Cpanel/Exim ‘535 Incorrect authentication data’ when sending mail

So this issue has been plaguing some customers ever since I started migrating sites from older Ensim boxes to new Cpanel servers. It seems 50% of the email users (or more, haven’t heard from everyone yet) is getting authentication errors on their outbound mail – even in Webmail. So the first solution I’ve been telling people for the past few weeks is to remove then re-add the email account in Cpanel. It works…but it’s like using an axe instead of a scalpel. For those who rely solely on webmail, this cannot be done as all their email would be lost.

So I happened along this thread.

The problem ended up being the permissions of everyone’s /home/<user>/etc/<domain>/shadow files. For some reason the Ensim migration script leaves them as 0600 when they need to be 0640. This single command fixed all 300+ domains in one fell swoop:

chmod 640 /home/*/etc/*/shadow

So rather than use a single axe, I took 300+ scalpels at once the problem.