Author: wahab Page 4 of 7

Disable/suspend email service for one domain

From version 56, cPanel provides API support to disable email service for domain or email accounts. Please note this limit cannot be override by the user from their cPanel. This can be very helpful if there is any spamming activity and you just want to disable the email service feature for the domain for the time being.

You can run the below commands through SSH console

To suspend email service for a the cPanel user “aacenyor”

whmapi1 suspend_outgoing_email user=aacenyor

For unsuspending the account, please run the below command:

whmapi1 unsuspend_outgoing_email user=aacenyor

If you are not comfortable with SSH, you can also call these through browser XML.

Example:

To suspend
https://hostname.example.com:2087/cpsess##########/xml-api/suspend_outgoing_email?api.version=1&user=aacenyor

where replace hostname.example.com with your hostname
replace cpsess########## with WHM session id.

To un suspend
https://hostname.example.com:2087/cpsess##########/xml-api/unsuspend_outgoing_email?api.version=1&user=aacenyor

For older versions cPanel, you may refer to this below forum from cPanel. There is a workaround

https://forums.cpanel.net/threads/how-do-i-block-one-domain-from-sending-email-from-my-server.223731/#post920912

Problems logging into Plesk because of IP restrictions

By wahab

On June 29, 2016

In Linux server, Plesk

Hello,

If you receive following error while logging to the Plesk panel, that means there is a IP based restriction to access Plesk admin panel and your current IP is not allowed to access.

“Unable to log into Plesk: Access for administrator from address xx.xx.xx.xx is restricted in accordance with IP Access restriction policy currently applied”

Cause
Plesk IP access policy was configured in such a way so that Plesk could not be accessed from the certain IP.

Resolution

Method 1. To enable Plesk access, you need to log into the Plesk from another IP and change the IP access policy:

Tools and Settings > Restrict Administrative Access
Add your IP to the whitelist

Method 2. Updating the database directly

If you cannot login to the panel, then you can connect to the server using SSH and correct this through database queries. Plesk database records regarding the access policy need to be corrected.

To retrieve the current policy and the restricted/allowed IPs, the following commands can be used:

Linux

#MYSQL_PWD=`cat /etc/psa/.psa.shadow` mysql -u admin psa
    mysql> select * from cp_access;
    mysql> select * from misc where param='access_policy';

Windows

"%plesk_bin%\dbclient" --direct-sql --sql="select * from cp_access"
    "%plesk_bin%\dbclient" --direct-sql --sql="select * from misc where param='access_policy'";

If you wish to clear the access policy settings, remove all records from “cp_access” and set the policy to “allow”:

Linux

# MYSQL_PWD=`cat /etc/psa/.psa.shadow` mysql -u admin psa
    mysql> delete from cp_access;
    mysql> update misc set val="allow" where param='access_policy';

Windows

"%plesk_bin%\dbclient" --direct-sql --sql="delete from cp_access";
    "%plesk_bin%\dbclient" --direct-sql --sql="update misc set val='allow' where param='access_policy'";

To whitelist the IP manually

bash# mysql -uadmin -p`cat /etc/psa/.psa.shadow ` psa

insert into cp_access values ("", "deny", "x.x.x.", "255.255.255.255"); //change the IP address to your public IP.

Then you should be able to connect to the Plesk control panel from the new IP address.

Email sending limits and throttling – iRedmail free edition

By wahab

On June 29, 2016

In iRedmail Mailserver

iRedMail is:
1. A ZERO COST, fully fledged, full-featured mail server solution. All components are free and open source software
2. It support unlimited domains and email accounts.
2. SpamAssassin, ClamAV, SPF, DKIM, greylisting, whitelisting, blacklisting.
3. Stores mail accounts in your favorite backend: OpenLDAP, MySQL, MariaDB, PostgreSQL.
4. Supports major Linux distros

Throttling

iRedmail supports following level of throttling for email limits.
Global, per-domain and per-user throttling based on: max size of single message, number of max inbound/outbound messages per time unit.

iRedmail uses a component named iredpad for this. With iRedmail Pro version, you can configure these settings through GUI(iRedadmin panel). However they are not available through GUI for free version. The feature is enabled though we will have to modify them through database directly.

So the database is “iredapd” and table is “throttle”.

