What is __cpanel__service__auth__exim__ And where can I check/disable/authenticate it.

[martin MHC]

I am running the MSP service and this is returning to me who is sending emails on my server, one unexpected result is:

[root@basic ~]# /usr/local/cpanel/3rdparty/bin/perl <(curl -s "https://raw.githubusercontent.com/CpanelInc/tech-SSE/master/msp.pl") --auth
Checking Mail Authentication statistics...
------------------------------------------
Setting I/O priority to reduce system load: best-effort: prio 6

Emails sent via Password Authentication:
     23 __cpanel__service__auth__exim__xxniydptb664doy05ln3tvxhcsnd458s5a1_3gvfsf9lavwt_lhaoud_jnqkk5w9

This appears from only be reading recent logs and the counter of emails sent from this address is increasing. So what is this user sending details?

 

[martin MHC]

Further to the above, I have expaned the Exim log_selector to include +all and some new information in the exim_mainlog shows:

2023-01-09 17:04:32.181 [18354] no MAIL in SMTP connection from (localhost) [127.0.0.1]:37574 I=[127.0.0.1]:25 D=0.204s A=dovecot_plain:__cpanel__service__auth__exim__xxniydptb664doy05ln3tvxhcsbd458s5a1_3gvfsf9lavwt_lhaoud_jnqkk5w9 C=EHLO,AUTH,QUIT

Any ideas what this is?

 

[cPRex]

Hey hey! cpanel_service_auth_exim is the internal monitoring tool on the machine that checks to make sure Exim is accepting connections. This wouldn't be sending any real mail traffic, but just making connections to ensure things are up and running properly.

 

[martin MHC]

Hey hey! cpanel_service_auth_exim is the internal monitoring tool on the machine that checks to make sure Exim is accepting connections. This wouldn't be sending any real mail traffic, but just making connections to ensure things are up and running properly.

Ok. Thanks @cPRex . As a follow up, why does this apparently have 23 emails sent via Password auth? I will assume these are 23 "empty" emails. Perhaps this is an issue with the cPanel MSP plugin/github app?

Also checking now, this cpanel_service_auth_exim has sent 61 emails, according to the MSP tool; the number keeps increasing. Does this system send emails on accounts that appear dormant (ie no other outbound traffic) or suchlike? Should I be concerned at this increasing number of mails sent by cpanel_service_auth_exim ? Cheers

 

[cPRex]

That part I'm not sure - it might be best to make a ticket for that one.