I was just trying to install Contao5 on PHP8.4 within Froxlor. Contao complains about /dev/null not being in the open_basedir directive. So I wanted to add it under Settings > Webserver > Paths to append ... but it is not reflected in the PHP-Ini. The open_basedir says "open_basedir = "<customerpaths>:/usr/share/php/:/usr/share/php5/" - the latter paths are taken from FCGID-Settings in Froxlor. But the /dev/null won't get added.

Is this normal behaviour or can it be considered a bug?

The full name of the setting is:

<--

Paths to append to OpenBasedir
These paths (separated by colons) will be added to the OpenBasedir-statement in every vHost-container.

-->

Does this only apply for vhost-Containers? Since I have PHP as FCGID - the vhost does not Apply for Open_Basedir...

Thanks for your thoughts,

Thomas.

ich habe versucht Froxlor von einer Uralt-Version unter Debian 9 (noch im alten Design) auf Version 2.3.10 upzugraden.

Ich bin auch von Debian 9 direkt auf Debian 12 Bookworm gesprungen, das ging auch nicht ohne Querelen.

Das neue Login-Panel von Froxlor 2.3.10 war sichtbar, auch das Dashboard, wo man links nur "froxlor upgrade" sieht.

Unten auf "proceed" geklickt, Database integrity ok. Aber "Click here to continue" führt mich nur wieder zur froxlor update Seite.

Ich habe in der Zwischenzeit versucht froxlor mit purge komplett zu entfernen und neu zu installieren, nach der Anleitung auf https://docs.froxlor.org/latest/general/installation/apt-package.html.

Der Fehler bleibt aber derselbe, ich bleibe im Update-Schirm von Froxlor hängen.

Aus einem anderen Post im Forum ahne ich schon, dass da was mit der Uralt-Datenbank nicht richtig funktioniert.

Könntest Du mir einen Tipp geben, wie ich das ganze beheben kann? Die installierten Websites sind nicht so wichtig, ich könnte alle Konfigurationen problemlos löschen und neu installieren (also die gesamte Froxlor-Datenbank und die sites-enabled-Konfigurationen aus /etc/nginx/ entfernen).

Server ist jetzt auf Debian 12 Bookworm, PHP 8.4., nginx.

liebe Grüße aus Wien

is there any way to completely disable statistics in an update safe way?
I already uninstalled awstats, so there is nothing left on my debian server.

Froxlor still creates folders/configs as I did not find any place to disable statistics.

Thank you for all the assistance so far! Today, I modified a user to have 3MB of stored, then uploaded a 414MB file. I adjusted the Web- and Traffic- Reports cronjob to run every 8 hours instead of once a day. After a few hours, the cron ran and the traffic bar updated to 416.69 MiB / 3.00 MiB. However, the user can still upload more files. Although not tested, this makes me wonder if exceeding the traffic limit allows the user's website to keep getting more hits past the limit.

I noticed the Quota option in System > Settings > Quota, however the directories listed there (/usr/bin/quotatool and /usr/sbin/repquota) do not exist (Even after activating Quota and rebuilding configuration files). I found a GitHub repository with a similar name (https://github.com/ekenberg/quotatool), but could not find any documentation that connects it to Froxlor.

Does Froxlor has a way to suspend uploads and file creation activity when account quotas are reached and deactivating the user when traffic limits are reached?

Thank you!

Are there any plans to integrate rspamd quarantine into froxlor?

TIA & regards,

Dudi

Just upgraded from 2.3.6 to 2.3.7 on debian 12, unable to login as admin.

Tried Edge, Chrome & Brave - credentials are correct.

Services are all functioning and I have ssh access.

Please advice.

Regards,

Dudi

I am trying to give customers access to the PHP error log from their FTP account. I have been experimenting with the error_log statement in the php.ini setting under PHP > PHP Configurations > [User PHP Config], however it only seems to work if the destination file has already been created. Obviously, this is not ideal as users could accidentally delete the file or the process I would have to setup to create the file could fail.

Leaving the statement blank sends the data to Froxlor's error logging system. Since I passed 1 for the option "speciallogfile", the user seems to have their own dedicated log file in the system (Please correct me if either of these statements are wrong). Is there a way to get this log file accessible to the user over FTP without manually creating systemlinks?

