Category: Plesk

Mitigate SWEET32 On Plesk Panel

November 21, 2016

Here’s a great article on the SWEET32 vulnerability and how to mitigate: https://bobcares.com/blog/how-to-fix-sweet32-birthday-attacks-vulnerability-cve-2016-2183 If you have a Plesk server then you’ll need adjust the panel ciphers by editing:

/etc/sw-cp-server/conf.d/ssl.conf

1	/etc/sw-cp-server/conf.d/ssl.conf

and change the contents to:

ssl_prefer_server_ciphers On;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;

ssl_prefer_server_ciphers On;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;

The restart the panel:

service sw-cp-server restart

1	service sw-cp-server restart

Plesk – Bulk Reset Subscription Expire Date

August 18, 2016

Here’s a one liner to set the expire date on all subscriptions to unlimited:

for SUBSCRIPTION in `/usr/local/psa/bin/subscription --list`; 
 do /usr/local/psa/bin/subscription_settings --update $SUBSCRIPTION -expiration -1; 
done;

for SUBSCRIPTION in `/usr/local/psa/bin/subscription --list`;

do /usr/local/psa/bin/subscription_settings --update $SUBSCRIPTION -expiration -1;

done;

Install New Relic With Plesk 12.5

July 23, 2016

Plesk 12.5 allow for multiple PHP versions and integration methods. This is a great feature but it makes installing New Relic more difficult. New Relic by default installs to the Linux distribution’s version of PHP. With Plesk 12.5, there are multiple PHP versions in different locations. Also New Relic uses a unix socket to facilitate communication between the newrelic-daemon and the PHP component. When running PHP under php-fpm there are permission problems with multiple sites using New Relic. Here are the steps to get New Relic working on CentOS or RedHat. Other Linux distributions will be similar. 1. Install New Relic for the operating system following the standard instructions: https://docs.newrelic.com/docs/agents/php-agent/installation/php-agent-installation-overview 2. Set the newrelic-daemon to run independently by copying the config file template:

cp /etc/newrelic/newrelic.cfg.template /etc/newrelic/newrelic.cfg

1	cp /etc/newrelic/newrelic.cfg.template /etc/newrelic/newrelic.cfg

3. Configure the newrelic-daemon to listen on a TCP port instead of a UNIX socket:

echo "port=21111" >> /etc/newrelic/newrelic.cfg

1	echo "port=21111" >> /etc/newrelic/newrelic.cfg

4. Start the newrelic-daemon:

service newrelic-daemon restart

1	service newrelic-daemon restart

5. Configure distribution provided PHP

Plesk 12 / CentOS / PHP 5.3 Issue Causes “abrt” Crash From Yum

December 29, 2015

Recent on servers with Plesk 12 and the PHP 5.3 distribution from Odin, we’re seeing “abrt” crash reports from Yum with a back trace like:

:miscutils.py:71:checkSig:OSError: [Errno 2] No such file or directory: 
'/var/cache/yum/x86_64/7/plesk-php-5.3/packages/plesk-php53-ioncube-loader-5.0.18-centos7.15101218.x86_64.rpm'

1 2	:miscutils.py:71:checkSig:OSError: [Errno 2] No such file or directory: '/var/cache/yum/x86_64/7/plesk-php-5.3/packages/plesk-php53-ioncube-loader-5.0.18-centos7.15101218.x86_64.rpm'

Until Odin fixes their repository the only way to get updates to proceed normally is to disable the PHP 5.3 repository by editing:

/etc/yum.repos.d/plesk-php5.3.repo

1	/etc/yum.repos.d/plesk-php5.3.repo

And adding this line:

enabled=0

enabled=0

Since PHP 5.3 is EOL there aren’t any updates expected so disabling the repository should not cause problems.

Plesk 12.5 Protected Directories Break Nginx/PHP-FPM

November 27, 2015

On Plesk 12.5, when using PHP-FPM with Nginx there’s a problem with the way protected directories are implemented. Each protected directory creates a “location” block in the Nginx config that proxies to Apache. So protected directories are implemented in Apache only. Nginx just passes through to Apache. This is not a great design choice in our opinion. Instead protected directories should be implemented directly in Nginx. One of the side effects of the 12.5 implementation is that inside protected directories Apache handles PHP even if you have the domain configured to use Nginx with PHP-FPM. This is especially problematic if you have the entire site password protected. The “location /” block takes precedence over the “location *.php” block so the entire sites ends up using Apache instead going directly to PHP-FPM. To get around this problem I do the following in Plesk: Create a protected directory for “/protected”. Add users