134 results found

1. Deny access to all dot files by default

   A lot of web applications that are either built or simply installed on a website use dot files and folders, whether those be .htaccess, .git, .env, etc.

   Generally speaking dot files and folders are used to store either sensitive files or backend configuration which you would never want users to be able to access.

   By default Apache has some protection built-in to restrict accessing dot files, but Nginx does not. This creates a potential security risk, for example I might install a web application or build one which has dot files in the public root, these most likely would be .htaccess and .git folders. Now if the site was running using Apache I probably wouldn't need to worry, but if I disable Apache and use only Nginx, these dot files and folders become accessible, and there is no guarantee that I would remember or even know I needed to deny access to dot files, I might simply assuming Plesk or the web server would do it for me. Just today I went through all of our websites and added additional Nginx configuration to restrict access to dot files and folders, but this means for months someone may have been able to read .htaccess files and .git folders, giving them insight into potentially sensitive information. I imagine I'm not the only one who didn't consider that Nginx doesn't deny access to dot files, so imagine how many similar cases are out there.

   To address this issue I am proposing that Plesk add new default configuration to each website in the Nginx config which denies access to dot files, and then provide an option in the "Apache & nginx Settings" screen to enable access to dot files, this in the rare case where the administrator might want dot files to be accessible (maybe Plesk is running on an internal dev environment or something similar).

   A lot of web applications that are either built or simply installed on a website use dot files and folders, whether those be .htaccess, .git, .env, etc.

   Generally speaking dot files and folders are used to store either sensitive files or backend configuration which you would never want users to be able to access.

   By default Apache has some protection built-in to restrict accessing dot files, but Nginx does not. This creates a potential security risk, for example I might install a web application or build one which has dot files in the public root, these most likely would be… more

   6 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.

   Everyone, please continue voting for this feature if you consider it important.

   —
   IG

2. deny access to .git folder by default

   I think it would be great if you could prevent access to .git folders that are usually left exposed by users in the server when building the vhost templates .

   It's very common that users forget to remove credentials and other sensitive information out of their repositories so by leaving the folder exposed it's possible for an attacker to gain access to this sensitive information.

   Currently we manually protect those folders when we spot them but it would be nice if this was implemented from the start.

   For example in nginx the following rule could be used.

   location ~ /.git {
   deny all;
   }

   For apache something like this

   <Directorymatch "^/.*/\.git/">
   Order deny,allow
   Deny from all
   </Directorymatch>

   I think it would be great if you could prevent access to .git folders that are usually left exposed by users in the server when building the vhost templates .

   It's very common that users forget to remove credentials and other sensitive information out of their repositories so by leaving the folder exposed it's possible for an attacker to gain access to this sensitive information.

   Currently we manually protect those folders when we spot them but it would be nice if this was implemented from the start.

   For example in nginx the following rule could be used.

   location ~ /.git… more

   6 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

3. Implement Dropbox's (zxcvbn) password strength library

   Please consider implementing Dropbox's password strength library in future versions of plesk. https://github.com/dropbox/zxcvbn

   Right now (Plesk Onyx Version 17.8.11) very secure passwords such as applaud-bisque-batch-forefoot won't even pass the "medium" filter, and very bad passwords such as Pa$$word123 are marked "Strong".

   Brute force cracking continues to get more sophisticated and the current strength ratings are misleading.

   24 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   3 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases, if it will be popular.

   Everyone, please continue voting for this feature if you consider it important.
   —
   IG

4. Ability for Plesk administrator to disable Plesk customers to change their Plesk UI password

   Please add ability for Plesk administrator to disable Plesk customers to change their Plesk UI password.

   Message from customer:
   I am working on a separate account management panel and I want the customer to log in with the same password. Can I prevent the user changing the password in Plesk.

   11 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.
   Everyone, please continue voting for this feature if you consider it important.
   —
   IG

5. More customizable password strength

   Please consider implementing more options for customization of password strength - for example disalbing it, setting allowed password to have lower than 5 symbols or the opposite - increase number of symbols required for a password.

   17 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   4 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.

   Everyone, please continue voting for this feature if you consider it important.
   —
   IG

6. add git to users in chroot shell
   7 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

7. Use Lets Encrypt to secure FTPs connections

   Hi,

   I usually use the ftp.site.com subdomain for the client FTP connections.
   And to secure those connections I enabled FTPs. But at this point the users receive a certificate host name mismatch because the FTPs connection is being setup using the VPS Lets Encrypt cert.

   It would be nice to use the Lets Encrypt certificate service also to secure the FTPs connections.

