Search results

Hello there. I found out some cron job belonging to a customer when I went into PLESK settings: I can't post it as this server won't accept it, but it's a one liner that downloads a file from some hellodolly site and runs it this was put into their crontab even though the owner of that domain...

Hi. I just noticed this - I checked it because I saw a lot of php-fpm in the process list.. Any ideas what to do? Thanks Apr 01 13:47:46 sail.kalfaoglu.net kernel: Code: e8 8b ef ff ff 84 c0 0f 84 5c fe ff ff 48 8b b3 28 03 00 00 eb c7 66 2e 0f 1f 84 00 00 00 00 00 41 55 41 54 55 53 48 83 ec 08...

Hello everyone! Some (strange) user wanted to get all his junk mail delivered. I checked and he already disabled his Spam Filter setting in his mail settings. I checked the disk and this is what I found at /var/qmail/mailnames/domain/user/.spamassassin/user_prefs file: Shouldn't this file...

Hi. I went to the Tools page and went into Apache server settings, noticed very few modules were enabled.. I enabled some that were recommended by another PLESK guide but now it won't start. Here is what it says: What to do?

Hi there.. Is there a way to enable this tool globally : https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker It seems wonderful and we are wasting a lot of CPU/IO on bots.. Many thanks, -t

Hi - yet another outgoing mail thread for you :) Strange thing -- I set a domain to 50 emails per hour.. While setting it, I accidentally set it to 0 for a few minutes, realized my mistake and changed it back to 50. saved, all is well.. I went back to check it, yes, still 50 for ALL items (for...

Hi - doing another migration from one Obsidian to another (both at latest versions) So far I saw this in the logs.. IIS on Linux? 2023-06-29 09:40:23 Info Restore Apache restart interval 2023-06-29 09:40:24 Info Force Apache restart 2023-06-29 09:40:29 Info Restart IIS for IDN...

Hi there. today I wanted to check a vulnerable web site (immunifyAV found a virus) of a site so I went into that hosting, clicked wordpress tab and clicked security, and that popup loaded, and in the "security measures" tab it said Checking WordPress website security... and it's been going...

I wrote a little chron thing that warns me when there are too many open files (which can be fatal on the server).. I got a warning at 4 AM.. The open files number comes from /proc/sys/fs/file-nr, the 42 thousand.. Apparently my script that lists the open files doesn't work as well as I hoped...

On AlmaLinux 8.8, the journalctl -f shows these messages arriving every second.. May 27 07:27:02 storm.kalfaoglu.net kernel: kauditd_printk_skb: 27 callbacks suppressed May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1130 audit(1685161622.605:37852006): pid=1 uid=0 auid=4294967295...

Customers reported that their web sites would not open today.. I restarted that server.. then I did a PLESK REPAIR WEB -y and it found many webmail.conf files it said were unknown and deleted them.. the web server still does not work.. I had autoupdates enabled, I wonder if yesterday there...

Hi.. assume domain.com is our default domain for the server. I generated some certificates for it with Lets Encrypt, and eventually created a wildcard certificate and *.domain.com is using it. When I try to logon to https://lists.domain.com it gives a warning -- saying that the certificate is...

Hi - a customer complained -- (and sent a video) that about 50% of the time when he deletes a mail in webmail, he gets the default web page, "alma linux apache bla bla" instead of the next message in the preview window. He says that this happens only when he is deleting mails in rapid...

Hi.. A server had been having over 50k open files recently. I wrote a small code that checks it and warns me if it's over 50k, so I got some emails like that. This is the server that crashed a few times from too many open files (not crashed, but apps couldn't open new files) in the past. I...

Hi there. I noticed a high CPU usage in a server of ours and went to check it.. We are getting hit hard by the google bots.. the access_ssl_log contains thousands/millions of entries like: I checked the IP and it is google indeed. I checked the settings why nginx is not being used for these...

Hi there. for some reason /var/log/maillog no longer contains any dovecot entries. I believe rsyslog was used for this logging? Well, rsyslog is working, but still no logging.. I tried setting it to a file in dovecot.conf, that is, /var/log/maillog, but it complained about permission. I didn't...

Hi there. I noticed in Obsidian that the php.ini's disable_functions was now empty, whereas the old PLESK versions seem to have that populated. I'm asking because a virus on a wordpress site had put itself in systemd to re-create itself when the virus was removed! thanks, -t

I have an interesting case. A web site (wordpress) has all the security applied in plesk, but it's virus ridden. Has been scanned and cleaned by ImmunifyAV many times. I saw that the index.php has viruses so I deleted that file. the moment I delete it, it reappeared. It appears it attached...

Interesting thing.. I'm seeing this in the logs: Oct 01 16:31:53 storm postfix/smtpd[30855]: disconnect from r31.mail.safisalons.fr[192.243.255.31] ehlo=1 starttls=0/1 commands=1/2 Oct 01 16:32:02 storm postfix/pickup[63938]: 2A76841426BB: uid=10181 from=<[email protected]> Oct 01...

This is strange: A server we got from hetzner germany keeps failing to renew its license. Hetzner was of no help, and I just got this email again (happens every month): Unable to update PLSK.XXXXX.XXXX: an error occurred while processing your key. You can try to retrieve the key manually in...