By default inline HTML is disabled in Horde.

Resolution

To enable inline HTML, set option “inline” to “true” in the following files:

/usr/share/psa-horde/imp/config/mime_drivers.php
/usr/share/psa-horde/config/mime_drivers.php

Example:
/* HTML driver settings */
‘html’ => array(
/* NOTE: Inline HTML display is turned OFF by default. */
‘inline’ => true,

This command will update your virtuozzo license. I needed to do this whenever we increase the number of virtuozzo containers we are licensed to create on our hardware node:

/usr/sbin/vzkeyupdate -n

Dr. Adams at http://psychological.com had a problem getting rid of google sitemap errors. After resolving the problem he sent us this update:

If you use Youst as an SEO plug-in for WordPress, do NOT use Youst for creating a sitemap. If you fail to uncheck a box, it creates a sitemap.HTML, and Google becomes obsessed with it. Instead use the Google plug-in for Sitemap.

OK, so you now have Google believing you have sitemap.html…even though such a file does not exist.

So you see a list of errors in Google Webmaster Tools, and you will never get rid of it. Never, ever…for eternity. Trust me.

It occurred to me that every stiemap.xml (sitemap-authors.xml) that is now misidentified as .html.

So you take each of those misperceived *.xml files and test them in Webmaster Tools. They will return NO errors. You then submit them one at a time. Each has many sitemap files nested beneath.

So each one you test/verify has many files beneath it.

Then you submit each (which includes nested files) again. This time they will pass.

I had 66 sitemap errors, all listed as html even though they are not.

Once you verify and then submit again, they go away.

Store SPAM and HAM messages in two different folders, for example ‘train_spam’ and ‘train_ham’.

Train Spamassassin for one mailbox using the messages from that folders:

cd /var/qmail/mailnames/DOMAIN/spam/Maildir/

sa-learn –spam .train_spam/*
Output will look similar to this:
Learned tokens from 727 message(s) (13758 message(s) examined)

sa-learn –ham .train_ham/*
Output will look similar to this:
Learned tokens from 573 message(s) (11408 message(s) examined)

Copy the spam assassin files into every email account on the server. Keep in mind that if anyone was doing their own spam/ham sorting this will override it (whitelist/blacklist will be left alone).

find /var/qmail/mailnames/ -mindepth 2 -maxdepth 2 -type d -exec /bin/cp -f /var/qmail/mailnames/DOMAIN/spam/.spamassassin/bayes_* {}/.spamassassin/ \;

Spam Protection
PrecisionPros uses the latest and best in technology to combat and reduce unsolicited email (spam). We estimate that over 95% of all email traffic is spam. Spam is not only a distraction; it can serve as a vector for viruses, malware, and phishing attacks. Our email spam filtering system is a continuously-updated, multi-layered process that eliminates 98% of all spam with near zero false-positives. Below is the layering process:

Layer 1: The Gateway Scan
As soon as an email arrives the sending IP address is compared to an aggregated spam blacklist compiled from multiple spammer tracking systems. Our gateway servers also analyze the email message in the context of other arriving mail. If a large number of emails are coming simultaneously from a single IP or are addressed to random addresses that do not exist in our system, it could signify a spam attack and the email will be blocked. If the sending address is from a domain in our system but the mailbox does not exist the email will be blocked. This last case is called “spoofing” and it is the reason you may have received spam from your own email address or domain.

Layer 2: Cloudmark® Scan
All email is scanned by Cloudmark’s industry-leading spam detection software. Cloudmark uses Advanced Message Fingerprinting™ to detect spam, phishing, and viruses. Instead of relying on a spam blacklist Advanced Message Fingerprinting examines algorithm patterns that expose spam across all languages and character formats. These patterns are updated every 60 seconds based on worldwide feedback loops and the latest spammer tactics.

Layer 3: The Message Sniffer Scan
Email is then scanned with Message Sniffer from ARM Research Labs. Message Sniffer relies on pattern recognition and machine learning technology to detect spam and malware. It searches the entire message for spam, virus, and malware features including unusual headers, structural artifacts, message source behaviors, obfuscation techniques, email and URL targets, binary and image signatures, unusual code fragments, and even coding styles.

Virus Protection
PrecisionPros also uses the latest and best in technology to make sure your data isn’t compromised. Our antivirus system scans all inbound and outbound emails using a multistage process. The process is broken down into the following four stages:

Stage 1: Restricted Attachments
Virus protection starts with scanning messages for dangerous types of file attachments. Dangerous files are those that can execute code, which can be used by malicious persons to spread viruses or do harm to your computer. Restricted file types include, but are not limited to, program files (.exe, .com), script files (.bas, .vbs, .js), and shortcuts to files (.lnk, .pif). When an email is sent or received that contains a restricted file attachment, the email is rejected and the sender receives a “bounced” email notification informing them of the restriction.

