• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Issue How to stop cron abuse?

tkalfaoglu

Silver Pleskian
Server operating system version
Rocky Linux 8.9
Plesk version and microupdate number
Obsidian latest
Hello there. I found out some cron job belonging to a customer when I went into PLESK settings:
I can't post it as this server won't accept it, but it's a one liner that downloads a file from some hellodolly site and runs it

this was put into their crontab even though the owner of that domain does not have permission to schedule jobs according to PLESK.
I believe cron can protect itself from such jobs using /etc/cron.d/cron.allow and deny files.
What would be the required users to put into the allow file for plesk?
I assume root and psaadm?

Regards, -turgut
 
The problem can be that path traversal is done by a malicious PHP script, and the directory where the cron files are stored can be reached. New cron files can be written to it. These will then show up as new cron jobs in the scheduler. The newer the PHP version, the less danger there is. In PHP versions 5.6 or older it was very easy to break out of the base URL jail. In newer versions it became more difficult, but I would not guarantee for that it cannot be done. So if you still have old PHP running on your server, a first good step is to remove it.
 
Back
Top