Issue Opening SSH Terminal in Plesk fails

[MiSuisse]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

Plesk Obsidian 18.0.69

Hi all,

I have access to the terminal with Putty or from the interface if I use the IP to access the UI, but if I go through the domain name the terminal is blank and a "broken connection" error pops up

plesk-ssh-terminal.service - Plesk SSH Terminal Backend Service
     Loaded: loaded (/lib/systemd/system/plesk-ssh-terminal.service; enabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/plesk-ssh-terminal.service.d
             └─options.conf
             /usr/lib/systemd/system/plesk-ssh-terminal.service.d
             └─respawn.conf
     Active: active (running) since Wed 2025-04-16 14:14:16 CEST; 1h 59min ago
   Main PID: 914 (plesk-ssh-termi)
      Tasks: 7 (limit: 19054)
     Memory: 7.1M
        CPU: 30ms
     CGroup: /system.slice/plesk-ssh-terminal.service
             └─914 /usr/local/psa/admin/plib/modules/ssh-terminal/libexec/plesk-ssh-terminal.x86-64 --listen /run/plesk-ssh-terminal/backend.sock --connect-to "*:22"

Apr 16 14:14:16 plesk-hosting.mydom.org systemd[1]: Started Plesk SSH Terminal Backend Service.
Apr 16 16:11:15 plesk-hosting.mydom.org plesk-ssh-terminal.x86-64[914]: 2025/04/16 16:11:15 checkSameOrigin error: Origin header 'plesk-hosting.mydom.org' does not match request Host '192.168.1.30'
Apr 16 16:11:15 plesk-hosting.mydom.org plesk-ssh-terminal.x86-64[914]: 2025/04/16 16:11:15 remote=10.5.1.14 user=root WebSocket error: websocket: request origin not allowed by Upgrader.CheckOrigin
Apr 16 16:11:57 plesk-hosting.mydom.org plesk-ssh-terminal.x86-64[914]: 2025/04/16 16:11:57 remote=10.5.1.14 Session error: session with token ce514455207b063d5b5df5f1999feaa686d274df035491e62a13b2d4ec8443ab was not found

$ grep PermitRootLogin /etc/ssh/sshd_config
PermitRootLogin yes

Firewall :
SSH (secure shell) server => Allow incoming from all

it has no effect

$ /usr/local/psa/admin/sbin/modules/ssh-terminal/installer --update-configuration
Configuring to connect to *:22

$ systemctl restart plesk-ssh-terminal.service

panel.ini configuration :

extensionCatalogUrl = "/opt/psa/admin/conf/panel.ini.d/packages.json"

[webserver]
nginxClientMaxBodySize = 512m

[security]
sameOriginOnly = false

[updates]
updateDays = saturday,sunday
timeFrameStart = 11
timeFrameEnd = 18

[ext-nodejs]
showApplicationLogs = true

[websocket]
allow_any_origin = true

[ext-ssh-terminal]
rootAccessAllowed = true

 

[alvarezcruz]

Can't find anything about this error. What URL are you using to access Plesk?

 

[MiSuisse]

if i use https://192.168.1.30/modules/ssh-terminal/ it works
if i use https://plesk-hosting.mydom.org/modules/ssh-terminal/ it doesn't work

Don't have message, only a black page with the pop-up 'connection broken'

the best log I found is

checkSameOrigin error: Origin header 'plesk-hosting.mydom.org' does not match request Host '192.168.1.30'
remote=10.5.1.14 user=root WebSocket error: websocket: request origin not allowed by Upgrader.CheckOrigin
remote=10.5.1.14 Session error: session with token ce514455207b063d5b5df5f1999feaa686d274df035491e62a13b2d4ec8443ab was not found

thanks for the help

 

[alvarezcruz]

When you use https://plesk-hosting.mydom.org, are you entering the Plesk port? i.e. https://plesk-hosting.mydom.org:8443

 

[MiSuisse]

No I don't use the port; the domain is configured from the command :

plesk bin admin --enable-access-domain plesk-hosting.mydom.org

 

[alvarezcruz]

Please confirm whether it works when you use the port or not

 

[MiSuisse]

The port is not opened directly, there is a forward reverse proxy with these properties:

location / {
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass https://192.168.1.30:8443};
    }

I don't think that's the problem, because my other server with the same configuration doesn't have the problem.

 

[alvarezcruz]

Have you tried removing this and testing without it?

 

[MiSuisse]

Indeed, if I modify the internal record of the machine to bypass the reverse proxy, it works.
I don't understand the problem, because my other server has the same configuration and doesn't have the problem.

After investigation, I will get back to you in a few days, thank you.

 

[alvarezcruz]

Any difference if you use the hostname instead of the IP address on this line?

proxy_pass https://192.168.1.30:8443

I see it's private so you may need to add it to hosts, you can figure that out.