Internal Server error Webmail

    Kann man hier an irgendetwas erkennen woran es liegt ? Teile von den IP Adressen und ID's habe ich natürlich raus gelöscht.

    [Tue Feb 24 11:40:51.3133 2026] [cgid:error] [pid 9399:tid 95441 [client ] AH01264: stderr from /usr/lib/cgi-bin/index.php: script not found or unable to stat

    [Tue Feb 24 11:42:59.4794 2026] [security2:error] [pid 9383:tid 9548] [client ] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/modsecurity.d/rules/comodo_free/02_Global_Generic.conf"] [line7"] [id "2192"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.baumdienst-illner.de"] [uri "/.env"] [unique_id "aZ2As5EJuqJLHNXLgAAAJY"]

    [Tue Feb 24 11:43:03.5848 2026] [security2:error] [pid 9543:tid 9592] [client ] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/modsecurity.d/rules/comodo_free/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||default-72-167|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "default-72-167"] [uri "/hello.world"] [unique_id "aZ2At5EJuqJLHNQQAAAIc"]

    [Tue Feb 24 11:43:03.7824 2026] [security2:error] [pid 9583:tid 9501] [client ] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/modsecurity.d/rules/comodo_free/21_PHP_PHPGen.conf"] [line "22"] [id "2180"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||default-72-167|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "default-72-167"] [uri "/"] [unique_id "aZ2At5EJuqJLHNXLQJyBQgAAAI8"]

    [Tue Feb 24 11:45:24.6821 2026] [security2:error] [pid4444:tid 9544] [client 164.5:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/modsecurity.d/rules/comodo_free/02_Global_Generic.conf"] [line "117"] [id "2192"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dev.hallenbad-eickel.de"] [uri "/.env"] [unique_id "aZ2BRGuT6pcYAAAA"]

    [Tue Feb 24 11:45:53.9812 2026] [cgid:error] [pid 4399:tid 9540] [client 226.22:0] AH01264: stderr from /var/www/vhosts/default/cgi-binupfile.php: script not found or unable to stat

    [Tue Feb 24 11:45:55.5684 2026] [cgid:error] [pid 9444:tid 9544] [client .22:0] AH01264: stderr from /var/www/vhosts/default/cgi-binlsd.php: script not found or unable to stat

    [Tue Feb 24 11:46:14.605636 2026] [security2:error] [pid 9544:tid 9544] [client .110.187:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/modsecurity.d/rules/comodo_free/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kfztransport-musikant.de"] [uri "/.env"] [unique_id "aZ2BdmuT6pcYGytp0QAAAAM"]

    [Tue Feb 24 11:46:14.6582 2026] [security2:error] [pid 4399:tid 4427] [client 110.187:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/modsecurity.d/rules/comodo_free/02_Global_Generic.conf"] [line "117"] [id "2192"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.kfztransport.kreativ-webhosting.de"] [uri "/.env"] [unique_id "aZ2BAAAE4"]

    [Tue Feb 24 11:58:35.2809 2026] [cgid:error] [pid 983:tid 9589] [client 9.148.10:0] AH064: stderr from /var/www/vhosts/default/cgi-binindex.php: script not found or unable to stat

    [Tue Feb 24 11:59:29.8332 2026] [cgid:error] [pid 9444:tid 9544] [client .66:0] AH264: stderr from /var/www/vhosts/default/cgi-binindex.php: script not found or unable to stat

    [Tue Feb 24 12:01:15.4521 2026] [security2:error] [pid 9583:tid 9541] [client.2.181:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/modsecurity.d/rules/comodo_free/02_Global_Generic.conf"] [line "117"] [id "2192"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tippspiel.radio-schlagerwahn.de"] [uri "/.git/config"] [unique_id "aZ2E-5EJasAAAAIY"]

    [Tue Feb 24 12:02:36.7268 2026] [security2:error] [pid 9544:tid 9543] [client 96.229:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/modsecurity.d/rules/comodo_free/02_Global_Generic.conf"] [line "117"] [id "2104"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stage.kreativ-webhosting.de"] [uri "/.env"] [unique_id "aZ2Fyt9JgAAABE"]

    [Tue Feb 24 12:05:58.4022 2026] [cgid:error] [pid 9583:tid 9510] [client .2.0:0] AH264: stderr from /var/www/vhosts/default/cgi-binindex.php: script not found or unable to stat

    [Tue Feb 24 12:07:20.0664 2026] [cgid:error] [pid 9383:tid 9597] [client .67.15:0] AH264: stderr from /var/www/vhosts/default/cgi-binupfile.php: script not found or unable to stat

    [Tue Feb 24 12:07:21.446945 2026] [cgid:error] [pid 9544:tid 9560] [client .67.15:0] AH01264: stderr from /var/www/vhosts/default/cgi-binlsd.php: script not found or unable to stat

    [Tue Feb 24 12:08:15.4342 2026] [cgid:error] [pid 9543:tid 9504] [client .148.10:0] AH064: stderr from /var/www/vhosts/default/cgi-binindex.php: script not found or unable to stat

    [Tue Feb 24 12:08:23.2617 2026] [cgid:error] [pid 383:tid 954] [client 169.245:0] AH065: stderr from /usr/lib/cgi-bin/: attempt to invoke directory as script

    nach meinen Kenntnisstand sollte die passende log unter /var/log/mail.log und nicht zum apache gehören falls du einen Server hast?

