The nginx webserver has a max. body size limit of 1 MB for requests as default. This might be too low for file uploads in scripts and you will see the following error message when you try to upload a file:
413 Request Entity Too Large
The configuration variable for this option is “client_max_body_size” and it can be set in the http, server and location sections of the nginx configuration file. To set the Limit globally to 25 MB, edit the nginx.conf file and add:
client_max_body_size 20M;
in the http section.
Example for Ubuntu Linux:
user www-data;
worker_processes 4;
pid /var/run/nginx.pid;
events {
worker_connections 768;
# multi_accept on;
}
http {
geoip_country /etc/nginx/geoip/GeoIP.dat; # the country IP database
geoip_city /etc/nginx/geoip/GeoLiteCity.dat; # the city IP database
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
Mod security will now start to block hack attempts to your websites and log the actions in the file /var/log/apache2/modsec_audit.log.
tail /var/log/apache2/modsec_audit.log
You will see very likely some falsely blocked URL’s. To whitelist them, you can add the ID’s of the rules that should not be used in the whitelist file.
Example:
vi /etc/apache2/mod-security/modsecurity_crs_99_whitelist.conf
The follwing article describes the steps that can be taken to debug the ISPConfig 3 server scripts.
Enable the debug Loglevel in ISPConfig
Login to the ISPConfig intterface and set the log level to Debug under System > System > Server Config (see also chapter 4.9.2.2 of the ISPConfig 3 manual) for the affected server. After one or two minutes, there should be more detailed messages in ISPConfig’s system log (Monitor > System State (All Servers) > Show System-Log).
Disable the server.sh cronjob
Go to the command line of the server on which the error happens (on multiserver systems, it is often the slave and not the master) and run (as root):
Run the server script manually to get detailed debug output
Then run the command:
/usr/local/ispconfig/server/server.sh
This will display any errors directly on the command line which should help you to fix the error. If you have fixed
the error, please don’t forget to uncomment the server.sh cron job again.
If you get a 500 error in a webpage hosted on Debian Linux (6.0) with apache webserver and fastcgi, take a look into the apache error.log file. This can either be the global error.log or the error.log of the website where you got the error. If you find a error similar to this one:
If you have a local mail server installed and change your server controlpanel to ISPConfig 3, having used ISPConfig 2 in the past, you may have to change the value that defines the form field observed by all functions in need of the address that mails are supposed to be delivered to (catchalls, etc.) on your mail server preferences since the identifier has changed from X-Delivered-To to Delivered-To in ISPConfig 3; otherwise the system won’t be able to find the necessary information in the mails’ headers.
The following guide describes the steps to add DNS records that route emails from a domain managed in ISPConfig 3 to google apps / gmail. The guide assumes that you have already setup the dns zone for your domain in ispconfig.
Login to ISPConfig, click on the DNS module icon in the upper navigation bar, then open the settings of the DNS zone that you want to redirect to google and click on the “records” tab. You should see a record list similar to this:
The following guide shows how to disable and remove mysql replication from two or more mysql servers. These steps can be used for master/slave and master/master mysql setups. The following SQL commands have to be be executed in phpmyadmin or with the mysql commandline program. It is just important that you are logged in as mysql root user. Below I will use the mysql commandline client.
Login into mysql as root user from commandline:
mysql -u root -p
the mysql command will ask for the mysql root password.
Then execute these commands if the installed mysql version is < 5.5.16:
STOP SLAVE;
RESET SLAVE;
QUIT
use the commands below instead if the mysql version is > 5.5.16
STOP SLAVE;
RESET SLAVE ALL;
QUIT
Now edit the my.cnf file (/etc/mysql/my.cnf) and add a # in front of all lines that start with “replicate-” or “master-”. Example:
If you use the apache mod_security module on your apache server, you might encounter wrong 403 errors for several URL’s of the cms systems. Here are some exception rules to avoid that:
Add these rules inside the vhost file of the website. If you use ISPConfig to manage the server, then add the rules in the apache directives field of the website settings in ispconfig.
