Disabling an email account

How can a particular email account be ‘disabled’ temporarily. Note that the email account should not be ‘deleted’ ? Is this possible at all via cPanel?

There is no direct functionality in cPanel at the moment for this. This feature might be added at a later stage.
However, you can achieve this functionality by modifying a few entries via SSH.

Comment out the entries related to the particular email account in the following locations:
/home/user/etc/domainname/passwd
/home/user/etc/domainname/shadow
/home/user/etc/domainname/quota

Make sure that you just comment them and NOT delete them as you might need them back later.

Where to check the version of Horde

Where can I check the current version of Horde webmail client running with cPanel ?

If you have ‘root’ SSH access to the server then, simply open the file /var/cpanel/horde/version using your favorite editor and you’ll be able to see the current Horde version.

How to limit the overall size of emails

How can the overall size of an email including attachment, encoding etc. be limited to a pre-defined value?


This can be done in the following way :
Go to WHM >> Main >> Service Configuration >> Exim Configuration Editor
In the first box where you can type ( right below where you see ‘#!!# cPanel Exim 4 Config’ ), add the following directive :

message_size_limit = 100M

This will limit the overall size of the message to 100Mb

How to block emails from a specific address using Exim

How to block emails from a specific address on a cPanel/WHM server using Exim ?

This is fairly easy to achieve with Exim.
First you’ll need to find the system filter file for Exim. This can be found out through WHM >> Main >> Service Configuration >> Exim Configuration Editor.
Towards the middle of the page, under the section ‘Filters’ , you ‘ll find the path to the file.
Open that file via SSH using your favorite editor and add the following to it :

    if first_delivery
    and ( (“$h_from:” contains “emailtoblock@domainname.com”)
    )
    then fail
    endif

If you would like a copy of the email to be sent to you after the message fails, use the following code :

    if first_delivery
    and ( (“$h_from:” contains “emailtoblock@domainname.com”)
    )
    then
    unseen deliver “youremail@yourdomainname.com”
    fail
    endif

Make sure that you substitute the correct email addresses in the above code.

How to change the default email settings

Issue :
Whenever a new account is created, the server sends out an email notification. Where can this setting be accessed and modified?

Fix :
Just go to WHM >> Basic cPanel/WHM Setup >> Server Contact Email Address.
You can make the required changes there.

SpamAssassin : WHM ACL Options : Reject mails with spam score at SMTP time

Issue :

It seems that by default, it is set to reject mails with a spam score of more than 20 at SMTP time. How to change the value of spam score for rejecting the mails at SMTP time ?

Solution :

You can do that by doing the following :

1. Go to WHM >> Main >> Service Configuration >> Exim Configuration Editor
2. Look for the section ‘ACL Options’ .
3. The first parameter under that deals with the spam score setting at SMTP time. De-select the check box corresponding to that.
4. When you de-select the check box, it will give you the other available options. Check the box corresponding to the desired value.
5. Click on ‘Save’ at the bottom to save the settings.

How to enable DKIM in cPanel server.

DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message while it is in transit and one can use this to prevent from getting blacklisted by the free email providers like Yahoo, MSN and Google. DKIM can increase the mail authenticity.

cPanel does not have an interface to enable DKIM like we have for SPF and Domain Keys. cPanel is still working on it for getting it implemented. However we can enable it manually by following the below steps.

Check if exim is compiled with DKIM support enabled.

root@server # /usr/sbin/exim -dd 2>&1 | grep Experimental_DKIM

Support for: crypteq iconv() IPv6 PAM Perl OpenSSL Content_Scanning Old_Demime Experimental_SPF Experimental_SRS
Experimental_DomainKeys Experimental_DKIM

Generate the SSL keys

    cd /usr/local/cpanel/etc/exim

     openssl genrsa -out dkim.key 1024
     openssl rsa -in dkim.key -out dkim.public -pubout -outform PEM

You will find two keys, dkim.key & dkim.public

Open dkim.public and copy the contents excluding the –Begin– and –End– section. This is your DKIM key.  Now open exim configuration file and append the below entries under the section ‘remote_smtp’