Here are some examples

1. Allow user `user@domain.com` to send 50 mails in 5 minutes (period=300):

INSERT INTO throttle (account, kind, priority, period, msg_size, max_msgs, max_quota) VALUES (‘user@domain.com’,’outbound’,100,300,0,50,0);

2. Set global limit of 500 mails per day and a maximum single mail size of 55MB

INSERT INTO throttle (account, kind, priority, period, msg_size, max_msgs, max_quota) VALUES (‘@.’,’outbound’,0,86400,57671680,500,0);

57671680 bytes = 55MB
86400 – 1 Day

# Technical details of throttle plugin
# ————-
#
# Currently you may throttle based on:
#
# – amount of mails sent over a given period of time
# – accumulated mail size sent over a given period of time
# – size of singe message
#
# Eg: You can enforce that user@domain.com does not send more than 1000 mails
# or 1GB of mail (whichever limit is hit first) in 5 minute.
#
# Possible throttling address:
#
# *) Full email address: user@domain.com
# *) Domain name (with a prefixed ‘@’): @domain.com
# *) Sub-domain name (with a prefixed ‘@.’): @.domain.com
# *) IP address: 192.168.1.1
# *) IP network: 192.168.1.*
# *) Catch-all for email address: ‘@.’ (note, the dot is required)
# *) Catch-all for IP address: ‘@ip’
#
# Priorities of different thorttle address (larger digital number has higher priority):
#
# *) email: 100 # e.g. ‘user@domain.com’. Highest priority
# *) wildcard_addr: 90 # e.g. `user@*`. used in plugin `amavisd_wblist`
# # as wildcard sender. e.g. ‘user@*`
# *) ip: 80 # e.g. 173.254.22.21
# *) wildcard_ip: 70 # e.g. 173.254.22.*
# *) cidr: 70 # e.g. 173.254.22.0/24
# *) domain: 60 # e.g. @domain.com
# *) subdomain: 50 # e.g. @.domain.com
# *) top_level_domain: 40 # e.g. @com, @org
# *) catchall: 0 # ‘@.’. Lowest priority

Please note that priority for global setting is 0 and priority of a single user is 100.

SOGo ActiveSync not working – iRedmail

By wahab

On June 28, 2016

In iRedmail Mailserver

iRedMail is:
1. A ZERO COST, fully fledged, full-featured mail server solution. All components are free and open source software
2. It support unlimited domains and email accounts.
2. SpamAssassin, ClamAV, SPF, DKIM, greylisting, whitelisting, blacklisting.
3. Stores mail accounts in your favourte backend: OpenLDAP, MySQL, MariaDB, PostgreSQL.
4. Supports major Linux distros

You know how difficult is to configure a fully fledged email service you have tried. iRedmail do this heavy part for you. I would recommend this piece of software to everyone. I used to configure email server manually using Postfix, Postfixadmin, MySQL, SpamAssassin, etc. Even though I have done this several times, it needs 2-3 hours for setup. But iRedmail can do all of this and MORE in few minutes, thus saves lot of time.

iRedmail comes with SOGo which provides EAS Activesync support

SOGo is providing the EAS support. If you are getting an error “Unable to connect” on email client do following

1. Check https://hostname/Microsoft-Server-ActiveSync

if it gives 404, issue with SOGo httpd conf
If it gives white page, no problem with conf

SOGo installs Apache config file /etc/httpd/conf.d/SOGo.conf by default, please open it and find below lines:

#ProxyPass /Microsoft-Server-ActiveSync \
# http://127.0.0.1:20000/SOGo/Microsoft-Server-ActiveSync \
# retry=60 connectiontimeout=5 timeout=360

Remove # at the beginning to enable ActiveSync support:
ProxyPass /Microsoft-Server-ActiveSync \
http://127.0.0.1:20000/SOGo/Microsoft-Server-ActiveSync \
retry=60 connectiontimeout=5 timeout=360

Find string yourhostname in the same file, replace all yourhostname by your FQDN server hostname. (Tip: you can get your FQDN hostname with command hostname -f.)

Restart Apache

Disable greylisting completely – iRedmail

By wahab

On June 28, 2016

In iRedmail Mailserver

iRedMail is:
1. A ZERO COST, fully fledged, full-featured mail server solution. All components are free and open source software
2. It support unlimited domains and email accounts.
2. SpamAssassin, ClamAV, SPF, DKIM, greylisting, whitelisting, blacklisting.
3. Stores mail accounts in your favourte backend: OpenLDAP, MySQL, MariaDB, PostgreSQL.
4. Supports major Linux distros

How to disable greylisting completely

Greylisting is a method of defending e-mail users against spam. A mail transfer agent (MTA) using greylisting will “temporarily reject” any email from a sender it does not recognize

To disable greylisting completely, please remove plugin name greylisting in iRedAPD config file
/opt/iredapd/settings.py, parameter plugins =:
plugins = […, ‘greylisting’, …]

Restarting iRedAPD service is required.

