I currently have the Web Application Firewall (ModSecurity) installed but would like a visual interface to block IP's, subnets etc.. Can I install the Plesk firewall as well without any conflict with the Web Application Firewall?
View 3 RepliesI have enabled modsecurity system and in 1 day the modsec_audit.log file has grown to more than 700Mb. Is there any way to reduce the number of messages that this module logs?
View 4 Replies View RelatedI want to create logrotate in logrotate.d for modsecurity log.
I find following code, but it don't works.
Code:
/var/log/modsec_audit.log {
rotate 7
compress
missingok
notifempty
sharedscripts
postrotate
/sbin/service httpd reload > /dev/null 2>/dev/null || true
endscript
}
I have a Real Time Web Application Security Rules Subscription. I change the ModSecurity Rule Setup and add the Atomic LoginData to Plesk. All looks fine but the ModSecurity Log is now empty.
- Debian 7 with all Updates
- Plesk Version 12.0.18 Update #49
Output from: ~# aum -df upgrade asl
[URL] ....
After install the ModSecurity Web Application Firewall for Apache no button for manageing module is displayed in plesk.
Installation was successful. How can I repair the button in plesk / webbased manage mod_security?
Error when trying to set atomic subscription rule:
Failed to install the ModSecurity rule set: SecReadStateLimit is depricated, use SecConnReadStateLimit instead.
Syntax error on line 70 of /etc/httpd/conf/modsecurity.d/rules/atomic/modsec/00_asl_zz_strict.conf:
Error creating rule: Could not add entry "127.0.0.0/8" from: 127.0.0.0/8.
In directory /etc/httpd/conf/modsecurity.d/rules I have only: atomic.new modsecurity_crs-plesk tortix tortix.backup
There is no file 00_asl_zz_strict.conf
Once Atomic Basic is enabled, the following error appears:
Code:
Failed to install the ModSecurity rule set: modsecurity_ctl failed: gpg: key 4520AFA9: "Atomicorp (Atomicorp Official Signing Key) <support@atomicorp.com>" not changed gpg: Total number processed: 1 gpg: unchanged: 1 gpg: Signature made Tue Jun 17 16:53:49 2014 CEST using RSA key ID 4520AFA9 gpg: Good signature from "Atomicorp (Atomicorp Official Signing Key)
[Code] .....
OS Debian 7.5
Plesk version 12.0.18 Update #4, last updated at June 18, 2014 02:51 AM
I'm in the process of installing PPA on infrastructure running Parallels Cloud Server. Each container has 2 interfaces, one public facing and a private interface for inter-server communication.
No problems installing PPA 11.5 (specifying IP's on commandline) or adding service nodes however, the firewall rules the documentation speaks of are nowhere to be seen? i.e.:
Important: After the installation, PPA creates the special firewall chain PPA-SN-Rules-INPUT used for communication with service nodes. Do not change it, otherwise, you will not be able to add service nodes to PPA.Click to expand...
Has this been dropped from PPA 11.5 ? (I recall seeing the firewall settings in 11.1) There is also no sign of the ppa.firewall tool that is also mentioned.
The only rule I see inserted is for Postgres on the management node, and 2 for pleskd on all of the nodes (open to world!).
I have just recently moved to Plesk web admin from cpanel. I have been trying to get the cron to run for the past 48 hours but no luck. Bellow is the code i have been trying to execute via cron but It does not run.
"/usr/bin/php /var/www/ vhosts/mydomain. com /httpdocs/billing/index.php cron"
I have installed plesk on cloudlinux
But I can not see an login prompt when i try to connect with https://myserverip:8443
netstat -tulpen gives me the Output
EN 0 183156 69422/httpd
tcp 0 0 :::8443 :::* LIST
How to activate/enable the firewall by cli, does this is possible?
Firewall module is installed.
Option in plesk GUI working well.
Does this is possible ? If yes how ?
I tried to setup a cronjob to run a php script. Something simple like this:
php /var/www/vhosts/onlinehome-server.info/mydomain.co.uk/script.php
didn't worked. So I used the terminal as root and I noticed that php is not running script not even as root.
not even commands like php -v works. I don't get any error back.
Plesk version 12.0
an email notification for this is coming through every day. It says ended successfully so no errors...
