Resolved webmail "randomly" has issue

[larryk]

CentOS Linux 7.5.1804 (Core)‬ProductPlesk Onyx
Version 17.8.11 Update #89, last updated on July 28, 2020 10:12 AM


[Thu Jul 30 11:30:18.977694 2020] [:error] [pid 11649:tid 3894787827456] [client 99.99.99.99:49372] client denied by server configuration: /usr/share/psa-roundcube/, referer: http://webmail.domain.com/?_task=ma...f=0,webp=1&_uid=3363&_mbox=INBOX&_action=show

Webmail will spin or give gateway error or the testing 123 page... while trying to use webmail.
NOTE: this happens randomly...
say, webmail is up all day long and is used for 8 hours. then the issue happens about 2-4 times a day? Kind of self corrects itself?

NOTE 2: this just started due to plesk crash problem, where /var/ was moved (apparently on accident), but none the less... the whole /var/ directory got moved, the server was completely down, then var was moved back and server back online.

BUT weird or odd things are happening?
Hard to explain?

any thoughts?

 

[IgorG]

any thoughts?

Perhaps this is a positive of fial2ban or ModSecure

 

[larryk]

Hi IgorG

Issue - Roundcube does not work until I restart Apache

I have noticed this several times when I add a new subscription. The Roundcube-webmail doesn't work after that. I will get a Plesk-page. A "plex repair web -y -v" does not fix it either. A "/etc/init.d/apache2 restart" however DOES fix it. It's an annoyance only, but something that should be...

talk.plesk.com

We just had the impossible happen:
webmail.domain.com => only spinning/refreshing... can't connect or load the page.

client closed down all browsers and tried to load the page again... can't even get to the page... it doesn't load.

I tried. same thing.
I tried a different webmail.domain2.com = instantly comes up.

confirmed via logs, client logged in to mail about 1 hour prior, but not since then. EVEN though webmail was up and/or trying to run. It was just spinning or refreshing.

in theory, it was like the server DID NOT have webmail installed for this domain. OR the server would not let anything connect to webmail for this domain.

so while on the phone, magically... everything came back. it was like it never happened?
note: nothing was done.

thoughts?

ps. fail2ban is not installed or used.
I have ASL, which has whitelisted IPs and atomicorp support confirmed ASL is not blocking anything.

 

[larryk]

more details:

1) it appears ONLY 1 domain has this issue. Meaning, webmail.domain1.com gets the 502 bad gateway error or spins/refreshes, etc.
WHILE webmail.domain2.com is just fine.

2) the issue appears out of now where, last from 5 to 10 minutes... and just go aways.

3) no issues at all WHEN the issue is not there, however, the issue RANDOMLY appears?!!?!??

4) was looking at log entries during the downtime...
BEFORE issue... you can see webmail logins, etc.
DURING the issue, the server does not see any login attempts, anything... it is like the domain has wrong DNS or wrong settings.
AFTER issue... all is good

the above happens all by itself, nothing was done... only observing?

using Round Cube as webmail.

any other thoughts as to what could CAUSE it?

 

[AlbertoPizzarelli]

Same problem, any news??

 

[AlbertoPizzarelli]

Ciao, ho trovato e risolto il problema.

io un modulo apache chiamato mod_evasive, tutte le prove sono possibili trovate in un registro di giornale.

in questo caso ho inserito nella whitelist localhost (l'ultima riga del file di configurazione in /etc/httpd/conf.d/mod_evasive.conf - Centos conf)

DOSWhitelist 127.0.0.1

 

[AlbertoPizzarelli]

I changed the config lines below to increment threshold

 DOSPageCount 6
DOSSiteCount 50

hope this is helpful to someone

 

[JMB]

Ciao, ho trovato e risolto il problema.

io un modulo apache chiamato mod_evasive, tutte le prove sono possibili trovate in un registro di giornale.

in questo caso ho inserito nella whitelist localhost (l'ultima riga del file di configurazione in /etc/httpd/conf.d/mod_evasive.conf - Centos conf)

DOSWhitelist 127.0.0.1

My mistake:
client denied by server configuration: /usr/share/psa-roundcube/noindex, referer: xxxxxxxxxxx

Your solution worked for me, thanks

 

[sinapseredes]

Ciao, ho trovato e risolto il problema.

io un modulo apache chiamato mod_evasive, tutte le prove sono possibili trovate in un registro di giornale.

in questo caso ho inserito nella whitelist localhost (l'ultima riga del file di configurazione in /etc/httpd/conf.d/mod_evasive.conf - Centos conf)

DOSWhitelist 127.0.0.1

Thank you very much!!!