SOLVED SMTP connections problem

[d4mourtzis96]

Hi all,
i have a vps with whm cpanel and litespeed web server. I host wordpress websites. I use wp smtp email plugin so i can avoid sending php emails. And every now and then i get an authentication arror and i have to manually reset the connection so many emails get lost.
The error i get in the plugin is

2021-05-15 20:26:24 CLIENT -> SERVER: [credentials hidden]

2021-05-15 20:26:26 SERVER -> CLIENT: 535 Incorrect authentication data

2021-05-15 20:26:26 SMTP ERROR: Password command failed: 535 Incorrect authentication data

But i am pretty sure that the password and username is corrent since when i reset the connection it successfully.
Does anyone knows what is going on?

 

[kodeslogic]

When you see "SMTP ERROR: Password command failed: 535 Incorrect authentication data" try to login to the email account using the webmail URL before resetting the password, If the login credentials do not work in webmail as well then you will need to contact your hosting provider in case of the shared hosting account.

 

[d4mourtzis96]

I am able to connect via webmail. Also i am able to connect in gmail smtp but i also get these errors every once in a while there too. But i am the vps admin so is there any configuration setting that is causing this issue?

 

[andrew.n]

Do you see the same error on the server side in /var/log/maillog as well?

 

[d4mourtzis96]

Do you see the same error on the server side in /var/log/maillog as well?

Thanks for the answers,
i am see some errors in the maillog.

master: Warning: Killed with signal 15 (by pid=9030 uid=0 code=kill) *i am not sure what this error is

imap([email protected])<mysession>: Server shutting down. in=632, out=3700, bytes=632/3700 *i am not sure what this error is

imap-login: Disconnected (auth failed, 1 attempts in 17 secs): user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured,session=mysession

*when i connect through gmail i sometimes get this error
Disconnected (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=gmail-ip, lip=myserver-ip, TLS: Connection closed, session=mysession
Disconnected (auth failed, 1 attempts in 17 secs): user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=mysession

*When i tried to send an email from wordpress i got this logs
pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=mysession
lmtp(12984): Connect from local
lmtp(12984): Disconnect from local: Client has quit the connection (state=READY)
imap-login: Login: user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=12996, secured, session=myssesion
imap(__cpanel__service__auth__imap__tyumqcpavsp2ucml)<myssesion>: Logged out in=11, out=519, bytes=11/519
*This time the smtp email from wordpress works but sometimes it doesn't and i suppose i would get an auth failed error like with gmail.

Hope this helps!

 

[andrew.n]

Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.

 

[d4mourtzis96]

Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.

I am always able to login with webmail but i do not use it. I use gmail and i have connected pop3 and smpt. I also use wp smpt email to send registration emails. So sometimes in both google and wordpress i see the auth error but as soon as i hit retry to login it is able to log-in. I have imunify360 in the server and i see no comprimised files. I have also never changed the password and i use the auto generated passwords. I have also disabled smtp restrictions in the server so see if it causes the problem. Also i have blacklistes all countries in cphulk except my country, the servers country and usa which google ip is from. Lastly i have raised the auth deamons to check if this is causing the problem. I wonder if there is a configuration error that i have made that leads to this problem.
The server is new and this happened since the beginning.

 

[d4mourtzis96]

Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.

So a while ago i got an error again with gmail.
Gmails error says

Sun, May 16, 2021 at 11:08 PM    Authentication error.
Server returned error "[AUTH] Authentication failed."

So i went in maillog at the same time and i see

May 16 23:08:54 "hostname" dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=gmail-ip, lip=myserver-ip, TLS: Connection closed, session=<mysession>
May 16 23:08:54 "hostname" spamd[7577]: spamd: connection from localhost [::1]:48434 to port 783, fd 5
May 16 23:08:54 "hostname" dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Connect from local
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Disconnect from local: Client has quit the connection (state=READY)
May 16 23:08:55 "hostname" dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2061, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: imap(__cpanel__service__auth__imap__tyumqcpavsp2ucml)<2061><dMPqC3jCmMB/AAAB>: Logged out in=11, out=511, bytes=11/511

These are all the logs that happend at that time.

