What is __cpanel__service__auth__exim__ And where can I check/disable/authenticate it.

Operating System & Version
CentOS 7.9
cPanel & WHM Version
102.0.25

martin MHC

Well-Known Member
Sep 14, 2016
326
72
78
UK
cPanel Access Level
Root Administrator
I am running the MSP service and this is returning to me who is sending emails on my server, one unexpected result is:

Code:
[[email protected] ~]# /usr/local/cpanel/3rdparty/bin/perl <(curl -s "https://raw.githubusercontent.com/CpanelInc/tech-SSE/master/msp.pl") --auth
Checking Mail Authentication statistics...
------------------------------------------
Setting I/O priority to reduce system load: best-effort: prio 6

Emails sent via Password Authentication:
     23 __cpanel__service__auth__exim__xxniydptb664doy05ln3tvxhcsnd458s5a1_3gvfsf9lavwt_lhaoud_jnqkk5w9
This appears from only be reading recent logs and the counter of emails sent from this address is increasing. So what is this user sending details?
 

martin MHC

Well-Known Member
Sep 14, 2016
326
72
78
UK
cPanel Access Level
Root Administrator
Further to the above, I have expaned the Exim log_selector to include +all and some new information in the exim_mainlog shows:

2023-01-09 17:04:32.181 [18354] no MAIL in SMTP connection from (localhost) [127.0.0.1]:37574 I=[127.0.0.1]:25 D=0.204s A=dovecot_plain:__cpanel__service__auth__exim__xxniydptb664doy05ln3tvxhcsbd458s5a1_3gvfsf9lavwt_lhaoud_jnqkk5w9 C=EHLO,AUTH,QUIT

Any ideas what this is?
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
14,241
2,217
363
cPanel Access Level
Root Administrator
Hey hey! cpanel_service_auth_exim is the internal monitoring tool on the machine that checks to make sure Exim is accepting connections. This wouldn't be sending any real mail traffic, but just making connections to ensure things are up and running properly.
 
  • Like
Reactions: martin MHC

martin MHC

Well-Known Member
Sep 14, 2016
326
72
78
UK
cPanel Access Level
Root Administrator
Hey hey! cpanel_service_auth_exim is the internal monitoring tool on the machine that checks to make sure Exim is accepting connections. This wouldn't be sending any real mail traffic, but just making connections to ensure things are up and running properly.
Ok. Thanks @cPRex . As a follow up, why does this apparently have 23 emails sent via Password auth? I will assume these are 23 "empty" emails. Perhaps this is an issue with the cPanel MSP plugin/github app?

Also checking now, this cpanel_service_auth_exim has sent 61 emails, according to the MSP tool; the number keeps increasing. Does this system send emails on accounts that appear dormant (ie no other outbound traffic) or suchlike? Should I be concerned at this increasing number of mails sent by cpanel_service_auth_exim ? Cheers