Running task: C:Pleskadmininweb_statistics_executor.exe
Started: Fri Jun 19 01:49:01 2015
Ended successfully: Fri Jun 19 01:49:09 2015
If i go to Server -> Scheduled Tasks and look for it, it cannot be found anywhere. Also scheduled tasks only shows system users, not 'Plesk Administrator' as the kb articles refer to.
Is that possible to block baidu without specifying whole list of IDs it's using ?
View 1 Replies View RelatedI have these problems since version 11.5. Now I have installed version 12 on centos . FTP works fine and is super fast and speedy until i enable PLEK FIREWALL, I also tried to add passive port range 60000-65534 to Plesk Firewall rules.
But nothing works.
It takes like 10 times longer to Login + List Files + Make changes using FTP. We applying changes via FTp and its very slow. We can use plesk file manager but its very inconvenient way for quick file uploads and changes.
I already posted this as a bug report and now wanted to inform other users.
Starting with Plesk 11.5, the file "/opt/psa/var/modules/firewall/firewall-emergency.sh" contains the following line:
Code:
rm -f /opt/psa/var/modules/firewall/active.flag
That line stems from updating
Code:
Preparing to replace psa-firewall 11.0.9-debian6.0.build110120608.16 (using .../psa-firewall_11.5.30-debian6.0.build115130819.13_amd64.deb) ...
Unpacking replacement psa-firewall ...
Now, when you stop the firewall, you cannot start it again, cause deleting the active.flag disables the firewall:
Code:
# ll /opt/psa/var/modules/firewall/active.flag
-rw-r--r-- 1 root root 0 2013-11-26 09:22 /opt/psa/var/modules/firewall/active.flag
# /etc/init.d/psa-firewall stop
psa-firewall: firewall successfully disabled
# ll /opt/psa/var/modules/firewall/active.flag
ls: cannot access /opt/psa/var/modules/firewall/active.flag: No such file or directory
# /etc/init.d/psa-firewall start
psa-firewall: service is disabled
You then have to manually "touch" the active.flag to be able to start the firewall again. A workaround is to remove the line:
Code:
sed -i 's:rm -f /opt/psa/var/modules/firewall/active.flag::' /opt/psa/var/modules/firewall/firewall-emergency.sh'
I really hope that Parallels fixes this asap, as normally you won't notice that the firewall is not active when every works fine (nothing is blocked) and Plesk still shows all the rules.
I have a brand new and fresh installed server with:
Parallels Plesk v12.0.18
openSUSE 13.1
My Problem is, every day i have to click on activate in the settings of the firewall. Otherwise i have no Mail. The rest (Hosting, etc.) works fine.
No changes in the firewall settings where made, just a migration from my old server.
Plesk Firewall has no effect on IPv6?
I am writing today regarding the Plesk Firewall. It seemed to be pretty handy for quickly blocking troublesome users from *replace-with-whatever-IP-block-is-giving-you-trouble*. Yet I am unable to block IPv6 addresses, and the fire wall seems to let some blocked IPv4s right in. I did not see any distinction as to v4 or v6 in the Firewall dialog for adding custom rules, so...
The question is...
(1) Is the Plesk Firewall *supposed* to apply rules to IPv6 by default?
If yes...
(2) Is there a setting or a switch that has to be configured for this to work?
If yes...
(3) Where are said configuration options located?
Okay, when I run /sbin/ip6tables -L (CentOS) I get output that resembles the iptables (no 6) output, only... what, converted to IP6? Not sure. Example output:
DROP tcp ::ffff:31.0.0.0/104 ::/0 tcp dpts:1:10000
In that particular instance I added a drop for the 31.0.0.0/8 block (using the Plesk Firewall interface), in order to create the script that's loaded into iptables (and ip6tables as well, apparently) when one elects to "Apply Configuration". It worked great, executed perfectly, and the iptables output list output looked to be (and remember, I have grossly insufficient background knowledge in this area) accurate.
Yet at the time of this writing I can see via live traffic monitor that an address in the 31.0.0.0/8 block (IPv4) is pounding away at a website. This is curious, as the live traffic monitor indicates an IPv4 address. So... can an IPv4 address be detected and recorded from a host that is only able to connect via IPv6? While an interesting question, I was more concerned with just blocking the IPv6 address and get more academic with it later.
