Original Publishing Date: 2020-01-22 Release Notes Full release notes for Operations Automation version 6.0.3 can be downloaded here. Functional Changes VPS Hosting Self-update of pa_updates_installer Output of pem.exchange.getEmailDomains Method can be filtered by Specific Subscription Gradual Deletion of SharePoint Sites is Supported Support of Underscore Symbol "_" in CNAME Records New Privilege: Billing Access for Login as Sessions Fixed Issues POA-91976 Log files rotation algorithm is broken in Operations Automation 6.0 POA-91813 PACI thread pool for updateResourceUsage too big and can kill chief-sc POA-91812 Excessive parallel calls to updateResourceUsage can make system unusable POA-91766 addDomainRequest induces overuse on subscriptions with DNS-management set to 0 POA-91703 Duplicate constraint error is displayed after clicking "Forgot password" link POA-91685 "Revoke WebFileManager" service never ends POA-91633 Subscription migration freezing in Migrating state POA-91588 POA Migration Manager fails when moving PostgreSQL database POA-91542 Changing ASP.NET to 4.5 version for IIS8 result to 'No Managed Code' for webspace application pool POA-91525 IIS website location change is not possible if SiteBuilder 11.5 is installed: java.util.ConcurrentModificationException POA-91467 One unprocessed request covered by APS2Cache could block similar requests for undefined amount of time POA-91381 Unable to add MX record with empty "Mail Domain" prefix POA-91370 6.0.3: Incorrect auto-instantiation of APS application services for mailboxes POA-91352 "java.lang.NullPointerException" error is displayed on DNS tab of domain in Provider Control Panel POA-91339 List of websites on Websites tab in Customer Control Panel is empty POA-91311 SiteBuilder services are absent in Customer Control Panel POA-91204 Enabling of SNI for NG Shared Hosting should be documented POA-91109 "Update Belgacom server" task running too much time in case if DNS zone contains huge amount of records POA-91059 The courier IMAP does not contact LDAP for authentication POA-91015 Default language for new SharePoint site is not detected if region-specific UI locales are used POA-90972 Capacity number format of Exchange resource mailbox is displayed incorrectly in Customer Control Panel POA-90968 Parallels Plesk Panel-related tasks fail if there is domain with both IPv6 and IPv4 addresses in Plesk POA-90935 Not possible to add physical hosting for subdomain via API POA-90934 There is green alert about unread notification messages on Home screen of Customer Control Panel of reseller's customer, but there is no messages in list POA-90880 Reflected XSS in control panel POA-90873 Incorrect query when filtering users by status in Customer Control Panel in Windows POA Management Node POA-90871 Domain with Parallels Plesk hosting cannot be created POA-90870 Incorrect instructions on enabling/disabling .htaccess file processing with OptimizeHTAccess option POA-90792 pem.addDomain API method ignores path parameter for hosting_type 0 POA-90788 Task of type "Remove access host from database on server on host " fails during subscription removing operation POA-90702 httpd service is not started after enabling option 'OptimizeHtAccess=on' in /etc/httpd/conf/httpd.conf POA-90696 "Protect Calendar folder for mailbox" task fails POA-90625 Install service-WindowsProvisioningEngine-5.5.168 package failed if user/password authentication is configured for WPE POA-90599 pa_updates_installer cannot import hashlib POA-90548 Restricted DNS subscription appears when trying to change DNS Hosting POA-90475 CentOS6 migration fails due to error: error while loading shared libraries: libboost_regex.so.1.41.0 POA-90473 POA migration script does not create Redis services on destination POA Management Node POA-90446 PBA session is not invalidated when user logs out from Provider Control Panel POA-90440 Error: "You do not have permissions to see the screen" appears on attempt to manage advanced settings in Customer Control Panel POA-90421 Resource usage for Cron Management resource is not changed if resource was unprovisioned POA-90420 "Drop database user xxx ..." task for PostgreSQL databases fails if user database contains objects POA-90322 Hosted Link displays domains of other subscriptions without DNS hosting POA-90225 Registration of database server breaks "mylittleadmin" configuration POA-90178 Hosting related tabs disappear after clicking 'Registered Domains > Manage DNS' in Customer Control Panel POA-90170 Privilege escalation vulnerability in Customer Control Panel POA-90144 "Change publishing settings for Parallels Plesk Sitebuilder site" task fails because of non-existing resource POA-90056 Custom php.ini does not supported with FastCGI POA-89261 "Plesk DNS hosting" is incorrectly changed to "Internal Name Servers" after deletion of subdomain with Plesk webhosting POA-89108 Underscore symbol cannot be created for DNS TXT records for cyrillic domains POA-88908 Note that domain parking on NG hosting does not support PHP should be added POA-88398 Migration may fail due to violation of packages dependency POA-88042 POA saves path to protected directory in Redis as httpdocs/ even if SSL support option is selected POA-86621 POA Reseller's Guide has info for dropped feature "Staff Members management from POA UI" POA-86333 Cannot enable SSL support during migration of Brand due to checkbox absence POA-84832 Outdated instructions for Legacy Linux Shared Hosting deployment in POA Linux Shared Hosting Deployment Guide POA-83564 Not all ports required by Windows FileManager are documented in PA Firewall Configuration Guide POA-83306 Note about absence of custom services on POA Management Node should be added to POA Services Upgrade and Migration Guide POA-82979 List of obligatory Plesk 11.5/12 EZ templates should be added to POA Parallels Plesk Panel in VPS Hosting Deployment Guide POA-82595 POA migration fails due to missing pgsql_firewall.sh file POA-80225 Conditions for destination VPS Hardware Node during VPS migration process should be described CCU-10398 Cannot create Linux PACI VE after upgrade to 6.0 - checkVELimits checks "not enabled in ST" storages limits CCU-10301 Discrepancy between Instance Manager and vm2vf callback CCU-10263 Memory usage spike from paciagent CCU-10259 "Backups and Images" list is not filtered by Period CCU-10257 Autoscale allows setting cpu_frequency above limit set in Service Template CCU-10087 Incorrect checkout of limit for CCU-10042 "Get usage data from PACI Instance Manager" task works unstable CCU-9841 POA cannot communicate with Instance Manager from different subnet APS-20564 SAAS Service Controller crashes constantly APS-20211 "Instance of application with id 0 does not exist" error is displayed on APS 1.2 application tab when "Embed application user interface" is enabled and application instance is not created yet APS-20043 External service password shown in CP source code APS-19856 Tenant resource is not linked with "Application Instance" resource if saas_ctl tool is applied for POA Account APS-19854 6.0.3: Task for provisioning of Lync license fails: creation of resource with type "dns" is not allowed APS-19659 Error when trying to install application: "You cannot install selected application as the current domain does not fulfill its requirements" APS-19234 "Synchronize Resource Usage" task is very slow if subscription has many counters Obtaining All required system updates can be easily installed through the pa_updates_installer (see the instructions). The update can be downloaded here. Important After upgrade to Odin Service Automation 6.0.3 (both Service Automation and Business Automation parts), the additional configuration is required. See also: Operations Automation 6.0 Updates. Internal content