I want the customer to be able to access their php error logs via FTP. Where that file is stored I don't really have a preference as long as it is easily accessible.

I took a look at past forum posts and the documentation, but did not see anything relevant.

Thank you!

I recently setup my first Froxlor instance and have been trying to prevent the froxlor login UI from showing on the server's IP address. I would like all logins to happen through hostname.tld. Over the past few hours, I have unsuccessfully been modifying the settings under IPs and Ports to try and achieve this. I tried DocRoots, and a whole bunch of different V-Host settings but everything that worked for preventing the IP logins also affected client sites in some negative way.

I was unable to find any other related topics by searching the forum, but I may have just been using the wrong keywords.

How would I go about configuring the system to reject any direct-IP requests?

Thank you!

I can not down grade to PHP 8.2

What can I do, or change in the install files that would allow the installation to continue with PHP 8.3.29?

Thanks

after updating to Froxlor 2.2.6, I encountered the following error when i try to create a new database.

A database error occurred
SQLSTATE[42000]: Syntax error or access violation: 1410 You are not allowed to create a user with GRANT

This are the log:

==> /var/log/apache2/error.log <==
froxlor[2673501]: SQLSTATE[42000]: Syntax error or access violation: 1410 You are not allowed to create a user with GRANT
froxlor[2673501]: --- DEBUG: #0 /var/www/froxlor/lib/Froxlor/Database/Database.php(122): PDOStatement->execute(Array) 
#1 /var/www/froxlor/lib/Froxlor/Database/Manager/DbManagerMySQL.php(363): Froxlor\Database\Database::pexecute(Object(PDOStatement), Array) 
#2 /var/www/froxlor/lib/Froxlor/Database/DbManager.php(209): Froxlor\Database\Manager\DbManagerMySQL->grantCreateToDb('b---m', 'b---4', '127.0.0.1') 
#3 /var/www/froxlor/lib/Froxlor/Api/Commands/Mysqls.php(118): Froxlor\Database\DbManager->createDatabase('b---m', 'F8%k@PF((Dd5:b9...', 0, 3, 'b---m') 
#4 /var/www/froxlor/customer_mysql.php(151): Froxlor\Api\Commands\Mysqls->add() #5 {main}

Additionally, I recently updated my Ubuntu system. Here are the versions currently installed:

• MySQL: 8.0.41-0ubuntu0.24.04.1
• Froxlor: 2.2.6

Could you help me resolve this issue?

Thanks
Bastian

Ich habe mein Roundcube außerhalb von /var/www/html/ froxlor liegen:

root@v201993 ~ # ls -la /var/lib/roundcube
total 24
drwxr-xr-x  6 root     root     4096 Sep  3 13:57 .
drwxr-xr-x 53 root     root     4096 Feb 19 18:44 ..
lrwxrwxrwx  1 root     root       14 Jun  2  2025 config -> /etc/roundcube
lrwxrwxrwx  1 root     root       23 Jun  2  2025 .htaccess -> /etc/roundcube/htaccess
lrwxrwxrwx  1 root     root       30 Jun  2  2025 index.php -> /usr/share/roundcube/index.php
lrwxrwxrwx  1 root     root       19 Jun  2  2025 logs -> ../../log/roundcube
drwxr-xr-x  2 root     root     4096 Sep  3 13:58 plugins
lrwxrwxrwx  1 root     root       28 Jun  2  2025 program -> /usr/share/roundcube/program
drwxr-xr-x  3 root     root     4096 Sep  3 13:57 public_html
drwxr-xr-x  2 root     root     4096 Sep  3 13:58 skins
lrwxrwxrwx  1 root     root       24 Jun  2  2025 SQL -> /usr/share/roundcube/SQL
drwxr-x---  2 www-data www-data 4096 Jun  2  2025 temp

In /etc/apache2/conf-enabled/phpmyadmin.conf habe ich Folgendes stehen:

root@server ~ # cat /etc/apache2/conf-enabled/phpmyadmin.conf  
# phpMyAdmin default Apache configuration 

