Missing Email Accounts

madpato

Well-Known Member
May 30, 2008
51
1
58
Hello

Yesterday i had a report of one of my customers saying that their Email accounts where gone, well i went to check this and to my surprise everything was gone but if i go to /home/username/mail all the information was there. So here is what i have done (looking some old posts on this forum):

- Switched from X3 to paper_lantern (old customer) theme, no luck.
- Checked on configserver mail manage in WHM, email accounts are present there, if i try to recreate the accounts it wont let me since the account exists.
- tried upcp --force, nothing.
- restarted cpanel services, nothing
- looking at email_accounts.yaml under the .cpanel folder i can see the information but if i go to email_accounts.json i dont see all email accounts listed there. Any way to recreate this file? I believe thats the problem.

This is the second case since yesterday, my first case all i did was a recover from a backup, but i dont want / can do this with every customer that reports this problem.

My Cpanel version is 74.0.6

Regards.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,272
313
Houston
Hi @madpato

If you create an email account once the account is created do the rest of them reappear? That's the easiest way I know of to repopulate the email_accounts.json file.


Thanks!
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,272
313
Houston
Hi @madpato

The email_accounts.json was never created? Do you have any errors logged in the cPanel error logs?

Without the email_accounts.json file being populated there wouldn't be a way to restore this without restoring from a backup I'm afraid.

Thanks!
 

madpato

Well-Known Member
May 30, 2008
51
1
58
Yeah i noticed, all i was left to do was to restore a backup. This concerns me since its not the first case.
The json file was there but it was not being repopulated with all the information. I will check the logs and post any other useful information.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,272
313
Houston
Hi @madpato

The only other thing I can think of would have been to remove the email_accounts.json entirely, create an email account then see if it had been repopulated. What is perplexing is how the account ended up in that state, I'm really happy you were able to restore from backups.

Thanks!
 

madpato

Well-Known Member
May 30, 2008
51
1
58
Well i just found more cases, i cant keep restoring backups, im opening a ticket.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,272
313
Houston
Hi @madpato

I do think that's best, as seeing the system may reveal why the issue is occurring. Please post the ticket ID here once it's open so we can follow up with the outcome in this thread.

Thanks!
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,272
313
Houston
Hi @madpato

I checked in on your ticket this morning and found that the issue appears to have been identified as a malicious script on the account experiencing the issue. Based on the outcome of the ticket some of the Wordpress installations were out of date and you would be resolving this.

Thanks!
 

Olusegun

Registered
Jun 10, 2019
1
0
1
Lagos/Nigeria
cPanel Access Level
Root Administrator
Having this missing email issue
We noticed that the email accounts of some email account are missing on our cpanel account.

The files and folders are still there, but the email accounts don't show up in the cPanel interface.

Kindly help with solution
 

laraaj

Registered
Nov 15, 2017
3
1
3
USA
cPanel Access Level
Root Administrator
I just had the same issue today on one of our company's servers, in case this can help someone with this issue or help Cpanel debug the issue,

The solution in my case was to restore the contents of this emails shadow passwords backup file here :

/home/[CpanelUser]/etc/[DomainName]/shadow.134.bak

into the actual emails shadow passwords file here :

/home/[CpanelUser]/etc/[DomainName]/shadow

then delete /home/[CpanelUser]/.cpanel/email_accounts.json It should regenerate automaticly by Cpanel.

For some reason all the email accounts disappeared from the actual shadow file except for one, but they were still exist in the shadow.134.bak
the passwod also had all the accounts information.
 
Last edited:
  • Like
Reactions: czmorgan

laraaj

Registered
Nov 15, 2017
3
1
3
USA
cPanel Access Level
Root Administrator
I just did more digging into the issue and turns out there was a malicious PHP script updaloaded into the website after it got hacked
which creates an SMTP account for the hacker, but it also end up overwriting all the other email accounts. Hope this can help Cpanel
patch the vulnerability that allow for this to happen. if Cpanel Team need the hacking script please contact me.
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,272
313
Houston
We don't need the script, managing malware on Wordpress installations is outside our scope of support. This would be something you'd want to troubleshoot or discuss with a system administrator.
 

Sundance Kid

Registered
Jul 2, 2020
1
0
1
Canada
cPanel Access Level
Website Owner
I just did more digging into the issue and turns out there was a malicious PHP script updaloaded into the website after it got hacked
which creates an SMTP account for the hacker, but it also end up overwriting all the other email accounts. Hope this can help Cpanel
patch the vulnerability that allow for this to happen. if Cpanel Team need the hacking script please contact me.
Hi Laraaj, I think I had the same thing happen to me. Today my email stopped working and I logged into cpanel and it was gone. I followed your earlier instructions and found this (see attached). It appear like something new was done today at 11:11 right around when email stopped working. Is this the same issue? and how did you restore the email account? I found a backup from a few days ago from Jetbackup but there a few emails that would be too recent and not in the backup I am really hoping to be able to get these back as well as restore the account. Thank you
 

Attachments

Last edited:

czmorgan

Registered
Feb 23, 2021
1
0
0
Montreak
cPanel Access Level
Website Owner
I just had the same issue today on one of our company's servers, in case this can help someone with this issue or help Cpanel debug the issue,

The solution in my case was to restore the contents of this emails shadow passwords backup file here :

/home/[CpanelUser]/etc/[DomainName]/shadow.134.bak

into the actual emails shadow passwords file here :

/home/[CpanelUser]/etc/[DomainName]/shadow

then delete /home/[CpanelUser]/.cpanel/email_accounts.json It should regenerate automaticly by Cpanel.

For some reason all the email accounts disappeared from the actual shadow file except for one, but they were still exist in the shadow.134.bak
the passwod also had all the accounts information.
Thank you thank you laraaj so much. I didn't even have to delete the json. Adding the contents of the shadow bak file into the actual shadow file restored all my email accounts. I appreciate your post so much. You're the best!