• Debian 11 has reached its end-of-life (vendor EOL date - August 31, 2026). Plesk Obsidian 18.0.81 is the last release to support it.
    If you are running Plesk Obsidian on Debian 11, we recommend you upgrade those servers to Debian 12 using our dist-upgrade tool.
  • We plan to deprecate and remove the support for XML RPC protocol versions earlier than 1.6.9.1 in Plesk Obsidian 18.0.82. We strongly recommend that you update all existing integrations using earlier versions of the XML RPC protocol to comply with the version 1.6.9.1 specification.

FTP permission thread with sub FTP users

B

BonDuong

Guest
Hi,

I am using Plesk v10. I just found out that sub FTP users are able to delete files and folders which they can not modify or upload.

For example, customer name shawncust3 has a domain shawncust3domain.com with main FTP account shawncust3d/Testing@123. Shawn can not delete/modify/upload anything from following directories: anon_ftp/, error_docs/, statistics, subdomains, and web_users/.

However, if shawncust3 creates another FTP account cust3FTP3/Testing@123 with read and write permission, this cust3FTP3 is unable to modify/upload BUT ABLE to DELETE any folders and files from following directories: anon_ftp/, error_docs/, statistics, subdomains/, and web_users/.

We really worry about this thread because we do not want sub FTP user to be able delete config files.


Is it a bug with Plesk?


Thank you,
 
Back
Top