Top Nav

Navigation

Archive | Plesk

Diffie–Hellman (DHE) Ciphers On Nginx

By on November 6, 2020 in Nginx, Plesk

In some cases you may wish to allow Diffie–Hellman (DHE) ciphers in order to support older clients like IE on Windows 7.  On Plesk we often use the “intermediate” level in the Mozilla cipher set as described here:

https://wiki.mozilla.org/Security/Server_Side_TLS

The “intermediate” level includes:

  • ECDHE-ECDSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-ECDSA-AES256-GCM-SHA384
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-ECDSA-CHACHA20-POLY1305
  • ECDHE-RSA-CHACHA20-POLY1305
  • DHE-RSA-AES128-GCM-SHA256
  • DHE-RSA-AES256-GCM-SHA384

Of course the “ECDSA” or “Elliptic Curve Digital Signature Algorithm” ciphers will only be available if you are using ECC signed certificates.

Additionally the “DHE” ciphers will not be available by default if you are using Nginx releases greater then 1.11. With the 1.11 release Nginx moved the DHE key to an external setting instead of an internally generated key. The stock Nginx packages on Ubuntu and CentoOS do not setup a DHE key which results in the DHE ciphers not being available.

To address this problem, start by generating a key:

Next tell Nginx where to find the key:

Verify Nginx config and restart:

Now the DHE ciphers will be offered to clients and Window 7 / IE clients will be able to connect to the sites hosted on the server.

 

 

 

0

Mixing Plesk open_basedir path syntax

By on February 12, 2019 in Plesk

Plesk uses a convoluted syntax for open_basedir settings in Plesk. You can find this setting on a per-domain basis by navigating the Plesk GUI like this:

Domains -> example.com -> PHP Settings -> Common settings ->  open_basedir

The default setting looks like this:

This breaks down as follows:

The first part, {WEBSPACEROOT}{/} means the the entire webspace root, /var/www/vhosts/example.com/ in this case. This includes httpdocs and any folder in this path.

The second part {:} is the delimiter.

The third part {TMP}{/} means the /tmp directory

Any additional paths can be added by appending a normal UNIX-style path syntax as in this example:

In this case the default plus the PHP 7.2 pear directory is allowed. You can add as many directories as needed using the UNIX style path syntax in combination with the Plesk default. Be sure to use a colon as your delimiter.

0

Disable Basic Auth For Virtual Path On Plesk

By on February 16, 2018 in Apache, Nginx, Plesk

In a recent case we needed to allow request to a particular virtual URL path on a site that was password protected with HTTP Basic Auth. The site was hosted on a Linux server with Plesk, nginx and Apache.  Typically this problem is solved by adding a “Satisfy Any” to the .htaccess in the directory that you want to remove authentication. But this does not work if the path is virtual instead of a physical directory path. Additionally we needed to allow access for a list of IP addresses. We tried an number of different solutions and ended up with the following:

Step 1 – The HTTP Basic Auth and IP access controls are configured in the .htaccess file like this:

Step 2 – In Plesk under:

Add the following block:

where “/excluded/path” is the virtual URL to be allowed access and “x.x.x.x” is the IP address assigned to the site.

When a request comes is received, nginx looks for the path and adds the AUTH_OVERRIDE header. Then the request is passed to Apache which processes the .htaccess file. The AUTH_OVERRIDE header is converted to an “AUTH_REQUEST” environment variable and allow without authentication by the “allow from env=” rule.

There may be better ways to accomplish this solution but this is one that we successfully implemented.

 

 

0

Mitigate SWEET32 On Plesk Panel

By on November 21, 2016 in Plesk

Here’s a great article on the SWEET32 vulnerability and how to mitigate:

SWEET32 Birthday attack : How to fix TLS vulnerability (CVE-2016-2183) in OpenSSL, Apache, Nginx and IIS in RedHat, CentOS, Ubuntu, Debian, OpenSUSE and Windows

If you have a Plesk server then you’ll need adjust the panel ciphers by editing:

and change the contents to:

The restart the panel:

0

Plesk – Bulk Reset Subscription Expire Date

By on August 18, 2016 in Plesk

Here’s a one liner to set the expire date on all subscriptions to unlimited:

 

0