Directadmin – auto assign custom authorized_keys for newly created users – SSH access

I setup a Directadmin server which was primary for website hosting. Separating every project with new DirectAdmin user is a good practice security vise. If one website/project is hacked, other sites that are with different users are safe. But creating new users and then set up ssh keys that are allowed for every user can be time consumedly. In this case, ssh public keys were the same for every user as only developers were able to ssh connect to user account. I created a simple script that will create .ssh directory and authorized_keys with public keys for every user.

  • First, create script inside /usr/local/directadmin/scripts/custom/.
  • Create template file with all ssh  public keys that should be assign to every new user. I created file /usr/local/directadmin/data/custom-authorized_keys
  • Add this content to the script:

    mkdir /home/$username/.ssh
    chown $username:$username /home/$username/.ssh
    cp /usr/local/directadmin/data/custom-authorized_keys /home/$username/.ssh/authorized_keys
    chown $username:$username /home/$username/.ssh/authorized_keys
    chmod 600 /home/$username/.ssh/authorized_keys

    echo "SSH keys added!"

    exit 0;
  • Give this script execution rights
    chmod +x /usr/local/directadmin/scripts/custom/

That is it. Every time a new user is created, .ssh directory with authorized_keys will be created inside user’s home account.

Directadmin – get disk size information for every email account on your server/user

If you want to get information about how much of disk is consuming every email account on your Directadmin server, then you can use this command.

[root@post ~]# find /home/*/imap/*/*/ -maxdepth 1 -type d -exec du -sh {} \; | awk -F '/' {'print $6"@"$5 " -> " $1'} -> 60K -> 60K -> 529M -> 529M -> 772K

If you would want for every email account of some specific user, than you can use this:

[root@post ~]# find /home/user1/imap/*/*/ -maxdepth 1 -type d -exec du -sh {} \; | awk -F '/' {'print $6"@"$5 " -> " $1'} -> 1.3G -> 1.3G -> 68M

Simple, but it can save some time 🙂

Directadmin restore error: “your_user” is not a valid username

I had this weird error when I tried to restore some directadmin accounts on new server. Majority of accounts were restored successfully, but some returned this error:

user1 is not a valid username
user2 is not a valid username

I tried many things and than found out that there is default setting for username length in directadmin configuration max_username_length. Default value is 10, so if your username of account that you are trying to restore is larger than 10 characters, error will be returned. You have to edit directadmin configuration and set this variable.

[root@mx ~]# vi /usr/local/directadmin/conf/directadmin.conf

then edit max_username_length to larger value. I my example 20.


Fix high server load and memory/cpu consumption of clamd ( ClamAV )

I had troubles with one of Directadmin servers which was constantly loading because clamd process. When executing top command, clamd was always top on the list. As I researched, there is no way you can limit ClamAV’s memory and CPU consumption via its configuration itself. This is how you do it.

What you have to do is limit clamd within startup script, so that clamd will start with some limitations.

Just open ClamAV startup script. I this case CentOS 7:

vi /etc/systemd/system/clamd.service

Then add this lines. Of course change according to your needs.

IOSchedulingPriority = 7
CPUSchedulingPolicy = 5
Nice = 19

Your startup script should now look something like this:

Description = Generic clamav scanner daemon
After =

Type = simple
ExecStartPre=-/bin/mkdir -p /var/run/clamd
ExecStartPre=-/bin/chown -R clamav:clamav /var/run/clamd
ExecStart = /usr/local/sbin/clamd --foreground=yes
Restart = on-failure
PrivateTmp = true
IOSchedulingPriority = 7
CPUSchedulingPolicy = 5
Nice = 19

WantedBy =

Directadmin – instal imagick (ImageMagick PHP module) with pecl – multi php

It’s amazingly simple. If you have multi PHP instances installed, go to bin directory of the one for which you want to install imagick module. In this example, I’ll install it on php version 7.3. This is CentOS 7 with Directadmin. You don’t need custombuild in this procedure.

Go to PHP bin directory:
[root@wutang4eva ~]# cd /usr/local/php73/bin/

Then just install imagick module likeå this:
[root@wutang4eva bin]# ./pecl install imagick

If php_ini is not set, then add extension to your php.ini manualy:
Add to /usr/local/php73/lib/php.ini

Restart php-fpm for php version - if you are using fpm of coruse:
systemctl restart php-fpm73.service

Check if imagick is installed:
[root@wutang4eva bin]# ./php73 -m | grep imag

If you want on other PHP versions, just do the same for each version you need imagick on.

I hope this helps.

Invalid characters in mail autoresponder/vacation messages – DirectAdmin

One client complained about invalid characters that customers was getting on clients mail autoreply message. Because of special characters, mail was wrongly formated. When I try and enter correct text in autoresponder form, when save and opened again, wrong characters were shown.

