Update scripts
Reqad keeps its maintenance scripts in /usr/local/reqad/scripts/update/. Each one fixes or sets up one thing on an existing server. Most run on their own on every install and update; a few are for you to run when you need them. This page lists them all, so you know which ones have already run and when to run the others.
You rarely need to run any of these.
dnf update reqad runs the automatic ones for you, in the right order. Each checks first and changes nothing when the server is already right, so running one again is harmless. Their output is in /usr/local/reqad/log/post_install.log.Running one by hand
bash /usr/local/reqad/scripts/update/<script> --dry-run bash /usr/local/reqad/scripts/update/<script> --apply
- Run them as root.
- Where a script has
--dry-run, try that first: it shows what would change and changes nothing. - Scripts that edit nginx, Apache, exim, dovecot or PHP-FPM test the new configuration first (
nginx -t,httpd -t,exim -bV,doveconf,php-fpm -t) and put the old file back if the test fails. - The header comment at the top of each script explains why it exists and what it touches.
Run on every install and update
In the order the update runs them. By hand lists the options that are useful when you run one yourself; panel marks scripts the panel also calls when you change the setting they belong to.
Panel, webmail and web server
| Script | What it does | By hand |
|---|---|---|
setup_reqad_fpm.sh | Sets up the panel's own PHP-FPM master (reqad-php-fpm, with its own php.ini). Runs once; later updates leave it alone, so your changes are kept. | - |
update_ini.sh | Adds missing keys to etc/server-software.ini. Never changes a value you set. | - |
update_roundcube.sh | Updates Roundcube (webmail) to the latest stable release; keeps its config, logs, temp files and custom plugins. | Run it to update webmail between Reqad releases. |
install-webmail-autologin.sh | Installs the Roundcube plugin behind the panel's "open webmail" button. | Panel: when webmail auto-login is switched on. |
setup_webmail_guard.sh --apply | Webmail brute-force protection: at most 3 failed logins a minute per mailbox, login POSTs limited per IP in nginx, and an lfd rule (tag reqadwebmail) that blocks an IP in the firewall after 10 failed logins. Blocks show under Settings > Security > Blocked addresses. | --dry-run, --remove |
update_user_phpfpm.sh | Adds required settings (security, logs, temp directories) to every account's PHP-FPM pool. | - |
update_default_nginx_host.sh | Creates the default nginx site for the server hostname if it is missing, with a Let's Encrypt certificate if there is one, otherwise self-signed. | Panel: when converting Apache to nginx. |
update_certbot_hostname.sh | Renews the hostname certificate through the web server instead of the standalone method. | - |
update_default_apache_host.sh | The same as the nginx one, for Apache servers. | - |
update_wetty_shell.sh | Keeps the web terminal (wetty) on Reqad's packaged start script. Does nothing without wetty. | - |
| Script | What it does | By hand |
|---|---|---|
setup_autoresponder_sieve.sh | Sets up autoresponders in Sieve. Only acts on servers that deliver mail through dovecot LMTP (see setup_dovecot_sieve.sh below). | - |
setup_sieve_pipe.sh | Enables the "Pipe to a program" email filter action, for server-wide and domain filters only. Same condition as above. | - |
seed_skiprbl_extra.sh | One-time move of a hand-made RBL skip list into the panel's "extra addresses". Does nothing afterwards. | - |
fix_maildir_dotfiles.sh | Keeps dovecot's internal files out of the folder list in mail clients. | - |
fix_imap_separator.sh | Makes sure the IMAP folder separator is ., which matches how mail is stored, and repairs folder subscriptions. | - |
fix_managesieve_listen.sh | ManageSieve listens on IPv4 loopback only, so dovecot starts on servers without IPv6. | - |
setup_special_use.sh | Tells mail clients which folders are Sent, Drafts, Trash and Junk, so phones and webmail use the same ones. | Afterwards see merge_duplicate_sent.sh. |
repair_truncated_exim_conf.sh | Restores a damaged exim configuration from the newest good backup. Does nothing when the configuration is complete. | [path to exim.conf] |
setup_spam_score_logging.sh | One SpamAssassin scan per incoming message as the receiving account, the score in exim's log and X-Spam-* headers on the message. | - |
setup_spamd_per_user.sh | Lets SpamAssassin read each account's own allow and block lists. | - |
setup_exim_reload.sh | Gives exim a real reload, so configuration changes apply without dropping connections. | Panel: used before reloading exim. |
setup_mail_limits.sh | Outgoing limits per sending domain: messages per hour and failed messages per hour. | Panel: Email > Config. |
fix_system_alias_pipe.sh | Delivers mail for root to the panel's root-mail forwarder reliably. | - |
setup_forward_spam_gate.sh | Doesn't forward mail SpamAssassin already marked as spam, which protects the server's sending reputation. | Panel: switch in Email > Config. |
ensure_dovecot_packages.sh | Checks that the dovecot add-on packages match dovecot and that Sieve is installed where it is used. During an update it only reports. | --fix installs what is missing. |
