Mail – Mellowhost Blog

Server Error! (Ok) Roundcube Cpanel – Fix

When I tried to load my Roundcube today, found that it failed to load the inbox and instead had thrown the following error:

Server Error! (Ok)

Then, I tried searching the cpanel logs or the roundcube error log but found nothing. Then, I checked the Dovecot log located here:

/var/log/maillog

I found the following:

May  7 13:57:49 network2 dovecot: imap([email protected])<26343><cQG+qxX7MvdneMrv>: Error: Mailbox INBOX: mmap(size=351817308) failed with file /home/mellow/mail/mellowhost.com/shawon/dovecot.index.cache: Cannot allocate memory

This is happening because Dovecot caches the mail index in a file, once it tries to cache a lot of emails, it fails with a memory error. In those cases, you may remove the cache file and let Dovecot generate a new cache based on the latest mails. You may simply rm the file and see Roundcube is loading again:

rm -f /home/mellow/mail/mellowhost.com/shawon/dovecot.index.cache

How to install SSL in Zimbra with Certificate and CA-bundle

There are 3 things you need:

Private key
Certificate
Ca-bundle

First, switch to the user zimbra:

su - zimbra

Let’s except your files are located here:

Private Key: /tmp/private.key
Certificate: /tmp/your.domain.com.crt
Ca-Bundle: /tmp/your.domain.com.ca-bundle

Now, copy your private key file to the following location:

cp /tmp/private.key /opt/zimbra/ssl/zimbra/commercial/commercial.key

Now, first, verify 3 things to make sure, they are correct:

/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/your.domain.com.crt /tmp/your.domain.com.ca-bundle

If it, says ok, now you may deploy the certificate like the following:

/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/your.domain.com.crt /tmp/your.domain.com.ca-bundle

Once done, now, exit from the user zimbra and restart zimbra:

exit
service zimbra restart

Your SSL should work now.

Email Deleted/Archived But Still Showing in Space Usage – Cpanel/Dovecot

Synopsis

Your customer has deleted the emails using Outlook/Imap client or may have archived them on their PC. But the space usage didn’t change in your Cpanel counterpart. What do to?

Solution

The issue arises because Dovecot Imap does soft delete when issuing delete command. They don’t necessarily get deleted, instead marked for expunge. You need to issue the expunge/purge command to get the storage cleared. In Cpanel, they usually do it on the daily upcp command they run. But if you are not running upcp daily, or would like to voluntarily do this, you can do this by running the following command:

/scripts/dovecot_maintenance

If you do not run upcp daily, then you can run the above command using a cron, daily to make sure IMAP deletions are expunged daily to reclaim storage.

The above command expunges all the accounts that require expunge. But if you want to expunge any single account, you may do so using the following command:

doveadm purge -u [email protected]

Replace [email protected] with the email address that has issued the deletes.

550 Please turn on SMTP Authentication in your mail client.

Error Examples:

When someone tries to send you mail from gmail/outlook, they get a reply mail with the following errors:

550 Please turn on SMTP Authentication in your mail client. mail-lf1-f43.google.com [209.85.167.43]:42770 is not permitted to relay through this server without authentication.

Remote Server returned '550 5.7.368 Remote server returned authentication required to relay -> 550 Please turn on SMTP Authentication in your mail client. ;mail-oln040092255101.outbound.protection.outlook.com;(APC01-HK2-obe.outbound.protection.outlook.com) [40.92.255.101]:9693 is not;permitted to relay through this server without authentication.'

Error Solution

The error appears for several reasons. I will try to point out the most common ones I have faced for clients.

One, this domain is listed in /etc/remotedomains, while the domain is actually a local domain or shall use a local exchanger. As the domain is set not to use local mail exchange, hence the MTA is bouncing the mail back from receiving. To resolve this problem, you need to go to:

WHM >> DNS Zone Manager >> Search your domain that is having problem >> Manage

Now, click on the ‘Email Routing Configuration’ just beside the ‘Actions’ button as shown in the screenshot.

In the MX, make sure to set your local MX, and then select ‘Local Mail Exchanger’, then save.

If the domain was in remotedomains, and you did the above, and the issue is still not fixed, then you may want to run the following command to rebuild the remotedomains and localdomains file for Cpanel

/scripts/checkalldomainsmxs –yes

The second reason, the issue can appear, if you have defined two different MX and one of them, does not have the user, to whom the mail is trying to deliver. You should try to avoid such ambiguity. If you use multiple different MX, then you need to make sure, both of them accepts the same set of the user list.

Hope this works for you. Let me know the result.

Cpanel Hosting Tries to Send Mail using Localhost for Remote Relay from PHP Script

Question: When I try to send mail using a PHP script in Cpanel, it automatically switches the SMTP hostname to localhost, even if I use a remote relay like sparkpost or mailgun. How to fix this?