If you get error messages from amavisd similar to the one posted below on a server which is virtualized with OpenVZ:
Mar 5 09:09:02 v100 amavis[17378]: (17378-14) (!!)TROUBLE in process_request: Error writing a SMTP response to the socket: Broken pipe at (eval 100) line 987, <GEN44> line 31.
then the issue can be caused by the NUMTCPSOCK value in the openvz limits. Even if the barrier of this limit was never met in /proc/user_beancounters, the above error occurs when more then 25% of all TCP sockets were used. The solution is to set the NUMTCPSOCK barrier and limit to a high value in the openvz container configuration file. Here a value that worked for me on a moderately used mailserver:
NUMTCPSOCK=”2000:2000″
Finally restart the OpenVZ VM to apply the new limit value.
Dovecot is watching the whole server filesystem for modifications and removed or added sub filesystems. If you get errors similar to this one on your server:
Aug 30 09:10:23 server1 dovecot: master: Warning: /var/www/clients/client1/web1/log is no longer mounted. If this is intentional, remove it with doveadm mount
(the directory path may vary), then you can fix it by excluding the path from being watched by dovecot. In my case, dovecot shall not watch my website directories as they do not contain any mailboxes
Run the following command on the shell as root user:
doveadm mount add ‘/var/www/*’ ignore
To exclude all files and folders in /var/www from deovecot monitoring.
Here is a list of ports that are used commonly on ISPConfig 3 servers. If you dont have all services installed or if you e.g. dont want to connect to MySQL from external servers, then close the unused or unwanted ports.
Jailkit is an easy to use tool to create and maintain jail environments for shell users on Linux. In this guide, I will show you how to move PHP and its dependencies into the jail so that the jailed user can execute PHP scripts inside the jail.
Edit the jailkit .ini file and add a section for PHP at the end of the file
Open the jk_init.ini file with an editor:
nano /etc/jailkit/jk_init.ini
and paste the following lines at the end of the file:
High page speed and short page load times of your website are essential for good search engine rankings today. In this FAQ, I will show you how to enable caching of graphic and CSS files in apache on Ubuntu and Debian.
The first step is to enable the expires module in apache:
a2enmod headers expires
This module allows the apache web server to set HTTP headers, in this case, to set the modification header for static assets like image and CSS files that don't change often.
Add the following config snippet inside the vhost file of the web site or at the end of the file /etc/apache2/apache2.conf to enable it globally.
<FilesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf)$">
Header set Cache-Control "max-age=3024000, public"
</FilesMatch>
Finally reload apache to apply the configuration change.
service apache2 reload
On ISPConfig 3 servers, the snippet can be added in the "Apache Directives" field of the website instead. There is no apache reload required as ISPConfig takes care about that.
This tutorial describes the steps to renew the SSL Certificate of the ISPConfig 3 control panel. There are two alternative ways to achieve that:
Create a new OpenSSL Certificate and CSR on the command line with OpenSSL.
Renew the SSL Certificate with the ISPConfig updater
I'll start with the manual way to renew the ssl cert.
1) Create a new ISPConfig 3 SSL Certificate with OpenSSL
Login to your server on the shell as root user. Before we create a new SSL Cert, backup the current ones. SSL Certs are security sensitive so I'll store the backup in the /root/ folder.
tar pcfz /root/ispconfig_ssl_backup.tar.gz /usr/local/ispconfig/interface/ssl
chmod 600 /root/ispconfig_ssl_backup.tar.gz
Now create a new SSL Certificate key, Certificate Request (csr) and a self signed Certificate.
2) Renew the SSL Certificate with the ISPConfig installer
The alternative way to get a new SSL Certificate is to use the ISPConfig update script.
Download ISPConfig to the /tmp folder, unpack the archive and start the update script.
cd /tmp
wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
tar xvfz ISPConfig-3-stable.tar.gz
cd ispconfig3_install/install
php -q update.php
The update script will ask the following question during update:
Create new ISPConfig SSL certificate (yes,no) [no]:
Answer "yes" here and the SSL Certificate creation dialog will start.
This tutorial shows how you can build your own custom template for the PDF invoices in the ISPConfig billing module. The custom template will be update-safe, so you don't have to worry that your modifications will vanish on ISPConfig or Billing Module update.
What we will do
I will create a new custom template with the name "mycompany" and set this template as the default template for new invoices, proforma invoices and credit notes.
The Basics
The templates for the PDF files that get created by the ISPConfig Billing Module are in the folder:
Each template has it's own folder, the folder name is the name of the template. Please note that the folder name has to be in lowercase letters and it may not contain whitespaces. Instead of a whitespace, you can use an underscore "_" in the folder name.
