Ajith Sahadevan's Blog

Opening port 465 in ASSP using Stunnel

ajitz — Sun, 24 Jul 2011 11:30:27 +0000

ASSP SSL support on port 465 using stunnel (#03)
( updated 11 Mar 2011 , compatible with all ASSP versions)

Be sure your all your ASSP alternative ports (listePort2) are allowed on your firewall (TCP IN/OUT).
Using below “how to” you can use SMTP SSL/TLS to send email securely using port 465.
If you want secure imap receiving , you should use port 143 with STARTTLS
If you want secure pop3 receiving , you should use port 110 with STARTTLS

Thanks to Szymon Rybczynski (pro-net-hosting.com and prohost.pl)

HOW TO
All lines starting with # are commands to execute as root.

1. You need stunnel installed. Cpanel should have stunnel installed. To check:
# stunnel -version
If you get something like “stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003″ you can continue.

2. You can make your own certificate for SSL or use cPanel cert. This howto shows how to use cPpanel cert. To make your own cert just search google for instruction and change cert path in stunnel.conf to your cert.

3. Setting up stunnel user and config file:
# adduser stunnel;passwd stunnel
Set password for user stunnel

# cd /etc/stunnel;nano -w stunnel.conf

copy and paste this:

cert = /etc/stunnel/cpanel.pem
chroot = /usr/local/cpanel/var/run/stunnel-assp/
pid = /stunnel.pid
setuid = stunnel
setgid = stunnel
output = /var/log/stunnel.log
[ssmtp]
accept = 465
connect = 127.0.0.2:26

note : you should replace 26 with your preferred alternative port you have setup in listenPort2 , by default you will find port 26

Save the file.

4. Copy cPanel cert.

If you have set correctly your own certificate for your cpanel/exim services in
WHM > Service Configuration >> Manage Service SSL Certificates

execute this

# cp /var/cpanel/ssl/cpanel/mycpanel.pem /etc/stunnel/cpanel.pem

otherwise execute this

# cp /var/cpanel/ssl/cpanel/cpanel.pem /etc/stunnel/cpanel.pem

Note : if /usr/local/cpanel/etc/cpanel.pem or (mycpanel.pem) does not exists you can find
the cpanel certificate also here /var/cpanel/ssl/cpanel/cpanel.pem , in this case execute this
# cp /usr/local/cpanel/etc/cpanel.pem /etc/stunnel/

Now execute this

# cd /etc/stunnel/;chown stunnel.stunnel cpanel.pem

5. Create run dir.

# cd /usr/local/cpanel/var/run/;mkdir stunnel-assp;chown stunnel.stunnel stunnel-assp
6. Setup 127.0.0.2 – if you don’t do this you will create open relay on SSL port.
# cp /etc/sysconfig/network-scripts/ifcfg-lo /etc/sysconfig/network-scripts/ifcfg-lo:1;
# nano -w /etc/sysconfig/network-scripts/ifcfg-lo:1

Change it to look like this:

DEVICE=lo:1
IPADDR=127.0.0.2
NETMASK=255.0.0.0
NETWORK=127.0.0.0
BROADCAST=127.255.255.255
ONBOOT=yes
NAME=myloop

Save.

7. Now bring lo:1 up.
# /etc/sysconfig/network-scripts/ifup-aliases lo

# ifconfig

It should now list 127.0.0.2

8. Login to ASSP web interface (ip:55555) and change:
Network Setup:
————
Second SMTP Listen Port
26
————
Second SMTP Destination
127.0.0.1:125
————
Force SMTP AUTH on Second SMTP Listen Port
Checked
————

Relaying:
————
Accept All Mail
127.0.0.1

If you make a mistake here you can make your mail server open relay so double check the settings.

8. Open TCP IN/OUT port 465 on your firewall.

9. Now you are ready to start stunnel. Execute:

# stunnel /etc/stunnel/stunnel.conf

At this moment your SSL connection should work. Test it:

# openssl s_client -quiet -connect localhost:465
If you get error then something is wrong and you need to check /var/log/stunnel.log

If you get something like:
“depth=0 /C=US/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=dom.host.com/emailAddress=ssl.net
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=US/ST=Unknown/L=Unknown/O=Unknown/OU=Unknown/CN=dom.host.com/emailAddress=ssl.net
verify return:1
220-pol.nameserverus2.com ESMTP Exim 4.63 #1 Mon, 23 Jul 2007 15:42:14 +0200
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.”

Everything is ok and ready to use.