Solution:

The reason behind the behavior is, by default Cpanel doesn’t let your customers use remote SMTP using PHP. This is controlled using a feature called ‘SMTP Restriction’. Go to WHM, log in using root, from Security Center select “SMTP Restrictions” and now, disable this. Your script shall now be able to send mail using remote SMTP like sparkpost/mailgun/pepipost.

failed to open db file /var/spool/exim/db/ratelimit: permission denied

Cpanel incoming mails are failing, with an error in the exim_mainlog as following:

failed to open db file /var/spool/exim/db/ratelimit: permission denied

The error is appearing due to some permission issues with the exim db or the files are corrupted. These files recreate when the exim restart. Hence, we can do the following:

# delete the db files
rm -rf /var/spool/exim/db/*

# restart exim
service exim restart

# fix permission of exim spool
chown -Rf mailnull.mail /var/spool/exim
chmod 0750 /var/spool/exim

You should be done now.

How to Configure Postfix Relay

Open your main.cf file, in my case, it’s a zimbra main.cf file:

nano /opt/zimbra/common/conf/main.cf

Now change the following settings:

relayhost = [smtp.yourrelayserver.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = static:relayusername:relaypassword
smtp_sasl_mechanism_filter = login

You need to replace 3 things here:

smtp.yourrelayserver.com should be your original relay server.
relayusername should be the relay authentication username.
relaypassword should be the relay authentication password.

Once done, you may now restart your postfix to see the mail is relaying through the new relay you have added.

How to manually install/renew Let’s Encrypt SSL in Zimbra

If you are having trouble installing Let’s Encrypt SSL with the certbot-zimbra.sh file, then probably you would need to follow this tutorial. To follow this tutorial, we first need to install certbot. certbot has a built in web server to allow you get the certificate without actually installing an extra web server or through Zimbra web server (nginx to be specific).

First, we install certbot with the following:

// install epel-release first
yum install epel-release
// install certbot from epel
yum install certbot

Once done, you may now use the following command to ensure certbot is working:

# certbot --help

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
it will attempt to use a webserver both for obtaining and installing the
certificate. The most common SUBCOMMANDS and flags are:

obtain, install, and renew certificates:
    (default) run   Obtain & install a certificate in your current webserver
    certonly        Obtain or renew a certificate, but do not install it
    renew           Renew all previously obtained certificates that are near
expiry
    enhance         Add security enhancements to your existing configuration
   -d DOMAINS       Comma-separated list of domains to obtain a certificate for

  (the certbot apache plugin is not installed)
  --standalone      Run a standalone webserver for authentication
  --nginx           Use the Nginx plugin for authentication & installation
  --webroot         Place files in a server's webroot folder for authentication
  --manual          Obtain certificates interactively, or using shell script
hooks

   -n               Run non-interactively
  --test-cert       Obtain a test certificate from a staging server
  --dry-run         Test "renew" or "certonly" without saving any certificates
to disk

manage certificates:
    certificates    Display information about certificates you have from Certbot
    revoke          Revoke a certificate (supply --cert-name or --cert-path)
    delete          Delete a certificate (supply --cert-name)

manage your account:
    register        Create an ACME account
    unregister      Deactivate an ACME account
    update_account  Update an ACME account
  --agree-tos       Agree to the ACME server's Subscriber Agreement
   -m EMAIL         Email address for important account notifications

More detailed help:

  -h, --help [TOPIC]    print this message, or detailed help on a topic;
                        the available TOPICS are:

   all, automation, commands, paths, security, testing, or any of the
   subcommands or plugins (certonly, renew, install, register, nginx,
   apache, standalone, webroot, etc.)
  -h all                print a detailed help page including all topics
  --version             print the version number
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Once you ensure certbot is installed, now you may use certbot to get the certificate, using the certbot –standalone tag. Remember to stop zimbra first, as Zimbra also runs a nginx web server, that would prevent certbot to use standalone or it’s own web server to verify certificate.

// from root, run
[root@mailapp ~]# service zimbra stop

// wait until zimbra stops, once done, use the following to get certificate for your domain/hostname in place of mail.domain.com
[root@mailapp ~]# certbot certonly --standalone -d mail.domain.com

This would get your certificate and save it in:

/etc/letsencrypt/live/mail.domain.com

Now, that folder would contain 4 files. Something like the following:

]# ls -la /etc/letsencrypt/live/mail.domain.com/
total 16
drwxr-xr-x 2 root root 4096 Apr 16 11:30 .
drwx------ 4 root root 4096 Feb 10  2020 ..
lrwxrwxrwx 1 root root   40 Apr 16 11:30 cert.pem -> ../../archive/mail.domain.com/cert8.pem
lrwxrwxrwx 1 root root   41 Apr 16 11:30 chain.pem -> ../../archive/mail.domain.com/chain8.pem
lrwxrwxrwx 1 root root   45 Apr 16 11:30 fullchain.pem -> ../../archive/mail.domain.com/fullchain8.pem
lrwxrwxrwx 1 root root   43 Apr 16 11:30 privkey.pem -> ../../archive/mail.domain.com/privkey8.pem

As you can see, these files are symbolically linked to another files, depends on how many time you are running certbot. Each time, it generates a number liker cert8.pem, the next one would be cert9.pem and so on. So the orignal files are here:

/etc/letsencrypt/archive/mail.domain.com/cert8.pem
/etc/letsencrypt/archive/mail.domain.com/chain8.pem
/etc/letsencrypt/archive/mail.domain.com/fullchain8.pem
/etc/letsencrypt/archive/mail.domain.com/privkey8.pem

Now, we have our certificates. We need to follow a couple of steps to make sure everything is set correctly.