Sample file: vi /etc/exim.conf

    ——————————-
        remote_smtp:
        driver = smtp
        #
        dkim_domain=your_domain_name.com
        dkim_selector=mail
        dkim_private_key=/usr/local/cpanel/etc/exim/dkim.key #path to the dkim.key key.
        interface = ${if exists {/etc/mailips}{${lookup{$sender_address_domain}lsearch*{/etc/mailips}{$value}{}}}{}}
        helo_data = ${if exists {/etc/mailhelo}{${lookup{$sender_address_domain}lsearch*{/etc/mailhelo}{$value}{$primary_hostname}}}
        {$primary_hostname}}

    ————————–

    Now on WHM, open DNS editor for the particular domain and add the TXT entry with DKIM key like below.

    ————————–
        mail._domainkey.domain_name.com. IN TXT "v=DKIM1; g=*; k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDv4PSEM9P
        cxlI2tRojAUQ9hpRQ0Zj/XM4SK08/Drhm/CaspJAKZF9rZDAw18TrfuXeRgsMWAdS2vJ4Oa/kXqX0NM2eBJcmasu4GeNXANmXvC1umz+8mC6r
        EPlE/Ucau4tmAHOZL0HJ9IDd/PIxoTkeTm3mjGeqvKBLbdvVIDXbcQIDAQAB"

    ————————–

Here p=the_key_you_have_copied_from_dkim.public

Restart exim and named services.
    /scripts/restartsrv exim
    /scripts/restartsrv named

To check whether DKIM is setup properly, send a mail to dkimtest@atmail.org , if setup properly, you will get a reply like below ,else a failure message.

    —————————————————-

    Subject:    AutoReply from dkimtest@atmail.org

    From:    spftest@your_domain_name.com

    Date:    Sun, May 23, 2013 1:27 am

    To:    spftest@your_domain_name.com

    *** DKIM TEST SUCCESSFUL ***

    —————————————————–

Or you can also test from http://www.brandonchecketts.com/emailtest.php

phplist is sending 2 mails

This is very simple to fix.

Open the mailing_list_name/config/config.php

in the config file, find define(‘SEND_ONE_TESTMAIL’,0);
change the value from 0 to 1

You did i

HOW-TO: finding “Nobody” spammer

In this script we will change the sendmail binary with a custom script, because php is using the sendmail to send the mails through script. So the spammer is calling this script instead, which is then logging the user info into a log file before calling the now renamed sendmail.

After installation check /var/log/formmail.log to find spammer activity.
Installation:

Note:- Place take a backup before moving the file to prevent any sort of data loss issue.
mv /usr/sbin/sendmail /usr/sbin/sendmail.act

vim /usr/sbin/sendmail (paste the below code into it)
chmod +x /usr/sbin/sendmail
echo > /var/log/formmail.log
chmod 777 /var/log/formmail.log

————————————————————————


#!/usr/bin/perl

# use strict;
use Env;
my $date = `date`;
chomp $date;
open (INFO, “>>/var/log/formmail.log”) || die “Failed to open file ::$!”;
my $uid = $>;
my @info = getpwuid($uid);
if($REMOTE_ADDR) {
print INFO “$date – $REMOTE_ADDR ran $SCRIPT_NAME at $SERVER_NAME \n”;
}
else {

print INFO “$date – $PWD – @info\n”;

}
my $mailprog = ‘/usr/sbin/sendmail.act’;
foreach (@ARGV) {
$arg=”$arg” . ” $_”;
}

open (MAIL,”|$mailprog $arg”) || die “cannot open $mailprog: $!\n”;
while (<STDIN> ) {
print MAIL;
}
close (INFO);
close (MAIL);


————————————————————————

Using “imapcopy” to transfer the mails

MAPcopy is a small utility that will help you migrate from one IMAP e-mail message store to a another one.

1) wget http://home.arcor.de/armin.diehl/imapcopy/imapcopy.tar.gz

2) tar -xzvf imapcopy.tar.gz

3) cd imapcopy

4) Edit the file “ImapCopy.cfg”

Adjust the source and destination server. Add the source and destination users and passwords. The following sample copys the users “foo” and “bar” from server source.imap.com port 143 to server dest.imap.com port 145. Passwords for foo are “foosrcpw” and “foodestpw”, for bar “barsrcpw” and “bardstpw”. The folders “Trash”, “Sent” and “Sent Objects” will not be copied.

