Items you must select, such as
menu options, command
buttons, or items in a list.
Go to the QoS tab.
Titles of chapters, sections,
and subsections.
Read the Basic Administration
chapter.
Italics
Used to emphasize the
importance of a point, to
introduce a term or to
designate a command line
placeholder, which is to be
replaced with a real name or
value.
The system supports the so
called wildcard character
search.
Monospace
The names of style sheet
selectors, files and directories,
and CSS fragments.
The license file is called
license.key.
Preface
Typographical Conventions
The following kinds of formatting in the text identify special information.
Preface 7
Preformatted Bold
What you type, contrasted with
on-screen computer output.
Unix/Linux:
# cd /root/rpms/php
Windows:
>cd %myfolder%
Preformatted
On-screen computer output in
your command-line sessions;
source code in XML, C++, or
other programming languages.
Unix/Linux:
# ls –al /files
total 14470
Windows:
>ping localhost
Reply from 127.0.0.1:
bytes=32 time<1ms
TTL=128
Feedback
If you have found an error in this guide, or if you have suggestions or ideas on how to
improve this guide, please send your feedback using the online form at
http://www.parallels.com/en/support/usersdoc/. Please include in your report the guide‟s title,
chapter and section titles, and the fragment of text in which you have found an error.
Configuring SELinux Policy for Your Parallels Plesk Panel Server .................... 10
Securing the /tmp Partition ................................................................................ 11
C H A P T E R 1
Administering Security Settings
Administering Security Settings 9
Configuring Firewall
Make sure these ports are opened for all Parallels Plesk Panel services to work with a
firewall:
20 for ftp-data;
21 for ftp;
22 for ssh;
25 for smtp;
53 for dns (TCP and UDP);
80 for http (web server and Parallels Plesk Panel updater);
106 for poppassd (for localhost only);
110 for pop3;
113 for auth;
143 for imap;
443 for https;
465 for smtps;
587 for mail message submission;
990 for ftps;
993 for imaps;
995 for pop3s;
3306 for mysql;
5224 for (outgoing connections only) plesk-license-update;
5432 for postgres;
8443 for plesk-https;
8880 for plesk-http;
9080 for tomcat;
5224 for license updates.
10 Administering Security Settings
Configuring SELinux Policy for Your
Parallels Plesk Panel Server
To configure SELinux you need to know the rules that should be added into the system
policy. SELinux reports all denied messages into the /var/log/audit/audit.log
file and these messages can be easily converted into the rules using the
/usr/bin/audit2allow utility.
cat /var/log/messages | /usr/bin/audit2allow
Also, /var/log/messages.* files can be examined for the SELinux deny messages.
To configure SELinux policy:
1. Add the rules into the appropriate domain file which describes the
application.
For example:
c. Move current /tmp directory content to another location.
d. Mount new /tmpp partition:
# mount /tmp
e. Move content from old /tmp directory to the new one.
To reduce the risk of compromising sensitive data hosted on your server, you might
Option
Description
-- enable all | --disable all
The option “—enable all” switches off weak SSL ciphers
and protocols for Web and e-mail servers.
The option “—disable all” reverts all changes made by the
utility and restores original configuration files, thereby
allowing weak SSL ciphers and protocols for connections to
Web and e-mail servers.
-- enable courier | --disable
courier
Switches off or switches on weak SSL ciphers and
protocols for connections to Courier IMAP mail server.
-- enable apache | --disable
apache
Switches off or switches on weak SSL ciphers and
protocols for connections to the Apache Web server that
serves users‟ sites.
-- enable panel | --disable panel
Switches off or switches on weak SSL ciphers and
protocols for connections to Parallels Plesk Panel.
C H A P T E R 2
Achieving Compliance with Payment
Card Industry Data Security Standard
want to implement special security measures that comply with the Payment Card
Industry Data Security Standard (PCI DSS). The standard is intended to help
organizations protect customer account data. For detailed information about the
standard, refer to
https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml.
This chapter describes the steps required to achieve PCI compliance on Linux and
FreeBSD-based systems.
You first need to run the PCI Compliance Resolver utility available from the Plesk
Control Panel installation directory. It will disable weak SSL ciphers and protocols for
Web and e-mail servers operated by Plesk Control Panel.
To run the utility:
1. Log in to the server shell.
2. Issue the following command:
/usr/local/psa/admin/bin/pci_compliance_resolver—enable all
The following table describes all options supported by the utility.
Achieving Compliance with Payment Card Industry Data Security Standard 13
Some PCI compliance scanners may require that the medium strength SSL ciphers for
access to the Panel be also switched off. For this reason, after you have run the utility,
you need to modify a configuration file that was created by it.
1. Open for editing the file
/usr/local/psa/admin/conf/cipher.lst.
14 Achieving Compliance with Payment Card Industry Data Security Standard
On Linux systems, issue the command /etc/init.d/postfix restart.
On FreeBSD systems, issue the command /usr/local/etc/rc.d/postfix
restart.
You also need to prohibit access to MySQL database server from external addresses.
To do this, in a firewall that protects your Panel-managed server, add or enable a rule
that prohibits TCP and UDP connections to the port 3306 from all addresses except
127.0.0.1.
To use the firewall that comes with your Parallels Plesk Panel for Linux:
1. Log in to the Panel as administrator.
2. If you did not install the firewall component, install it:
a. Go to Home > Updates (in the Help & Support group).
b. Click the link corresponding to your version of the Panel.
c. Locate Plesk Firewall module, select the corresponding check box,
and click Install.
3. Configure the firewall rule that blocks external MySQL connections and
switch the firewall on:
a. Click the Settings link in the navigation pane.
b. Click Manage Firewall Rules, and then Edit Firewall Configuration.
c. Click the MySQL server link.
d. Select the Deny option and click OK.
e. Click Activate to apply the configuration, and then click Activate
again to switch on the firewall.