Stage 2: Normalization
This stage of the email antivirus process searches for email formatting vulnerabilities that can be used by viruses to hide from virus scanners. If any vulnerability is found our system corrects the formatting of the message so that it can be thoroughly scanned for viruses. This is called “normalizing” the message, and most notably this process protects against known Microsoft Outlook security threats.

Stage 3: Decompression
Next, if the email contains any compressed attachments such as zip files, the compressed attachments are temporarily unzipped so that the contents can be scanned for viruses. Many of today’s viruses use compression as a way to sneak their way past virus scanners, sometimes even compressing themselves in several layers to try to hide from scanners. If an attachment cannot be decompressed, as might be the case for password-protected zip files, the original file is scanned for virus signatures that occur within compressed attachments.

Stage 4: Virus Scan
After the above preprocessing is complete an email antivirus scanner is used to scan the email and all of its uncompressed attachments. Everything is scanned to ensure maximum protection against new virus threats. ClamAV (www.clamav.net) is the current scanner of choice, although our system was designed to be able to plug-in any virus scanner on the market should the need to do so arise. Updated virus definitions are automatically pushed to our system. This gives our customers protection from new viruses within minutes. Virus definitions are updated hourly. In contrast, most desktop and server anti-virus programs are configured to check for new virus signatures only once per day.

Bulk Email Policy
Our Bulk Email Policy is simple: Customers may not send email of similar content to more than 250 recipients. In our effort to make our email hosting services as reliable as possible we must restrict our customers from doing anything that could jeopardize the reputation of our mail servers. Thanks to our strict Acceptable Use Policy (AUP) our mail servers have a strong reputation for consistently sending legitimate email. Our customers benefit from this directly; email sent from reputable mail servers will be delivered promptly and effectively—arriving in their recipients’ inboxes rather than their spam folders.

One of the most important ways we protect the integrity of our mail servers is to restrict bulk email. Our AUP’s Bulk Email Policy restricts customers from sending any email of similar content to more than 250 recipients—even if the email is sent in batches over time or is sent using multiple email accounts. These restrictions are tough but they are necessary to protect our mail servers from potential blacklisting. If an ISP or another email host detects that unsolicited or undesired email has been sent from one of our servers (even just one email out of a thousand) the server may be blacklisted – which results in email delivery delays and may cause legitimate email to end up in recipients’ spam folders. This affects not just the offending customer but all customers sending email through the mail server. Though we have safeguards in place to promptly replace blacklisted servers, we must preserve our mail servers’ reputation for always sending legitimate email.

When email hosting companies compromise and allow their customers to send bulk email it negatively affects everyone. In fact, many businesses turn to us because of our strict AUP. They’re tired of having their email flagged as spam by their recipients’ email providers and they know that our AUP will prevent this from happening. It’s one more way that we’re Fanatical for our customers. We do recognize that many businesses need to send legitimate bulk email—and we are here to help. We have identified iContact, a leader in the email marketing industry, as a company that not only specializes in permission based, CAN-SPAM compliant, bulk email services, but that also shares our commitment to high quality products and reliable email delivery. To learn more about iContact and how they can help with your bulk email needs, please visit them at www.icontact.com.

Procedure: Setup NTPD on CentOS Linux

Open the terminal or login over the ssh session. You must login as as the root user. Type the following yum command to install ntp
# yum install ntp ntpdate ntp-doc

Turn on service, enter:
# chkconfig ntpd on

Synchronize the system clock with 0.pool.ntp.org server (use this command only once or as required):
# ntpdate pool.ntp.org

Start the NTP server. The following will continuously adjusts system time from upstream NTP server. No need to run ntpdate:
# /etc/init.d/ntpd start

Easy cut/paste

Steps to Stay Clean

If you are reading this page then you are on your way to being proactive and actively taking steps to help reduce the risk of reinfection. While no-one can promise you the risk will ever be zero, we can work together to ensure that its as low as possible.

Website Firewall – WAF

There are a growing number of software vulnerabilities being exploited by attackers, trying to keep up with it can be very challenging to you as a website owner. Let’s face it, when you created your website you were hoping it was going to be easy and weren’t interested in spending every day focusing on security. If this is you, then you’ll want to consider something like a Website Firewall to help keep your website performing and keep the hackers out.

Update your website(s)!

If you are using WordPress, Joomla (or any other CMS), and it is not already using the stable current version, take a minute to update please. Why? Because out-of-date software is leading cause of infections. This includes your CMS version, plugins, themes, and any other extension type.

