Beiträge von ñull

I think I must retract this question. I notice now you can create a certificate at admin level and then assign it to a reseller's end user, which apparently in this case I did. I changed the end user instance of this certificate from Start SSL to Let's Encrypt, but I should have done that on admin level. I tried now to do it on admin level and it seems to have "taken over" the certificate management although there could be a conflict there.

First of this seems all very confusing and at end user level it should be clearer who in fact really owns the certificate. When admin made certificate then I thing the end user should not be able to touch it or when he does, it should break the dependency chain (remove it from admin).

Secondly I think it should be clearer in the user interface what is really going on here. On the end user side I could not see that the certificate in fact was made on admin level and assigned to the end user (you can only see this on the admin side). This lead me to make the mistake.

I cut and paste the certificates from end user to admin now and it was accepted and then enabled the ACME management on it. I don't know if Let's Encrypt will now accept that management was taken over by the new ID. If this is not possible without errors, LC should warn me or make it impossible to do so (instructing me how to do it right). I then disabled the ACME management at the end user side. I now wait and see what happens next renewal attempt, if it will error out because of ID change.

I created a ACME managed certificate for domain mail.example.com of User A but now I want to use it as mail server certificate. This is impossible because the admin user is not owning and therefore cannot see the certificate of user A. Obviously I want the certificate to work now and being updated automatically when it expires (the old one is expiring soon).

What is the appropriate procedure to migrate this certificate to the admin account where I can then use it as mail server certificate? What happens when I delete the certificate? Can I then request the same domain again under the Admin account? Or will it be revoked / blocked until expiry?

Please note that this is not only moving ACME certificate from one subscription to another but also from one LE ID to another. LC does not allow to re-use a LE ID between different subscriptions, which I experience as a great disadvantage.

As company I manage admin, my clients under a reseller account and my hosting domains under a normal hosting account. In this set up I would need only one Let's Encrypt ID for all my certificates, but LC does not allow me and tells me the ID is already in use.

I would like the Certificate management to be centered around the Let's Encrypt ID, not around the LC subscription. Now I have several different LE IDs in several contracts and they cannot be used between each other. The whole questions I ask here are a result of this.

Sometimes you don't want to put a personal first and last name when the contact is a company. However in the list of users the company name never appears. The user name for security reasons might not clearly identify the company, nor the name of a person.

Could you please do something to improve this? May be you could also list the company name when the associated Contact Type is "Company/Organisation"?

inet_protocols configuration is in fact correctly used by LC and I oversaw that. Except for SPF (DNS still propagating) all seems ready after I followed your suggestion. Already delivered to Gmail via IPv6. Thanks for your encouragement!

Effectively. I manually added smtp_address_preference = ipv4 and from then on emails arrived normally like before.

In LC mail server setting I see the select box outbound IPv6 address. One of the options is no outbound IPv6 I would expect that then smtp_address_preference = ipv4 is added to /etc/postfix/main.cf but I cannot find it there. I believe my mails are marked spam because recently ipv6 was activated on my vServer and may be postfix is using IPv6 now.

See also http://serverfault.com/questio…ix-use-ipv6-and-when-ipv4

There is a minor inconvenience and confusion for users when they add a new database. Just before submitting the form the user remembers that the database should be created under another subscription. Apparently the javascript counts on it that you follow the top-down order when filling out the form. When you change the subscription the other field content remains unchanged, which is good, but then the save button is greyed out! Apparently it "believes" that you should still fill out the other fields, but they are already, because the user simply decided to change the entry order, just correcting one error, namely the subscription.

The work around is that you add one character to the user name and then delete the added character again. The javascript will see the entry, validate the form and the save button becomes active. The fix would be that the form is not only validated when the text forms changed, but also when subscription changed.

Every time a new domain zone is created by LC, I need to manually create the zone on a secondary DNS servers. Is there no easy way to at least run some custom bash scripts every time a zone is created and deleted? That would be very helpful. My understanding of LUA script is not sufficient to suggest any solution.

I have this overriden in custom.lua:

function LC.users.addUser(user, group, home, shell)


  LC.log.print(LC.log.INFO, "Adding system account '", user, "'")


  if shell == "sh" then
    shell = "/bin/bash"
  elseif shell == "scponly" then
    if LC.fs.is_file("/usr/bin/rssh") then
      shell = "/usr/bin/rssh"
    else
      shell = "/usr/bin/scponly" 
    end
  elseif shell == "nologin" then
    if LC.fs.is_file("/sbin/nologin") then
      shell = "/sbin/nologin"
    else
      shell = "/usr/sbin/nologin" 
    end
  else
    shell = "/bin/false"
  end