But this raises another question; why would Plesk populate ip6tables and not provide an interface to actually submit IPv6 addresses.
When I modify rules using the firewall panel it is not generating rules correctly when selecting allow from selected sources deny from others.
View 2 Replies View RelatedRunning plesk 12.018 on OpenSUSE 13.1
What causes the firewall to change / reset itself periodically? I enabled the plesk firewall, but some time later it is reset itself and switched to the opensuse firewall (completely different rule set, which blocks most of the ports).
I then disabled the plesk firewall and loaded my own iptables rule set via iptables-restore command. However a few hours later, it also gets reset to the opensuse firewall. The std. opensuse firewall closes most of the ports, so then our email is blocked.
I would like to permanently switch off any plesk handling of the firewall and manage the iptables myself. How to do this?
I also have fail2ban running and defined my own jail.local files.
i've uninstalled nginx and php-fm from plesk panel.but phpmyadmin info still showing it is running on nginx 1.6 and while uploading sql file i'm getting 503 gateway error.
View 3 Replies View RelatedI recently updated from 11.5 to 12. After the update, my simple "Websites & Domains->Scheduled Tasks" is no longer executing.
I verified that the task is still present in Plesk and enabled.
The simple task launches one of my PHP web pages to perform an action:
(set to once a day: Min=30, H=7, DM=*, M=*, DW=*)
wget --quiet --delete-after "http://www.MYWEBSITE.com/some/path/index.php?someparam=somevalue"
This cron job had been working fine for more than a year but stopped working after the update.
I would like to ask if its possible ( supported ) to run Parallers Plesk 12 Panel on centos 7 ( openlogic) in Microsoft Azure infrastructure.
View 3 Replies View RelatedIs there a way to set the php-handle for all domais as "fastcgi".
At the moment when i create a domain, it will be run as "apache".
I like to change it to "fastcgi". I know there is way, to change it in the databases, but i forget where was it...
my plesk control panel 11.5.30 has problems running the auto update of the panel. During the upgrade, the server reboots even after an error message appears that shows the following message: Can't parse /root/parallels/products.inf3: Error reading end tag.
View 4 Replies View RelatedThis happens in around 30% of the cases when I run CLI autoinstaller to update/install/remove packages.
Code:
Patches were installed successfully.
The changes were applied successfully.
Synchronizing the Debian APT package index files...
# pgrep -lf xinetd || service xinetd start
Starting internet superserver: xinetd.
# pgrep -lf xinetd || service xinetd start
849 /usr/sbin/xinetd -pidfile /var/run/xinetd.pid -stayalive
As you can see, after the autoinstaller finishes, xinetd is not running and has to be started again.
For some reason pmmcli-daemon has started to run constantly at 90-100% CPU even when it's not backing up.
No error message emails are generated.
I can stop it, but then I find it running after it has completed the domain backups.
Applying Plesk firewall changes? I make my change, apply and get to:
Status: Applying in progress. If your browser shows connection error messages, or if this screen does not disappear in more than 30 seconds, go to previous page.
And there things stay. Going back to look at the firewall I can see the change haven't been applied, and going to apply just results in the same. No error, just no anything. It also took numerous attempts to get firewall modification to be swtich on although finally at about the eighth attempt changes were enabled. Only now I can't apply them ...
After upgrading to Plesk 12 the FTP connection has become very slow. Mode Security, Fail2Ban and Plesk Firewall have been enabled, the security is set to force sFTP and maximum security and in /etc/proftpd.d/ a conf file has been added to set the passive ports that have been opened in the Plesk Firewall (60000 to 62000)
Turning off the Mod Security does not solve the slow connection.
What can we do to detect the cause of the problem?
Plesk 12.x
CentOS 6.5
Any method for copying the Firewall (extension) rules from one server to another.
I am using the plesk firewall and trying to set up SSH rule which only allows from my IP but deny from everywhere else. In previous versions this worked fine by adding an ip selecting Allow from selected sources, deny from others and the icon in the rules would be orange with the lines
allow incoming from xxx.xxx.xxx.xx
Deny incoming from all others
However this no longer works as the deny from all others is not appearing and is not being generated in the iptables by plesk.