Plesk: /etc/init.d/qmail: line 25: [: =: unary operator expected

Re: qmail restart error, plesk qmail error,  [: =: unary operator expected

You have installed Plesk, updated all your modules, upgrade PHP, mysql, everything looks great. Then, you realise that you have Plesk with the Postfix MTA but you want Qmail MTA – so you go ahead and select Qmail MTA in the Plesk Upgrade Manager.

Install is fine, until you try to start qmail.

[root@server ~]# service qmail restart
/etc/init.d/qmail: line 25: [: =: unary operator expected

Before you panic, check this file:

# cat /etc/sysconfig/network
HOSTNAME=server.yourhostname.com
NETWORKING=yes

If you are missing the NETWORKING line, simply insert it.

# [root@server ~]# service qmail start
Starting qmail:                                            [  OK  ]

Your qmail service is now functioning as required. Panic over 🙂

Where is the Plesk maillog located?

Re: Where can I find the mail log in Plesk?

The mail logs in Plesk qmail are stored here:

/usr/local/psa/var/log/maillog

You can view the entire maillog like this:

# cat /usr/local/psa/var/log/maillog

Or you can look at the last 150 lines like this:

# tail -150 /usr/local/psa/var/log/maillog

You can watch the maillog devlop in real time like this:

# tail -f /usr/local/psa/var/log/maillog

You can search for specific entries like this:

# tail -500 /usr/local/psa/var/log/maillog | grep test@domain.co.uk

The Plesk maillog is your friend when it comes to finding spammers and email problems on your server.

How do I find the SPAM source on a Plesk server using qmail?

Re: Finding spammers in Plesk, find source of spam on Plesk server

If you are hosting a Plesk server wilth multiple sites then eventually you will find that spam will appear from one of those sites and it will be difficult to determine where the spam is coming from. This will put your server IP at risk of being suspended by your server provider.

First things first, let’s check to see if the spam is being sent by a mailbox user, this would indicate deliberate spamming from a client or a compromised password on a mailbox account.

Out of the ordinary authentications

A large number of authentications to a particular mailbox, ie. thousands, can indicate massive email activity, you can check this quickly as follows:

# cat /usr/local/psa/var/log/maillog |grep -I "LOGIN"|awk {'print $12'}|sort|uniq -c|sort -n

If you cannot see anything out of the ordinary, the search continues.

The Maillog is your friend

Let’s take a look at the plesk qmail maillog:

# tail -500 /usr/local/psa/var/log/maillog

Entries like the following indicate the domain and mailbox that the email is being sent from:

Dec  7 10:51:01 server qmail-local-handlers[29265]: from=info@spammerdomain.com

This leaves you no further work to do, possibly suspend the account and contact the client in question. You might want to clear the mail queue in the Plesk panel also.

Difficult to locate spammers

A more difficult situation is where the email is being sent using the Apache user or as anonymous. This type of email spam cannot so easily be traced to a sender as it is not being sent from a mailbox.

These entries look something like this:

Dec  7 10:50:17 server qmail-queue-handlers[29080]: from=anonymous@server.hostname.com

Or like this:

Dec  7 10:50:17 server qmail: 1323255017.404624 info msg 47220220: bytes 501 from <anonymous@server.hostname.com> qp 29081 uid 48

It is not possible to determine the spammer from the maillog in this situation. These emails are being sent using a form processor or other PHP mailer / PERL mailer script.

Track, Trace and Remove

To solve this problem you need to

  • Login to the Plesk Control Panel > Home > Mail Settings > Mail Queue
  • Click on one of the many SPAM emails you will see listed

Look for this at the top of the mail header:

Received: (qmail 2583 invoked by uid 10211)

Once you have the UID (which in this case in 10211) you can now trace the client like this:

# grep 10211 /etc/passwd

Which will show something like this:

dom74628:x:10211:2523::/var/www/vhosts/thespammerdomain.com:/bin/false

You can now proceed suspend the spam account and remove all the mails from the mail queue.

Plesk – Unable to stat entry ‘/usr/local/psa/handlers/info/’

Re: Mail being bounced even though Mailbox exists, bounce message

Hi. This is the qmail-send program at server.mailserver.com.
I’m afraid I wasn’t able to deliver your message to the following addresses.
This is a permanent error; I’ve given up. Sorry it didn’t work out.”

Take a look in the mail log file:

tail -1500 /usr/local/psa/var/log/maillog

You see errors such as this:

Unable to stat entry '/usr/local/psa/handlers/info'

To resolve you need to remove and rebuil all mail handlers as follows:

1. Stop the mail service

    # /usr/local/psa/admin/sbin/mailmng --stop-service

    OR

    # service qmail stop

2. Backup old handlers in a temporary directory

    # mkdir /usr/local/temp

    # cp -a /usr/local/psa/handlers/before-* /usr/local/temp/

    # cp -a /usr/local/psa/handlers/info /usr/local/temp/

3. Remove the handlers

    # rm -rf /usr/local/psa/handlers/before-*/*

    # rm -rf /usr/local/psa/handlers/info/*

4. Recreate handlers using mchk utility

    # /usr/local/psa/admin/sbin/mchk --with-spam

5. Start mail service:

    # /usr/local/psa/admin/sbin/mailmng --start-service

    OR 

    service qmail start

This may take a little time however it will resolve all errors.

How to remove DR WEB from Plesk

One of the first things we do to a Plesk server is remove Dr Web and all of it’s components which is not as easy as it may first appear as there are a number of modules that need removing.

Here we will show you how to remove all parts of Dr Web from your Plesk server.

Open an SSH session with your server and do the following:

# yum remove drweb-base drweb-bases drweb-common drweb-daemon drweb-updater psa-drweb-configurator

You will now find no trace of Dr Web in your logs or in your system.