Alias /phpmyadmin /usr/share/phpmyadmin 

<Directory /usr/share/phpmyadmin> 
    Options SymLinksIfOwnerMatch 
    DirectoryIndex index.php 

    # limit libapache2-mod-php to files and directories necessary by pma 
    <IfModule mod_php7.c> 
        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp 
        php_admin_value open_basedir /usr/share/phpmyadmin/:/usr/share/doc/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpm
yadmin/:/usr/share/php/:/usr/share/javascript/ 
    </IfModule> 

    # PHP 8+ 
    <IfModule mod_php.c> 
        php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp 
        php_admin_value open_basedir /usr/share/phpmyadmin/:/usr/share/doc/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpm
yadmin/:/usr/share/php/:/usr/share/javascript/ 
    </IfModule> 

</Directory> 

# Disallow web access to directories that don't need it 
<Directory /usr/share/phpmyadmin/templates> 
    Require all denied 
</Directory> 
<Directory /usr/share/phpmyadmin/libraries> 
    Require all denied 
</Directory>

Nun ist es so, dass in meine /etc/apache2/sites-enabled/10_froxlor_ipandport_123.123.123.123.443.conf (Name und Inhalt bissl anonymisiert) der Handler nur für:

root@server ~ # cat /etc/apache2/sites-enabled/10_froxlor_ipandport_123.123.123.123.443.conf
# 10_froxlor_ipandport_123.123.123.123.443.conf
# Created 20.02.2026 17:15
# Do NOT manually edit this file, all changes will be deleted after the next domain change at the panel.

<VirtualHost 123.123.123.123:443>
DocumentRoot "/var/www/html/froxlor"
 ServerName server.domain
  <Directory "/var/www/html/froxlor/lib/">
    <Files "userdata.inc.php">
    Require all denied
    </Files>
  </Directory>
  <DirectoryMatch "^/var/www/html/froxlor/(bin|cache|logs|tests|vendor)/">
    Require all denied
  </DirectoryMatch>
  <Directory "/var/www/html/froxlor/">
  <FilesMatch \.(php)$>
    <If "-f %{SCRIPT_FILENAME}">
        SetHandler proxy:unix:/var/lib/apache2/fastcgi/10-froxlor.panel-server.domain-php-fpm.socket|fcgi://localhost
    </If>
  </FilesMatch>
    Require all granted
    AllowOverride All
  </Directory>
Protocols h2 http/1.1
 SSLEngine On
 SSLProtocol -ALL +TLSv1.2
 Protocols h2 http/1.1
 SSLCompression Off
 SSLSessionTickets on
 SSLHonorCipherOrder off
 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!DHE-RSA-AES128-GCM-SHA256:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-AES128-SHA256:!DHE-RSA-AES256-SHA:!DHE-RSA-AES128-SHA:!DHE-RSA-AES256-SHA256:!DHE-RSA-CAMELLIA128-SHA:!DHE-RSA-CAMELLIA256-SHA
 SSLVerifyDepth 10
 SSLCertificateFile /etc/apache2/apache2.pem
 SSLCertificateKeyFile /etc/apache2/apache2.key
 SSLCACertificateFile /etc/apache2/apache2.ca
</VirtualHost>

Nun ist es so, dass der folgende Block dafür sorgt, dass phpmyadmin nicht mit dem php handler läuft und mir lediglich Quellcode beim Aufruf von phpmyadmin angezeigt wird:

<Directory "/var/www/html/froxlor/">
  <FilesMatch \.(php)$>
    <If "-f %{SCRIPT_FILENAME}">
        SetHandler proxy:unix:/var/lib/apache2/fastcgi/10-froxlor.panel-server.domain-php-fpm.socket|fcgi://localhost
    </If>
  </FilesMatch>
    Require all granted
    AllowOverride All
  </Directory>

weil phpmyadmin nicht unterhalb von /var/www/html/froxlor/ liegt und somit keinen handler hat. Passe ich hier Zeilen an, schreibt der froxlor-cron sie mir jedoch wieder rein.

Meine Frage wäre also, wo genau sind diese Zeilen definiert? Wo genau finde ich eine Einstellung oder template um die default.conf nachhaltig zu beeinflussen?

