129 results found

1. Add configuration option for protection against host header injection

   It will be good to add the feature to configuration the Plesk host header injection protection.
   Curretly that is not possible to make it by the Plesk interface.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

2. Deprecate clear domain names as home directory

   Since plesk is storing each vhost as clear domain name, every user wit shell access is able to see which domains/customers are on this host, eg. with > getenv passwd

   We know we can chroot the user but chroot is NOT a security feature and makes trouble with applications the user might expect (or the environment these applications expect) - and there is still a way to break out from the environment or new ways get discovered. Much afford for nothing in the end.

   We do not want to put customers in containers, jails whatsoever to restrict the user access if there is an easy solution to mask user home directories so nobody is able to examine them.

   Or add LDAP support at system level so home directories can be stored and queried from there.

   Since plesk is storing each vhost as clear domain name, every user wit shell access is able to see which domains/customers are on this host, eg. with > getenv passwd

   We know we can chroot the user but chroot is NOT a security feature and makes trouble with applications the user might expect (or the environment these applications expect) - and there is still a way to break out from the environment or new ways get discovered. Much afford for nothing in the end.

   We do not want to put customers in containers, jails whatsoever to restrict the user access… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   This is a valid request, so we'll look into it. There is no ETA at the moment, but we would really appreciate you voting for this request so that we can accurately assess its popularity relative to other features.

   Thanks in advance!

   --

   IG

3. Firewall, Remote Adress(es): input a lot of remote adresses at once.

   In the Firewall settings, to input remote adress(es) to block or allow, it would be usefull, to input a lot of remote adresses, just to block or allow a whole company at once (after getting their adresses from ipinfo.io, for example).

   Actually I get spam, check remote IP (at dnslytics.com for example) and block that IP, if wanted.
   After getting a lot of these mails from IP adresses of the same company, I get the IP adresses from that company and block all the known IP ranges...one by one.
   That could be 100s or more and take too much time.
   So it would be nice, if I can block a bunch of IP adresses at once.

   In the Firewall settings, to input remote adress(es) to block or allow, it would be usefull, to input a lot of remote adresses, just to block or allow a whole company at once (after getting their adresses from ipinfo.io, for example).

   Actually I get spam, check remote IP (at dnslytics.com for example) and block that IP, if wanted.
   After getting a lot of these mails from IP adresses of the same company, I get the IP adresses from that company and block all the known IP ranges...one by one.
   That could be 100s or more and take too much time.… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   This is a valid request, so we'll look into it. There is no ETA at the moment, but we would really appreciate you voting for this request so that we can accurately assess its popularity relative to other features.               

   
   

   Thanks in advance!

   
   

   --

   IG

4. Create security.txt

   Help admins and customers to create a security.txt file when creating a site in Plesk Panel, see https://securitytxt.org/
   No details yet.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   open discussion  ·  2 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

5. Make Plesk Firewall add/change rules incrementally without restarting the whole service

   Make Plesk Firewall add/change rules incrementally without restarting the whole service.

   Now Plesk firewall reloads all rules in iptables when rules are changed in firewall (all rules are added anew). If there is a long list of blacklisted IPs or server is under a brute-force attack and there are a lot of IPs blocked by the Fail2Ban, adding/changing any rule via Plesk Firewall will cause server restart that is taking a lot of time due to a large number of blocked IPs.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it is popular. Everyone, please continue voting for this feature if you consider it important.

   —
   IG

6. Automatically set the default SSL certificate for new domains
   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   open discussion  ·  1 comment  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

7. Add a security mechanism when changing a user password

   Add a security mechanism for resetting a user password in Plesk, for example verify the password change via email or add a field to submit the old password (implemented for Plesk admin user)

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

8. User Role Permissions

   Users with permissions to edit roles can edit rights that they do not own and create roles with rights that they do not own. It would be ideal if a user who has the permissions to edit roles can only change and assign rights that he owns.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular. Everyone, please continue voting for this feature if you consider it important.
   —
   IG

9. Password-protected directories: LDAP / Active Directory

   Fetch users from AD for Password-protected directories

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Security  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   open discussion  ·  AdminPlesk Staff (Community Manager, Plesk International GmbH) responded

   Thank you for your input! We will consider this functionality in upcoming releases if it will be popular.
   Everyone, please continue voting for this feature if you consider it important.

   —
   IG