Items you must select, such as
menu options, command
buttons, or items in a list.
Go to the QoS tab.
Titles of chapters, sections,
and subsections.
Read the Basic Administration
chapter.
Italics
Used to emphasize the
importance of a point, to
introduce a term or to
designate a command line
placeholder, which is to be
replaced with a real name or
value.
The system supports the so
called wildcard character
search.
Monospace
The names of style sheet
selectors, files and directories,
and CSS fragments.
The license file is called
license.key.
Preface
Typographical Conventions
The following kinds of formatting in the text identify special information.
Preface 7
Preformatted Bold
What you type, contrasted with
on-screen computer output.
Unix/Linux:
# cd /root/rpms/php
Windows:
>cd %myfolder%
Preformatted
On-screen computer output in
your command-line sessions;
source code in XML, C++, or
other programming languages.
Unix/Linux:
# ls –al /files
total 14470
Windows:
>ping localhost
Reply from 127.0.0.1:
bytes=32 time<1ms
TTL=128
Feedback
If you have found an error in this guide, or if you have suggestions or ideas on how to
improve this guide, please send your feedback using the online form at
http://www.parallels.com/en/support/usersdoc/. Please include in your report the guide‟s title,
chapter and section titles, and the fragment of text in which you have found an error.
Configuring SELinux Policy for Your Parallels Plesk Panel Server .................... 10
Securing the /tmp Partition ................................................................................ 11
C H A P T E R 1
Administering Security Settings
Administering Security Settings 9
Configuring Firewall
Make sure these ports are opened for all Parallels Plesk Panel services to work with a
firewall:
20 for ftp-data;
21 for ftp;
22 for ssh;
25 for smtp;
53 for dns (TCP and UDP);
80 for http (web server and Parallels Plesk Panel updater);
106 for poppassd (for localhost only);
110 for pop3;
113 for auth;
143 for imap;
443 for https;
465 for smtps;
587 for mail message submission;
990 for ftps;
993 for imaps;
995 for pop3s;
3306 for mysql;
5224 for (outgoing connections only) plesk-license-update;
5432 for postgres;
8443 for plesk-https;
8880 for plesk-http;
9080 for tomcat;
5224 for license updates.
10 Administering Security Settings
Configuring SELinux Policy for Your
Parallels Plesk Panel Server
To configure SELinux you need to know the rules that should be added into the system
policy. SELinux reports all denied messages into the /var/log/audit/audit.log
file and these messages can be easily converted into the rules using the
/usr/bin/audit2allow utility.
cat /var/log/messages | /usr/bin/audit2allow
Also, /var/log/messages.* files can be examined for the SELinux deny messages.
To configure SELinux policy:
1. Add the rules into the appropriate domain file which describes the
application.
For example:
c. Move current /tmp directory content to another location.
d. Mount new /tmpp partition:
# mount /tmp
e. Move content from old /tmp directory to the new one.
To reduce the risk of compromising sensitive data hosted on your server, you might
Option
Description
-- enable all | --disable all
The option “—enable all” switches off weak SSL ciphers
and protocols for Web and e-mail servers.
The option “—disable all” reverts all changes made by the
utility and restores original configuration files, thereby
allowing weak SSL ciphers and protocols for connections to
Web and e-mail servers.
-- enable courier | --disable
courier
Switches off or switches on weak SSL ciphers and
protocols for connections to Courier IMAP mail server.
-- enable apache | --disable
apache
Switches off or switches on weak SSL ciphers and
protocols for connections to the Apache Web server that
serves users‟ sites.
-- enable panel | --disable panel
Switches off or switches on weak SSL ciphers and
protocols for connections to Parallels Plesk Panel.
C H A P T E R 2
Achieving Compliance with Payment
Card Industry Data Security Standard
want to implement special security measures that comply with the Payment Card
Industry Data Security Standard (PCI DSS). The standard is intended to help
organizations protect customer account data. For detailed information about the
standard, refer to
https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml.