  if LC.distribution.family == "Debian" then
    useradd = "/usr/sbin/useradd -m -d " .. home .. " -g " .. group .. " " .. "-s " .. shell .. " " .. user
  elseif LC.distribution.family == "SunOS" then
    useradd = "useradd -m -d " .. home .. " -g " .. group .. " " .. "-s " .. shell .. " " .. user
  elseif LC.distribution.family == "RedHat" then
    useradd = "/usr/sbin/useradd -m -d " .. home .. " -M -g " .. group .. " " .. "-s " .. shell .. " " .. user
  elseif LC.distribution.family == "SUSE" then
    useradd = "useradd -m -d " .. home .. " -g " .. group .. " " .. "-s " .. shell .. " " .. user
  elseif LC.distribution.family == "BSD" then
    useradd = "pw useradd " .. user .. "-m  -d " .. home .. " -g" .. group .. " -s" .. shell .. " -c ''" 
  elseif LC.distribution.family == "Gentoo" then
    useradd = "/usr/sbin/useradd -m -d " .. home .. " -g " .. group .. " " .. "-s " .. shell .. " " .. user
  end


  local rc = LC.exec(useradd)


  if rc ~= 0 then
    return false, "Error while adding user '" .. user .. "' (exit code: " .. rc .. ")"
  end


  if LC.hooks then
    LC.hooks.check("LC.users.addUser", user, group, home, shell)
  end


  return true


end

Could you please add this feature to users.lua in a next release? It is very useful because it will allow us administrators to use the /etc/skel to set some desired defaults, like relocating the HOME to priv etc.

Thank you!

Zitat von kk

It's up and running again.

By the way: thank you for your translations!

I'm used to open source and I gladly keep my promise to maintain my translations up-to-date as a small contribution to this unique hosting control panel.

I wanted to update Spanish and Dutch translation but got the 502 error.

Zitat von Beichti

Look to http://sfwall.de, here you find the Spam Firewall for incomming or for outgoing spam.

Outgoing is to expensive for me, sorry!

In the Wiki I find the instructions to migrate from Liveconfig using SQLite to using MySQL. I experience a problem in the third step:

Zitat

Schritt 3: Import der Daten
Importieren Sie nun die in Schritt 1 exportierten Daten in MySQL:

$ mysql -u liveconfig -p -h localhost LIVECONFIG < /root/dump.sql
Enter password: ************

I get the error ERROR at line 91: Unknown command '\\'. Line 91 is a very long line beginning with

INSERT INTO APPTEXTS (AT_ID, AT_REV, AT_APPID, AT_LANG, AT_TITLE, AT_DESC_SHORT, AT_DESC_LONG, AT_VENDOR_URL) VALUES

and it continues with all the values on the same line. 91. Likely the script lcdbdump needs some correction to avoid long long lines?

Bei aptitude safe-upgrade sehe ich jetzt:

# aptitude safe-upgrade
Resolving dependencies...                
The following NEW packages will be installed:
  liblua5.1-0{a} libopendbx1{a} libopendbx1-mysql{a} libopendkim9{a} librbl1{a} libunbound2{a} libvbr2{a} 
  opendkim{a} 
The following packages will be REMOVED:
  libapache2-mod-php5{u} 
The following packages will be upgraded:
  liveconfig-meta 
1 packages upgraded, 8 newly installed, 1 to remove and 0 not upgraded.
Need to get 603 kB of archives. After unpacking 7,875 kB will be freed.
Do you want to continue? [Y/n/?] n
Abort.

Nicht so schön wenn einige Kunden davon abhängig sind.

When logged in as admin, you can set the contact and associated email of the admin login user. This contact email is also the sender address of the password reset email. Not only for the admin but for all users that request a password reset. If you set your admin contact email for instance to a gmail address and someone with a gmail address tries to reset his password, he will get an email with:

from: my@gmail.com
to: client@gmail.com
etc.

When you client@gmail.com receives the password reset email it will end up in the SPAM box. When POP3 service is used to retrieve client@gmail.com emails, then it will go unnoticed. When IMAP is used the message will silently go in the SPAM folder and there will be no notification of new mail (bold folder name in Thunderbird; it is SPAM therefore no notification needed, right?) With large hosting companies, with many password resets, the server might even end up being blacklisted.

My suggestions to improve this to either have a full blown smtp client in Liveconfig that would allow sending email from any smtp server or an extra Sender address setting for password reset emails. May be the Sender email should be part of the email template configuration?

I can confirm that this bug is apparently fixed. At least I cannot reproduce it any longer.

Still doubting if that is the cause. It fails to reset correctly even with more complex passwords. I am glad that at least "PaSsWoRt" keeps working.

No two factor authentication and yes the latest version. But I now discovered the reason why command line password reset failed. Apparently it now tests for how complex the password is. I used a lowercase only password and it failed, without notifying. Then I used the PaSsWoRt like in the example and voila I could suddenly log-in. So please could you check that and let the comman-line password reset give an error message when the password is weak and not the - /usr/sbin/liveconfig: Password updated successfully.

This issue remains unsolved and is becoming more urgent now. It has repeated itself on a second test server, where the admin password spontanuously stopped working. Happily I could reset the password there from the command line. On my first test server it still fails to reset.

I just generated a new Let's Encrypt certificate at 7:21 UTC (that's what "date" returns from server command line) and in the SSL manager it appears as 6:21

Not very important because the certificate works ( I don't need to wait an hour).