Blackberry mail issues

ajitz — Wed, 29 Jun 2011 14:58:17 +0000

Its a common issue in web hosting environment that blackberry device may encounter error connecting to mail server while configuring mail accounts. Please whitelist the following blackberry network ips in the firewall to fix the issue:

======

206.51.26.0/24 # Blackberry
193.109.81.0/24 # Blackberry
204.187.87.0/24 # Blackberry
206.53.144.0/20 # Blackberry
216.9.240.0/20 # Blackberry
67.223.64.0/19 # Blackberry
93.186.16.0/20 # Blackberry
68.171.224.0/19 # Blackberry
74.82.64.0/19 # Blackberry
173.247.32.0/19 # Blackberry
178.239.80.0/20 # Blackberry
180.149.148.0/22 # Blackberry
180.168.204.0/22 # Blackberry

======

Enjoy

Install OS template in a VPS host node

ajitz — Thu, 31 Mar 2011 03:50:17 +0000

Download the required tar file for the OS template you need to install from the following link:

http://wiki.openvz.org/Download/template/precreated

Copy the tar files to /vz/template/cache (permission 755)

Do not untar it.

That’s all

Installin YUM in a VPS container manually

ajitz — Thu, 31 Mar 2011 03:11:51 +0000

Install all the prerequisites and yum using rpm :

rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/python-elementtree-1.2.6-5.i386.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/python-sqlite-1.1.7-1.2.1.i386.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/python-iniparse-0.2.3-4.el5.noarch.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/m2crypto-0.16-6.el5.6.i386.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/python-urlgrabber-3.1.0-5.el5.noarch.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/rpm-python-4.4.2.3-18.el5.i386.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/yum-metadata-parser-1.1.2-3.el5.centos.i386.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/yum-3.2.22-26.el5.centos.noarch.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/sqlite-3.3.6-5.i386.rpm
rpm -ivh http://mirror.centos.org/centos-5/5.5/os/i386/CentOS/sqlite-devel-3.3.6-5.i386.rpm

Finally update yum
yum update

You are done

Exim : retry time not reached for any host after a long failure period

ajitz — Tue, 18 Jan 2011 10:13:01 +0000

The issue is because of the corrupted exim db files.

Goto /var/spool/exim/db and delete files: retry , retry.lockfile , wait-remote_smtp, wait-remote_smtp.lockfile

cd /var/spool/exim/db

rm -f retry retry.lockfile wait-remote_smtp wait-remote_smtp.lockfile

/etc/init.d/exim restart

ClamAV outdated Warning

ajitz — Mon, 06 Dec 2010 08:56:33 +0000

1. Login to your server through SSH

2. cd /usr/local/cpanel/modules-install/clamavconnector-Linux-i686

3. wget http://sourceforge.net/projects/clamav/files/clamav/0.96.5/clamav-0.96.5.tar.gz/download

4. Edit the file “install” with the command “vi install”

1. Alter the line “AVV=0.96.3″ and make it “AVV=0.96.5″

2. Alter the line “AVVOLD=0.96.1″ and make it “AVVOLD=0.96.3″

3. Save the file

5. echo “0.96.5″ > progversion

6. Execute the script install with the command “./install”

7. Wait for the compilation to finish and check your mail servers functionality.

Display the load average in all VPS containers(Virtuozzo)

ajitz — Thu, 02 Dec 2010 05:34:03 +0000

for i in `vzlist | awk ‘{print $1}’ | grep -v CTID` ; do echo -n “$i => “; vzctl exec $i cat /proc/loadavg ; done

How To Add iptable modules on a VPS

ajitz — Sat, 18 Sep 2010 21:31:30 +0000

While installing CSF in a container you may get the following error while testing CSF in the server:

==========

Testing ipt_LOG…FAILED [FATAL Error: iptables: Unknown error 4294967295] -
Required for csf to function
Testing ipt_multiport/xt_multiport…FAILED [FATAL Error: iptables: Unknown
error 4294967295] – Required for csf to function
Testing ipt_state/xt_state…FAILED [FATAL Error: iptables: Unknown error
4294967295] – Required for csf to function
Testing ipt_limit/xt_limit…FAILED [FATAL Error: iptables: Unknown error
4294967295] – Required for csf to function
Testing ipt_recent…FAILED [Error: iptables: Unknown error 4294967295] -
Required for PORTFLOOD and PORTKNOCKING features
Testing ipt_owner/xt_owner…FAILED [Error: iptables: Unknown error
4294967295] – Required for SMTP_BLOCK and UID/GID blocking features
Testing iptable_nat/ipt_REDIRECT…FAILED [Error: iptables: Unknown error
4294967295] – Required for MESSENGER feature

==========

Please follow the steps given below to fix it:

1. Load the missing modules in the host node

#modprobe ipt_MASQUERADE
#modprobe ipt_helper
#modprobe ipt_REDIRECT
#modprobe ipt_state
#modprobe ipt_TCPMSS
#modprobe ipt_LOG
#modprobe ipt_TOS
#modprobe tun
#modprobe iptable_nat
#modprobe ipt_length
#modprobe ipt_tcpmss
#modprobe iptable_mangle
#modprobe ipt_limit
#modprobe ipt_tos
#modprobe iptable_filter
#modprobe ipt_helper
#modprobe ipt_tos
#modprobe ipt_ttl
#modprobe ipt_REJECT

