Lena

Thank you. Everything worked, but suddenly all my CGI scripts stopped to work. For example, http://mail2ftp.heliohost.org/env.pl gives "500 Internal Server Error", in the log: "End of script output before headers: env.pl". It worked yesterday, I didn't touch that script file, its permissions remain rwx r-x r-x, .htaccess contains: AddHandler cgi-script .pl I couldn't find anything suspicious in Plesk. "CGI support" allowed and remains checked. In Apache settings I added in Handlers: "cgi-script .pl" - that didn't help. May be some protection was tripped on my account? I cannot guess why. Even simpler CGI script http://mail2ftp.heliohost.org/testperl.pl also doesn't work, same 500 Internal Server Error, same in log "End of script output before headers: testperl.pl". Sorry to bother you.

50 min after the test email message I mentioned above (one line "help" in plain text message body, Subject ignored), I received an email reply from the script, so piping worked. I don't know why the delay (the delay is not because of receiving mailserver, I whitelisted johnny IP-address there). Forwarding isn't visible in Plesk. A copy of the incoming email message is kept in the mailbox, but that's no problem. johnny.heliohost.org resolves to 65.19.141.67, but PTR for that IP-address doesn't resolve: dig -x 65.19.141.67 @8.8.8.8 ... ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 23760 ... dig +trace -x 65.19.141.67 ... 67.141.19.65.in-addr.arpa. 86400 IN CNAME 67.subnet64.141.19.65.in-addr.arpa. subnet64.141.19.65.in-addr.arpa. 86400 IN NS ns2.heliohost.org. subnet64.141.19.65.in-addr.arpa. 86400 IN NS ns1.heliohost.org. ;; Received 129 bytes from 216.66.1.2#53(ns4.he.net) in 36 ms dig 67.141.19.65.in-addr.arpa. ptr @ns1.heliohost.org ... ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 13410 ... dig 67.141.19.65.in-addr.arpa. ptr @ns2.heliohost.org ... ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 51684 ... This is bad for emails from johnny. Thank you.

Again the same error message: while trying to set up forwarding on https://johnny.heliohost.org:8443/smb/email-address/edit/id/64 (Plesk - Mail - mail2ftp()mail2ftp.heliohost.org - Forwarding). Instead of being piped to the script, a test email appeared in that mailbox (accessible via Roundcube web-mail), twice for some reason. I tried to find that mailbox (file or dir) among files accessible for CGI scripts on my account - unsuccessfully.

Same without the pipe character "|".

Also "You specified invalid email address: |/home/mail2ftp.heliohost.org/public_html/server/mail2ftp.pl."

The purpose of my account "mail2ftp" is to provide free email-to-FTP service: users can send emails to the email address <mail2ftp @ mail2ftp.heliohost.org> on that account, I had an email forwarder set up in cPanel with forwarding to a pipe: |/home/mail2ftp/public_html/server/mail2ftp.pl Incoming emails were processed by that script. After migration today from tommy (cPanel) to johnny (Plesk), the forwarder disappeared, and when I try to set up forwarding to that pipe, Plesk (unlike cPanel) complains "You specified invalid email address: |/home/mail2ftp/public_html/server/mail2ftp.pl." I tried to set up forwarding as a filter in RoundCube web-mail, same error message. How can I set up forwarding to a pipe? Or can admin set up this forwarding?

65.19.141.67 (johnny.heliohost.org) is blacklisted for spam, some culprits are visible on http://www.projecthoneypot.org/ip_65.19.141.67 Example Messages Sent From 65.19.141.67 From: Joseph Kruger <directorpaymentoffice@dwtntwk.helio Subject: Collaborative partnership From: Gary Hoffman <ec1726257@cablentw.heliohost.org> Subject: United Nations payment office From: Gary Hoffman <ec1726257@cablentw.heliohost.org> Subject: Your Immediate Response From: Gary Hoffman <ec1726257@cablentw.heliohost.org> Subject: The United Nations payment office

Until yesterday, emails from Johnny came from [64.62.211.131]. Today I received email from my account on Johnny from new IP-address [65.19.141.67]. This new IP-address hasn't reverse DNS - that's bad for email: many recipients reject all mail from IP-addresses without reverse DNS. Please set RDNS for 65.19.141.67 to johnny.heliohost.org .

Stevie got into the CBL blacklist (and as a consequece info the widely user ZEN blacklist): http://www.abuseat.org/lookup.cgi?ip=65.19.143.2 That means that some user's password was stolen and used for spamming. How to detect and block stolen passwords automatically in Exim: https://github.com/Exim/exim/wiki/BlockCracking

HelioHost username: mail2ftp server: stevie main domain: mail2ftp.heliohost.org Suspended for unknown reason. http://www.heliohost.org/home/support/scripts/renew : "we either could not find that account in the database, or it is not listed as inactive".

