Enkompass Admin

Enkompass Critical Firewall Ports

By Todd Thrash on September 1, 2011 12:49 PM

Make sure that the following ports are open among all servers in the Active Directory Domain:

135 - Remote Procedure Call (RPC)
139 - Netbios

2097 - Various WCF (WSOI, PreAuth, MOI)
2098 - Various WCF (SAI, StepLogging, SAI Streaming, ServiceMonitor)
9031 - WCF (MSMQ)
9111 - MailEnable connector service WCF connections
9998 - SmarterMail

Make sure the following are open for all web servers:

2084 - Postgres
9021 - WCF (WebLogService)
9099 - WCF (certificate service)

The Enkompass server should also have the following ports open:

2082 - WSOI
2083 - WSOI SSL

2084 - Postgres
2086 - SAI
2087 - SAI SSL
2089 - License
2095 - MOI
2096 - MOI SSL

For the Server Connection test to work, allow ICMP (file and printer sharing) on any remote servers. In some cases IPv6 could be disabled on the Firewall and causing a Server Connection to fail.

To enable the Windows Firewall logging to see what might be failing, you can do the following:

From Administrative Tools, open the Windows Firwall with Advanced Security

Right click on Windows Firewall with Advanced Security on Local Computer at the top of the left pane and go to Properties. Each of the firewall profiles will have a tab: Domain, Private, Public.

Within each tab is an option to customize the Logging and you can enable 'Log dropped packets' to see what is failing.

Once the Logging is enabled, try whatever connection attempts were failing again and then check the log. The log file can be found under the Monitoring section and a link is provided under the Logging Settings on the right hand pane.

Once you've identified the protocol you can return to the Inbound Rules section and and scroll down until you find it. Simply right click to enable it and the block should be resolved.

Configuring Secondary DNS in Enkompass

By Todd Thrash on August 7, 2011 11:10 AM

There are two ways that a secondary DNS server can be added.

In both scenarios you will need to add the new server to the Forwarders list of the primary Domain Controller.

From the primary server, open DNS Manager, right click on the server name and select Properties. Click on the Forwarders tab and click the Edit button in the middle of the dialogue box.

Add the IP or host name of the server and click OK.

Fron this point, we have two options:

1) Create a Member Server

2) Promote another server to a Domain Controller

Promoting a server to be a Domain Controller:

Use Server Manager's Add Role Services to install Active Directory on the new server

Once the wizard has finished with the install you will have to run DCPROMO to start the configuration steps.

Once you have finished the wizard it will need to reboot to complete the process. If you have other tasks to preform that are not DNS related you can, otherwise check the Reboot upon completion box and let it reboot itself when ready. Had I done the step shown in the first picture I suspect I would have not gotten this error message (thus changing the order of how I posted them) but wanted to include it as a just in case.

If you do not wish to promote another server to a Domain Controller you can add DNS services to a member server. The first picture in this document will need to be followed to add the member server to the Forwarders list on the Primary DNS server.

Once the service has been added you will have to complete the following steps:

Update Each Zone on the Master DNS server to allow Zone Transfers and Notification. Repeat steps 1 through 12 on each Zone.

On the Master Server, open the DNS tool.
Expand Forward Lookup Zones.
Right click on the zone in question and select Properties.
Click on the Zone Transfers tab.
Put a check in Allow zone transfers and select the radio button for "Only to servers listed on the Name Servers tab".
Click the Notify button at the bottom.
Put a check in Automatically Notify and select the radio button for "Servers listed on the Name Servers tab".
Click ok.
Click on the Name Servers Tab.
Click Add.
Type in the hostname of the Slave DNS Server and click ok.
Click Ok.

Setup each Zone as a Secondary Zone on the Member Server:

Inside of Administrative Tools, open the DNS tool:
Expand the Server.
Right click on Forward Lookup Zones and click new Zone.
Click Next.
Select the Secondary Zone radio button and click next.
Type in the name of the Zone and click next.
Type n the IP of the Master DNS server and click next.
Click finish.
Right click on the Zone and select Transfer from Master.

Managing WSO features via Roles

By Todd Thrash on July 11, 2011 10:55 AM

Many new Enkompass admins struggle with backups, ASP and PHP features not working correctly for the accounts they are creating. The core issue is the Role assigned to the account. At Install, the only role created is Standard WSO. In a nutshell, Standard WSO is nothing more than a basic framework that allows an account to be created and function with basic HTML: no Backups, PHP, ASP, Support Requests, SSL or anything else. The reason for this is to allow Admins and Resellers the ability to offer these features as upgrades and premiums. If that isn't your business model it may be simplest to just create an 'All WSO' Role and use it as the default Role when creating accounts.