 

[d4mourtzis96]

Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.

Sorry for many comments but i just noticed that my servers ip is blacklisted in cphulk. Cphulk show the ip is from Cyprus although my server is located in Bulgaria. So i whitelisted Cyprus and i hope the problem is fixed!

 

[andrew.n]

Cool, glad you were able to figure it out though it might have been due to the incorrect login attempts, anyway keep us updated.

 

[d4mourtzis96]

Cool, glad you were able to figure it out though it might have been due to the incorrect login attempts, anyway keep us updated.

Today i have same auth error despite all the changes. Any idea what else to try? I am pretty sure the password and username that i am using are corrent.

 

[andrew.n]

you sure the settings in gmail are correct? Try to reset your password again and reconfigure gmail with that. Also make sure the mail address and ports are correct.

 

[cPRex]

That's definitely odd, and I don't have much to add besides what has already been said. Let us know how your future testing goes and we'll go from there.

 

[d4mourtzis96]

That's definitely odd, and I don't have much to add besides what has already been said. Let us know how your future testing goes and we'll go from there.

you sure the settings in gmail are correct? Try to reset your password again and reconfigure gmail with that. Also make sure the mail address and ports are correct.

I reset the password and also changed from smtp ssl with 465 to tls 587 but still the same problem. Also gmail is receiving the error in pop3 connection so i do not think there is something wrong with ports. Sometimes gmail and wp gets the auth error but as soon as i retry to login everything works fine until it doesn't and this seems random. Is it possible to be a problem with ssl or auth deamons or something else in the configuration?

 

[cPRex]

When the issue happens, do you see anything in /var/log/maillog? That is where the connection attempts would get logged on the server.

 

[d4mourtzis96]

When the issue happens, do you see anything in /var/log/maillog? That is where the connection attempts would get logged on the server.

Yes, this is the full log that i got for a failed login attemp via gmail

May 16 23:08:54 "hostname" dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=gmail-ip, lip=myserver-ip, TLS: Connection closed, session=<mysession>
May 16 23:08:54 "hostname" spamd[7577]: spamd: connection from localhost [::1]:48434 to port 783, fd 5
May 16 23:08:54 "hostname" dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Connect from local
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Disconnect from local: Client has quit the connection (state=READY)
May 16 23:08:55 "hostname" dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2061, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: imap(__cpanel__service__auth__imap__tyumqcpavsp2ucml)<2061><dMPqC3jCmMB/AAAB>: Logged out in=11, out=511, bytes=11/511

 

[cPRex]

Unfortunately that doesn't really tell us much. If you're able to reliably make the login from a certain location fail, feel free to submit a ticket to our team and we can do some additional troubleshooting on our end.

 

[d4mourtzis96]

Unfortunately that doesn't really tell us much. If you're able to reliably make the login from a certain location fail, feel free to submit a ticket to our team and we can do some additional troubleshooting on our end.

Thanks for the help

 

[d4mourtzis96]

Unfortunately that doesn't really tell us much. If you're able to reliably make the login from a certain location fail, feel free to submit a ticket to our team and we can do some additional troubleshooting on our end.

Sorry last question
I went to exim_mainlog and i found the auth error of the wordpress smtp plugin and it is like that

2021-05-16 11:59:01 SMTP connection from [serverip]:47010 (TCP/IP connection count = 1)
2021-05-16 11:59:04 dovecot_login authenticator failed for (mysubdomain.mydomain.com) [serverip]:47010: 535 Incorrect authentication data (set_id=myemail)
2021-05-16 11:59:04 SMTP connection from (mysubdomain.mydomain.com) [serverip]:47010 closed by QUIT

Note that the website is trying to connect via servers ip and not localhost.
I am 100% sure that the username and password are correct.

 

[cPRex]

I would expect either the server IP or localhost to work well for that connection type.

As a test, are you able to access email through a client using the authentication details configured in the WordPress plugin?