Here is a screenshot how the folder with the default templates looks like.
The file invoice.conf.php contains the base settings of the invoice like fonts, background color, and column widths. The file make_pdf_invoice.php is the actual PDF template, it contains the code that creates the invoice. The file test.php can be used to test the invoice. In that file, you can set the ID of an invoice that shall be rendered directly in the browser.
Create a custom invoice template in ISPConfig Billing Module
Let's get started with the new invoice template. I will use the "default" template as the basis.
Make a copy of the default template and name it "mycompany".
cd /usr/local/ispconfig/interface/web/billing/templates/pdf_invoice/mycompany
and edit the make_pdf_invoice.php file.
nano make_pdf_invoice.php
Near the top of the file, you will find this line:
class PDFInvoice_default extends tFPDF
The word default in that line refers to the name of the invoice template. Change the line to:
class PDFInvoice_mycompany extends tFPDF
so that the name matches the on that you have chosen for your template.
Next, open the test.php file:
nano test.php
Set the ID of the invoice that you like to render for test purposes in line 11. The ID refers to the column invoice_id of the database table invoice in the ISPConfig database. In line 20, exchange the word default with the name of your invoice template. In case of this example, the line will be like this:
$pdf = new PDFInvoice_mycompany();
Activate the invoice template in ISPConfig
Login to ISPConfig as admin user, go to the billing module. There you click on Settings > Company in the left menu to edit the company details. Select your custom invoice template in the PDF invoice template field:
file to customize the invoice. The code in this file is commented, so you should easily find the places where you can adjust headline, address field etc. in your template.
Testing
There are several ways to test your new template. One way is that you open the details of an existing invoice (or create a new one) and press the "Save and finalize" button, this will create a new invoice based on your custom template. Then click on the PDF download icon to download or view it.
This procedure might become a bit annoying when you want to do extensive edits. That's why we made the test.php file for. Login to ISPConfig as admin.
To use test.php, login to ISPConfig as admin user (test.php will not work without login), then modify the URL in the browser to point to the test file. Example:
and press return. The invoice with the ID that you configured in the test.php file will get rendered with your new template directly in the browser. Just press reload after editing the make_pdf_invoice.php file the latest changes you made in the template.
This tutorial shows you how to solve the RoundCube webmail error message:
config.inc.php was not found.
on an ISPConfig Debian server that uses Nginx as the web server.
Solution
RoundCube webmail is accessed on an ISPConfig Nginx web server through the apps vhost. The PHP-FPM of the apps vhost is running under the user and group ispapps. To fix the above error you'll have to change the owner of some RoundCube files.
Run these commands as root user to apply the changes.
This tutorial explains how to change your DNSSEC algorithm for a DNS zone managed by ISPConfig 3.
In this case, the current algorithm is 7 (NSEC3RSASHA1), and we will be moving to algorithm 13 (ECDSAP256SHA256)
Log in to the panel and open the settings for the zone. Enable the new algorithm, but DON'T disable the current algorithm yet.
When the new keys are generated, you can find them in the box "DNSSEC DS-Data for registry". You will see both the keys for your old, and for your new algorithm. It will look something like this:
; This is a zone-signing key, keyid 6417, for example.com.
; Created: 20200812004704 (Wed Aug 12 02:47:04 2020)
; Publish: 20200812004704 (Wed Aug 12 02:47:04 2020)
; Activate: 20200812004704 (Wed Aug 12 02:47:04 2020)
example.com. IN DNSKEY 256 3 13 DBOqv9nfRRmR7WoDH6WVSWra2gHkFF9gdvsVyDoyfv2D3oV3pGa2TAqw JMyLIrrB/LqyEnhowR3r9pWNISpbpw==
In this example, the keyid is 6417, it's the ZSK (256), and the algorithm is 13.
Copy both the new zone-signing key and key-signing key to your registry, and fill in the necessary fields (ZSK/KSK, keyid, algorithm).
After adding these keys, wait for the changes to propagate. You can monitor this with https://dnsviz.net.
When the changes are propagated (this will probably take 4 to 24 hours), you can remove the old keys from your registry. Wait for these changes to propagate again. When this is propagated, you can disable the algorithm in the ISPConfig interface.
