Question Disabling access to <server-ip>/login_up.php in plesk

[kentsmike]

Server operating system version

Debian 11

Plesk version and microupdate number

18.0.56

is there a way to disable accessing Plesk from <server-ip>/login_up.php and allow access only from :8443

i want to access plesk from only <server-ip>:8443

 

[scsa20]

Edit the Customize Plesk URL setting to be "No custom URLs. Only https://<server-ip-or-hostname>:8443".

Setting can be found under Tools & Settings > General Settings > Customize Plesk URL

 

[kentsmike]

Thank you

 

[trialotto]

is there a way to disable accessing Plesk from <server-ip>/login_up.php and allow access only from :8443

i want to access plesk from only <server-ip>:8443

@kentsmike

It might seem logical and/or more secure to access Plesk Panel with [server IP]:8443, but there are some considerations here.


If you want to change access for reasons of personal convenience, then I could understand your question.

However, in an environment with lots of servers or in order to prevent typos in IPs or for convenience, a simple domain name is more easy and secure.


If you want to change access for reasons of security, then I can safely assume that you have asked the wrong question.

Security is not benefitting from URLs consisting of IPort combinations in browsers that store everything ..... that is not wise.

A custom URL makes it quite easy to change the URL - good for security, but also practical when (sysadmin) mail notifications are blocked (just change URLs!)

It is often good to use a format of [server id of some kind].domain.tld across all Plesk servers - just change the server id (read: subdomain prefix) and the DNS records on a relatively frequent basis.

Security is more benefitting from allowing access to Plesk Panel from a very limited number of IPs (and blocking all other IPs explicitly) :

- use Plesk Firewall extension : there are two pre-defined rules already!
- use panel.ini : set the "allowedIPs" value to the allowed IPs in the [api] block
- use Fail2Ban : set the allowed IPs as trusted IPs
- use Nginx rules (if necessary - in general, do not mess with Nginx settings for the Plesk Panel)

and so on.


In short, plenty of considerations that are relevant, but it is essentially up to you and your own preferences.

I deliberately left out a huge number of (other) considerations, since the "nitty gritty" details are barely relevant here.

In my humble opinion, it should be preferred to use a custom URL for Plesk Panel access, for many reasons.


Just some food for thought .......... and I hope it helps a bit!

Kind regards.....