Original Publishing Date: 2020-01-22 This hotfix is superseded by hotfix OA 7.4.0 HOTFIX 133474 PLATFORM v17 Internal content

Original Publishing Date: 2020-01-22 Symptoms During brands synchronization several tasks 'H2E Operation on host #xxx' have been found in failed state with the following output: Task name H2E Operation on host #xxx Internal error: /sbin/service /sbin/service httpd graceful failed with code 1 saying: STDOUT: '' STDERR 'Job for httpd.service invalid. At the same time httpd service became unavailable on Branding UI hosts causing outage of control panel. All other OA services are working correctly. In /var/log/messages the following errors are logged: abrt-hook-ccpp: Process 19637 (httpd) of user 0 killed by SIGSEGV - dumping core systemd: httpd.service: main process exited, code=dumped, status=11/SEGV abrt-server: Generating core_backtrace httpd: httpd not running, trying to start kill: kill: cannot find process "" systemd: httpd.service: control process exited, code=exited status=1 In error_log of Apache: AH00060: seg fault or similar nasty error detected in the parent process Version of httpd package is httpd-2.4.6-67.el7.centos.6. Cause Synchronization of brands performs a series of rapid Apache service reloads on all branding UI nodes in scope of 'H2E Operation on host #xxx' task. But due to software-related issue on RedHat side, Apache crashes after several reloads, resulting in the outage of control panel. This issue is marked as 'Fixed' on RedHat side, but it still could be reproduced with repository-supplied httpd package. Resolution Workaround should be applied on all affected Branding UI hosts to prevent httpd from crashing: Modify file /usr/lib/systemd/system/httpd.service by changing the line: ExecReload=/usr/sbin/httpd $OPTIONS -k graceful to ExecReload=/bin/sleep 0.5 ; /usr/sbin/httpd $OPTIONS -k graceful Propagate changes to systemd: # systemctl daemon-reload Start httpd (if it is stopped): # service httpd start Internal content

Original Publishing Date: 2020-01-22 Question How does High Availability work in Operations Automation Cloud Infrastructure environment? Answer When a Virtuozzo node is registered in OACI with Cloud Storage support enabled, OACI_hn_fail RPM is installed on the server. It stores the OACI IM address and credentials in /usr/local/etc/PACI_hn_fail.conf file and brings two additional shaman scripts /usr/share/shaman/50_node_crash and /usr/share/shaman/node_start. When shamand service on a node detects that the node is crashed (which means that it has become unavailable for the shaman master server), PACI_hn_fail script is called on the shaman master node and passes the IP address of the crashed node to OACI IM and triggers the failover procedure. The failover procedure: 3.1. If the crashed node is in "INACTIVE" state in OACI or if other nodes in cluster have "INACTIVE" status in OACI and there is no candidate node to put resources on, then no virtual environments are relocated. 3.2. If the crashed node is in "ACTIVE" or "LOCKED" state, then OACI IM chooses appropriate nodes in the same Cloud Storage cluster which currently host the least amount of containers and relocates the resources from the failed node to the healthy ones. During the relocation process, the VE gets a transient "FAILOVER_IN_PROGRESS" state in its history. After a successful failover, it gets a transient "FAILOVER_SUCCESS" state. All Load Balancers that were present on the failed node are recreated on healthy nodes. Note!: All VEs present in OACI would be relocated, it is impossible to disable failover for VEs created from OACI. A notification is sent to the affected customers that their servers have been relocated to other nodes. Internal content

Original Publishing Date: 2020-01-22 Symptoms OA generates wrong digest for DS record and send it to PHP domain plugins in SetDNSSEC method. As a result: Providers can not use digest fetched from OA while developing own PHP domain plugin; Current OpenSRS plugin sends wrong digest to registrar directly that should lead to imposibility to use DNSSEC for domain registered in OperSRS. Cause Issue is acknowledged as POA-115037. Resolution Contact your Technical Account Manager to trace the status of the issue. Internal content

