecure login.

Both IP's that show up are whitelisted.

This is the other log entry:
2019-11-18 12:00:13 dovecot_login authenticator failed for c-IPREMOVED.hsd1.wa.comcast.net ([<INTERNALIPREMOVED>]) [IPREMOVED]:62140: 535 Incorrect authentication data (set_id=[email protected])
2019-11-18 12:00:23 dovecot_login authenticator failed for c-IPREMOVED.hsd1.wa.comcast.net ([<INTERNALIPREMOVED]) [IPREMOVED]:62140: 535 Incorrect authentication data (set_id=[email protected])

This would indicate that the password is incorrect...have you confirmed the password has not updated and the IP the request is originating from is not blocked with cPHulk?

 

[alinford]

Yes, I am able to login to webmail with that password, from that device. The IP's are not blocked, and are whitelisted in cPHulk. I also tried changing passwords, but the results were the same.

 

[cPanelLauren]

What are the settings you're using to connect, I just noticed you didn't provide them previously.

 

[Cameron Worts]

This has been an ongoing issue with Mac Mail and cPanel. The issue is to do with the SSL/TLS Cipher Suit List.

I went to a mac store, showed them the issue and they blamed cPanel. cPanel is blaming Mac.

A Workaround:

in WHM go to Exim Configuration Manager,

Options for OpenSSL:
+no_sslv2 +no_sslv3

SSL/TLS Cipher Suite List:
ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS


Save it, go to 'Mailserver Configuration' and under SSL Cipher List:

ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS

 

[alinford]

Cameron, Do I add this to what is currently there, or do I replace what is there?
Here is what I currently have:

Exim Configuration Manager / Options for OpenSSL:
+no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1

Exim Configuration Manager / SSL/TLS Cipher Suite List:
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256


Mailserver Configuration / SSL Cipher List:
ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

 

[Cameron Worts]

Cameron, Do I add this to what is currently there, or do I replace what is there?

Just replace with the above.

 

[Mat-d-rat]

I'm sure I used this a while ago... but now it's started to happen again, cannot get Mac mail to connect (bu Office mail works fine!). Any other ideas?

 

[keat63]

I experienced something similar when I migrated my server recently.

I had a remote user, using a macbook who couldn't authenticate.
I spent hours checking and double-checking passwords, port number, ssl/tls setting etc.

In exim config manager, under the security tab, try these custom settings, but make sure you copy your current settings first.

+no_sslv2 +no_sslv3

ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS

 

[Mat-d-rat]

That's the same as above, and what I already had configured, still no go

 

[Mat-d-rat]

Changing DoveCot to a SSL minimim of 1 fixes it... hmmm, maybe have to abandon that client?