To conceal the version of DNS server from potential attackers, do the
following:
1. Open for editing the DNS server‟s configuration file named.conf. On
Linux systems, it is located in /etc/, and on FreeBSD systems, in
/etc/namedb/.
2. Locate the options {} section, and add the version “none” line
there.
3. Restart the named service:
On Deb package-based systems, issue the command /etc/init.d/bind9
restart
On RPM package-based systems, issue the command /etc/init.d/named
restart
On FreeBSD systems, issue the command /etc/rc.d/named restart
Achieving Compliance with Payment Card Industry Data Security Standard 15
To conceal the version of the Apache Web server from potential attackers,
do the following:
1. Open for editing the Web server‟s configuration file.
On Debian, Ubuntu, and SuSE Linux, it is located at
/etc/apache2/apache2.conf.
On other distributions of Linux, it is located at
/etc/httpd/conf/httpd.conf.
On FreeBSD, it is located at /usr/local/etc/apache2/httpd.conf.
2. Add the following lines:
ServerTokens ProductOnly
TraceEnable OFF
3. Save the file.
4. Restart the Web server.
On Deb package-based systems, issue the command /etc/init.d/apache2
restart
On RPM package-based systems, issue the command /etc/init.d/httpd
restart
On FreeBSD systems, issue the command /usr/local/etc/rc.d/apache2
restart
If you have Single Sign-On v.2.2 components installed, then you need to
disable SSL v.2 and weak SSL ciphers for the single sign-on service:
1. Open for editing the file /etc/sw-cp-
server/applications.d/sso-cpserver.conf.
On Linux systems, issue the command /etc/init.d/sw-cp-server
restart.
On FreeBSD systems, issue the command /usr/local/etc/rc.d/sw-cp-
server restart.
To alleviate security risks arising from disclosure of information about files and their
properties by Apache Web server, configure the FileETag directive in the Web server
configuration file.
To do this:
1. Open for editing the Web server‟s configuration file.
On Debian, Ubuntu, and SuSE Linux, it is located at
/etc/apache2/apache2.conf.
On other distributions of Linux, it is located at
/etc/httpd/conf/httpd.conf.
On FreeBSD, it is located at /usr/local/etc/apache2/httpd.conf.
Achieving Compliance with Payment Card Industry Data Security Standard 17
2. Locate the line FileETag INode MTime Size and remove the
INode keyword from this line.
3. Save the file.
4. Restart the Web server.
On Deb package-based systems, issue the command /etc/init.d/apache2
restart
On RPM package-based systems, issue the command /etc/init.d/httpd
restart
On FreeBSD systems, issue the command /usr/local/etc/rc.d/apache2
restart
The Event Manager is designed to help you organize data interchange between
Event Parameters Passed by Event Handlers ................................................... 21
C H A P T E R 3
Using Event Tracking Mechanism
Parallels Plesk Panel and external systems. It works the following way: you create a
script to be executed upon a certain Parallels Plesk Panel event, and then create an
event handler that triggers the event processing. You can assign several handlers to a
single event.
Important: The Parallels Plesk Panel administrator can create the event handlers that
will trigger scripts running on the server on behalf of the root user. If you wish to restrict
usage of the root account, create an empty file with name
root.event_handler.lock in the location
/plesk_installation_directory/var/.
Using Event Tracking Mechanism 19
Adding Event Handlers
Let‟s, for example, create an event handler for the „client account creation‟ event. The
handler will accept a client name and the client‟s login from environment variables. For
simplicity we will use a shell-script called test-handler.sh that looks as follows:
#!/bin/bash
echo “--------------“ >> /tmp/event_handler.log
/bin/date >> /tmp/event_handler.log # information on
the event date and time
/usr/bin/id >> /tmp/event_handler.log # information on
the user, on behalf of which the script was executed (to ensure
control)
echo “client created” >> /tmp/event_handler.log # information on
the created client account
echo “name: ${NEW_CONTACT_NAME}” >> /tmp/event_handler.log #
client‟s name
This script prints some information to a file so that we could control its execution (we
cannot output information to stdout/stderr, as the script is executed in the background
mode).
Suppose, that our script is located in the directory
/plesk_installation_directory/bin (for instance). Let‟s register it by creating
an event handler via Parallels Plesk Panel.
To add an event handler via Parallels Plesk Panel:
1. Go to Home > Event Manager.
2. Click Add New Event Handler. The event handler setup page appears.
3. Select the event, you wish to assign a handler to in the Event menu.
4. Select the priority for handler execution, or specify a custom value. To
do this, select custom in the Priority menu and type in the value.
When assigning several handlers to a single event you can specify the handler
execution sequence, setting different priorities (higher value corresponds to a
higher priority).
20 Using Event Tracking Mechanism
5. Select the system user, on behalf of which the handler will be executed
(“root” user, for example).
6. In the Command input field, specify a command to be executed upon the
selected event. In our example it is /usr/local/psa/bin/test-handler.sh.
7. Click OK.
Note: In the script, we have specified the variables $NEW_CONTACT_NAME and
$NEW_LOGIN_NAME. During execution of the handler, they will be replaced with
name and login of the created client respectively. The entire list of available variables is
provided in the following section. You should keep in mind that with the removal
operations, the variables of type $NEW_xxx are not set. And with creation operations
the parameters of type $OLD_xxx are not set.
Now if you login to your Parallels Plesk Panel and create a new client, specifying the
value „Some Client‟ in the Contact name field, and „some_client‟ in the field Login, the
handler will be invoked, and the following records will be added to the
/tmp/event_handler.log:
Fri Mar 16 15:57:25 NOVT 2007
uid=0(root) gid=0(root) groups=0(root)
client created
name: Some client
login: some_client
The parameter templates that can be used when setting up an event handler are
presented in the Event Parameters Passed by Event Handlers (see page 21) section.