Here is a breakdown of the features that can be enabled (or left disabled) in a Role:

Preferences
    Branding Editor
    Theme Editor

Mail
    Advanced Mail
    Support Contact Tools

Files
    Backup Daily
    Backup Monthly
    Backup Tools
    Backup Weekly

Security
    SL Tools

Addins
    Configure Pipeline Mode
    Php
    Enable ASP.NET
        Configure ASP.NET Framework
    Enable Classic ASP

There are two ways you can work with Roles.

1) You can create one as you are creating a user when using Create a New Account. Go to the section for WSO Role and select Custom(*) from the dropdown menu. A popup box will appear to select WSO features for the Role. Once you have selected the features you need, name and save the Role.

2) You can use the Configure Resources in the Reseller section to add and edit Roles (both for WSO and Resellers)

Plans can be used to quickly assign the following values/limits to an account:

Dedicated IP
Bandwidth (MB/Month)
Quota (MB)
Max FTP Users
Max Email Users
Max Email Lists
Max Databases
Max Sub Domains
Max Parked Domains
Max Addon Domains
WSOI Language
WSOI Theme
WSOI Skin

WSOI Role

However, if a Role is assigned to a Plan and a Plan to an account you cannot change the Role assigned to an account without either editing the Plan or changing the Role assigned to the Plan.

In other words, if you want a handful of plans but great flexibility over the Roles, don't assign Roles with Plans. To quickly check what a Role gives in a given plan you can check the Manage Plans page.

Hopefully this will demystify Roles and get Backups, PHP and ASP up and running quickly.

Create Virtual Directory for an application

By Todd Thrash on June 30, 2011 3:12 PM

Many need the ability to create a Virtual Directory in IIS that will be persistant with the config pushes that Enkompass does. This will be easy to accomplish when 2.2 releases but in the interim we have worked on a method to do this via the PostgreSQL backend database. Please make sure you have a backup and use extreme caution when editing the PG database as it is a critical component of Enkompass.

Figure 1 & 2: Launch PG3Admin to log into Postgresql

Figure 3 & 4: Drill down through Databases, apphostconfig, Schema, Public, Tables and find the Sites table. Use View Top 100 Rows from the View Data sub menu for each table example in this tutorial.

Figure 5: Get the id [PK] integer for the site you wish to create the virtual directory and application for. I am using my todd.tld domain as an example and therefore need the id[PK] integer 1. You can close this table view when you have the value.

Figure 6: Go to the application table and at the bottom on a new line add the name of the subdirectory to the second column (path character varying) and the id from Sites to the third column (site integer). In my case I needed the subdirectory of /newapp and it was for site 1 so that is what I put in the respective columns.

Figure 7: Once you save a value will be generated for the first column; refresh and get that number for the next step. The id [PK] integer in this table, 17 is what I will need for the next step.

Figure 8: Now go to the virtualdirectory table: Again, scroll to the bottom for a new line to be visible and in the second Column 2 (application integer) you will enter the value generated after saving/refreshing from column 1 (id [PK] interger from the previous step) In my case this was 17. In Column 3 (virtualpath character varying) you will add a /, and in Column 4 (physicalpath character varying) you will add the full path to the folder. In my case it is c:\Users\cPanel\todd\public_html\newapp.

Figure 9: Once you save, you can trigger a configuration push or wait for the scheduled configuration re-publish. If the application is already setup in c:\Users\cPanel\todd\public_html\newapp then it should start working immediately.

Enkompass DNS Configuration

By Todd Thrash on April 19, 2011 8:08 AM

Enkompass uses Microsoft's Active Directory DNS to manage DNS.

As a result, the AD server will be listed as a nameserver in each zone. The name of the server is key to making the NS record look clean. The name of the server and the AD Domain will be used for the NS record. When the server is setup the machine name is often something like WIN-34DC234DFG. If you then create someAD.local your Name Server (NS) records will all have the following added to each zone: WIN-34DC234DFG.someAD.local

Because everything is tied together you cannot make your AD Domain be the same as a domain you wish to host. If your Enkompass solution is part of a larger hosting network this may not be a big deal. But if you need to host yourcompany.tld within Enkompass your AD name will need to be different.

Consider the following: Computer name: NS1, Domain Name win.yourcompany.tld and you end up with NS record that is ns1.win.yourcompany.tld If you don't need to host yourcompany.tld you can have ns1.yourcompany.tld for the NS records. Additional entries can be made and additional IPs can be bound to listen for DNS requests. IPs can either be bound via SAI or directly to the adapter. If bound in SAI you can also use those IPs for other features or you can keep them reserved.

Within SAI, Tweak Settings allows you to manage a number of features, one of them being Default Nameservers. The name servers added here will be added to any new domain created. If accounts already exist these new NS entries won't be added but could be added manually. The AD Server will always be added even if other servers aren't listed here because that's what AD does.

