When you need to grant server‑wide access to teammates or helpdesk staff in Plesk Obsidian, the most robust way is via the Plesk CLI. This article walks through creating and managing additional Administrator accounts using admin_alias, with security best practices, restricted mode options, automation, and troubleshooting.
Works with: Plesk Obsidian 18.x. Commands should be run as
rootor with equivalent privileges on the Plesk server.
Why use admin_alias (Additional Administrator)?
- Keeps a unique login per person (no shared
admincredentials). - Enables easy disable/rotation without touching the main admin.
- Supports Restricted Mode so you can limit what each person can do.
- Scriptable for repeatable, audited operations.
Quick start: create an additional admin
|
1 2 3 4 5 6 7 8 |
# Secure method: avoid passing passwords on the command line # PSA_PASSWORD is read by Plesk; set it in the environment, then pass an empty -passwd PSA_PASSWORD='S3cureP@ss' \ plesk bin admin_alias --create jdoe \ -passwd '' \ -email [email protected] \ -contact "John Doe" |
Parameters you’ll use most:
--create <login>: the new additional admin username.-passwd '': leave empty when usingPSA_PASSWORDto avoid leaking secrets in shell history.-email <address>and-contact <name>: for notifications and audit.
Tip: Choose a username policy (e.g., first initial + last name) and stick to it for clean audit trails.
Common tasks
List all additional admins
|
1 2 |
plesk bin admin_alias --list |
Show one admin’s details
|
1 2 |
plesk bin admin_alias --info jdoe |
Update contact or email
|
1 2 |
plesk bin admin_alias --update jdoe -email [email protected] |
Disable / enable a login
|
1 2 3 |
plesk bin admin_alias --update jdoe -enabled false # disable plesk bin admin_alias --update jdoe -enabled true # re-enable |
Remove an additional admin
|
1 2 |
plesk bin admin_alias --remove jdoe |
Security best practices
- Never put passwords on the command line. Use the
PSA_PASSWORDenvironment variable and pass-passwd ''so credentials don’t end up in process lists or shell history. - Rotate credentials when people change roles. Disable first, then remove once offboarding completes.
- Enforce MFA in Plesk (if enabled in your deployment) for additional admins as you do for the primary admin.
- Audit regularly. Export the list of additional admins and compare it against HR/IT rosters (see automation snippet below).
Restricted Mode (Custom View) for safer access
Sometimes you want server‑wide access without full power. Create the additional admin with restrictions enabled, then fine‑tune capabilities.
|
1 2 3 4 5 6 7 8 |
# Create with Restricted Mode enabled PSA_PASSWORD='S3cureP@ss' \ plesk bin admin_alias --create helpdesk \ -passwd '' \ -email [email protected] \ -contact "Helpdesk" \ -enable_admin_restrictions true |
With restrictions on, tune what the (primary) admin role can do for these restricted accounts. Examples show toggling server‑level capabilities:
|
1 2 3 4 5 |
# Examples of tightening capabilities plesk bin admin --update -manage_server_firewall false plesk bin admin --update -manage_server_backup false plesk bin admin --update -manage_subdomains true |
Note: The
adminutility edits global admin settings; pair it with role profiles in the GUI for finer scoping.
Automation: tiny helper script
Drop a small helper to standardize operations. Save as /usr/local/sbin/plesk-admin-alias and chmod +x it.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
#!/usr/bin/env bash set -euo pipefail usage() { cat <<EOF Usage: plesk-admin-alias create <login> <email> <contact> plesk-admin-alias disable <login> plesk-admin-alias enable <login> plesk-admin-alias remove <login> plesk-admin-alias list plesk-admin-alias info <login> Notes: - Set PSA_PASSWORD in the environment for create operations. EOF } cmd=${1:-help} case "$cmd" in create) login=${2:?login}; email=${3:?email}; contact=${4:?contact} : "${PSA_PASSWORD:?Set PSA_PASSWORD for secure password input}" exec plesk bin admin_alias --create "$login" -passwd '' -email "$email" -contact "$contact" ;; disable) login=${2:?login} exec plesk bin admin_alias --update "$login" -enabled false ;; enable) login=${2:?login} exec plesk bin admin_alias --update "$login" -enabled true ;; remove) login=${2:?login} exec plesk bin admin_alias --remove "$login" ;; list) exec plesk bin admin_alias --list ;; info) login=${2:?login} exec plesk bin admin_alias --info "$login" ;; *) usage; exit 1;; cesac |
Optional: schedule a monthly audit export (cron):
|
1 2 3 4 |
# /etc/cron.monthly/plesk-admin-audit #!/bin/sh plesk bin admin_alias --list > /var/log/plesk-admin-alias-$(date +%F).txt |
Troubleshooting
admin_alias: command not found— Ensure you’re on a Plesk server and running as root. Full path is usually/usr/sbin/pleskthenbin admin_alias.Permission denied— Run withsudo -ior as root.User already exists— Pick a unique login; check with--list.- Password prompts ignored — Remember: when using
PSA_PASSWORD,-passwdmust be present but empty (-passwd '').
Copy‑paste reference
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# Create PSA_PASSWORD='S3cureP@ss' plesk bin admin_alias --create jdoe -passwd '' -email [email protected] -contact "John Doe" # List plesk bin admin_alias --list # Info plesk bin admin_alias --info jdoe # Update (email) plesk bin admin_alias --update jdoe -email [email protected] # Disable / Enable plesk bin admin_alias --update jdoe -enabled false plesk bin admin_alias --update jdoe -enabled true # Remove plesk bin admin_alias --remove jdoe |
Final notes
- Test in a staging environment first if you maintain multiple Plesk servers.
- Pair CLI changes with your credential management and offboarding playbooks.
- Consider enforcing MFA and IP allow‑lists where feasible.
Need help hardening or automating your Plesk fleet? Reliable Penguin can set up standardized scripts, logging, and monitoring tailored to your environment.