2. Stop the VPS

#vzctl stop VEID

3. Add the modules to your VPS using the vzctl command

#vzctl set VEID –iptables ipt_REJECT –iptables ipt_tos –iptables ipt_TOS –iptables ipt_LOG –iptables ip_conntrack –iptables ipt_limit –iptables ipt_multiport –iptables iptable_filter –iptables iptable_mangle –iptables ipt_TCPMSS –iptables ipt_tcpmss –iptables ipt_ttl –iptables ipt_length –iptables ipt_state –iptables iptable_nat –iptables ip_nat_ftp –save

4. Start the VPS

#vzctl start VEID

The issue should be fixed. Enjoy

Custom php.ini set up in Cpanel

ajitz — Thu, 09 Sep 2010 15:06:12 +0000

Custom php.ini set up in Cpanel

1. Remove the # infront of the Include line to add custom conf to customize the virtualhost entry for the particular dmain from httpd.conf

2. Create any file end with .conf in the respective directory

Eg: /usr/local/apache/conf/userdata/std/2///custom.conf

3. Add the following lines to the custom configuration file

suPHP_UserGroup

suPHP_ConfigPath /home//

4. run apache distiller

5. restart apache

In LiteSpeed

· (For suEXEC only) Added support for PHPIniDir directive at virtual host level to allow customized php.ini.
· (For suEXEC only) Added support for PHPRC environment variable to customize php.ini.
· Added suEXEC configuration for server level external applications such as FastCGI, LSAPI.
1. Remove the # infront of the Include line to add custom conf to customize the virtualhost entry for the particular dmain from httpd.conf

2. vi /usr/local/apache/conf/userdata/std/2///custom.conf

PHPIniDir /home/ (path to php.ini)

Edit lsphp4 or lsphp5 as per the requirement and add the following under “Environment”:

PHPRC=$VH_ROOT/php

Now you will be able to create custom php.ini for all users under /home/user/php folder

3. run apache distiller

4. Restart Apache

Recreate a VPS from a crashed HDD (Cpanel server)

ajitz — Fri, 03 Sep 2010 16:05:37 +0000

Recreate a VPS from a crashed HDD (Cpanel server)

* Backup necessary files.

/vz/private/VEID and /etc/sysconfig/vz-scripts/VEID.conf
* Recreate VPS

grep OSTEMPLATE /etc/sysconfig/vz-scripts/VEID.conf
OSTEMPLATE=”centos-5-x86-tmpsecure”
cp -p /etc/sysconfig/vz-scripts/VEID.conf /etc/sysconfig/vz-scripts/VEID.conf.bak
vzctl stop VEID
vzctl destroy VEID
vzctl create VEID –ostemplate centos-5-x86-tmpsecure
cp -p /etc/sysconfig/vz-scripts/VEID.conf.bak /etc/sysconfig/vz-scripts/VEID.conf
vzctl start VEID

* Install Cpanel

cd /home — Opens the directory /home.
wget -N http://httpupdate.cpanel.net/latest — Fetches the latest installation file from the cPanel servers.
sh latest — Opens and runs the installation files.
/usr/local/cpanel/cpkeyclt — Activates your license after installation.

* Restore Files

rsync -vrplogDtH /oldHD/usr/local/apache/conf /usr/local/apache
rsync -vrplogDtH /oldHD/var/named /var
rsync -vrplogDtH /oldHD/home/* /home
rsync -vrplogDtH /oldHD/usr/local/cpanel /usr/local
rsync -vrplogDtH /oldHD/var/lib/mysql /var/lib
rsync -vrplogDtH /oldHD/var/cpanel /var
rsync -vrplogDtH /oldHD/usr/share/ssl /usr/share
rsync -vrplogDtH /oldHD/var/ssl /var
rsync -vrplogDtH /oldHD/usr/local/cpanel/3rdparty/mailman /usr/local/cpanel/3rdparty
rsync -vrplogDtH /oldHD/var/log/bandwidth /var/log
rsync -vrplogDtH /oldHD/usr/local/frontpage /usr/local
rsync -vrplogDtH /oldHD/var/spool/cron /var/spool
rsync -vrplogDtH /oldHD/root/.my.cnf /root
rsync -vrplogDtH /oldHD/etc/httpd/conf/httpd.conf /etc/httpd/conf

cd oldhdd/etc
rsync -vrplogDtH secondarymx domainalias valiases vfilters exim* proftpd* pure-ftpd* passwd* group* *domain* *named* wwwacct.conf cpupdate.conf quota.conf shadow* *rndc* ips* ipaddrpool* ssl hosts /etc

#/scripts/upcp
#/scripts/updatenow
#/scripts/sysup
#/scripts/exim4
#/scripts/easyapache
#/scripts/securetmp
# /scripts/fixeverything

#/scripts/restartsrv httpd
#/scripts/restartsrv cpanel
#/scripts/restartsrv mysql
#/scripts/restartsrv named
#/scripts/restartsrv exim