In DNS Manager, you can specify which IPs DNS will listen on. You can also tell it to listen to all IPs that are bound to the adapter.

Enabling Verbose logging in Enkompass

By Eric on April 6, 2011 12:39 PM

Howdy,

This week I’d like to show you how to enable the verbose log in any of the Enkompass services. You may not want logging like this on all the time because it causes a great deal of data to be written when the server is active. But if you see an error you can diagnose exactly what the server is doing.

For our example we will be using the WCF Service which is the work horse for Enkompass. First let’s do something simple like create an account with the normal logging.

Nothing gets logged because everything went well. Because the logging level is set to Error. Let’s get the full story by editing the config file. It’s located by default in:

C:\Program Files\cPanel\Enkompass\Services\WcfService\cPanel WCF Service.exe.config

and I recommend opening it up with notepad. Use “Replace” (CTRL + h) to replace “Error” with “Verbose” in all three places. Save the file and restart the WCF service in services.msc. Go ahead and restart the Enkompass Web Server Service too.

Now let’s go back and make a simple account. If you are following the log file using mtail you will notice it spring to life showing the service starting and then started.

Our simple create account looks like this with verbose logging on.

cPanel.Core Verbose: 0 : 2011-04-06 17:33:44Z [VERBOSE ] - WSOI - WSOI - (TID:0x10) - GetDnsServerIpAddress

cPanel.Core Verbose: 0 : 2011-04-06 17:33:44Z [VERBOSE ] - DNS Provider - cPanel.Dns.Providers.MicrosoftDnsDataProvider - (TID:0x10) - Does zone echo.tld exist on 208.74.120.81

cPanel.Core Verbose: 0 : 2011-04-06 17:33:44Z [VERBOSE ] - Account Provider - cPanel.Core.Providers.ActiveDirectoryAccountDataProvider - (TID:0x10) - Creating new account echo

cPanel.Core Verbose: 0 : 2011-04-06 17:33:45Z [VERBOSE ] - Account Provider - cPanel.Core.Providers.ActiveDirectoryAccountDataProvider - (TID:0x10) - Creating home directory E:\WebSiteShare\Users\cPanel\echo

cPanel.Core Verbose: 0 : 2011-04-06 17:33:45Z [VERBOSE ] - Web Site Provider - cPanel.Http.Providers.Iis7WebSiteDataProvider - (TID:0x10) - Creating web site echo.tld, ftp site echo.tld, and ftp user echo

cPanel.Core Verbose: 0 : 2011-04-06 17:33:45Z [VERBOSE ] - DNS Provider - cPanel.Dns.Providers.MicrosoftDnsDataProvider - (TID:0x10) - Creating zone echo.tld on 208.74.120.81

cPanel.Core Verbose: 0 : 2011-04-06 17:33:46Z [VERBOSE ] - DNS Provider - cPanel.Dns.Providers.MicrosoftDnsDataProvider - (TID:0x10) - Creating A resource with zone name echo.tld on 208.74.120.81

cPanel.Core Verbose: 0 : 2011-04-06 17:33:46Z [VERBOSE ] - DNS Provider - cPanel.Dns.Providers.MicrosoftDnsDataProvider - (TID:0x10) - Creating CName resource with zone name echo.tld on 208.74.120.81

cPanel.Core Verbose: 0 : 2011-04-06 17:33:46Z [VERBOSE ] - ServerAdministratorService - cPanel.Services.ServerAdministratorService - (TID:0x10) - Account 'echo' created without an assigned MailServer. Mail accounts have not been created.

cPanel.Core Verbose: 0 : 2011-04-06 17:33:46Z [VERBOSE ] - Enkompass Contact Manager - Contact Manager Gateway - (TID:0x10) - ContactManagerGateway .ctor

cPanel.Core Verbose: 0 : 2011-04-06 17:33:47Z [VERBOSE ] - Enkompass Contact Manager - Contact Manager Gateway - (TID:0x10) - GetAlertsEx

cPanel.Core Verbose: 0 : 2011-04-06 17:33:47Z [VERBOSE ] - Enkompass Contact Manager - Contact Manager Gateway - (TID:0x10) - GetContactManagerRegistryKey

cPanel.Core Verbose: 0 : 2011-04-06 17:33:47Z [VERBOSE ] - Enkompass Contact Manager - Contact Manager Gateway - (TID:0x10) - GetCPanelRegistryKey

cPanel.Core Verbose: 0 : 2011-04-06 17:33:47Z [VERBOSE ] - Enkompass Contact Manager - Contact Manager Gateway - (TID:0x10) - ConvertToAlertsEx

cPanel.Core Verbose: 0 : 2011-04-06 17:33:47Z [VERBOSE ] - Enkompass Contact Manager - Contact Manager Gateway - (TID:0x10) - GetAlertEx