SOLVED SMTP connections problem

Operating System & Version
centos 7
cPanel & WHM Version
96.0.4

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
Hi all,
i have a vps with whm cpanel and litespeed web server. I host wordpress websites. I use wp smtp email plugin so i can avoid sending php emails. And every now and then i get an authentication arror and i have to manually reset the connection so many emails get lost.
The error i get in the plugin is


Code:
2021-05-15 20:26:24 CLIENT -> SERVER: [credentials hidden]

2021-05-15 20:26:26 SERVER -> CLIENT: 535 Incorrect authentication data

2021-05-15 20:26:26 SMTP ERROR: Password command failed: 535 Incorrect authentication data
But i am pretty sure that the password and username is corrent since when i reset the connection it successfully.
Does anyone knows what is going on?
 
Last edited by a moderator:

kodeslogic

Well-Known Member
Apr 26, 2020
293
103
118
IN
cPanel Access Level
Root Administrator
When you see "SMTP ERROR: Password command failed: 535 Incorrect authentication data" try to login to the email account using the webmail URL before resetting the password, If the login credentials do not work in webmail as well then you will need to contact your hosting provider in case of the shared hosting account.
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
I am able to connect via webmail. Also i am able to connect in gmail smtp but i also get these errors every once in a while there too. But i am the vps admin so is there any configuration setting that is causing this issue?
 

andrew.n

Well-Known Member
Jun 9, 2020
607
171
43
EU
cPanel Access Level
Root Administrator
Do you see the same error on the server side in /var/log/maillog as well?
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
Do you see the same error on the server side in /var/log/maillog as well?
Thanks for the answers,
i am see some errors in the maillog.

Code:
master: Warning: Killed with signal 15 (by pid=9030 uid=0 code=kill) *i am not sure what this error is

imap([email protected])<mysession>: Server shutting down. in=632, out=3700, bytes=632/3700 *i am not sure what this error is

imap-login: Disconnected (auth failed, 1 attempts in 17 secs): user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured,session=mysession

*when i connect through gmail i sometimes get this error
Disconnected (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=gmail-ip, lip=myserver-ip, TLS: Connection closed, session=mysession
Disconnected (auth failed, 1 attempts in 17 secs): user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=mysession

*When i tried to send an email from wordpress i got this logs
pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=mysession
lmtp(12984): Connect from local
lmtp(12984): Disconnect from local: Client has quit the connection (state=READY)
imap-login: Login: user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=12996, secured, session=myssesion
imap(__cpanel__service__auth__imap__tyumqcpavsp2ucml)<myssesion>: Logged out in=11, out=519, bytes=11/519
*This time the smtp email from wordpress works but sometimes it doesn't and i suppose i would get an auth failed error like with gmail.
Hope this helps!
 

andrew.n

Well-Known Member
Jun 9, 2020
607
171
43
EU
cPanel Access Level
Root Administrator
Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.
I am always able to login with webmail but i do not use it. I use gmail and i have connected pop3 and smpt. I also use wp smpt email to send registration emails. So sometimes in both google and wordpress i see the auth error but as soon as i hit retry to login it is able to log-in. I have imunify360 in the server and i see no comprimised files. I have also never changed the password and i use the auto generated passwords. I have also disabled smtp restrictions in the server so see if it causes the problem. Also i have blacklistes all countries in cphulk except my country, the servers country and usa which google ip is from. Lastly i have raised the auth deamons to check if this is causing the problem. I wonder if there is a configuration error that i have made that leads to this problem.
The server is new and this happened since the beginning.
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.
So a while ago i got an error again with gmail.
Gmails error says

Code:
Sun, May 16, 2021 at 11:08 PM    Authentication error.
Server returned error "[AUTH] Authentication failed."
So i went in maillog at the same time and i see