Removing Event Handlers
To remove an event handler:
1. Go to Server > Event Manager.
2. Select the corresponding check boxes in the list of handlers and click
Recompiling Apache With More File Descriptors ............................................... 59
Including Directives into Web Server Configuration File .................................... 65
Customizing httpd.include for Domains ............................................................. 66
Preventing Graphics Hotlinking on a Web Site .................................................. 66
Apache Port Change ......................................................................................... 67
C H A P T E R 4
Configuring Apache Server
file:
/etc/httpd/conf/httpd.conf for RedHat-based systems;
/etc/apache2/apache2.conf (or a corresponding file from
/etc/apache2/conf.d/ /etc/apache2/sites-enabled/) for Debian-based
systems;
/etc/apache2/httpd.con (or /etc/apache2/vhosts.d/*) for SuSE;
56 Configuring Apache Server
Getting Familiar with Virtual Host Structure
Directories Tree
User
Group
Perms
Description
/<VHOST
>
root
root
755
/anon_ftp
user
psaserv
750
Anonymous
FTP files
/cgi-bin
user
psaserv
750
CGI scripts
/conf
root
psaserv
755
Configuratio
n files
/error_docs
root
psaserv
755
Error
messages
files
<doc>.html
user
psaserv
755
/etc
root
root
755
Chroot
environment
catalogue
/httpdocs
user
psaserv
750
HTTP
documents
/httpsdocs
user
psaserv
750
HTTPS
documents
/pd
root
psaserv
750
Passwords
to protected
directories
d..<dir1>@<dir2>
apache
apache
400
/private
user
root
700
User‟s
private
storage
/statistics
root
psaserv
550
Statistics
directory
and Permissions
Vhost permissions should satisfy the following conditions:
Home directory should be readable by apache, psaadm and psaftp.
The user cannot change some catalogues of their directories.
Other users should not have access to the user‟s home directory.
The following table shows the virtual host structure and permissions set to the vhost
catalogue:
Configuring Apache Server 57
/anon_ftpstat
root
root
755
Anonymous
FTP
statistics
/ftpstat
root
root
755
FTP user
statistics
/logs
root
root
755
Virtual host
logs
/webstat
root
root
755
HTTP user
statistics
/webstat-ssl
root
root
755
HTTPS user
statistics
/usr
root
root
755
Chroot
environment
catalogue
/web_users
root
psaserv
755
Web users
catalogue
/<web_user>
web_user
psaserv
750
/subdomains
root
psaserv
755
Subdomains
catalogue
/<subdomain>
root
root
755
/cgi-bin
sub_user
psaserv
750
/conf
root
psaserv
750
/error_docs
root
root
755
/httpdocs
sub_user
psaserv
750
/httpsdocs
sub_user
psaserv
750
Tip: Microsoft FrontPage Server Extensions are no longer shipped with Parallels Plesk
Panel, thought if you want to use Microsoft Frontpage Server Extensions, modify the vhost
permissions. Assign the psaserv group to http(s)docs/_vti_* files recursively and to
the http(s)docs/.htaccess file in the http(s)docs catalogue, and set the 751
permission to the http(s)docs catalogue.
58 Configuring Apache Server
Enabling Piped Logs for Web Server to
Reduce the Risk of Web Service Disruption
If you are going to host more than 300 domains or web sites on your server, you should
switch on support for piped logs in the Apache Web Server.
To enable piped logs:
1. Log in to the server shell.
2. Issue the command mysql -uadmin -p„cat /etc/psa/.psa.shadow„ -D psa -e
“replace into misc (param,val) values („apache_pipelog‟, „true‟);”
3. Rebuild Apache configuration by issuing the command
/usr/local/psa/admin/sbin/websrvmng -a -v
This will allow to host about 900 domains/web sites. If you need to host more than 900
domains/Web sites, then you will need to recompile Apache and some other system
packages, as described in the Recompiling Apache With More File Descriptors (see page 59)
section.
Configuring Apache Server 59
Recompiling Apache With More File
In this section:
Recompiling Apache With More File Descriptors on RedHat-like System .......... 60
Recompiling Apache With More File Descriptors on Debian System ................. 62
Recompiling Apache With More File Descriptors on FreeBSD System .............. 63
Descriptors
If you are going to host a large number of web sites on the Parallels Plesk Panel server,
Apache may fail to work because of a problem with the file descriptors limit.
Note: Since Parallels Plesk Panel 8.2.0 up to 900 domains can be hosted on the OS vendor
Apache build without system packages recompilation described in this section, if Piped Logs
feature is enabled on the Parallels Plesk Panel server (see page 58).
60 Configuring Apache Server
Recompiling Apache With More File Descriptors on
RedHat-like System
Parallels Plesk Panel requires, closely depends on and uses many server applications which
are not part of Parallels Plesk Panel software actually. For example, apache web server,
mysql server, php module and binaries and many others are not provided or compiled by
Parallels, but standard system RPM packages from operating system vendor are used by
Parallels Plesk Panel and they are used „as is‟. This allows to upgrade and recompile such
packages with the options the Parallels Plesk Panel administrator wants.
To recompile related applications and libraries, such as openssl, apache, imap,
PHP etc from source RPMs with increased FD_SETSIZE value, perform the
following steps:
1. Make sure that the system allows to open enough files:
# /sbin/sysctl fs.file-max
fs.file-max = 131072
If fs.file-max is quite small (several thousands or so), change it in the following way:
a. Add the following line to /etc/sysctl.conf:
fs.file-max = 131072
b. Running the shell command:
# /sbin/sysctl -w fs.file-max=131072
Note: If you are running Virtuozzo, you have to adjust the fs.file-max on the
hardware node and it will be applied to all VEs.
2. Make sure you have the glibc-kernheaders and glibc-headers
packages installed. They can be taken from the operating system distributive
CD or from your operating system download sites.
