cPanel, Exim, General

Implementing comodo mod security rules in cPanel server

Use the below steps to setup and configure Comodo Web Application Firewall

1)Login the Admin Console on below URL using the login credentials to get the latest installer .Create a new account there if you don’t have it. Access the below URL using the newly created credentials.

https://waf.comodo.com

Copy the link address ‘Download latest installer’ link at the top right of the page.

Download the file to the server and install it

cd /usr/src

wget https://waf.comodo.com/cpanel/cwaf_client_install.sh

sh cwaf_client_install.sh
4) An installation screen will be displayed and you should select “OK” for the remaining steps.

ENTER CWAF LOGIN :
password :

Give the already create login credentials on the above step
Now, Login to the server WHM, navigate to COMODO WAF option
Click yes for the popup “Do you want to download latest COMODO Rules and run Protection Wizard?” to download the latest rules.

Thats All.

A new include file will be now added in /usr/local/apache/conf/modsec2.conf

root@server [/usr/src]# grep cwaf.conf /usr/local/apache/conf/modsec2.conf
Include “/var/cpanel/cwaf/etc/cwaf.conf”

Below Rules are included in /var/cpanel/cwaf/etc/cwaf.conf
Include /var/cpanel/cwaf/etc/httpd/domains/*.conf
Include /var/cpanel/cwaf/rules/*.conf
Include /var/cpanel/cwaf/etc/httpd/global/*.conf
Include /var/cpanel/cwaf/etc/httpd/custom_user.conf
You can see the rules in
root@server [/var/cpanel/cwaf/rules]# ls

./ bl_input cwaf_01.conf cwaf_05.conf LICENSE.txt userdata_login_pages@
../ bl_output cwaf_02.conf cwaf_06.conf rules.dat userdata_wl_agents@
bl_agents bl_scanners cwaf_03.conf cwaf_07.conf scheme.yml userdata_wl_domains@
bl_domains categories.conf cwaf_04.conf exclude.yml userdata_bl_agents@ userdata_wl_methods@

=====<>=====

Standard
cPanel, Exim, General, Linux

Server Error: STATUS: Internal error occurred Refer to server log for more information.

if you are seeing this error on Roundcube, your mail folder ownerships are messed up.

Don’t worry,do the below steps as root via SSH.

If the email account is info@domain.com

check the username of the domain and access the directory

/home/username/mail/domain.com

chnage all the ownership of the directories recursively using the below step. (info is the folder of mail account)

chown -R user. info

chown user.mail maildirsize

Standard
cPanel, Exim, General, Linux

Rebuild /etc/localdomains and /etc/remotedomains in cPanel server

There may be some cases where you can see email issues since the domain is added in incorrect group.

/etc/localdomains-list all the domains which have local MX ie,mails are going through the server
/etc/remotedomains-domains that are having remote mail servers, even if the website point to the server.

If a domain which having a local MX reside on remotedomains, the mails will not be sent/recieved since exim doesn’t know how to handle the mails for this domain. In this case you can use the below command and execute it on the server via SSH as root. This will check the zone files of all the domains and assign them to localdomains and remotedomains.

/scripts/checkalldomainsmxs –yes

Thats all 🙂

Standard
cPanel, Exim, Linux

Database error: connection failed in roundcube

Fix is to drop the existing roundcube database and do a roundcube force update.

Take the backup of existing database before proceeding.

root@server[~]$ mysqldump roundcube > /path/to/backup.sql

#mysql

DROP database roundcube;

root@server[~]$ /usr/local/cpanel/bin/update-roundcube –force

Standard
cPanel, Exim, Linux

Steps to troubleshoot email issues.

Basic Email Troubleshooting

1) Take a Look at Email Limits

Trying to send bulk emails or to a mailing list . Check for the limits before sending emails

Outgoing Email Limitations on our servers

we have set a limit of 200 outgoing emails per hour on shared and reseller hosting, 500 outgoing emails per hour on VPS Hosting, 1000 outgoing emails per hour on Semi Dedicated Hosting and 3600 outgoing emails per hour on Dedicated Hosting to avoid any sort of email spamming from our servers. Customers cannot send more than the specified number of emails in an hour irrespective of the size of their mailing lists.

Also you can only send up to 2MB via webmail. If you use an email client you can send emails up to 10MB in size.

2) Is your email service enabled?

If you wish to use email with your domain it must be enabled. Check from the control panel under “Mail” option of selected domain, if the email user and the email is enabled.

3) Check out for your Mailbox Quotas

If you are out of Mailbox space , emails may begin to bounce back to the sender. Other things that can occur is webmail will stop working, or you can no longer receive emails. This may be a result of your entire service or email user reaching a disk quota.
So check if Mailbox has reached its limits and clean up some space for new emails.

4) Watch out for Mail Protect and Spam Settings:

If you are not able to receive email you may check your spam folder.
Try to disabling Spam filter.

5) Is your Mail server accessible ?

Open Command prompt and type

Ping mail.yourdomain.com

Check if you get the following response

================================================== =
Pinging mail.yourdomain.com {mail IP/server IP] with 32 bytes of data:
Reply from email_server_ip: bytes=32 time=148ms TTL=120
Reply from email_server_ip: bytes=32 time=143ms TTL=120
Reply from email_server_ip: bytes=32 time=148ms TTL=120
Reply from email_server_ip: bytes=32 time=148ms TTL=120

Ping statistics for email_server_ip:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 143ms, Maximum = 148ms, Average = 146ms
================================================== ==
This means that your email server is accessible .

If you get any error response, it means that the email server is inaccessible , check if firewall is enabled locally or check out for any ISP issue.