This chapter describes the steps required to achieve PCI compliance on Linux and
FreeBSD-based systems.
You first need to run the PCI Compliance Resolver utility available from the Plesk
Control Panel installation directory. It will disable weak SSL ciphers and protocols for
Web and e-mail servers operated by Plesk Control Panel.
To run the utility:
1. Log in to the server shell.
2. Issue the following command:
/usr/local/psa/admin/bin/pci_compliance_resolver—enable all
The following table describes all options supported by the utility.
Achieving Compliance with Payment Card Industry Data Security Standard 13
Some PCI compliance scanners may require that the medium strength SSL ciphers for
access to the Panel be also switched off. For this reason, after you have run the utility,
you need to modify a configuration file that was created by it.
1. Open for editing the file
/usr/local/psa/admin/conf/cipher.lst.
14 Achieving Compliance with Payment Card Industry Data Security Standard
On Linux systems, issue the command /etc/init.d/postfix restart.
On FreeBSD systems, issue the command /usr/local/etc/rc.d/postfix
restart.
You also need to prohibit access to MySQL database server from external addresses.
To do this, in a firewall that protects your Panel-managed server, add or enable a rule
that prohibits TCP and UDP connections to the port 3306 from all addresses except
127.0.0.1.
To use the firewall that comes with your Parallels Plesk Panel for Linux:
1. Log in to the Panel as administrator.
2. If you did not install the firewall component, install it:
a. Go to Home > Updates (in the Help & Support group).
b. Click the link corresponding to your version of the Panel.
c. Locate Plesk Firewall module, select the corresponding check box,
and click Install.
3. Configure the firewall rule that blocks external MySQL connections and
switch the firewall on:
a. Click the Settings link in the navigation pane.
b. Click Manage Firewall Rules, and then Edit Firewall Configuration.
c. Click the MySQL server link.
d. Select the Deny option and click OK.
e. Click Activate to apply the configuration, and then click Activate
again to switch on the firewall.
To conceal the version of DNS server from potential attackers, do the
following:
1. Open for editing the DNS server‟s configuration file named.conf. On
Linux systems, it is located in /etc/, and on FreeBSD systems, in
/etc/namedb/.
2. Locate the options {} section, and add the version “none” line
there.
3. Restart the named service:
On Deb package-based systems, issue the command /etc/init.d/bind9
restart
On RPM package-based systems, issue the command /etc/init.d/named
restart
On FreeBSD systems, issue the command /etc/rc.d/named restart
Achieving Compliance with Payment Card Industry Data Security Standard 15
To conceal the version of the Apache Web server from potential attackers,
do the following:
1. Open for editing the Web server‟s configuration file.
On Debian, Ubuntu, and SuSE Linux, it is located at
/etc/apache2/apache2.conf.
On other distributions of Linux, it is located at
/etc/httpd/conf/httpd.conf.
On FreeBSD, it is located at /usr/local/etc/apache2/httpd.conf.
2. Add the following lines:
ServerTokens ProductOnly
TraceEnable OFF
3. Save the file.
4. Restart the Web server.
On Deb package-based systems, issue the command /etc/init.d/apache2
restart
On RPM package-based systems, issue the command /etc/init.d/httpd
restart
On FreeBSD systems, issue the command /usr/local/etc/rc.d/apache2
restart
If you have Single Sign-On v.2.2 components installed, then you need to
disable SSL v.2 and weak SSL ciphers for the single sign-on service:
1. Open for editing the file /etc/sw-cp-
server/applications.d/sso-cpserver.conf.
On Linux systems, issue the command /etc/init.d/sw-cp-server
restart.
On FreeBSD systems, issue the command /usr/local/etc/rc.d/sw-cp-
server restart.
To alleviate security risks arising from disclosure of information about files and their
properties by Apache Web server, configure the FileETag directive in the Web server
configuration file.
To do this:
1. Open for editing the Web server‟s configuration file.
On Debian, Ubuntu, and SuSE Linux, it is located at
/etc/apache2/apache2.conf.