3. Edit the __FD_SETSIZE value in typesizes.h and posix_types.h files:
To find the typesizes.h file, run:
# find /usr/include/ -name typesizes.h
To find the posix_types.h file, run:
# find /usr/include/ -name posix_types.h
To edit the __FD_SETSIZE value in a file, run:
#define __FD_SETSIZE 65536
4. Download the following source RPMs that can be found on your operating
system download sites or similar places, you may use RPM search engines
such as http://rpm.pbone.net or http://rpmfind.net:
Recompiling Apache With More File Descriptors on
FreeBSD System
Apache and apache modules come with Parallels Plesk Panel for FreeBSD versions 8.1.0 or
earlier and are already compiled with FD_SETSIZE = 16384 and if you have problem with file
descriptors lack then the reason is in some non-Plesk system application. The most probably
it is related to standard system OpenSSL libraries which are dynamically loaded by Parallels
Plesk Panel‟s apache. To have the system OpenSSL library files be recompiled with
increased FD_SETSIZE value, please do the following.
To recompile OpenSSL with increased value of file descriptors larger than
FD_SETSIZE (1024) on FreeBSD system, perform the following steps:
1. Obtain FreeBSD sources for your FreeBSD version, for example using the
cvsup utility. See “Obtaining FreeBSD” in the FreeBSD HandBook for
details. We would recommend that you obtain not original sources for exactly
the same FreeBSD release that you are currently running, but updated
sources from a stable branch for your FreeBSD version.
2. Edit the /usr/src/sys/sys/select.h and
/usr/include/sys/select.h files and modify there FD_SETSIZE value
from 1024U to 16384U:
# ifndef FD_SETSIZE
# define FD_SETSIZE 16384U
3. Run the following commands to recompile all the system files including
OpenSSL libraries:
# rm -rf /usr/obj/usr
# cd /usr/src
# make clean ; make cleandepend
# make buildworld
You can update not only OpenSSL libraries but also system binaries and libraries and
also update or modify the kernel. To do this and continue with system/kernel update,
please follow “The Cutting Edge” chapter in FreeBSD HandBook for details.
4. If your system/kernel is up-to-date or you don‟t need to update anything
except OpenSSL libraries for other reason, you can find what files are used
by apache and replace them manually with new copies. Below is example for
FreeBSD 6.0:
6. Replace these files with newly compiled copies (they are located in
/usr/obj/usr/src/ subfolders). If you use remote connection to server
console, execute the below commands as a single command as shown in the
example below:
Including Directives into Web Server
Configuration File
You can include domain-specific Apache configuration directives into web server
configuration file. In Parallels Plesk Panel each domain has virtual hosts configuration stored
in a separate file httpd.include.
On all Linux systems, this file is located in the directory /var/www/vhosts/<domain-name>/conf/.
On FreeBSD systems, this file is located in the directory <VIRTUAL_HOSTS_D>/<domain-name>/conf/.
If you upgraded from Parallels Plesk Panel version 7.5.4 or earlier, try looking for this file in
the directory <VIRTUAL_HOSTS_D>/<domain-name>/conf/.
Check the HTTPD_VHOSTS_D variable in /etc/psa/psa.conf.
Note: You can change the location of virtual host directories using the transvhosts.pl
utility, which is located either in /usr/local/psa/bin/ or /opt/psa/bin/ directory,
depending on your operating system.
This file is overwritten each time the virtual host configuration is changed, thus any manual
alterations made to the file are discarded. To use custom directives or redefine those
inserted by Parallels Plesk Panel, you need to create the files vhost.conf and/or
vhost_ssl.conf with necessary directives in the directory
<VIRTUAL_HOSTS_D>/<domain-name>/conf/ for a domain, and
<VIRTUAL_HOSTS_D>/<domain-name>/subdomains/<subdomain-name>/conf/ for
a subdomain.
If any of these files exist by the time the main configuration file is generated, Parallels Plesk
Panel inserts the appropriate Include directive into the HTTP and/or HTTPS virtual host
context respectively. For security reasons, only root can create the vhost.conf and
vhost_ssl.conf files.
For the changes to take effect, you need to run the following command:
Important: Note that modification of httpsd.conf and php.ini files can result in
improper Parallels Plesk Panel functioning or failure, cause damage and loss of data. it is
highly recommended that you do not modify these files or any part of them. If you require
custom modifications to be applied to the configuration, please perform them in the following
files:
When you need to use some specific configurations for a domain or a subdomain, it‟s not a
good idea to include them directly in httpd.include file. This file is overwritten each time
the virtual host configuration is changed, thus any manual alterations made to the file are
discarded.
To use custom directives or redefine those inserted by Parallels Plesk Panel,
do the following:
1. Create the files vhost.conf and/or vhost_ssl.conf with necessary directives
in the <VIRTUAL_HOSTS_D>/<domain-name>/conf/ directory.
If any (or both) of these files exist by the time the main configuration file is
generated, Parallels Plesk Panel inserts the appropriate directive:
Include <VIRTUAL_HOSTS_D>/<domain-name>/conf/vhost.conf
or
Include <VIRTUAL_HOSTS_D>/<domain-name>/conf/vhost_ssl.conf
into the HTTP and/or HTTPS virtual host context respectively.
For security reasons, only root can create the vhost.conf and
vhost_ssl.conf files.
2. For the changes to take effect, run the following:
For the changes to be implemented for all domains, run the following:
# /usr/local/psa/admin/bin/websrvmng -a
Preventing Graphics Hotlinking on a Web
Site
Bandwidth theft or hotlinking is a direct linking to web site‟s files (images, video, etc.). It can
be prevented with the mod_rewrite module. Place rules like below into the vhost.conf or
.htaccess files for the domain (for example www.example.com):
You can change Apache web server port to use a lightweight high-performance web server,
such as nginx, as a front-end web server, and move Apache web server to back-end.