Code:
May 16 23:08:54 "hostname" dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=gmail-ip, lip=myserver-ip, TLS: Connection closed, session=<mysession>
May 16 23:08:54 "hostname" spamd[7577]: spamd: connection from localhost [::1]:48434 to port 783, fd 5
May 16 23:08:54 "hostname" dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Connect from local
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Disconnect from local: Client has quit the connection (state=READY)
May 16 23:08:55 "hostname" dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2061, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: imap(__cpanel__service__auth__imap__tyumqcpavsp2ucml)<2061><dMPqC3jCmMB/AAAB>: Logged out in=11, out=511, bytes=11/511
These are all the logs that happend at that time.
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
Unfortunately from this log we don't see much. The server shutting down error was due to the server being rebooted probably. Can you paste a bit longer snippet? When you can't login to webmail are you able to login with your email client? Do you use strong password with upper and lowercase characters? In some cases the cPanel account could be compromised if the password is being changed multiple times so it might also be advised to change the cPanel password and use Immunify to see if there is any compromised files on the account.
Sorry for many comments but i just noticed that my servers ip is blacklisted in cphulk. Cphulk show the ip is from Cyprus although my server is located in Bulgaria. So i whitelisted Cyprus and i hope the problem is fixed!
 

andrew.n

Well-Known Member
Jun 9, 2020
607
171
43
EU
cPanel Access Level
Root Administrator
Cool, glad you were able to figure it out though it might have been due to the incorrect login attempts, anyway keep us updated.
 

andrew.n

Well-Known Member
Jun 9, 2020
607
171
43
EU
cPanel Access Level
Root Administrator
you sure the settings in gmail are correct? Try to reset your password again and reconfigure gmail with that. Also make sure the mail address and ports are correct.
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
That's definitely odd, and I don't have much to add besides what has already been said. Let us know how your future testing goes and we'll go from there.
you sure the settings in gmail are correct? Try to reset your password again and reconfigure gmail with that. Also make sure the mail address and ports are correct.
I reset the password and also changed from smtp ssl with 465 to tls 587 but still the same problem. Also gmail is receiving the error in pop3 connection so i do not think there is something wrong with ports. Sometimes gmail and wp gets the auth error but as soon as i retry to login everything works fine until it doesn't and this seems random. Is it possible to be a problem with ssl or auth deamons or something else in the configuration?
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
When the issue happens, do you see anything in /var/log/maillog? That is where the connection attempts would get logged on the server.
Yes, this is the full log that i got for a failed login attemp via gmail

Code:
May 16 23:08:54 "hostname" dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 3 secs): user=<[email protected]>, method=PLAIN, rip=gmail-ip, lip=myserver-ip, TLS: Connection closed, session=<mysession>
May 16 23:08:54 "hostname" spamd[7577]: spamd: connection from localhost [::1]:48434 to port 783, fd 5
May 16 23:08:54 "hostname" dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Connect from local
May 16 23:08:55 "hostname" dovecot: lmtp(2054): Disconnect from local: Client has quit the connection (state=READY)
May 16 23:08:55 "hostname" dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__tyumqcpavsp2ucml>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=2061, secured, session=<mysession>
May 16 23:08:55 "hostname" dovecot: imap(__cpanel__service__auth__imap__tyumqcpavsp2ucml)<2061><dMPqC3jCmMB/AAAB>: Logged out in=11, out=511, bytes=11/511
 

d4mourtzis96

Member
Mar 18, 2021
21
1
3
efpolis.com
cPanel Access Level
Website Owner
Unfortunately that doesn't really tell us much. If you're able to reliably make the login from a certain location fail, feel free to submit a ticket to our team and we can do some additional troubleshooting on our end.
Sorry last question
I went to exim_mainlog and i found the auth error of the wordpress smtp plugin and it is like that

Code:
2021-05-16 11:59:01 SMTP connection from [serverip]:47010 (TCP/IP connection count = 1)
2021-05-16 11:59:04 dovecot_login authenticator failed for (mysubdomain.mydomain.com) [serverip]:47010: 535 Incorrect authentication data (set_id=myemail)
2021-05-16 11:59:04 SMTP connection from (mysubdomain.mydomain.com) [serverip]:47010 closed by QUIT
Note that the website is trying to connect via servers ip and not localhost.
I am 100% sure that the username and password are correct.