Issue Delete FTP user not working: User not selectable

[ramasaig]

Server operating system version

Ubuntu 20.04.4 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.44 Update #3

It ought to be very simple to delete an FTP user. Just select it and click remove? In the attached image I want to remove the user 'mullbed2_ftp'. But the checkbox for selecting it is greyed out, I cannot click in it. I notice too that the icon beside that user name is different from the icon against the other user. When hovered that pop-up description says 'Subscription owner's ftp account'. That perhaps offers a clue as to why I can't delete it, but every domain (or 18) has an FTP user with similar icon (but different name and password). I created the second user so that I'd have one left after deleting the first.
I am the subscription owner, and I want to delete this FTP user (or at least change the name). How can I do this, please?

 

[Hangover2]

This user cannot be deleted, because it is the system user of the subscription used for login via ssh/ftp(s)/sftp. Furthermore all PHP handlers and interpreters are running as that user.

You can only change the user name but not delete it. More information can be found here:

https://support.plesk.com/hc/en-us/articles/360003363334-How-to-change-name-of-subscription-s-system-user-in-Plesk-

 

[ramasaig]

Thank you for your response. I thought it might be something like that, although the credentials I use to log in via SSH (root user) are entirely different.

I have clicked on the link you sent and tried to follow the instructions. When I click 'Subscriptions' I get a list of all the domains (18) on the server. When I click the domain representing the IP address I get the screen in the attached screenshot. At the bottom it says 'System user: riabhach_ftp'. The same occurs if I select any other domain from the 'Subscriptions' list, though the system user name is different in each case. I must assume from what you say that every domain has a 'system user' name and password that would enable login via SSH, though I've never tried that (except for 'root') and haven't so far seen a need. These would all be the same as the first FTP name and passwords that I've set up for each domain? I followed the pattern 'example_ftp'.

The screen I see (as in screenshot) is not the same as shown in the example on the link. I have not yet worked out where to find 'Web Hosting Access > System User', although of course I have clicked around looking for it. There's an item 'Users' in the horizonal menu, but that leads to a different list. I'm using Pleak Obsidian. Is the example from an older version, perhaps?

 

[Kaspar]

I have not yet worked out where to find 'Web Hosting Access > System User', although of course I have clicked around looking for it.

Web Hosting Access settings can be found on the Hosting & DNS tab.

I must assume from what you say that every domain has a 'system user' name and password that would enable login via SSH, though I've never tried that (except for 'root') and haven't so far seen a need. These would all be the same as the first FTP name and passwords that I've set up for each domain?

Thats right.

 

[ramasaig]

Ah, Yes, obvious now, thank you. I'd been there before of course. The link led me to expect a different route and 'Web hosting access' isn't shown until one first clicks ''Hosting & DNS'.. My password manager (LastPass) wasn't helping as it was not allowing Plesk just to show the current settings, instead coming up with 'helpful' suggestions. So now I've disabled Lastpass (for this site) and I hope it will make things clearer.
This discussion has been prompted by someone spamming from one of my websites using the FTP login name as the name in the e-mail 'From' address. So the e-mails purport to be coming from '[email protected]' and my server is getting blacklisted. So I wanted to change the FTP login name. Perhaps more worrying is how did they get it in the first place?

 

[Hangover2]

In that case it looks more like one of your PHP scripts is used for sending email spam, e.g. a contact form that has a auto-responder to the given email address including some form fields or the website has a malware infection or is just not update and has open doors. You could track it down with some extra logging through mail.add_x_header = On.

 

[ramasaig]

Thank you. This is a whole new can of worms that has been taking up hours of my time, largely going round in circles so far. I am desperate to get it resolved. Is it perhaps better to start a new thread?

 

[Bobbbb]

Thank you. This is a whole new can of worms that has been taking up hours of my time, largely going round in circles so far. I am desperate to get it resolved. Is it perhaps better to start a new thread?

If you're using Postfix for the SMTP server, this article may be helpful in tracking down the PHP script that is sending mail...

https://support.plesk.com/hc/en-us/...these-scripts-are-running-if-Postfix-is-used-

 

[ramasaig]

Thank you.
1. I have started a new thread because this topic doesn't fit this thread's title. New thread is: 'My entire server is getting blacklisted: what to do'. 28 views, no replies!
2. I'm fairly sure which domain/script is being used by someone to send spam becasue Cloudmark have told me. The problem is to stop it and get my server off the blacklist.
3. I'm not very competent at Linux. On my previous server I had cPanel/WHM. I could log into 'root' with my editing tools (using the same 'root' login and password as for SSH) and read mail logs easily. I have so far failed to achieve that with Plesk. Is it possible?

 

[Bobbbb]

I'll head over to the new topic, linked below for convenience...

Issue - My entire server is getting blacklisted: what to do?