Original Publishing Date: 2020-01-22 Symptoms A Plesk Panel upgrade fails with the error below: ERROR: Zend_Db_Statement_Exception SQLSTATE[HY000]: General error: 1017 Can't find file: './psa/smb_apsPackages.frm' (errno: 13)" I start the bootstrapper script to repair Plesk Panel and continue the upgrade process, but it fails too: /usr/local/psa/bootstrapper/pp11.0.9-bootstrapper/bootstrapper.sh repair ERROR while trying to upgrade MySQL password format for Sitebuilder user Cause The Presense Builder database user was not created during the Plesk upgrade. Resolution Back up the current Plesk Panel databases: mysqldump -u admin -p`cat /etc/psa/.psa.shadow` psa > ~/psa.`date +%F_%H:%M`.sql mysqldump -u admin -p`cat /etc/psa/.psa.shadow` apsc > ~/apsc.`date +%F_%H:%M`.sql Find the first preupgrade dump in the /var/lib/psa/dumps/ directory that has the following format: mysql.preupgrade.9.5.4-11.0.9.20130726-102859.dump Where: a) 9.5.4 - Plesk version before upgrade b) 11.0.9 - Plesk version you are upgrading to c) 20130726 - Date when upgrade started d) 102859 - Time when upgrade started Restore it: zcat /var/lib/psa/dumps/mysql.preupgrade.9.5.4-11.0.9.20130726-102859.dump | mysql -uadmin -p`cat /etc/psa/.psa.shadow` Check that the Presense Buidler user exists in the mysql database: #mysql -u admin -p`cat /etc/psa/.psa.shadow` mysql -sNe "select User from user where user='pp_sb_db'" pp_sb_db If the user is absent, then create it: a) For MySQL server version 5.1: #mysql -u admin -p`cat /etc/psa/.psa.shadow` mysql -sNe "insert into mysql.user values ('localhost','pp_sb_db','*3B063F312BAD7DB54911C318959EB12FF43925DB','N','N','N','N','N','N','N', 'N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N', 'N','','','','',0,0,0,0);" b) For MySQL server version 5.5: #mysql -u admin -p`cat /etc/psa/.psa.shadow` mysql -sNe "insert into mysql.user values ('localhost','pp_sb_db','*5D648C6BA7EC62DCBE81954B0FA0F9E18FFFF856','N','N','N','N','N','N','N', 'N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N','N', 'N','','','','',0,0,0,0,'',NULL);" Set a valid password for the pp_sb_db user from the /usr/local/sb/config file: a) Get the password: # grep password /usr/local/sb/config password = qwet1235 b) Update the database user with the password from the previous step: #mysql -u admin -p`cat /etc/psa/.psa.shadow` mysql -sNe "update mysql.user set password=password('qwet1235') where user='pp_sb_db';" Launch bootstraper again to perform a database upgrade: /usr/local/psa/bootstrapper/pp11.0.9-bootstrapper/bootstrapper.sh repair Internal content

Original Publishing Date: 2020-01-22 This hotfix is superseded by hotfix https://kb.cloudblue.com/126030. Internal content

Original Publishing Date: 2020-01-22 This hotfix also requires OA 7.3.0 HOTFIX 132121 PAU v2 Fixed Issues New fixed Issues PBA-83308 Capability to move resource between resource categories using CONFSYNC Included from BA 7.3.0 HOTFIX 132091 CONFSYNC v1 POA-114436 ConfSync removes delegated and not chosen for sync service templates Obtaining This hotfix can be downloaded from here. Installation Use oa-update KB111323 to install this hotfix. Also this hotfix will be installed automatically during upgrade to OA 7.3.0 via oa-update. Internal content

Original Publishing Date: 2020-01-23 Symptoms Attempt to change NS/update contact for the domain registered with OpenSRS fails: Name Servers update was failed. Can not modify name servers due to unable to set cookie with OpenSRS server. OpenSRS response: [415] Authentication Error. For support regarding , please contact your reseller, via the following: . This company may be contacted for domain login/passwords, DNS/Nameserver changes, and general domain support questions. Cause The external domain data is missing or incorrect. On the domain registration through BA a specific domain data is received from the registrar and is inserted to DomainExtData table. In case of missing data it means the subscription has been created manually with API or sales order was completed with the domain conflict resolver. Resolution Check the domain additional data: Home> Services> Domains> Domain #ID name.tld > Additional Information There should be the parameters DomainID, Login, Password If that is missing or incorrect, update it with DomainExtDataAdd_API call. Note, the correct parameterID for Password is Passwd. You might have to contact OpenSRS support to get correct password and might also want to check OpenSRS for possibility of Enabling "noauth" authentication. Enabling noauth in OpenSRS removes the requirement to authentication with the domains login/password. This is still secure because calls to the API are restricted to just IP address of BM server and uses the API key. You can contact OpenSRS for the additional details on how to enable/configure this. Internal content

Original Publishing Date: 2020-01-22 Symptoms There is no ASP.NET 4.0 Support established for the domain in ISAPI mode while enabling ASP.net 4 support on IIS 6-based hosting. Cause ASP.net 4 is not fully supported by IIS 6. Resolution ASP.net 4 is fully supported on IIS 7 and 7.5 as mention on KB Refer to the following knowledge base to learn more about supported versions of ASP.net: Internal content