To change Apache web server port, use the websrvmng utility with the following options:
--set-http-port - set a custom http port;
--get-http-port - get a custom http port;
--set-https-port - set a custom https port;
--get-https-port - get a custom https port.
Note: The default port values in Parallels Plesk Panel are 80 for http and 443 for https.
Examples
To change Apache web server http port to 8080, issue the following command:
Examples of configuration files for nginx web server on Debian 5
Web server configuration (on page 69)
Domains configuration (on page 70)
Subdomains configuration (on page 72)
Webmail configuration (on page 74)
Mailman configuration (on page 75)
When you use Sitebuilder with Parallels Plesk Panel and change Apache web server port,
you should reconfigure Sitebuilder (on page 76) to provide integration with the changed port.
Known issues
When nginx is installed as a front-end web server and Apache is moved to back-end, the
following Parallels Plesk Panel components are not working:
Publishing dynamic content in Sitebuilder
Server‟s default page
Tomcat via Apache
Statistics for cached static content is not calculated
68 Configuring Apache Server
In this section:
Example of Web Server Configuration File ........................................................ 69
Example of Domain Configuration File .............................................................. 70
Example of Subdomain Configuration File ......................................................... 72
Example of Webmail Configuration File ............................................................. 74
Example of Mailman Configuration File ............................................................. 75
Configuring Sitebuilder for Work With Changed Apache Port ............................ 76
Configuring Apache Server 69
Example of Web Server Configuration File
The following is the example of configuration file for the nginx web server on Debian 5:
# cat /etc/nginx/nginx.conf
user www-data;
worker_processes 8;
The following is the example of configuration file for a domain in Parallels Plesk Panel on
Debian 5:
Note: Each domain created in Parallels Plesk Panel should be configured separately.
Note: In this example replace <domain.name> with your domain name. In the
server_name line, include the domain name and all domain aliases separated by spaces.
To automate domains‟ configuration files generation, use Home > Event Manager. Create an
Event Handler for the Physical hosting created event with normal priority executed by the root
user with the command:
Configuring Apache Server 71
/bin/bash /root/domain_create.sh
where /root/domain_create.sh is the following:
# cat /root/domain_create.sh
#!/bin/bash
echo ―--------------― >> /tmp/event_handler.log
/bin/date >> /tmp/event_handler.log # information on the event date and
time
/usr/bin/id >> /tmp/event_handler.log # information on the user, on behalf
of which the script was executed (to ensure control)
/bin/echo ―Domain created ${NEW_DOMAIN_NAME}‖ >> /tmp/event_handler.log #
Domain‘s name
/bin/cat /etc/nginx/vhost.template | /bin/sed -e
―s/<domain.name>/${NEW_DOMAIN_NAME}/g‖ > /etc/nginx/sitesavailable/${NEW_DOMAIN_NAME}
/bin/echo ―Result of domain config creation is ―$? >>
/tmp/event_handler.log
/bin/ln -s /etc/nginx/sites-available/${NEW_DOMAIN_NAME} /etc/nginx/sitesenabled/${NEW_DOMAIN_NAME}
/bin/echo ―Result of domain config enabling is ―$? >>
/tmp/event_handler.log
/etc/init.d/nginx reload
/bin/echo ―Result of nginx reloading is ―$? >> /tmp/event_handler.log
72 Configuring Apache Server
Example of Subdomain Configuration File
The following is the example of configuration file for a subdomain in Parallels Plesk Panel on
Debian 5:
Note: Each subdomain created in Parallels Plesk Panel should be configured separately.
Note: In this example replace <subdomain> and <domain.name> with your subdomain
To automate subdomains‟ configuration files generation, use Home > Event Manager. Create an
Event Handler for the Subdomain created event with normal priority executed by the root user
with the command:
/bin/bash /root/subdomain_create.sh
where /root/subdomain_create.sh is the following:
Configuring Apache Server 73
# cat /root/subdomain_create.sh
#!/bin/bash
echo ―--------------― >> /tmp/event_handler.log
/bin/date >> /tmp/event_handler.log # information on the event date and
time
/usr/bin/id >> /tmp/event_handler.log # information on the user, on behalf
of which the script was executed (to ensure control)
/bin/echo ―Subdomain ${NEW_SUBDOMAIN_NAME} for domain ${NEW_DOMAIN_NAME}
created‖ >> /tmp/event_handler.log # Subdomain‘s name
/bin/cat /etc/nginx/subdomain.template | /bin/sed -e
Configuring Sitebuilder for Work With Changed Apache
Port
When you use Sitebuilder with Parallels Plesk Panel and change Apache web server port,
you should reconfigure Sitebuilder to provide integration with the changed port.
To configure Sitebuilder:
Note: In the commands below, replace <hostname> with your hostname. These commands
are an example for Debian 5.
1. Change vhost for Sitebuilder in conf.d/ of Apache web server:
/opt/sitebuilder/utils/configure—httpd_port 8080
2. Change the application_url parameter in Sitebuilder configuration file:
3. Change link to Sitebuilder in Parallels Plesk Panel database:
# echo ―select * from SBConfig where param_name=‘url‘;‖| mysql -uadmin p‗cat /etc/psa/.psa.shadow‗ psa
param_name param_value
url http://sitebuilder.<hostname>:8080/ServiceFacade/
echo ―update SBConfig SET
param_value=‘http://sitebuilder.<hostname>:8080/ServiceFacade/‘ where
param_name=‘url‘;‖| mysql -uadmin -p‗cat /etc/psa/.psa.shadow‗ psa
The following is the example of configuration file for Sitebuilder on Debian 5:
Note: In this example replace <IP-address> with your IP address.
server {
listen 80;
server_name sitebuilder.*;
access_log /var/log/nginx/sitebuilder.log main;
The default port numbers for Coyote and Warp connectors in Parallels Plesk Panel are
C H A P T E R 5
Changing Tomcat Java Connector Ports
9080 and 9008.