setup_dovecot_compress.sh --repair | Mail compression settings for dovecot 2.4; --repair only fixes a setup that is already on. | --status, --disable. Panel: Email > Config. |
setup_dovecot_vsz.sh --migrate | The memory limit per IMAP/POP3 process, kept in its own file. | --status, --vsz <size>, --reset. Panel: Email > Config. |
setup_autoconfig.sh | Automatic setup of mail accounts in Thunderbird and Outlook (static files, no PHP involved). | Panel: when converting Apache to nginx. |
Security and isolation
| Script | What it does | By hand |
|---|---|---|
patch_csf_cve_2026_67402.sh | Applies the CVE-2026-67402 fix to an installed csf (new installs get a fixed csf). | - |
fix_vhost_deny_order.sh | Puts the "deny hidden files" and "deny PHP in uploads" rules of existing sites before the PHP handler. | --dry-run |
setup_error_pages.sh | Reqad's error pages for every site; the pages don't name the web server software. | Panel: when converting Apache to nginx. |
fix_cache_perms.sh | Tightens permissions on the nginx caches and the shared PHP session folder. | - |
refresh_wp_security.php | Re-applies WordPress Toolkit security rules to the sites that use them, so rule improvements in an update reach them. | Run with the panel's PHP: /opt/reqad/php-current/usr/bin/php -c /etc/reqad/php-fpm/php.ini … |
fix_panel_ip_bypass.sh | The panel asks every client for its login, and monit checks an nginx-only /reqad-health address instead of the dashboard. | --dry-run |
setup_panel_loopback_guard.sh | Firewall rule: code running as a hosting account can't connect to the panel's local ports (panel, web terminal, monit). | --dry-run, --remove |
fix_panel_tree_perms.sh | The panel's folder, database and backups are readable by the panel only, not by hosting accounts. | --dry-run |
fix_dovecot_users_perms.sh | The mailbox password file is readable by the mail server and root only. | --dry-run |
setup_sysctl_hardening.sh | Kernel settings that keep accounts from watching each other (/etc/sysctl.d/90-reqad.conf). Override a value in 99-local.conf. | --dry-run, --remove |
setup_proc_hidepid.sh | Each account sees only its own processes. | --dry-run, --remove |
harden_account_perms.sh --apply --quiet | Account permissions: a site's files readable by its own account and the web server only; PHP pools in the account's own group. Writes a restore script (/var/lib/reqad/perms-restore-<time>.sh) before changing anything. | --dry-run, --user=NAME. Panel: after a PHP handler change and when converting Apache to nginx. |
tune_fpm_pools.sh --apply | Moves PHP pools still on the old defaults to on-demand workers: up to 20 per site, stopped after 10 s idle, a stuck script ended after 5 minutes. Pools you tuned are left alone. | --dry-run |
setup_session_limits.sh --apply | CPU, memory and process limits for each account's SSH, cron and web terminal sessions, and the log of limit hits. | --dry-run, --remove. Per account: reqad account limits. |
The update also runs two steps from outside this folder: scripts/account_shell.sh install (the jailed shell, for accounts with jailed or SFTP-only access) and reqad account limits --sync-db --quiet (database connection limits per account).
Run once, when needed
| Script | When the update runs it | What it does |
|---|---|---|
migrate_smtp_errors_log.sh | Updating from a panel database older than 1034. | Moves old SMTP delivery errors from the panel database into log/smtp_errors.log. |
Run by hand
These are never run by an update, because they change how mail is delivered, install packages, or are one-off jobs. Run each one when you need what it does.
| Script | When to run it | Notes |
|---|---|---|
check_lmtp_readiness.sh | Before switching mail delivery to dovecot LMTP. | Only reads. A non-zero exit code means: don't switch yet. setup_dovecot_sieve.sh runs it itself. |
setup_dovecot_sieve.sh | To turn on email filters at all three levels (server, domain, mailbox) and filter editing from webmail and mail clients. | Switches delivery to dovecot LMTP + Sieve and installs packages. --check only reports. See Email filters. |
setup_dovecot_fts.sh | To make mailbox searches fast. | Installs a package, restarts dovecot and indexes every mailbox over time. See Email search & indexing. |
merge_duplicate_sent.sh | Once, after setup_special_use.sh, to merge Apple Mail's "Sent Messages" into "Sent". | Only reports by default; --apply moves the mail. The only script here that moves messages. |
migrate_dovecot_2.4.sh | Upgrading a server from dovecot 2.3 to 2.4. | Rewrites the dovecot configuration and keeps mailboxes, certificates and keys. --no-upgrade, --force. |
rename_hostname.sh | Changing the server's hostname. | <new.host.name> [--dry-run] [--yes] [--no-cert] [--delete-old-cert]. Copies every file it changes to /root/reqad-hostname-rename-<time>/ first. |
update_phpmyadmin.sh | To update phpMyAdmin to the latest stable release. | Keeps its configuration and temp folder. |
ensure_dovecot_packages.sh --fix | When an update reported a missing or mismatched dovecot package. | The report-only check runs on every update. |
Need a hand? Create a free account or contact us.