Notify me when: Someone logs in to my account (Doesn't work)

[Amiga500]

In Webmail under "Contact Preferences", the feature:

Notify me when: "Someone logs in to my account", or "Send login notifications, even when the user logs in from an IP address range or netblock that contains an IP address from which a user successfully logged in previously", doesn't work.

No email notification is sent to the primary or secondary contact addresses I have configured under "Contact Information".

I did a search but didn't see this issue mentioned.

 

[quietFinn]

In here:

Edit Your Settings in Webmail | cPanel & WHM Documentation

This section in the Webmail interface has features that edit your settings.

docs.cpanel.net

it says:

• In order to use this setting, your hosting provider must enable cPHulk.
• The system only sends a single notice in each 24-hour window for a specific username, service, and IP address combination.

 

[cPRex]

Thanks, @quietFinn!

 

[Amiga500]

Hi, a little follow up.... Since we weren't receiving these login notifications I just assumed as mentioned above that cPHulk was not enabled. But all of a sudden a couple of days ago I started receiving login notifications. It seemed to start some time after we were upgraded to cPanel 110.0.13. I checked in our WHM and cPHulk is enabled. I'm not aware of anyone making any changes to our system. I can't tell you whether it was disabled previously or not. I'm sure there is a log file somewhere I could look at but.... I was just curious if this was an issue with previous versions of cPanel (110.0.11 and earlier) and was fixed with 110.0.13? In either case, it seems to be working now and cPHulk is enabled.

 

[cPRex]

The only case I see about notifications in the 110 changelog is CPANEL-42338, and that was an issue with relative URLs for our update notifications, so I don't see anything that would cause this issue to get fixed. I'm happy to take the credit, though, if you're okay with that!

 

[ITHKBO]

Are the primary and secondary contacts hosted on the same server? it might be a simple case of a false positive in an spamfilter.
We had it ourselves before especially with lfd related notifications due to spamassasin rule KAM_MXURI ( URI begins with a mail exchange prefix,)

Did you check the logs if the message actually was send or only if a message was received at the primary and secondary contact?

 

[Amiga500]

The only case I see about notifications in the 110 changelog is CPANEL-42338, and that was an issue with relative URLs for our update notifications, so I don't see anything that would cause this issue to get fixed. I'm happy to take the credit, though, if you're okay with that!

I'll give you credit for this one.

 

[Amiga500]

Are the primary and secondary contacts hosted on the same server? it might be a simple case of a false positive in an spamfilter.
We had it ourselves before especially with lfd related notifications due to spamassasin rule KAM_MXURI ( URI begins with a mail exchange prefix,)

Did you check the logs if the message actually was send or only if a message was received at the primary and secondary contact?

The secondary contact address is on a different server. I'm not sure which logs to check?

 

[Amiga500]

Someone above mentioned "The system only sends a single notice in each 24-hour window for a specific username, service, and IP address combination. " So, does that mean if a message hasn't been sent in 24 hours, that the next time I log in I will receive the notification immediately and if I log in a second time shortly after I wont receive a notification at all or the second log in notification wont come in for 24 hours? Because I just logged in and almost immediately I received the log in notification. Other times it seems to take hours. Or the next day I will have multiple log in notifications in my Inbox. Doesn't seem very secure if you only receive one message in a 24 hour period. How can that be secure if you aren't notified that possibly someone unauthorized logs into your webmail after you had logged in? That's a 24 hour period a hacker or whoever can mess with your email account until you are notified and can change your password. I'm just trying to figure out how this system works so I can better document it for our customers so they know what to expect. Thank you.

 

[Amiga500]

And just for your info.... I have a second test account on this system which I have "Notify me when: Someone logs in to my account", and "Send login notifications, even when the user logs in from an IP address range or netblock that contains an IP address from which a user successfully logged in previously", checked yet I haven't received any email login notifications for this account that I'm aware of. When I logged into that account yesterday and this morning I did not immediately receive a login notification. Yet my main test account which I log into daily received a login notification almost immediately after I logged into it this morning.

I'd just like to know how this process/feature is supposed to work so I can verify whether or not things on my end are working as designed or if there is some sort of issue going on.

 

[cPRex]

Even with the secondary contact address on a different server you would still see the notifications leaving your machine through the normal Exim logs.

You are also correct on the timeline. For a busy system, those notifications could quickly bombard the user with a lot of useless emails.

If you'd like an option to change that, how about a feature request to toggle that 24 hour option, or something similar? That way, people that WANT to see more emails would have the option.

