If you have ea-nginx installed on your cPanel server and you open Munin in WHM, you will notice something is wrong pretty quickly. The Apache graphs may be missing or showing no data, and there is no Nginx category at all. This is not a Munin bug — it is a configuration mismatch when adding the reverse proxy ea-nginx. This guide walks through fixing it completely, including the cPanel-specific quirks that generic Munin documentation does not cover.
Continue readingCategory: System Administration
How to Disable Sitejet Globally Without Breaking Existing Websites
Taking Back Control: Granular Sitejet Management on cPanel Servers
The hosting landscape is constantly evolving. Recently, WebPros has heavily integrated Sitejet into the core cPanel experience. While Sitejet is a powerful builder, it’s not the right fit for every hosting provider. Many companies have already invested in competing site builders, prefer to keep their interface lightweight, or are looking forward to WebPros’ own upcoming “Nova” builder and don’t want to invest in Sitejet in the interim.
The challenge for sysadmins is that simply disabling Sitejet globally via the WHM Feature Manager does not affect already deployed websites, but it does prevent customers who are still developing and continuously editing their published Sitejet sites from using the editor. To avoid back-and-forth support tickets to re-enable the editor for those users, we need a way to opt out new users while keeping active users’ editors functional.
Continue reading[cPanel][SpamAssassin] Aggressively Scoring SPF to Combat Email Forgery
Let’s talk about a persistent headache in email administration: header forgery. In an ideal world, technologies like SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting & Conformance) would effectively prevent malicious actors from sending emails that appear to originate from legitimate domains.
Continue readingSysAdmin Tale #130325
A friend of mine has a VPS on OVH and asked me to review if there is anything he can remove to make more space and install PHP 8.2. Here is the email I sent to him, in which I shared the diagnosing commands he can use.
Continue readingInstalling and Configuring the GeoIP2 Module for Nginx on AlmaLinux 9 / RHEL 9
GeoIP2 is a powerful module for Nginx that allows you to determine a visitor’s geographic location based on their IP address. This can be useful for access control, logging, and performance optimization. Since AlmaLinux 9/RHEL 9 doesn’t include this module by default, you’ll need to compile and install it manually.
Continue reading[cPanel][Maildir] Duplicate emails between different mail boxes using Symbolic links
When some users switch to a new email naming policy, they may need to duplicate email content. This process can be very demanding in terms of inodes and memory space.
In my experience, one client had over a hundred addresses. They needed to retain the old email addresses while maintaining a complete history of previous emails and setting up forwarding.
The transitions were as follows:
- ceo@example.com => firstname1.lastname1@example.com
- hr@example.com => firstname2.lastname2@example.com
- it@example.com => firstname3.lastname3@example.com, firstname4.lastname4@example.com
We use Maildir, and to avoid content redundancy. I wrote a basic script with the understanding that mail operations won’t alter the original emails. As the user can only:
- Remove the email message, which will result in the removal of the symlink.
- Or move the email message from one directory to another (e.g., Inbox => Archive, or Trash); which will be interpreted as moving the symbolic link to the directories .archives/cur or .trash/. Since we use full paths to describe the links, this won’t cause any issues and won’t alter the original files.
I have also excluded some maildir system files from being linked, starting usually with dovecot* or maildir*.
The script usage is straightforward:
./mailinker.sh mycpuser oldbox@example.com newbox@example.com[cPanel][Webmail] Add fonts to Roundcube
Many companies primarily use webmails and adhere to specific standards for email format, footer, and font. And while custom fonts can be utilized in local email clients (such as Outlook or ThunderBird), open webmail services predominantly support web-safe fonts. These are fonts that are available across the different web platforms and remain consistent with the original font. Besides this, there might be some variations in their support for other common fonts, such as Times New Roman.
Continue reading[SolusVM2][OpenVZ] Hooks
You can use hooks in SolusVM 2 to automatically run custom scripts before or after specific events take place. Hooks should be set under this directory: /usr/local/solus/hooks/, they can be written using Bash, PHP, Python or else.
Basically what it does is whenever there is an event it sends in stdin a json snap with the event and the action (e.g.: new installation, os reinstall, restart, etc) to all files under the hooks’ folder.
Example of JSON code:
{
"action": "server-restart",
"stage": "pre",
"data": {
"uuid": "915b5ca2-ff02-45ab-ba73-2e90793e6819",
"virtualization_type": "vz"
}
}
[Linux] Remove all empty files (e.g. 0 kb size PHP files)
Amongst the PHP malwares targeting WP plugins’ vulnerabilities I encounter, some generate hundred of thousand of empty files with 0KB size in all folders and sub-folders recursively . which create diversion and affects the inodes capacity of an account. But diversion may not the only goal. as they are generated through an obfuscated code, so I can imagine that these filenames may be part of an obfuscation process. Instead of writing the directives directly in a PHP or text file, the information is gathered through the listing and ordering of the filenames, possible no? Or maybe I’m over-complicating it.
Continue reading
Securing SSH access with Fail2ban and GeoIP filtering
Any service that is exposed to the network is a potential target, and SSH being so widely deployed across the internet means that it represents a very predictable attack surface or attack vector through which people can try to gain access.
If you review the logs for your SSH service running on any widely trafficked server, you will often see repeated, systematic login attempts that represent brute force attacks by users and bots alike.
tail /var/log/auth.log