Reject outgoing Spam – iRedmail server

By wahab

On June 28, 2016

In iRedmail Mailserver

iRedMail is:
1. A ZERO COST, fully fledged, full-featured mail server solution. All components are free and open source software
2. It support unlimited domains and email accounts.
2. SpamAssassin, ClamAV, SPF, DKIM, greylisting, whitelisting, blacklisting.
3. Stores mail accounts in your favourte backend: OpenLDAP, MySQL, MariaDB, PostgreSQL.
4. Supports major Linux distros

Reject outgoing Spam

iRedmail comes with Amavis, Spamassasin and Clamd. By default iRedmail will not block Outgoing spam message. However you can tweak Amavis configurations to reject such mails.

/etc/amavisd/amavisd.conf

Add following to $policy_bank{‘ORIGINATING’}

final_virus_destiny => D_DISCARD,
final_banned_destiny => D_REJECT,
final_spam_destiny => D_REJECT,
final_bad_header_destiny => D_REJECT,

Then restart amavis /etc/init.d/amavisd restart

This will reject all outgoing spam mails above the score

Of course tweak the spam score accordingly.

URL Monitoring With Nagios

By wahab

On November 18, 2015

In Linux server, Nagios

Capabilities

Nagios provides complete URL monitoring of HTTP and HTTPS servers and protocols as well as full URL transaction monitoring.

Benefits

Implementing effective URL monitoring with Nagios offers the following benefits:
* Increased server, services, and application availability
* Fast detection of network outages and protocol failures
* Monitor user experience when accessing URLs
* Web server performance monitoring
* Web transaction monitoring
* URL monitoring

URL monitoring

By using the ‘check_http’ nagios command, we can monitor a specific url rather than checking the Apache service is up or not. This method is helpful to identify if the website is hacked and url is injected with malicious codes or there is some Apache or php errors and page is throwing an error instead. The normal Apache service check will return successful results in the above case.
We can check for a specific keyword string on the webpage. If that string not present, an error will be returned.

Here is an real example

define service{
    use                            urlmonitoring-service
    host_name                      server.linuxwebhostingsupport.in
    service_description            url_check
    check_command                  check_http!-H linuxwebhostingsupport.in -t 30 -R "Cpanel and WHM" -f follow
}

The above will check for the keyword “Cpanel and WHM” on the page “linuxwebhostingsupport.in”. If the keyword is missing or the page is not responding nagios will retun and error.

URL monitoring +SSL

You can refer to below example if the web page has SSL/TLS enabled.

define service{
    use                            urlmonitoring-service
    host_name                      server.linuxwebhostingsupport.in
    service_description            url_check
    check_command                  check_http!-H linuxwebhostingsupport.in -t 30 -R "Cpanel and WHM" -f follow --ssl
}

Here we added the option “–ssl” to the check command

URL monitoring on ht password protected page

Normal method will not work as we need to validate ht password protection first to see the page. You can use the following example for such pages.

define service{
    use                            urlmonitoring-service
    host_name                      server.linuxwebhostingsupport.in
    service_description            url_check_protected
    check_command                  check_http!-H linuxwebhostingsupport.in -a user:password -t 30 -R "Cpanel and WHM" -f follow --ssl 
}

Replace the username and password appropriately.

FTP connectivity problem:: No route to host

By wahab

On October 6, 2015

In Cpanel and WHM, Linux server, Plesk

FTP connectivity problem

If you are getting following error while FTP directory listing, follow the solution provided below

———-
ftp> ls
227 Entering Passive Mode (108,61,169,245,167,161).
ftp: connect: No route to host
———-

Solution

Edit /etc/sysconfig/iptables-config and add this line:

IPTABLES_MODULES=”ip_conntrack_ftp”

Save it and restart iptables.
That’s because passive mode use non standard ports to communicate, so you need to keep trak of the ftp connections and iptables will allow them when necessary.