If you want Tomcat Java to work on other ports (e.g. 8090 and 8009), you should
connect to the Parallels Plesk Panel database and add two parameters to the database
as in the following example:
insert into misc (param,val) values (‗coyote_connector_port‘, ‗8090‘);
insert into misc (param,val) values (‗warp_connector_port‘, ‗8009‘);
Alternatively, you can use the dbclient.exe utility to add the information to the
Parallels Plesk Panel database. For information about using the dbclient.exe utility,
consult Parallels Plesk Panel for Windows Command Line Interface Reference.
Note: It is recommended that you change the Tomcat Java ports right after Parallels
Plesk Panel is installed on server, or prior to enabling the Tomcat Java service for your
domains.
In this chapter:
Configuring a Mailing List Where Only Members are Allowed to Post to ............ 80
Importing a List of E-mail Addresses into a Mailing List ..................................... 80
Limiting the Number of Recipients of a Mail Message ....................................... 81
Training SpamAssassin for All Mail Accounts on the Server .............................. 82
Limiting the Maximum Number of Child Processes for spamd ........................... 83
Fighting Against Spam on Qmail Mail Server .................................................... 84
Restoring Mail Configuration ............................................................................. 86
Installing Custom SSL Certificates for Qmail or Courier-IMAP Mail Servers ...... 87
C H A P T E R 6
Configuring Mail
80 Configuring Mail
Configuring a Mailing List Where Only
Members are Allowed to Post to
By default, when you create a mailing list, everyone may send correspondence to this list. If
you need to configure a mailing list where only members are allowed to send mail to, you can
do this through the WEB Mailman interface.
To configure a mailing list where only members are allowed to post to:
1. Log in to the WEB Mailman interface as the list administrator.
2. Enable the Restrict posting privilege to list members option.
Note: By default a mailing list is created with the Posts must be approved by an
administrator option enabled. That means all messages must be approved by the moderator
before they are posted to the list. So, if this option is disable and unwanted mail is posted to
the list, you may enable it back and moderate incoming messages.
Please see Mailman documentation for more information at
http://www.gnu.org/software/mailman/docs.html.
Importing a List of E-mail Addresses into a
Mailing List
If you need to import a number of e-mail addresses into a mailing list, adding them one at a
time can take a long time. To automate this task you can use Parallels Plesk Panel creation
utilities. To add several e-mail addresses to the mailing list, run the following command:
Limiting the Number of Recipients of a Mail
Message
Since Parallels Plesk Panel 8.4 version it is possible to limit maximum number of recipients
for an e-mail message.
To prevent your users from sending mass e-mail:
1. Create a file named maxrcpt in the directory
$QMAIL_ROOT_D/qmail/control/, where $QMAIL_ROOT_D is the location defined in the /etc/psa/psa.conf file.
2. Type the number of allowed recipients in this file and save it.
Note: The number defined in the maxrcpt file also affects sending messages to mailing list
or mail group subscribers. That is, if you set the value to 100, then only 100 subscribers will
receive the message sent to a mailing list or a mail group.
When you no longer need to restrict the number of recipients, delete the maxrcpt file.
82 Configuring Mail
Training SpamAssassin for All Mail Accounts
on the Server
You can manually train SpamAssassin for all mail accounts on the server from the command
line.
To train SpamAssassin for all mail names on the server:
1. Store spam and ham (non-spam) messages in two different folders, for
example spam_mails and ham_mails.
2. Train SpamAssassin for one mailbox using the messages from these folders:
# cd /path/to/spam_mail/
# for message in * ; do /usr/local/psa/admin/sbin/spammng—bayes—
mailname=mailname@domain.com—spam=$message ; done
# cd /path/to/ham_mail/
# for message in * ; do /usr/local/psa/admin/sbin/spammng—bayes—
mailname=mailname@domain.com—ham=$message ; done
3. Repeat this command for every mailbox on the server or just copy bayes
bases (./domain.com/mailname/.spamassassin/bayes_*) from this mailbox to
other mailboxes with the following command:
where domain.com and mailname should be replaced with the real domain name and
mail name.
Configuring Mail 83
Limiting the Maximum Number of Child
Processes for spamd
If there is a large spam attack, then too many processes are started by spam deferral
daemon spamd and the system can run out of resources. In Parallels Plesk Panel 7.5 and
Parallels Plesk Panel 8.0 you can limit the number of simultaneously running SpamAssassin
processes with the SPAMASSASSIN_MAX_CHILDREN option in /etc/psa/psa.conf:
SPAMASSASSIN_MAX_CHILDREN 5
Specify a desired value and restart psa-spamassassin.
If the line is omitted then the default value for SpamAssassin 3.x is 5.
Since Parallels Plesk Panel 8.1 this value can be managed through Parallels Plesk Panel.
Use the The maximum number of worker spamd processes to run (1-5) option on the Server > Settings > SpamFilter page in Parallels Plesk Panel 8.x, . The value is stored in the misc table
of the psa database:
# mysql -uadmin -p„cat /etc/psa/.psa.shadow „ psa -e “select * from misc where
param=‟spamfilter_max_children‟”
When unsolicited e-mails, or spam, are simultaneously sent indiscriminately to multiple mail
boxes on your server, there can be too many messages in the queue. Then the server is
overloaded with spam, the mail is delivered slowly.
To get rid of spam on your Qmail mail server:
1. Make sure that all domains have the Mail to nonexistent user option set to Reject.
This option is available since Parallels Plesk Panel 7.5.3 and can be changed for all the
domains using group operations: select the domains, click Modify Selected, in the
Preferences section select Switch on for the Mail to nonexistent user option and select the
Reject value for it.
2. Make sure that there are no untrusted IP addresses or networks in the white
list.