First, zimbra SSL files are stored here

/etc/zimbra/ssl/letsencrypt

We clean all old pem files

rm -f /etc/zimbra/ssl/letsencrypt/*

Now, copy the pem files we got to this folder with the following:

cp /etc/letsencrypt/archive/mail.domain.com/cert8.pem /opt/zimbra/ssl/letsencrypt/cert.pem
cp /etc/letsencrypt/archive/mail.domain.com/chain8.pem /opt/zimbra/ssl/letsencrypt/chain.pem
cp /etc/letsencrypt/archive/mail.domain.com/fullchain8.pem /opt/zimbra/ssl/letsencrypt/fullchain.pem
cp /etc/letsencrypt/archive/mail.domain.com/privkey8.pem /opt/zimbra/ssl/letsencrypt/privkey.pem

Check, how we are renaming all the files with number to file name without number, like cert8.pem is moved as cert.pem here.

Now, change the ownership of these files to zimbra with the following:

chown -Rf zimbra:zimbra /opt/zimbra/ssl/letsencrypt/*

Now, we are done from root, change your ownership to zimbra

su - zimbra

First job, is to change your directory to the ‘/opt/zimbra/ssl/letsencrypt/’

cd /opt/zimbra/ssl/letsencrypt/

Let’s Encrypt files are very much ready to use, only with one problem. Let’s Encrypt do not add it’s root CA certificate with it’s chain.pem file. We need to do this. First open the certificate with nano editor as following:

nano chain.pem

Now, at the end of the file, add the following section:

After adding the above, your chain.pem file should look like the following

Now, save the file (CTRL + o) and exit (CTRL + x)

We need to do one more thing before we are ready to verify and deploy the certificate. We need to set the letencrypt private key that we used to generate the certificate as commercial.key of zimbra. You may do this with the following two commands:

rm -f /opt/zimbra/ssl/zimbra/commercial/commercial.key
cp /opt/zimbra/ssl/letsencrypt/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key

Now, you are ready to complete the job. First verify if everything is alright with the following:

[zimbra@mailapp letsencrypt]$ /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
** Verifying 'cert.pem' against 'privkey.pem'
Certificate 'cert.pem' and private key 'privkey.pem' match.
** Verifying 'cert.pem' against 'chain.pem'
Valid certificate chain: cert.pem: OK

If everything is ok, you may now deploy certificate with the following command:

/opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem

Once the certificate is deployed successfully, get out from the zimbra user to root user with the following command

exit

Now, you may start/restart zimbra with the following command:

service zimbra restart

If everything went right, you should now be able to go to your zimbra domain, and under the lock sign on the left of the domain shown in browser, you may click on it to see the extended date of ssl expiry. Sweet!

How to Install Zimbra Universal UI Theme on Zimbra 8.8.*

WHAT IS ZIMBRA UNIVERSAL UI

Zimbra universal UI is a theme by Zimbra, that is much more modern, professional looking theme, looks much near to Outlook theme. According to Zimbra, this is still in Beta since 2017, and not available anywhere unfortunately to install/download it from Zimbra until you are using one of the Zimbra Cloud by Zimbra Inc.

HOW DID WE MANAGE TO GET ZIMBRA UNIVERSAL UI?

Zeta Alliance had released an unofficial Zimbra 8.8.5 with the Zimbra Universal UI theme in it, that is downloadable here:

zcs-8.8.5_GA_2000.RHEL7_64.20171222124635.tgz

We installed it and tweaked the ZUU theme to be able to use in any Zimbra 8.8.* version available.

HOW TO INSTALL ZIMBRA UNIVERSAL UI

First keep a copy of zimbra folder:

rsync -vrplogDtH /opt/zimbra/jetty/webapps/zimbra /root/zimbra_backup

Then, download a copy of the zimbra UI from here:

wget https://mellowhost.com/downloads/zimbra-ui.tgz

Untar and migrate to zimbra folder:

tar -xvzf zimbra-ui.tgz
rsync -vrplogDtH zimbra/ /opt/zimbra/jetty/webapps/zimbra/

(Optional) This will install a new theme called ‘clarity’ which is our Zimbra Universal UI theme. You may either use this, and advise your users to choose this as a theme, or replace the default Harmony with this one. To do this, you may do the following:

cd /opt/zimbra/jetty/webapps/zimbra/skins
mv harmony harmony_old
ln -sf clarity harmony

This is done only by creating a softlink for old harmony to clarity theme

Now fix the permissions and restart zimbra to make everything work:

# Fix permission
/opt/zimbra/libexec/zmfixperms -v
service zimbra restart

You may now access Zimbra from your browser to see the new theme loading. If you are having trouble with the http access for your webmail, you may use the following to redirect your http webmail to https webmails

How to Redirect HTTP to HTTPs Zimbra 8.8.*