   Thanks!

   378 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   75 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.

   Everyone, please continue voting for this feature if you consider it important.

   — AY

8. add posibility to secure webmail using Let's Encrypt certificate without domain being hosted on Plesk
   14 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   4 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for the update! We will consider this functionality in upcoming releases if it will be popular.

   Everyone, please continue voting for this feature if you consider it important.
   —
   IG

9. Description field for IP restrictions

   Here is my idea : add a description field for IP administration restriction access

   6 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.

   Everyone, please continue voting for this feature if you consider it important.

   —
   IG

10. Plesk Premium Email 2fa

    Would like to see google auth 2fa enabled for login to webmail on Plesk Premium Email.

    17 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    8 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

11. Have a "call-in PIN" (support phone password) field in each user account

    I think a call in pin would be nice. Something that the user can change, but it is kept hidden unless they are logged in and click on it to see it. This will allow for end users to request help securely.

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input. We will consider this functionality in upcoming releases if it is popular. Everyone, please continue voting for this feature if you consider it important.
    —
    IG

12. Security Policy per subscription

    To be able to set specific security policy per subscription instead of server-wide.

    9 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    2 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.
    Everyone, please continue voting for this feature if you consider it important.
    —
    IG

13. Content Security Generator

    A CSP Generator where you can define rules very simple.

    9 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    open discussion  ·  2 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

14. control-panel-access - add ddns support

    Please add DDNS Support for "control-panel-access" (Limit Admin Login) - Would be very helpful to restrict Admin Logins if no static IP Address is available ...

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.
    Everyone, please continue voting for this feature if you consider it important.
    —
    IG

15. Let pci_compliance_resolver --enable postfix also set FORWARD SECURITY and go dor TLSv1.3

    Even though server supports TLS 1.2, the cipher suite configuration is suboptimal. It is recommend to configure the server so that the cipher suites providing forward secrecy (ECDHE or DHE in the name, in this order of preference) and authenticated encryption (GCM or CHACHA20 in the name) are at the top. The server must also be configured to select the best-available suite!

    also there is TLSv3 https://tools.ietf.org/html/rfc8446
    (and draft is used already a long time by many;)

    http://www.postfix.org/TLS_README.html

    And while Playing on Mailserver think about MTA Strict Transport Security (Draft standard) and Email DANE / TLSA.

    THX

    3 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    This is a valid request, so we’ll look into it. There is no ETA at the moment, but we would really appreciate you voting for this request so that we can accurately assess its popularity relative to other features. Thanks in advance!

    — rk

16. add permission to disable "certificate selection"

    Add permission to disable "for certificate selection"

    Use case: if "hosting management" permission is disabled in Subscription > Customize > Permissions > Hosting management - uncheck, an additional Plesk user still able to select SSL certificate in "hosting settings" of domain. User can set certificate to none and thus violate website security.

    Add option in Permissions to forbid certificate selection by user to prevent such cases.

    •  

    7 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.
    Everyone, please continue voting for this feature if you consider it important.

    —
    IG

17. fail2ban - Add Details (Login Name)

    Often large Companies with lot's of Workstation are getting blocked because 1 Client in their Office is trying to log in with wrong Password (imap/pop/smtp) - then the whole Office of them is getting blocked and the search which PC/which User is causing the block.starts ...
    It would help big times if one got a reference which Login Name / Username caused the block as additional Info next to the IP ...
    Won't help on Brute Force Attacks where the Username changes ... but on this Scenario it would be a big Timesaver ...
    Andreas Schnederle-Wagner

    6 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    3 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.

    Everyone, please continue voting for this feature if you consider it important.

    —
    IG

18. Anonymize IP in logs instead of disabling them completely

    It would be great to have an option to anonymize IP addresses, not to disable it completely to get rid of issues with statistics displaying. For example as it is for Plesk on Linux.

    Currently, Plesk for Windows has an option to completely disable IP addresses logging In Tools & Settings > Server Settings which affects web statistics.

    3 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.

    Everyone, please continue voting for this feature if you consider it important.

    ---

    IB

19. DDOS Protection

    What about DDOS Protection in Plesk?

    359 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    11 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.
    Everyone, please continue voting for this feature if you consider it important.

    — SU

20. Use of FQDN in the firewall

    I would like to use FQDN in the plesk firewall instead of only IP addresses.

    19 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Security  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

    Thank you for your input! We will consider this functionality in upcoming releases, if it will be popular.

    Everyone, please continue voting for this feature if you consider it important.
    —
    IG