To do this, go to Home > Mail Server Settings > White List tab. To remove untrusted IP
addresses or networks, select them in the list and click Remove Selected.
3. Check how many messages there are in the Qmail queue with:
# /var/qmail/bin/qmail-qstat
messages in queue: 27645
messages in queue but not yet preprocessed: 82
If there are too many messages in the queue, try to find out where the spam is coming
from. If the mail is being sent by an authorized user, but not from a PHP script, you can
find out which user sent most of the messages with the following command:
Note that the SMTP authorization option should be enabled on the server to see these
records. The path to maillog may be different depending the OS you use.
4. Use the qmail-qread utility to read the messages headers:
it means that this message was sent via a CGI script by user with UID 12345. Use this
UID to find a corresponding domain:
# grep 12345 /etc/passwd
Received lines like:
Received: (qmail 19622 invoked from network); 10 Sep 2008 17:52:36
+0700
Received: from external_domain.com (192.168.0.1)
mean that the message was accepted for delivery via SMTP and the sender is an
authorized mail user.
If Received line contains an UID of an apache user (for example invoked by uid
48), it means that the spam was sent via an PHP script. In this case you can try to
find the spammer using information from the spam e-mails (from/to addresses,
subjects, etc). But usually to find the spam source is very hard in this case. If you are
sure that some script is sending spam at the current moment (the queue grows very
fast), you can use this little script to find out what PHP scripts are running in real-time:
Examine the /var/tmp/mail.send file. There should be lines starting with XAdditional-Header pointing out to domains‟ folders where the script that sends
the mail is located.
You can see all the folders where mail PHP scripts were run from with the following
If you see no output from the command above, it means that no mail was sent using
PHP mail() function from the Parallels Plesk Panel virtual hosts directory.
Restoring Mail Configuration
Sometimes, Parallels Plesk Panel mail server configuration becomes corrupt and it is
necessary to restore it. The restoration is carried out by internal mchk utility, intended for use
by Parallels Plesk Panel. However, as the administrator, you can use it for restoring the
Qmail and Courier-imap configuration when needed.
By default mchk is running in the background mode. To execute it in the foreground, use the
-v option. For example:
/usr/local/psa/admin/sbin/mchk -v
Note: You may not wish to restore SpamAssassin settings for mail accounts, as it requires
running Perl interpreter. To speed up restoring use the—without-spam option.
Configuring Mail 87
Installing Custom SSL Certificates for Qmail
In this section:
Installing SSL Certificate for Qmail .................................................................... 88
Installing SSL Certificates for Courier-IMAP Mail Server ................................... 90
or Courier-IMAP Mail Servers
To securely exchange mail data with Parallels Plesk Panel server, you may need to install
custom SSL certificates on the Parallels Plesk Panel server. Specifically, SSL certificates can
be installed for the Qmail mail transfer agent and the Courier-IMAP mail server that supports
the IMAP and POP3 protocols.
To install custom SSL certificates, you need to download the certificates to the Parallels
Plesk Panel server and then replace the installed default SSL certificates for Qmail and
Courier-IMAP servers with the downloaded custom certificates.
This section describes procedures for installing custom SSL certificates for Qmail and
Courier-IMAP servers.
88 Configuring Mail
Installing SSL Certificate for Qmail
To install a custom SSL certificate for Qmail on a Parallels Plesk Panel server:
1. Create a combined .pem certificate file.
To create a combined .pem certificate file, start your favorite text editor and paste the
contents of each certificate file and the private key in the file in the following order:
a. The private key
b. The primary certificate
c. The intermediate certificate
d. The root certificate
Make sure that you include the begin and end tags of the key and each certificate
including the dash lines. The resulting text should look like this:
-----BEGIN RSA PRIVATE KEY-----
..........
(Your Private Key here)
..........
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
..........
(Your Primary SSL certificate here)
..........
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
..........
(Your Intermediate certificate here)
..........
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
..........
(Your Root certificate here)
..........
-----END CERTIFICATE-----
2. Save the combined certificate file as plesk.pem.
3. Log in to a Parallels Plesk Panel server through SSH as a root user.
4. Download the combined certificate file plesk.pem.
5. Make a backup copy of the existing default SSL certificate for Qmail.
For example for RedHat or Fedora operating systems, the SSL certificate file that you
need to back up is var/qmail/control/servercert.pem.
Configuring Mail 89
Note: For other operating systems, the default certificate file location may be different.
6. Open the default certificate file /var/qmail/control/servercert.pem
by using your favorite text editor and replace the contents of the file with the
content of the combined certificate file plesk.pem.
7. Save and close the file.
8. To finish the certificate installation, restart Qmail.
90 Configuring Mail
Installing SSL Certificates for Courier-IMAP Mail Server
To install a custom SSL certificate for the Courier-IMAP (IMAP/POP3) mail
server on a Parallels Plesk Panel server:
1. Log in to a Parallels Plesk Panel server through SSH as a root user.
2. Download one or more SSL certificate files that you want to install.
Note: IMAP and POP3 each require separate certificate files, but both files can contain
same certificate.
3. Make a backup copy of the existing default SSL certificate for the CourierIMAP mail server.
For example for RedHat or Fedora operating systems, you need to back up the following
default SSL certificate files:
/usr/share/courier-imap/imapd.pem - the certificate enables secure data
transfers through IMAP protocol.
/usr/share/courier-imap/pop3d.pem - the certificate enables secure data
transfers through POP3 protocol.
Note: For other operating systems, the default certificate file locations may be different.
4. Open a default certificate file by using your favorite text editor and replace
the contents of the file, with the content of the SSL certificate file that you
want to install.
For example, the content to be copied from a custom SSL certificate and pasted in lieu of
a default certificate file body should look like this:
20. Login to Parallels Plesk Panel as the administrator.
21. Go to Home > Updates.
22. Click a link corresponding to the appropriate release version.
23. Select the check box corresponding to the ColdFusion support for Plesk
item, and click Install. Confirm the installation when prompted.
