Resolved How to update default open_basedir for all websites?

[macandcheese]

Server operating system version

AlmaLinux release 8.8 (Sapphire Caracal)

Plesk version and microupdate number

Plesk Obsidian 18.0.52.3

Dear Plesk community,

TLDR: How can we update PHP's default open_basedir for multiple domains at once?

For all domains on our 10+ Plesk servers, we're trying to configure PHP's auto_prepend_file to intercept fatal errors and send them to cloud logging.
However, most of the domains also have PHP's open_basedir setting enabled for security.
To make auto_prepend_file work, open_basedir needs to be changed to {WEBSPACEROOT}{/}{:}{TMP}{/}{:}/path/to/prependedstuff/.

Every domain uses the default setting:


...and ideally what I'd do is change that default in a single location to update all domains at once. This however seems impossible, because:

• PHP Settings > php.ini can't be used here, because every domain has a different {WEBSPACEROOT}.
• Service Plan > PHP Settings > Update & Sync has no effect; existing domains' open_basedir doesn't get updated.
• Restricted Mode Settings > PHP Settings similarly has no effect on existing domains.

Any ideas, like changing the psa database maybe? Thanks in advance.

Some additional details:
- Most servers use LiteSpeed
- Servers use a mix of fastcgi and php-fpm

 

[Peter Debik]

1) Make a backup of the psa database

https://support.plesk.com/hc/en-us/articles/12377958344855-How-to-back-up-restore-a-system-database-in-Plesk

2) Update PHP configuration in database:
plesk db

> use psa;
> UPDATE `psa`.`PhpSettingsParameters` SET value='<your new complete open_basedir entry>' WHERE name LIKE 'open_basedir';
> quit;

3) Apply PHP settings to domains using "/usr/local/psa/bin/domain --update-php-settings <domain name>". For example:
plesk bin domain -l | while read domain_name; do /usr/local/psa/bin/domain --update-php-settings $domain_name; done
Depending on the number of domains, this can take a while to complete, probably around 1 to 2 seconds per domain.

 

[macandcheese]

Thanks a million Peter, that did the trick!
I wrapped it all in a shell script, together with some other patches. Maybe it will be useful to someone.

Plesk auto_prepend_file installer

Plesk auto_prepend_file installer. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

 

[macandcheese]

1) Make a backup of the psa database

https://support.plesk.com/hc/en-us/articles/12377958344855-How-to-back-up-restore-a-system-database-in-Plesk

2) Update PHP configuration in database:
plesk db

> use psa;
> UPDATE `psa`.`PhpSettingsParameters` SET value='<your new complete open_basedir entry>' WHERE name LIKE 'open_basedir';
> quit;

3) Apply PHP settings to domains using "/usr/local/psa/bin/domain --update-php-settings <domain name>". For example:
plesk bin domain -l | while read domain_name; do /usr/local/psa/bin/domain --update-php-settings $domain_name; done
Depending on the number of domains, this can take a while to complete, probably around 1 to 2 seconds per domain.

One more question - is it also possible to (programmatically) update the defaults set in the following places?

• Service Plan > * > PHP Settings > Update & Sync
• Restricted Mode Settings > PHP Settings

 

[Peter Debik]

You seem to have a huge number of servers that you need to automate these settings ...

 

[macandcheese]

You seem to have a huge number of servers that you need to automate these settings ...

21 servers with 900 domains, proudly running Plesk

 

[Peter Debik]

For the service plan question I think that the --update-php-settings parameter described in service_plan: Hosting Plans can solve that. For restricted mode as far as I know there is no suitable CLI command.