A virus (email worm) in a computer with Windows in India sent itself as a .exe attachment to (published) email address in my account. The virus forged that same email address in From and envelope-from. Exim on stevie bounced the message because of .exe attachment. But the bounce went again to the same email address. The bounce message (containing .exe) was stored in that "bounced" file for my manual inspection which I do monthly. I deleted the file. I changed my software to try to truncate saved bounce messages before the beginning of .exe or similar attachment.

my HelioHost username: mail2ftp server: stevie my HelioHost main domain: mail2ftp.heliohost.org I don't know why it's suspended. I last logged into cPanel on November 30. Today I tried to renew/reactivate and got: "We're sorry, but we either could not find that account in the database, or it is not listed as inactive. Please contact an administrator if you feel this message is in error".

I tried - the same. I had to reset password (for the first time ever), now cPanel login works.

Still the same problem.

Hello, Username "mail2ftp". http://stevie.heliohost.org:2082 keeps asking for username and password (HTTP basic authentication) again and again. If I choose Cancel and enter username and password in the webform, again basic authentication popup appears, and so on in endless cycle. Same complaint of another user; http://www.helionet.org/index/topic/19401-cpanel-login-problems/

This test says failed: http://dnsstuff.host...e.heliohost.org (the last test in the MX section). The line in the zone file should be: 2 14400 IN PTR stevie.heliohost.org. (with the dot after "org", but nothing after it).

Which mailservers aren't accepting mail from stevie then? For example, @ukr.net, @ngs.ru, @meta.ua . My mailserver accepts mail from stevie only because I wrote the clause in its config to accept if connection is encrypted (TLS). It's fairly uncommon logic. Usually one of spam checks is for FCRDNS: IP-address must resolve to a hostname, and the hostname must resove to the same IP-address. "stevie.heliohost.org.subnet0.143.19.65.in-addr.arpa." doesn't resolve. Usual logic is to reject on lack of DCRDNS. My server greylists mail from such suspicious hosts, but that's also fairly uncommon. All what is needed is to add a dot after the "org" in the zone file.

I use `host` and `dig` commands under FreeBSD: ~ $ host 65.19.143.2 2.143.19.65.in-addr.arpa is an alias for 2.subnet0.143.19.65.in-addr.arpa. 2.subnet0.143.19.65.in-addr.arpa domain name pointer stevie.heliohost.org.subnet0.143.19.65.in-addr.arpa. ~ $ dig -x 65.19.143.2 ... ;; QUESTION SECTION: ;2.143.19.65.in-addr.arpa. IN PTR ;; ANSWER SECTION: 2.143.19.65.in-addr.arpa. 86174 IN CNAME 2.subnet0.143.19.65.in-addr.arpa. 2.subnet0.143.19.65.in-addr.arpa. 14174 IN PTR stevie.heliohost.org.subnet0.143.19.65.in-addr.arpa. ... An example of web-tool: http://dnsstuff.host...DNS=65.19.143.2

Now 65.19.143.2 resovles to stevie.heliohost.org.subnet0.143.19.65.in-addr.arpa. instead of stevie.heliohost.org. (because of lack of the dot after "org" in the zone file).

Thanks. Please add a dot at the end of "stevie.heliohost.org" in the PTR. Currently (without the dot) 65.19.143.2 resolves to stevie.heliohost.org.subnet0.143.19.65.in-addr.arpa.

I found additional details and edited my post above (ns1,ns2.heliohost.org configs need to be changed).

Mail from stevie goes from [65.19.143.2] with "helo=stevie.heliohost.org". The hostname stevie.heliohost.org resolves to 65.19.143.2 - that's good. But 65.19.143.2 has broken reverse DNS - that's bad, causes mail from stevie to be rejected by some recipient mailservers. I ran `dig +trace -x 65.19.143.2`, it showed that requests for reverse DNS for 65.19.143.2 are redirected (CNAME) to 2.subnet0.143.19.65.in-addr.arpa for which the nameservers are ns1.heliohost.org and ns2.heliohost.org. But currently ns1.heliohost.org and ns2.heliohost.org refuse requests for "2.subnet0.143.19.65.in-addr.arpa.". Please configure nameservers ns1.heliohost.org and ns2.heliohost.org to handle the zone subnet0.143.19.65.in-addr.arpa and to reply "stevie.heliohost.org" to TXT requests for 2.subnet0.143.19.65.in-addr.arpa.

a. your HelioHost username: mail2ftp b. the server your account is on: Stevie c. your HelioHost main domain: mail2ftp.org.ua No notice. I don't know why it's suspended (perhaps on about September 17). Tjoene replied to my previous topic http://www.helionet....ended-mail2ftp/ (I couldn't reply there because the topic was closed): The first thing I did was to try to reactivate. Now I tried again and got "We're sorry, but we either could not find that account in the database, or it is not listed as inactive. Please contact an administrator if you feel this message is in error." again. Then I again cleared browser cache, went to http://mail2ftp.org.ua and again saw "HelioHost Account Suspended". Then I again tried to log in to cPanel and again got "Login Attempt Failed". My account should not be suspended for inactivity because I successfully logged in to cPanel on September 15 (I do it on 15 and 30 of every month).

a. your HelioHost username: mail2ftp b. the server your account is on: Stevie c. your HelioHost main domain: mail2ftp.org.ua No notice. I don't know why it's suspended (perhaps on about September 17).

Not exactly. Memory Used 84.5 % Swap Used 99.99 %