    Falls eigener Server:

    1. Läuft Postfix? systemctl status postfix
    2. Läuft devecot? systemctl status dovecot

    OK, hier kommt die Ausgabe. Aus Datenschutzgründen habe ich IP's und Domain Namen teilweise raus gelöscht.

    Feb 24 13:13:30 server3 dovecot[971884]: service=lda, user=info@blumenhaus.de, ip=[]. Error: sieve: binary /var/qmail/mailnames/blumenhaus.de/info/.dovecot.svbin: save: failed to create temporary file: open(/var/qmail/mailnames/blumenhaus.de/info/.dovecot.svbin.) failed: Permission denied (euid=30(popuser) egid=31(popuser) missing +w perm: /var/qmail/mailnames/blumenhaus.de/info, dir owned by 0:0 mode=0755)

    Feb 24 13:13:30 server3 dovecot[971884]: service=lda, user=info@blumenhaus.de, ip=[]. Error: quota: Failed to get quota resource STORAGE_BYTES for INBOX: quota-maildir: Failed to get STORAGE_BYTES: open(/var/qmail/mailnames/blumenhaus.de/info/Maildir/maildirsize) failed: Permission denied - copying mail anyway

    Feb 24 13:13:30 server3 dovecot[971884]: service=lda, user=info@blumenhaus.de, ip=[]. Error: Mailbox INBOX: open(/var/qmail/mailnames/blumenhaus.de/info/Maildir/tmp/1771935210.M102205P971884.server3) failed: Permission denied

    Feb 24 13:13:30 server3 dovecot[971884]: service=lda, user=info@blumenhaus.de, ip=[]. Error: sieve: msgid=<0.0.21.47A.1DCA51A2AC0FC48.0@flickr.mannativf.com>: failed to store into mailbox 'INBOX': open(/var/qmail/mailnames/blumenhaus.de/info/Maildir/tmp/1771935210.M102205P971884.server3) failed: Permission denied

    Feb 24 13:13:30 server3 dovecot[971884]: service=lda, user=info@blumenhaus.de, ip=[]. Error: sieve: failed to open logfile (LOGGING TO STDERR): open(/var/qmail/mailnames/blumenhaus.de/info/.dovecot.sieve.log) failed: Permission denied (euid=30(popuser) egid=31(popuser) missing +w perm: /var/qmail/mailnames/blumenhaus.de/info, dir owned by 0:0 mode=0755)

    Feb 24 13:13:30 server3 dovecot[971884]: service=lda, user=info@blumenhaus.de, ip=[]. Error: sieve: Execution of script 'plesk/.dovecot' was aborted due to temporary failure (user logfile /var/qmail/mailnames/blumenhaus.de/info/.dovecot.sieve.log may reveal additional details)

    Feb 24 13:13:30 server3 postfix-local[971849]: 958A04A077: process '/usr/lib/dovecot/dovecot-lda -d "$DELIVERED_TO" -a "${ORIGINAL_RECIPIENT:-$DELIVERED_TO}"' stderr : sieve: info: started log at 2026-02-24 13:13:30 +0100.

    error: msgid=<0.0.21.47A.1DCA51A2AC0FC48.0@flickr.mannativf.com>: failed to store into mailbox 'INBOX': open(/var/qmail/mailnames/blumenhaus.de/info/Maildir/tmp/1771935210.M102205P971884.server3) failed: Permission denied.

    Feb 24 13:13:30 server3 postfix/pipe[971846]: 958A04A077: to=<info@blumenhaus.de>, relay=plesk_virtual, delay=46738, delays=46736/0.02/0/1.5,

    erstmal sollte der ordner (/var/qmail/mailnames/blumenhaus.de) popuser gehören ;) . Benutzt du Plesk oder eine andere verwaltungssoftware?

    das siehst du auch in deinen log siehe:

    Permission denied (euid=30(popuser) egid=31(popuser) missing +w perm: /var/qmail/mailnames/blumenhaus.de/info, dir owned by 0:0 mode=0755)

    Dann verwende das offizielle von plesk bereitgestellte Reparaturtool für Mail:

    Code
    /usr/local/psa/admin/sbin/mchk --with-spam

    und danach den Mailserver neu Startet mit:

    Code
    systemctl restart postfix
systemctl restart dovecot

    sagt Bescheid ob es Funktioniert hat :)