24. Once the selected components are installed, click the ColdFusion Settings
icon.
25. Specify the path to ColdFusion installation directory and click OK.
Note: JRun for ColdFusion 8 can resolve „localhost‟ to IPv6, while Apache resolves it to
IPv4. To make ColdFusion work, switch it to IPv4 in the /etc/hosts file. To do this, in
the /etc/hosts file find the entry:
::1 yourdomain.yourhostname.com yourdomain
localhost.localdomain localhost
and remove localhost.localdomain and localhost. Then restart Apache.
To uninstall Adobe ColdFusion from your server:
1. Log in as root.
2. Issue the following command at the prompt:
/opt/coldfusionmx7/uninstall/uninstall
3. To confirm deinstalling, press ENTER.
4. When the program completes, remove any remaining files and
directories in the /opt/coldfusionmx7/ directory.
5. Log in to Parallels Plesk Panel as the administrator, go to Home > Server
Components.
Installing Adobe ColdFusion 93
6. Click the Refresh icon. The list of installed components will be updated.
Your control panel will find out that you deinstalled ColdFusion and will
remove the ColdFusion related controls from the control panel screens
or will make them unselectable and mark them with the (component is not installed) comment.
7. Issue the command at the server shell:
/usr/local/psa/admin/bin/websrvmng -a
For Debian and Ubuntu systems, issue the command:
/opt/psa/admin/bin/websrvmng -a
By default, the open relay option for the mail server is disabled in Parallels Plesk Panel.
C H A P T E R 8
Using Open Relay Option for Your Mail
Server
You can enable it by using the root.controls.lock file located in
PRODUCT_DATA_D\var directory. However we do not recommend enabling this option
because an open relay can make it possible for an unscrupulous senders to route large
volumes of spam.
To enable open relay, follow these steps:
1. Open the root.controls.lock file.
2. Remove the /server/mail.php3:relay_open line and save the
file.
When you log in to Parallels Plesk Panel as administrator and click the Applications
C H A P T E R 9
Configuring APS Applications Catalog
shortcut in the navigation pane, you are taken to the Application Vault screen, which
provides links for downloading and installing applications on the server.
There is the Add Applications from APS Catalog link for downloading individual applications
from the APS Catalog, and there are links for downloading application bundles, where
all applications are categorized and sorted by popularity. There are three predefined
application bundles: 50 most popular applications, next 50 most popular applications,
and all applications.
You can do the following:
Redefine the set of applications included into each bundle, or remove the links for
downloading application bundles from the user interface.
Specify what applications and application categories should be presented in the
APS catalog.
To remove all links for downloading application bundles from the user
interface:
On the server file system, go to the directory
<parallels_plesk_panel_installation_directory>\etc and create there
an empty file named apscatalog_presets.conf.
To redefine the set of application bundles and to specify what applications
should be included into each bundle:
1. On the server file system, go to the directory
<parallels_plesk_panel_installation_directory> \etc\
and create a text file named apscatalog_presets.conf.
2. Add the required entries to the file.
You should first add a bundle‟s name in brackets, up to three entries, which can be
[mostused], [lessused], and [all]. Then you should type the names of
applications to be included into the corresponding bundle, one application name per
line.
The resulting text file should look like in the following example:
[mostused]
joomla
WordPress
Drupal
96 Configuring APS Applications Catalog
[lessused]
VideoDB
phpMyChatPlus
[all]
joomla
WordPress
Drupal
movabletype
SugarCRM
VideoDB
phpMyChatPlus
3. Save the file.
To specify what applications and application categories should be
presented in the APS catalog:
1. On the server file system, go to the directory
<parallels_plesk_panel_installation_directory>\etc\
and create a text file named apscatalog_categories.conf.
2. Add the required entries to the file.
You should first add a top-level category name in brackets, like [Web]. Then, you
should add a name of a nested sub-category, for example, [Web/Blog]. After that,
you can type the names of applications that belong to that category, one name per
line.
Also, to be sure that no other applications (except for those that you specified) are
shown in the server‟s APS Catalog and application vaults of other users, you can
add to the file the line otherApplicationsPolicy = hide, and in the next line,
add the line hideLevel = admin. If you want to hide other applications only from
your customers, but not from your own application vault, then use the line
hideLevel = client.
The resulting text file should look like in the following example:
otherApplicationsPolicy = hide
hideLevel = admin
[Web]
[Web/Blog]
joomla
WordPress
Drupal
[Web/Gallery]
phpGallery
Checking Free Disk Space Before Starting the Backup Process 97
VideoDB
Checking Free Disk Space Before
Starting the Backup Process
3. Save the file.
It is recommended that you make sure there is enough free disk space before starting
the backup process. By default, the amount of free disk space is not checked. If the
backup task is started and there is not enough disk space, the task is stalled in the GUI
and processes.
To enable the free disk space checking, open for editing the pmmcli configuration file
located on Parallels Plesk Panel server at
%PLESK_DIR%/admin/share/pmmcli/pmmcli-rc and set the
CHECK_BACKUP_DISK_SPACE option value to 1:
CHECK_BACKUP_DISK_SPACE 1
When this option is turned on, free disk space is checked prior to starting the backup
process. The free disk space is checked only for the local repository on Plesk server,
repository location is specified by the DUMP_D variable defined in the
/etc/psa/psa.conf configuration file. If there is not enough disk space, the backup
process is not started and the following error message is displayed:
Not enough free disk space to backup selected objects. At least <estimated-backup-size> free disk
space is required.
Note: The free disc space will be checked only before starting the backup process.
Thus, this option will not be effective, if the free disc space is occupied during the
backup process by other processes, such as a simultaneous upload.
Note: The backup size estimation does not consider possible content compression.
Actual size of a backup is usually less than its estimated size.
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.