 

[Amiga500]

I just did some checking and I have not received any login notification emails for my second test email account. My main test account receives these notifications to my Roundcube Inbox and to my secondary email account Inbox. Yet for my second test account I receive nothing at either address.

It just seems strange that some emails come immediately and others I guess take 24 hours? So, if I were to log in and out multiple times, let's say 10 times in a row, would I receive 10 notifications the next day (24 hours later)?

Anyway, you mentioned " If you'd like an option to change that, how about a feature request to toggle that 24 hour option, or something similar? That way, people that WANT to see more emails would have the option. " Yes I would like to submit a feature request to be able to toggle the 24 hour option or something similar.

Also, if someone doesn't like receiving emails every time they log in they can just uncheck " Send login notifications, even when the user logs in from an IP address range or netblock that contains an IP address from which a user successfully logged in previously", and only receive notifications when someone outside their IP Range tries to log in like a hacker. But again, if you already received a notification for yourself logging in and then have to wait 24 hours to be notified when someone else tries to log into your account, that doesn't make sense. So yes, let's submit a feature request.

 

[Amiga500]

Just trying to understand how this feature should work.

If you only check "Someone logs in to my account." you should only receive one login notification from each different location. And any additional successful logins from those same locations whether during the same 24 hour period or not, you will not receive any additional login notifications, unless the login comes from a new location. If that is true, then that makes sense.

But if you check "Send login notifications, even when the user logs in from an IP address range or netblock that contains an IP address from which a user successfully logged in previously," then you should continue receiving login notifications from the same location but only 1 per 24 hour period. This would appear to prevent receiving multiple login notifications every time you log into your own account during a 24 hour period. Okay, that makes sense. Although it might be nice to know if someone is logging into your account multiple times during a 24 hour period for security reasons, hence the feature request....

What doesn't make sense to me is if I log into my account multiple times per day, I may get one notification (or maybe not) but then the next day I open my mail client and there's multiple login notifications sitting in my Inbox. Shouldn't you only get one notification per 24 hour period no matter how many times you've logged in during that 24 hour period?

Then there's the issue of my second test email account where I get no notifications at all. This second test email account is on the same domain as my first test email account. Not that this should matter.

I was looking at the Mail Delivery Reports and I see the login notifications for my main test account (multiple notifications in one day) but nothing for my second test account.

 

[Amiga500]

FYI.. I finally just received a login notification from my second test email account. Not sure if this is from one of yesterday's logins or one from earlier this morning. Definitely delayed. Again we don't have a lot of customers on our server yet. So, the server shouldn't be that busy. And it's not our Barracuda being slow (my secondary contact email address filters through the Barracuda) because I still hadn't received the notification in my Roundcube Inbox. And I had checked the Barracuda and it was not backlogged. 3 second latency right now.

 

[cPRex]

It sounds like this one might be time for a ticket. We can do our testing, and then we can always create the feature request for you after everything has been confirmed and clarified.

 

[Amiga500]

Not sure if this has any meaning, but in looking at the different Notification Emails the "SERVICE" shown is either "dovecot" or "webmaild". What's the difference and why are there two different services processing these notifications?

 

[cPRex]

Can you let me know specifically where you're seeing this, as possibly provide a screenshot? But in general, dovecot is the IMAP server, while webmaild is the actual webmail service.

 

[Amiga500]

Also, in regards to our conversation above about supposedly only receiving one login notification in a 24 hour period which some times you may receive an immediate notification the first time you log in during a 24 hour period but other times not. The notifications come delayed. Maybe not until the next day. Yet, if you are only supposed to get one notification per 24 hour period, then I should only get one, and the next 24 hour period no matter how many times I log in I should only get one login notification. That's how I am assuming this process should work but it doesn't. I get multiple login notifications but they usually all show up the next day. You mentioned there could be a support ticket here... So, just to let you know, I haven't logged in since Thursday when we last discussed this issue, but I did log in multiple times on Thursday to both of my test accounts. Friday I received 8 login notifications. Saturday 2, Sunday 3, and 1 today. That doesn't make a lot of sense to me.

 

[Amiga500]

 

[Amiga500]

So, the last time I logged into my test accounts was last Thursday. Well, I might have logged in once yesterday. Anyway, as of yesterday afternoon I received 9 more login notifications and one more his morning. I did log into my test accounts multiple times last Thursday. Should I be receiving more than one notification in a 24 hour period no matter how many times I logged in? I do have the box checked to receive notifications even if the login comes from the same location. But, even then, should there only be one notification per 24 hour period? Sounds like not. But either way, should I still be receiving login notifications 4-5 days later?