Missing Email Accounts

[madpato]

Hello

Yesterday i had a report of one of my customers saying that their Email accounts where gone, well i went to check this and to my surprise everything was gone but if i go to /home/username/mail all the information was there. So here is what i have done (looking some old posts on this forum):

- Switched from X3 to paper_lantern (old customer) theme, no luck.
- Checked on configserver mail manage in WHM, email accounts are present there, if i try to recreate the accounts it wont let me since the account exists.
- tried upcp --force, nothing.
- restarted cpanel services, nothing
- looking at email_accounts.yaml under the .cpanel folder i can see the information but if i go to email_accounts.json i dont see all email accounts listed there. Any way to recreate this file? I believe thats the problem.

This is the second case since yesterday, my first case all i did was a recover from a backup, but i dont want / can do this with every customer that reports this problem.

My Cpanel version is 74.0.6

Regards.

 

[cPanelLauren]

Hi @madpato

If you create an email account once the account is created do the rest of them reappear? That's the easiest way I know of to repopulate the email_accounts.json file.


Thanks!

 

[madpato]

Did that. The other accounts dont show up.

Hi @madpato

If you create an email account once the account is created do the rest of them reappear? That's the easiest way I know of to repopulate the email_accounts.json file.


Thanks!

 

[cPanelLauren]

Hi @madpato

The email_accounts.json was never created? Do you have any errors logged in the cPanel error logs?

Without the email_accounts.json file being populated there wouldn't be a way to restore this without restoring from a backup I'm afraid.

Thanks!

 

[madpato]

Yeah i noticed, all i was left to do was to restore a backup. This concerns me since its not the first case.
The json file was there but it was not being repopulated with all the information. I will check the logs and post any other useful information.

 

[cPanelLauren]

Hi @madpato

The only other thing I can think of would have been to remove the email_accounts.json entirely, create an email account then see if it had been repopulated. What is perplexing is how the account ended up in that state, I'm really happy you were able to restore from backups.

Thanks!

 

[madpato]

Well i just found more cases, i cant keep restoring backups, im opening a ticket.

 

[cPanelLauren]

Hi @madpato

I do think that's best, as seeing the system may reveal why the issue is occurring. Please post the ticket ID here once it's open so we can follow up with the outcome in this thread.

Thanks!

 

[madpato]

Ticket ID: 10210383

 

[cPanelLauren]

Hi @madpato

Thanks! I'm following the progress of that ticket and I'll update here with any new information.

 

[cPanelLauren]

Hi @madpato

I checked in on your ticket this morning and found that the issue appears to have been identified as a malicious script on the account experiencing the issue. Based on the outcome of the ticket some of the Wordpress installations were out of date and you would be resolving this.

Thanks!

 

[Olusegun]

Having this missing email issue
We noticed that the email accounts of some email account are missing on our cpanel account.

The files and folders are still there, but the email accounts don't show up in the cPanel interface.

Kindly help with solution

 

[laraaj]

I just had the same issue today on one of our company's servers, in case this can help someone with this issue or help Cpanel debug the issue,

The solution in my case was to restore the contents of this emails shadow passwords backup file here :

/home/[CpanelUser]/etc/[DomainName]/shadow.134.bak

into the actual emails shadow passwords file here :

/home/[CpanelUser]/etc/[DomainName]/shadow

then delete /home/[CpanelUser]/.cpanel/email_accounts.json It should regenerate automaticly by Cpanel.

For some reason all the email accounts disappeared from the actual shadow file except for one, but they were still exist in the shadow.134.bak
the passwod also had all the accounts information.

 

[laraaj]

I just did more digging into the issue and turns out there was a malicious PHP script updaloaded into the website after it got hacked
which creates an SMTP account for the hacker, but it also end up overwriting all the other email accounts. Hope this can help Cpanel
patch the vulnerability that allow for this to happen. if Cpanel Team need the hacking script please contact me.

 

[cPanelLauren]

We don't need the script, managing malware on Wordpress installations is outside our scope of support. This would be something you'd want to troubleshoot or discuss with a system administrator.

 

[Sundance Kid]

I just did more digging into the issue and turns out there was a malicious PHP script updaloaded into the website after it got hacked
which creates an SMTP account for the hacker, but it also end up overwriting all the other email accounts. Hope this can help Cpanel
patch the vulnerability that allow for this to happen. if Cpanel Team need the hacking script please contact me.

Hi Laraaj, I think I had the same thing happen to me. Today my email stopped working and I logged into cpanel and it was gone. I followed your earlier instructions and found this (see attached). It appear like something new was done today at 11:11 right around when email stopped working. Is this the same issue? and how did you restore the email account? I found a backup from a few days ago from Jetbackup but there a few emails that would be too recent and not in the backup I am really hoping to be able to get these back as well as restore the account. Thank you

 

[czmorgan]

I just had the same issue today on one of our company's servers, in case this can help someone with this issue or help Cpanel debug the issue,

The solution in my case was to restore the contents of this emails shadow passwords backup file here :

/home/[CpanelUser]/etc/[DomainName]/shadow.134.bak

into the actual emails shadow passwords file here :

/home/[CpanelUser]/etc/[DomainName]/shadow

then delete /home/[CpanelUser]/.cpanel/email_accounts.json It should regenerate automaticly by Cpanel.

For some reason all the email accounts disappeared from the actual shadow file except for one, but they were still exist in the shadow.134.bak
the passwod also had all the accounts information.

Thank you thank you laraaj so much. I didn't even have to delete the json. Adding the contents of the shadow bak file into the actual shadow file restored all my email accounts. I appreciate your post so much. You're the best!