6) Take a look at DNS settings (MX records):

Check if your Mail records (MX records) for domain are correctly pointing to your email server ip. You would have received email server details in your welcome email.

Here are some tools you can use to check your DNS and MX records.

* intoDNS: checks DNS and mail servers health
* MX Lookup Tool – Check your DNS MX Records online – MxToolbox
* Traceroute, Ping, Domain Name Server (DNS) Lookup, WHOIS
* DNSstuff

7) Try Sending/Receiving from Webmail:

If you checked your email settings and mail is enabled, you may try sending and receiving emails from webmail. You can use either of the following URLs to access webmail:

If you have no issues sending or receiving in webmail, but still can’t send from your email client, you may need to go back and double-check your email client settings.

8 ) Check Email Client Settings:

The email client being incorrectly configured has a major role in email issues. You will need to double-check that your settings are correct.

Check your

* Incoming and outgoing email server — use mail.domain.com or email server ip
* Check for username and Password
* Check for ports Incoming (POP) – 110 and Outgoing (SMTP) – 25 / 587

Also Make sure that ‘My outgoing server (SMTP) requires authentication’ is selected.
To check this Follow the steps :-

1. In the Tools menu, select Options then Mail Setup. Under ‘Email Accounts,’ click E-mail Accounts.

2. Select an account, and click Change above the list of accounts. Click More Settings, then the Outgoing Server tab.

3. here you will find this option My outgoing server (SMTP) requires authentication’ .The radio button ‘Use same settings as my incoming mail server’ should also be selected.

4. Click OK

9) Search for error code and Bounce back message

If you are trying to send emails and are receiving Bounce back messages, you can copy that bounce back code and Make an internet search,
You will find many resolutions for it.

Some codes and its description are as follow’s

Code Meaning
200 – (nonstandard success response, see rfc876)
211 – System status, or system help reply
214 – Help message
220 – Service ready

221 – Service closing transmission channel

250 – Requested mail action okay, completed

251 – User not local; will forward to

354 – Start mail input; end with .

421 – Service not available, closing transmission channel

450 – Requested mail action not taken: mailbox unavailable

451 – Requested action aborted: local error in processing

452 – Requested action not taken: insufficient system storage

500 – Syntax error, command unrecognized

501 – Syntax error in parameters or arguments

502 – Command not implemented

503 – Bad sequence of commands

504 – Command parameter not implemented

521 – does not accept mail (see rfc1846)

530 – Access denied (Sendmail-specific)

535 – SMTP Authentication unsuccessful/Bad username or password on your account

550 – Requested action not taken: mailbox unavailable

551 – User not local; please try

552 – Requested mail action aborted: exceeded storage allocation

553 – Requested action not taken: mailbox name not allowed

554 – Transaction failed

Standard
cPanel, Exim, Linux

Changing Exim Default Sending IP or use spefic IPs for each domain

cPanel has a file named /etc/mailips that can be used to change mail routing either per-domain or for the entire server.

=====
*: 1.2.3.4
======
Will route all mail through 1.2.3.4.

======
domain.com: 1.2.3.5
*: 1.2.3.4
======
Will route domain.com’s mail through 1.2.3.5 while the rest go through 1.2.3.4.

There is also a setting in the Exim Configuration Editor in WHM that you can enable to send all mail for websites with dedicated IPs through their dedicated IP. This activates a separate section in /etc/exim.conf and will not modify the /etc/mailips file. This setting is labeled “Send mail from account’s dedicated IP.”

Standard
cPanel, Exim

Understanding Courier IMAP and Maildir

Directory Structure
A user’s email is store in ”’/home/user/mail///…”’. Below is a sample directory structure of an email account:

/home/username/mail (mail folder)
/domain.com (domain)
admin (email user)
maildirsize (quota/usage summary, expendable)
cur (default inbox for read email)
new (default email for unread email)
Drafts ( sample folder )
– cur (read email)
– new (unread email)
/home/username/etc
/domain.com (domain)
passwd (contains email account list and UIDs, similar to /etc/passwd)
shadow (contains email passwords, similar to /etc/shadow)
quota (contains email account quota info)
Folders
So basically, each email user has its own folder, each containing the main inbox (cur/new), and separate email folders. Each separate inbox folder also contains a ”’cur”’ and ”’new”’ folder.

cur – read email
new – unread email
Email that is marked as read by the IMAP client (outlook, etc) is moved from ‘new’ to ‘cur’ .

Etc Files

Here’s a sample passwd file:

admin:x:510:510::/home/vnessa5/mail/v-nessa.net/admin:/bin/bash
support:x:513:513::/home/vnessa5/mail/v-nessa.net/support:/bin/bash

Similar to the /etc/password on the server, the file contains some critical pieces of information. From left to right:

username
password (x indicates the password is in a shadow file)
UID (should match main user’s UID in /etc/password)
GID (should match main user’s GID in /etc/password)
home folder (location of the email account’s mail folders)
shell (not relevant)
Permissions
There is a script in cPanel to attempt to fix user mail permissions, which is safe to run on a VPS or Dedicated server, but should not be run on shared without approval from a system admin:

/scripts/mailperm

The permissions should be as follows:

– /home/user/etc (user:mail, 755)
– domain.com (user:mail, 770)
– passwd (user:mail, 644)
– shadow (user:mail, 644)

The other permissions can be 755 user:user, as those files don’t affect email delivery.

The ‘fixperms’ command on the shared servers should fix the permissions of a user’s home folder, including mail and etc.

Converting to Maildir
/scripts/convert2maildir

This will leave the inbox files behind if you’re coming from Mbox, so you can list/remove them with:

find /home/*/mail/* -name inbox -exec ls -la {} \;

Standard