SourceServer source.imap.com
SourcePort 143
DestServer dest.imap.com
DestPort 145

#CreateEmptyFolders

skipfolder INBOX.Trash
skipfolder INBOX.Sent
skipfolder "INBOX.Sent Objects"

#       SourceUser SourcePassword   DestinationUser DestinationPassword
Copy    "foo"       "foosrcpw"         "foo"          "foodestpw"
Copy    "bar"       "barsrcpw"         "bar"          "bardestpw"

Now verify that all users and passwords are correct:

imapcopy -t

You can also show some information about the used servers:

imapcopy -i

You can copy the mails as:

imapcopy

Mail transfer with IMAPSYNC

It is a tool to sync, migrate copy mails from source IMAP server to the destination servers.

1) Installation (this need Perl module Mail::IMAPClient supports)

yum install imapsync

2) for more details please use the command ‘imapsync –help’

3) You can transfer mails as follows : (you can use for loop with this)

imapsync --host1 imap.src.fr  --user1 buddy --password1 secret1 --host2 imap.dest.fr --user2 max   --password2 secret2

or

imapsync --host1 server1.example.com --user1 sales@example.com --passfile1 /et

Spam filtering with Exim filter on cPanel

1) touch /var/log/filter.log
2) chmod 0644 /var/log/filter.log
3) cp /etc/cpanel_exim_system_filter /etc/cpanel_exim_system_filter_new
Then paste the following code into last of the file “/etc/cpanel_exim_system_filter_new” and save.
—————————————————————————————–

# START
# Filters all incoming an outgoing mail
logfile /var/log/filter.log 0644
## Common Spam
if
# Header Spam
 $header_subject: contains "Pharmaceutical"
 or $header_subject: contains "Viagra"
 or $header_subject: contains "Cialis"
 or $header_subject: contains "RE: DISCOUNT 80% 0FF on Pfizer !"
 or $header_subject: is "The Ultimate Online Pharmaceutical"
 or $header_subject: contains "***SPAM***"
 or $header_subject: contains "[SPAM]"
# Body Spam
or $message_body: contains "Cialis"
or $message_body: contains "Viagra"
or $message_body: contains "Leavitra"
or $message_body: contains "St0ck"
or $message_body: contains "Viaagrra"
or $message_body: contains "Cia1iis"
or $message_body: contains "URGENT BUSINESS PROPOSAL"
or $message_body matches "angka[^s]+[net|com|org|biz|info|us|name]+?"
or $message_body matches "v(i|1)agra|vag(i|1)n(a|4)|pen(  i|1)s|asu|seks|l(o|0)l(i|1)ta|dewacolok"
then
# Log Message - SENDS RESPONSE BACK TO SENDER
# SUGGESTED TO LEAVE OFF to prevent fail loops
# and more work for the mail system
#fail text "Message has been rejected because it hasn
#           triggered our central filter."
logwrite "$tod_log $message_id from $sender_address contained spam keywords"
 seen finish
endif
# END
# Filters all incoming an outgoing mail
# START
# All outgoing mail on the server only - what is sent out
#Check forwarders so it doesn't get blocked
#Forwarders still work =)
## FINANCIAL FAKE SENDERS
## Log all outgoing mail from server that matches rules
logfile /var/log/filter.log 0644
if      (
         $received_protocol is "local"          or
         $received_protocol is "esmtpa"
        ) and (
         $header_from contains "@citibank.com"  or
         $header_from contains "@bankofamerica.com" or
         $header_from contains "@wamu.com"      or
         $header_from contains "@ebay.com"      or
         $header_from contains "@chase.com"     or
         $header_from contains "@paypal.com"    or
         $header_from contains "@wellsfargo.com" or
        $header_from contains "@bankunited.com" or
        $header_from contains "@bankerstrust.com" or
        $header_from contains "@bankfirst.com" or
        $header_from contains "@capitalone.com" or
        $header_from contains "@citizensbank.com" or
        $header_from contains "@jpmorgan.com" or
        $header_from contains "@wachovia.com" or
        $header_from contains "@bankone.com" or
        $header_from contains "@suntrust.com" or
        $header_from contains "@amazon.com" or
        $header_from contains "@banksecurity.com" or
        $header_from contains "@visa.com" or
        $header_from contains "@mastercard.com" or
        $header_from contains "@zamfoo.com" or
        $header_from contains "@mbna.com"
)
  then
     logwrite "$tod_log $message_id from $sender_address is fraud"
     seen finish
  endif
## OTHER FAKE SENDERS SPAM
## Enable this to prevent users using @domain from addresses
## Not recommended since users do use from addresses not on the server
## Log all outgoing mail from server that matches rules
logfile /var/log/filter.log 0644
if      (
         $received_protocol is "local"          or
         $received_protocol is "esmtpa"
        ) and (
        $header_from contains "@hotmail.com" or
        $header_from contains "@yahoo.com" or
        $header_from contains "@aol.com"
)
  then
     logwrite "$tod_log $message_id from $sender_address is forged fake"
     seen finish
  endif