This is simple to solve. You have to set correct encoding for Directadmin theme that is used. In my case, default “enhanced” theme was used so I edited accordingly:

vi /usr/local/directadmin/data/skins/enhanced/lang/en/lf_standard.html

Then find variable “LANG_ENCODING” and correct it to your needs. In my case:


Block wp-login and xmlrpc brute force attacks with CSF / cPanel

Another great counter attack to “flooders” on your WordPress installations. This time with CSF firewall. I had massive brute force attacks on WordPress installations on some cPanel server which were causing very high server loads.  Here is great way to block abusers with CSF firewall. Here is how.

First, create custom log from which CSF will be able to search for wp-login.php and xmlrpc.php requests. Edit your /etc/csf/csf.conf like bellow:

CUSTOM1_LOG = "/var/log/apache2/domlogs/*/*"

Because majority of those attacks are from some very well known country’s that are causing problems, you may want to white list country’s from which users shouldn’t be blocked. Add list of white list country’s in CC_IGNORE.

Then you must create custom functions for CSF so it will be able to block those attacks. Add this to your /usr/local/csf/bin/ file. If it’s not there, create one. Then add this:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/xmlrpc\.php.*" /)) {
return ("WP XMLPRC Attack",$1,"XMLRPC","5","80,443","1");

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] "\w*(?:GET|POST) \/wp-login\.php.*" /)) {
return ("WP Login Attack",$1,"WPLOGIN","5","80,443","1");

Restart CSF and check if LFD is doing his new job. On success you should see something like this:

May 10 11:33:16 cp lfd[589350]: (WPLOGIN) WP Login Attack (PL/Poland/ 5 in the last 600 secs - *Blocked in csf* [LF_CUSTOMTRIGGER]
May 10 11:33:36 cp lfd[589587]: (WPLOGIN) WP Login Attack (TR/Turkey/ 5 in the last 600 secs - *Blocked in csf* [LF_CUSTOMTRIGGER]
May 10 11:34:24 cp lfd[590012]: (WPLOGIN) WP Login Attack (DE/Germany/ 5 in the last 600 secs - *Blocked in csf* [LF_CUSTOMTRIGGER]83247]: (WPLOGIN) WP Login Attack (VN/Vietnam/-): 5 in the last 600 secs - *Blocked in csf* [LF_CUSTOMTRIGGER]

Requests for ignored country’s should look like this:

May 10 11:45:36 cp lfd[591718]: WP Login Attack - ignored
May 10 11:45:41 cp lfd[591718]: WP Login Attack - ignored

I hope this helps. 🙂


Directadmin – Process failed (1) when writing error message to (frozen)

User complained about not being able to receive error messages from remote mail servers. When he sent to this email address from Gmail, error message return, but when he tried from Directadmin server, no error message arrived in inbox. I could see those messages in Exim’s mail queue as frozen.

In Exim mail log, this error was shown:

Process failed (1) when writing error message to (frozen)

After a while of digging online, I’ve found out that BlockCracking is causing this problem. We had BlockCracking version 1.8 which was apparently version with this issue. You’ll have to upgrade BlockCracking to version 1.10 or newer. Just go to your Directadmin’s custombuild directory, then follow this steps:

./build exim
./build dovecot_conf
./build spamassassin
./build blockcracking
./build update
./build exim_conf

After that, error messages should arrive in your inbox.

CSF – whitelist user from SMTP_BLOCK

CSF features great option SMTP_BLOCK which block outgoing SMTP for all users except root, exim and mailman. I had a problem with one user which was using MailChimp as mass mailing within their application. Because of SMTP_BLOCK it wasn’t working. Disabling SMTP_BLOCK globally is not recommended, you can white list users for which you would like to allow sending.

Go to your CSF settings and find SMTP_ALLOWUSER. Then add user which should be allowed (users separated with coma). Don’t forget to restart CSF.

Directadmin – Proxy Error: DNS lookup failure for php-fpm56 …

If you changed php handler for your Directadmin installation to php-fpm, rewrite all configs and then get error like this:

Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /index.php.
Reason: DNS lookup failure for: php-fpm56.domainname

It is almost certainly that apache templates that are used for generating user http configuration files are wrong. Probably you have custom templates.

Go to /usr/local/directadmin/data/templates/custom and check if there are files like files virtual_host2.conf … . If they are, just rename custom directory to something new:

[root@lol ~]# cd /usr/local/directadmin/data/templates/
[root@lol templates]# mv custom custom-bak

Directadmin will then use default templates when creating new Apache configs. Rewrite your apache config files:

[root@lol ~]#  cd /usr/local/directadmin/custombuild
[root@lol custombuild]# ./build rewrite_confs

It should solve the problem. Also, make sure that php-fpm for all php versions are working.

© 2021
Hosted by SIEL

About author