Vielen Dank im Voraus und schöne Grüße aus Hamburg! 🛹

server.host.name is my hostname but I need an account set up for my www.host.name website so why can't it be used?

It doesn't make sense why I can't create that account.

apt update reported an untrusted cert for froxlor.org.

Trying to get the cert:

root@stoli:~# wget https://deb.froxlor.org/froxlor.gpg

--2025-12-28 15:48:49-- https://deb.froxlor.org/froxlor.gpg

Resolving deb.froxlor.org (deb.froxlor.org)... 185.123.52.110, 2a10:ec2::185:123:52:110

Connecting to deb.froxlor.org (deb.froxlor.org)|185.123.52.110|:443... connected.

ERROR: The certificate of 'deb.froxlor.org' is not trusted.

ERROR: The certificate of 'deb.froxlor.org' has expired.

The certificate has expire

FYI

Regards,

Dudi

After upgrading from Bookworm to Trixie I noticed Internal Server Errors when checking some of the websites. Looking at the logs I found out suexec was complaining about violation

[2025-12-08 14:52:40]: directory is writable by others: (/var/www/php-fcgi-scripts/xxxx/xxxx.org)

I checked the permissions of the /var/www/php-cgi-scripts with the following outcome

total 16
drwxr-xr-x 4 root root 4096 Dec  8 14:51 .
drwxr-xr-x 8 root root 4096 Dec 27  2023 ..
drwxrwxr-x 3 root root 4096 Dec  8 14:51 froxlor.panel
drwxrwxr-x 5 root root 4096 Dec  8 14:51 xxxx

I manually changed the permissions to 755 and the websites worked again

total 16
drwxr-xr-x 4 root root 4096 Dec  8 15:46 .
drwxr-xr-x 8 root root 4096 Dec 27  2023 ..
drwxr-xr-x 3 root root 4096 Dec  8 15:46 froxlor.panel
drwxr-xr-x 5 root root 4096 Dec  8 15:46 xxxx

Then I realized that the froxlor tasks overwrites those permissions of all the directories inside php-cgi-scripts directory with

drwxrwxr-x

Am I doing something wrong? this wasnt' a problem with bookworm. I'm using https://docs.froxlor.org/latest/admin-guide/configuration/fcgid/, well I've been using fast.cgi since when I first installed Froxlor 12 years ago.

Any ideas? Do you need some other logs or info from my system to help debug this?

Thank you,

Lluc

Whoops!

The configuration file lib/userdata.inc.php cannot be read from the webserver.

This mostly happens due to wrong ownership.
Try the following command to correct the ownership:

chown -R www-data:www-data /var/www/html/froxlor/

Has anybody successfully installed dovecot 2.4.1/2 on froxlor 2.2.8 ?
No chance. some awful issue with mysql.

no matter which dovecot config is changed, there is one of two possibilities:
1) dovecot does not start

2) Login does not work
Nov 23 09:04:43 mail dovecot[19382]: auth: Fatal: passdb sql: sql mysql: mysql { .. } named list filter is missing
Nov 23 09:04:43 mail dovecot[19380]: master: Error: service(auth): command startup failed, throttling for 2.000 secs
Nov 23 09:04:43 mail dovecot[19382]: imap-login: Login aborted: Auth process broken (disconnected before auth was ready, waited 0 secs)

i am out of ideas

regards,

Xibeaga

Under "Resources > Domains > Edit  a domain", the options related to "Webserver SSL settings" are selected, including "Use Let's Encrypt".

I already reloaded apache after doing these selections. Unfortunately, when I point a domain to froxlor server IP in /etc/hosts to access the domain locally, I get unsecured connection.

What should I do next in order to enable Let's Encrypt SSL certificate on a domain? 

i need some help to debug an issue. On my froxlor system with latest froxlor 2.2.8 on Debian 12 sents the quota mails on first of month every hour. Both quota: traffic and storage mails are effected and the values are based on the calculation of last month.

1) is this a "wanted" behaviour, that the mails are sent out every hour?

2) I do not find a dedicated cronjob for these mailout taskand no setting to adjust the sent out freuqency. Which job is taking care of the mails?