However, you will need to do this every time you reboot your RedHat server. Thus as a more permanent solution you can persistently load this module after each reboot by creating executable shell script within /etc/sysconfig/modules/ directory. Create file /etc/sysconfig/modules/iptables.modules with the following content:

#!/bin/sh exec /sbin/modprobe ip_conntrack_ftp >/dev/null 2>&1

Once you save this file you also need to make it executable:
# chmod +x /etc/sysconfig/modules/iptables.modules

Another solution is specify the passive ports that will be used on FTP server configuration, then open those specific ports on firewall.

Plesk update error/autoinstaller error

By wahab

On October 6, 2015

In Linux server, Plesk

If you are getting the below error while updating the Plesk versions or installing the microupdates

—-
ERROR: Unable to download the MD5 sum for the new Parallels Installer binary.
Not all packages were installed.
Please, contact product technical support.
—-

Solution
—–
Remove cache from /var/cache/parallels_installer/ and start autoinstaller again.
/usr/local/psa/admin/sbin/autoinstaller –select-product-id plesk –select-release-current –reinstall-patch –install-component base
—–

CSR generation for UCC certificates

By wahab

On August 15, 2015

In Cpanel and WHM, Linux server, Plesk

Unified Communications (UC) Certificates (also called SAN Certificates) use Subject Alternative Names o secure multiple sites (e.g. fully qualified domain names) with one certificate. Four SANs are included in the base price of the UC Certificate, but you can purchase additional names at any time during the lifetime of the certificate.

With a UC Certificate, you can secure:

www.linuxwebhostingsupport.in
www.example2.com
www.example3.net
mail.example.net
dev.example2.com

The CSR generation process is little different for creating an UCC certificates. We will have to create a Openssl based configuration file and then create private key and CSR from it.

Step 1: Create a custom OpenSSL Conf file.

The following is an example conf file that can be used for creation of a SAN/UCC cert. Save it as multissl.conf

———–
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
req_extensions = req_ext # The extentions to add to the self signed cert

[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Iowa
localityName = Locality Name (eg, city)
localityName_default = Iowa City
organizationName = Organization Name (eg, company)
organizationName_default = The University of Iowa
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Domain Control Validated
commonName = Common Name (eg, YOUR SSL domain name)
commonName_max = 64

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1 = www.linuxwebhostingsupport.in
DNS.2 = www.example1.com
DNS.3 = example2.com
———–

Notes:

The alt_names section (DNS.1, DNS.2, ….) are the list of all other domain names you wish to secure with this cert. Additional can be added such as DNS.4, etc.
The following examples assume that you name the above config file file multissl.conf (if it is named differently you must adjust the filename in the below examples accordingly.
Step 2: Generate the Private key and CSR with OpenSSL

Execute the following OpenSSL command

$ openssl req -nodes -newkey rsa:2048 -keyout serverfqdn.key -out multidomain.csr -config multissl.conf

* Replace “serverfqdn” with the fully qualified domain name of the server (ie: sample.server.uiowa.edu). Note: it may also be helpful to add a year to the filename.

You will then see output and be prompted for configuration as seen in the following example. Enter your details accordingly.

——————————————
$ openssl req -nodes -newkey rsa:2048 -keyout serverfqdn.key -out multidomain.csr -config multissl.conf
Generating a 2048 bit RSA private key
………………………………….+++
…………………………………………………………+++
writing new private key to ‘serverfqdn.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [US]:US
State or Province Name (full name) [Iowa]:Iowa
Locality Name (eg, city) [Iowa City]:Iowa City
Organization Name (eg, company) [The University of Iowa]:My Company name
Organizational Unit Name (eg, section) [Domain Control Validated]:IT SUPPORT
Common Name (eg, YOUR SSL domain name) []:www.linuxwebhostingsupport.in
——————————————

Note: Replace www.linuxwebhostingsupport.in with the “primary” domain name you want secured with this certificate (likely, but not necessarily the hostname of the machine).

At this point you should have the new key file, and CSR. Save the key file in a secure place, it will be needed to apply the new certificate. The CSR can now be submitted to request the SSL Cert.

Empowering you with the knowledge to master Linux web hosting, DevOps and Cloud

Author: wahab Page 4 of 7

Disable/suspend email service for one domain – cPanel

Problems logging into Plesk because of IP restrictions

Email sending limits and throttling – iRedmail free edition

SOGo ActiveSync not working – iRedmail

Disable greylisting completely – iRedmail

Reject outgoing Spam – iRedmail server

URL Monitoring With Nagios

FTP connectivity problem:: No route to host

Plesk update error/autoinstaller error

CSR generation for UCC certificates