Need help? Call us on 1300 789 260

Protecting From Running Tasks on Behalf of root in Plesk 12

Difficulty: Advanced

Prerequisites

  • SSH Access to the server
  • Parallels Plesk 12 installed

Overview

By default, Plesk Panel 12 allows utilities or scripts to be run on behalf of root in two cases:

  • Scheduling tasks with the cron manager
  • Handling events with the Event Manager tool

This makes Panel server potentially vulnerable to malicious software.

Upgraded cron functionality was included in the Plesk 12.5 release. If you're still running 12, we highly recommend you upgrade to take advantage of the new functionality.

Instructions

To eliminate these vulnerabilities, create the following files and leave them empty:

$PRODUCT_ROOT_D/var/root.crontab.lock

prevents users from running cron tasks and viewing the list of tasks scheduled on behalf of root.

$PRODUCT_ROOT_D/var/root.event.handler.lock

prevents users from creating event handlers functioning on behalf of root.

The $PRODUCT_ROOT_D is /usr/local/psa for RPM-based systems (RHEL / CentOS) or /opt/psa on DEB-based systems (Debian / Ubuntu).

Was this article helpful? Yes No
👥

Having trouble? We’re here to help!

We’ve built our company with a serious focus on quality service. Feel free to give us a call!

1300 789 260