Issue A drupal instance is accesible from another tenant domain

[hpaco]

Hello I have this problem maybe someone can help me solve it.

I have a domain that is the main domain www.maindomain.com and it has drupal running on it. There is not other tenant using drupal.

Then I have a few tenants, one of them has WP running on it www.tentant1.com. But it's administrator is getting emails to accept accounts created in drupal... the addresses are ww.w.tenant1.com cp.tenant1.com if you open the link or whois it, it directs you to www.maindomain.com to it's drupal instance.

In hosting settings everything shows to be fine. With 'plesk bin site --list' it lists the domains, included those that have a prefix like crm.maindomain.com (for example) but not those two that direct to the main domain.

Any advice would be apreciated.

 

[Peter Debik]

Hello @hpaco, thank you for posting.

What do you mean by "tenant"? Is that an additional subscription on the server or is it an add-on domain within the same subscription of maindomain.com? Do they have their own document root directories or have they been created as subdirectories to the httpdocs directory of maindomain.com?

If the link in the email is wrong, it is most likely configured that way in your Drupal website. A mail server does not modify the content of emails by itself.

 

[hpaco]

Sorry I don´t know how to call them in english.

I have a server with plesk obsidian (web host edition) on azure, I provide the service of webhosting to a few clients (it's a very small bussines). Each bussines is independen from one another, they're unrelated, other than they pay me to host their sites and applications (moodle, crm, etc). As I maintain their sites and provide hosting they don't have access to plesk (I know they could), So I log in as webhost admin, and on "Websites & Domains" I add new domains as I need them.

Some have only one page and thats it www.bussines1.com, other have other aplications so they have for example www.bussines2.com crm.bussines2.com, moodle.bussnes2.com, etc.

The ones that do not have aplications are main domains, the ones that have other aplications are main domains with subdomains in them. So the folder structure on my server it's:
/var/www/vhosts/bussines1.com
/var/www/vhosts/bussines2.com
/var/www/vhosts/bussines2.com/crm.bussines2.com (for me this is a subdomain)
/var/www/vhosts/bussines2.com/moodle.bussines2.com
/var/www/vhosts/bussines3.com
/var/www/vhosts/bussines4.com
/var/www/vhosts/bussines4.com/budget.bussines4.com
etc. only the main sites have a httpdocs directory, subdomains do not.

DNS is managed in azure and there I set subdomains, there aren´t the subdomains that are linked in the emails, nor in the plesk list 'plesk bin site --list' wich shows domains and sub domains I have created.

So there is a site that it's mine were I have drupal, it's the only one that has it. And one of the owners is getting several emails a day for account approval of an account created in drupal (wich is not installed in his site). and they have links to sub domains of his domain that do not exist but that points to my drupal install. I know the easiest ways is to shut down the drupal site, or block account creation, but I want to understand what somebody is doing and why. If the whole server is compromissed or they´re just trying to do it.