On other distributions of Linux, it is located at
/etc/httpd/conf/httpd.conf.
On FreeBSD, it is located at /usr/local/etc/apache2/httpd.conf.
Achieving Compliance with Payment Card Industry Data Security Standard 17
2. Locate the line FileETag INode MTime Size and remove the
INode keyword from this line.
3. Save the file.
4. Restart the Web server.
On Deb package-based systems, issue the command /etc/init.d/apache2
restart
On RPM package-based systems, issue the command /etc/init.d/httpd
restart
On FreeBSD systems, issue the command /usr/local/etc/rc.d/apache2
restart
The Event Manager is designed to help you organize data interchange between
Event Parameters Passed by Event Handlers ................................................... 21
C H A P T E R 3
Using Event Tracking Mechanism
Parallels Plesk Panel and external systems. It works the following way: you create a
script to be executed upon a certain Parallels Plesk Panel event, and then create an
event handler that triggers the event processing. You can assign several handlers to a
single event.
Important: The Parallels Plesk Panel administrator can create the event handlers that
will trigger scripts running on the server on behalf of the root user. If you wish to restrict
usage of the root account, create an empty file with name
root.event_handler.lock in the location
/plesk_installation_directory/var/.
Using Event Tracking Mechanism 19
Adding Event Handlers
Let‟s, for example, create an event handler for the „client account creation‟ event. The
handler will accept a client name and the client‟s login from environment variables. For
simplicity we will use a shell-script called test-handler.sh that looks as follows:
#!/bin/bash
echo “--------------“ >> /tmp/event_handler.log
/bin/date >> /tmp/event_handler.log # information on
the event date and time
/usr/bin/id >> /tmp/event_handler.log # information on
the user, on behalf of which the script was executed (to ensure
control)
echo “client created” >> /tmp/event_handler.log # information on
the created client account
echo “name: ${NEW_CONTACT_NAME}” >> /tmp/event_handler.log #
client‟s name
This script prints some information to a file so that we could control its execution (we
cannot output information to stdout/stderr, as the script is executed in the background
mode).
Suppose, that our script is located in the directory
/plesk_installation_directory/bin (for instance). Let‟s register it by creating
an event handler via Parallels Plesk Panel.
To add an event handler via Parallels Plesk Panel:
1. Go to Home > Event Manager.
2. Click Add New Event Handler. The event handler setup page appears.
3. Select the event, you wish to assign a handler to in the Event menu.
4. Select the priority for handler execution, or specify a custom value. To
do this, select custom in the Priority menu and type in the value.
When assigning several handlers to a single event you can specify the handler
execution sequence, setting different priorities (higher value corresponds to a
higher priority).
20 Using Event Tracking Mechanism
5. Select the system user, on behalf of which the handler will be executed
(“root” user, for example).
6. In the Command input field, specify a command to be executed upon the
selected event. In our example it is /usr/local/psa/bin/test-handler.sh.
7. Click OK.
Note: In the script, we have specified the variables $NEW_CONTACT_NAME and
$NEW_LOGIN_NAME. During execution of the handler, they will be replaced with
name and login of the created client respectively. The entire list of available variables is
provided in the following section. You should keep in mind that with the removal
operations, the variables of type $NEW_xxx are not set. And with creation operations
the parameters of type $OLD_xxx are not set.
Now if you login to your Parallels Plesk Panel and create a new client, specifying the
value „Some Client‟ in the Contact name field, and „some_client‟ in the field Login, the
handler will be invoked, and the following records will be added to the
/tmp/event_handler.log:
Fri Mar 16 15:57:25 NOVT 2007
uid=0(root) gid=0(root) groups=0(root)
client created
name: Some client
login: some_client
The parameter templates that can be used when setting up an event handler are
presented in the Event Parameters Passed by Event Handlers (see page 21) section.
Removing Event Handlers
To remove an event handler:
1. Go to Server > Event Manager.
2. Select the corresponding check boxes in the list of handlers and click