diff --git a/modules/cyrusauth.cpp b/modules/cyrusauth.cpp
index 4d25cdca..5e7830a0 100644
--- a/modules/cyrusauth.cpp
+++ b/modules/cyrusauth.cpp
@@ -128,21 +128,22 @@ public:
 					}
 
 					if (pUser && !pUser->Clone(*pBaseUser, sErr)) {
-						DEBUG("saslauth: Clone User [" << CloneUser() << "] " << sErr);
+						DEBUG("saslauth: Clone User [" << CloneUser() << "] failed: " << sErr);
 						delete pUser;
 						pUser = NULL;
 					}
 				}
 
+				if (pUser) {
+					// "::" is an invalid MD5 hash, so user won't be able to login by usual method
+					pUser->SetPass("::", CUser::HASH_MD5, "::");
+				}
+
 				if (pUser && !CZNC::Get().AddUser(pUser, sErr)) {
 					DEBUG("saslauth: Add user [" << sUsername << "] failed: " << sErr);
 					delete pUser;
 					pUser = NULL;
 				}
-
-				if (pUser) {
-					pUser->SetPass("::", CUser::HASH_MD5, "::");
-				}
 			}
 
 			if (pUser) {