## KNOWN FAKE PHISHING
### Log all outgoing mail from server that matches rules
logfile /var/log/filter.log 0644
if      (
         $received_protocol is "local"          or
         $received_protocol is "esmtpa"
        ) and (
#Paypal
        $message_body: contains "Dear valued PayPal member" or
        $message_body: contains "Dear valued PayPal customer" or
        $message_body: contains "Dear Paypal" or
        $message_body: contains "The PayPal Team" or
        $message_body: contains "Dear Paypal Customer" or
        $message_body: contains "Paypal Account Review Department" or
#Ebay
        $message_body: contains "Dear eBay member" or
        $message_body: contains "Dear eBay User" or
        $message_body: contains "The eBay team" or
        $message_body: contains "Dear eBay Community Member" or
#Banks
        $message_body: contains "Dear Charter One Customer" or
        $message_body: contains "Dear wamu.com customer" or
        $message_body: contains "Dear valued Citizens Bank member" or
        $message_body: contains "Dear Visa" or
        $message_body: contains "Dear Citibank" or
        $message_body: contains "Citibank Email" or
        $message_body: contains "Dear customer of Chase Bank" or
        $message_body: contains "Dear Bank of America customer" or

#ISPs
        $message_body: contains "Dear AOL Member" or
        $message_body: contains "Dear AOL Customer"
        )
  then
     logwrite "$tod_log $message_id from $sender_address is phishing"
     seen finish
  endif
# END
# All outgoing mail on the server only - what is sent out
 -----------------------------------------------------------------------------------------

4) Now select this filter from WHM as
main>>Service Configurations >>Exim Configuration Editor >>Select the file “/etc/cpanel_exim_system_filter_new “ under “Filters”.
This filter script will block most common spama and some KNOWN FAKE PHISHING emails you can see filter log any time by type “cat /var/log/filter.log” at your root SSH

Postfix Flush the Mail Queue

Traditionally you use the “sendmail -q” command to flush mail queue under Sendmail MTA. Under Postfix MTA, just enter the following command to flush the mail queue:[...]

postfix flush

OR

postfix -f

To see mail queue, enter:

mailq

To remove all mail from the queue, enter:

postsuper -d ALL

To remove all mails in the deferred queue, enter:

postsuper -d ALL deferred

How To: Exim Remove All messages From the Mail Queue

If you have ever had the need to delete specific email messages out of the queue here are a few commands that will help you out.  Personally on my WHM\cPanel servers I prefer to load ConfigServer’s Mail Queues plugin for cPanel. If your interested in installing CMQ here is a link to their page http://www.configserver.com/cp/cmq.html [...]



We will be adding an article showing how to install it as well.
For you el’ manual people here are the commands to clear messages from the Exim queue.

To print a list of the messages in the queue, enter:

exim -bp

To remove a message from the queue, enter:

exim -Mrm {message-id}

To remove all messages from the queue, enter:

exim -bp | awk '/^ *[0-9]+[mhd]/{print "exim -Mrm " $3}' | bash

or

exim -bp | exiqgrep -i | xargs exim -Mrm