Change your password for all access points. This includes FTP, SFTP (or SSH), Plesk, etc… .Choose a good and strong password. What often defines a good password is built around three core components – Complex, Long and Unique. The argument most make when it comes to passwords is that it’s too difficult to remember multiple passwords. This is true. It’s also why Password Managers were created.

Password Tip: Start using a password manager: Peguta <https://peguta.com/> and LastPass <https://lastpass.com/> are good ones to use (online and free).

We cannot stress the importance of changing all passwords to include those not related to your CMS. Your website has various access points, attackers understand this and because of this they will often exploit multiple points of entry. At a minimum, be sure to update the password for all administrator accounts. We say all because often users will create more administrators than they require and will often update one, but forget about the rest. There really is no better time to clean than after a compromise, take advantage of this time.

* Joomla users <http://docs.joomla.org/How_you_reset_an_administrator_password%3F>

* WordPress users <http://codex.wordpress.org/Resetting_Your_Password>

* Drupal users <http://drupal.org/node/44164>

Change your database password. If you are using a CMS (WordPress, Joomla, etc…) change your database password. Please be sure to update your configuration file – Joomla: configuration.php and WordPress: wp-config.php. This is not an automated process so you will need to know how to open those files and edit manually. If you’re not familiar with handling changes in your database and configuration files, contact support.

*If you don’t know how to change your passwords (specified above), contact support for details.

Run a virus scan on your personal desktop/laptop.

In a lot of cases we see that websites are compromised via local environment (notebooks, desktops, etc..). Its why we always ask you take a minute to run an Anti-Virus product. If you’re OK with spending a little money, the latest reports show that BitDefender is leading the pack in malware detection on MAC’s and PC’s. Other alternatives includes Kaspersky for Windows and MAC, and Sophos and F-Secure for Windows. You can also try Avast, MSE, Spybot that are free alternatives and very good. Here is the bottom-line, it doesn’t matter how many times your site gets cleared, if your desktop is not clean, your site can get reinfected quite easily.

Start doing backups of your site

Afterthe site is clean and secure, a very good practice is to do daily backups at a minimum. There are number of backup solutions out there you can use, if you are a client of ours you can sign up for our Website Backup solution. It’s a simple configuration that works off SFTP and stores all your content, including the database, in the cloud.

Sucuri Security WordPress Plugin.

Whether you’re a Sucuri client or not, it doesn’t matter, we recommend leveraging the Free WordPress Security plugin <https://wordpress.org/plugins/sucuri-scanner/>. They provide detailed instructions on how to install <https://sucuri.net/wordpress-security-plugin-installation> and provide a more in depth discussion on WordPress Security Monitoring <https://sucuri.net/wordpress-security/wordpress-security-monitoring>.

Clean your Kitchen.

Too often the issues we see plaguing our clients are caused by “soup kitchen” servers. Old installations of their content management systems, themes or plugins. Over time these old installs become forgotten but grow ripe with malware that’s ready to infest their entire server after each clean. Take a minute to separate those things that belong on a test, staging and production server.

Creating an instant backup

With an instant backup, you can create an immediate backup of your domain’s configuration, data and/or email. The following directions detail how to create a full backup of a domain.

1. Log into Plesk
2. Click on Domains
3. Click on Manage Domain or Manage Hosting
4. Click on Websites & Domains
5. Click on Backup Manager
6. Then, click Back Up.
7. Choose your options in the Backup Settings. This includes adding a prefix to the backup name, choosing to make a multivolume backup, where the backup will be created, and if a notification is desired.
8. From the same window, choose the “Domain configuration and content” option. When this is done, the drop down box to the right will become active and you can choose the type of backup you want that will include content for your domain. The “All configuration and content” option will make a full backup of your domain.
9. The last option on this page allows you to suspend the domain while it is being backed up. Suspending the domain will make the domain temporarily unavailable to web traffic while it is being backed up.
10. When you are finished customizing your backup, click “Back Up” to immediately backup your domain.
11. This will return you to the Backup Manager. When the backup is complete, you will see it listed below. You may need to refresh the page to see the new backup.
12. At this point, you may also choose to save a copy of this backup to your local computer. To do so, click the green arrow that is to the far right of the desired backup.

Restoring a backup

1. Log into Plesk
2. Click on Domains
3. Click on Manage Domain or Manage Hosting
4. Click on Websites & Domains
5. Click on Backup Manager
6. Select the existing backup you wish to restore from the list of backups in your Server Repository or Personal FTP Repository.
7. Select the items within the backup that you wish to restore.
8. Click Restore to restore from your selected backup.