No specific error was returned with the failed API call

LoadFactor

• May 07, 2018 15:27

CLOUDLINUX 6.9 standard v68.0.38 I have a user who starts by reporting that he can't get mail. Dovecot says authentication failures. He goes in, sees no accounts. So he tries to create one and gets the error in the topic when trying to create an email account. I get the same result. A Google search gives the solution as a missing etc/ directory in user's home directory. Sure enough, no etc. I create it, give it the right permissions, check the cPanel account, everything looks fine, all 5 pre-existing emails are there. I tell the client he's good to go. Client logs in, all the email accounts are gone. I log in again, now they're really gone. Check the file system, everything is gone. Fortunately this user is very relaxed about the whole matter, but 9/10 clients would be justifiably enraged. That's scary. Any idea what happened and how to prevent it?

• 

  cPanelLauren

  • May 08, 2018 12:58

  Hi @LoadFactor The missing /home/$USER/etc/ folder would cause the initial behavior for sure. You mentioned when they log in all the accounts are gone again, do you mean the actual /home/$USER/mail/ directory is gone? Thanks!

  0
• 

  LoadFactor

  • May 08, 2018 14:03

  By the time I'd gotten there, my user had created a mail account, so I can't be sure, but aside from the normal entries for that single email, /home/{$user}/mail was empty, no evidence of the previous mail accounts. FYI I've got an overnight backup of the account from before this started, so I can always unpack that to see if it has any answers.

  0
• 

  cPanelLauren

  • May 08, 2018 14:16

  Hi @LoadFactor Are you aware if the user had more than just one email account prior to this having occurred? If so can you please open a ticket using the link in my signature so that we can take a closer look? Once you do please reply with the ticket ID so we can update the thread of the outcome. Thanks!

  0
• 

  LoadFactor

  • May 08, 2018 14:39

  Yup, five of them, I saw 'em on the cPanel side. Ticket number is 9525179.

  0
• 

  cPanelLauren

  • May 08, 2018 15:00

  Thanks for that, I see that the ticket is already being worked on by an analyst so hopefully, we should have an update for you soon.

  0
• 

  LoadFactor

  • May 08, 2018 16:53

  Alright, here's the best theory: this account gained a new web developer the same day, there's activity from some new IP addresses (gleaned via /usr/local/cpanel/logs/access_log). Best guess is that the new developer is a cPanel noob who decided to "clean up". It looks like shortly after I put /home/{$user}/etc back, this fellow might have cleaned out /home/{$user}/mail as well. And that's the sort of thing that backups are for more often than not :) I'm going to dig into the logs some more to see if I can build a better picture, but I probably won't be updating here. Thanks to you and Sean for the help.

  0
• 

  cPanelLauren

  • May 08, 2018 17:02

  Hi @LoadFactor I'm glad at least you have a working theory that would explain what happened. Thanks for updating the thread as well!

  0

Please sign in to leave a comment.