My /etc/cron.d/froxlor looks like this:

# automatically generated cron-configuration by froxlor
# do not manually edit this file as it will be re-generated periodically.
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
#
*/2 * * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'tasks' -q 1> /dev/null
0 * * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'traffic' -q 1> /dev/null
3 * * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'usage_report' -q 1> /dev/null
6 */6 * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'mailboxsize' -q 1> /dev/null
*/10 * * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'letsencrypt' -q 1> /dev/null
9 * * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'export' -q 1> /dev/null
# Look for and purge old sessions every 30 minutes
09,39 * * * * root /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:php-sessionclean 1> /dev/null

I am getting 2 of these emails every 5 minutes:

1 - Subject: Cron <root@stoli> /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'tasks' -q 1> /dev/null

2 - Subject: Cron <root@stoli> /usr/bin/nice -n 5 /usr/bin/php -q /var/www/html/froxlor/bin/froxlor-cli froxlor:cron 'letsencrypt' -q 1> /dev/null

Content: PHP Warning:  Module "mbstring" is already loaded in Unknown on line 0 - Same for both

I set up a rule to delete them but I'd like to find out why I get these and fix it.

Regards,

Dudi

I have System->Settings->Antispam settings->Activate antispam disabled.

However - cron keeps adding the rspamd milter to postfix's main.cf.

How do I disable this?

Regards,

Dudi

I was searching for a best practice to setup OPcache in combination with PHP-FPM, Apache and Froxlor, but found none.

I tried to read many posts from different forums, but unfortunately I'm not getting anywhere. Also asking AI did not really help.

This is my PHP-FPM pool config:

php_admin_flag[opcache.enable]=1
php_admin_flag[opcache.enable_cli]=1
php_admin_value[opcache.restrict_api]="{DOCUMENT_ROOT}"
php_admin_value[opcache.memory_consumption]=4096
php_admin_value[opcache.interned_strings_buffer]=128
php_admin_value[opcache.max_accelerated_files]=131071
php_admin_flag[opcache.validate_timestamps]=1
php_admin_value[opcache.revalidate_freq]=60
php_admin_flag[opcache.save_comments]=1
php_admin_flag[opcache.fast_shutdown]=1
php_admin_value[opcache.max_wasted_percentage]=5

Somehow the memory usage is immediately full. It does not matter, if I set the memory size to 1024 MB, 4096 MB, 8192 MB, 32768 MB or even 102400 MB. Also the memory usage of the OPcache is not matching with the RAM usage of the server. The server has 12 vCPU and 64 GB of RAM running Debian 12.4.

I'm running about 25 small Wordpress sites, each has about 2-3 visitors per hour, so nearly no traffic and load. If I get the cached scripts with opcache_get_status(true) and sum the memory consumption of each script, I'm reaching about 110 MB.

In the overview the hits count and cached script count should be much higher, since only two out of 25 Wordpress sites are partially cached.

In attachment the OPcache overview page of Froxlor and phpinfo OPcache settings. I'm using PHP-FPM 8.4.12.

Is this an OPcache issue, misconfiguration or know behavior? Does anyone have an idea on how to solve that or maybe I should use another caching mechanism?

Thanks!

Reinstalled froxlor from scratch instead of the migration.

When trying to enable LE for a domain I get:

Error

Let's Encrypt cannot handle wildcard-domains using ACME in froxlor (requires dns-challenge), sorry. Please set the ServerAlias to WWW or disable it completely

Editing the domain shows: "Alias for domain - No alias domain" but the drop list is empty, nothing to choose or set.

What do I do next please?

Regards,

Dudi

I am looking for a good bind editor that can add all types of records including a PTR.

Can this be done in froxlor bind editor?

Regards,

Dudi

I am migrating froxlor to a new debian 12 machine with a temporary IP, not a private IP.

What is the best practice as far as froxlor is concerned to keep froxlor working after its real IP is assigned?

Tia & regards,

Dudi

I have a new debian 12 server set up, froxlor install worked with no issues.

I am unable to login to the new install, tried chrome, edge and brave browsers, same result.

purged froxlor db & users, tried a fresh install with root as froxlor privileged user, same result.

I tried setting the password for admin via mysql md5(), same result.

Pointers appreciated,

Regards,

Dudi Goldenberg

Kolcore ltd.