Resolved Plesk 18.0.61 Login Problem w/ Google Auth/MFA & Cloudflare

[J.Wick]

Server operating system version

Rocky Linux

Plesk version and microupdate number

Version 18.0.61 Update #1

Hello,

I upgraded Plesk to 18.0.61 today and was prevented from fully logging into Plesk and getting an SSL_ERROR page.

To regain access, I had to disable Google Authenticator using the CLI. This was necessary as the system was now attempting to use port 8880 (HTTP).

I'm running a custom Plesk URL on a subdomain secured with a Cloudflare Origin SSL certificate.

I uninstalled Google Authenticator and installed the current MFA option. Once again, upon activation, I was locked out of Plesk with the same error, requiring me to disable the extension from the CLI.

This extension needs to work on port 443 or it's going to mess up a lot of servers that use Cloudflare.

Please let me know if there's a fix for this.

 

[J.Wick]

I also just noticed that Graphana is also not accessible in this setup.

domain.net:8880/modules/grafana/service/login/generic_oauth produces another SSL error: ERR_SSL_PROTOCOL_ERROR

This is probably the cause why the monitoring dashboard won't work.

 

[Kaspar@Plesk]

We are aware of both (MFA & Grafana) issues. Unfortunately there is no ETA on a permanent fix yet. The suggested workaround is to access Plesk via port 8443. Does that work for you?

 

[Hangover2]

@Kaspar@Plesk The big problem behind this issue is, that our clients cannot handle it and this triggers support requests. If there is no fast patch release with version 18.0.61 Update #2 addressing this issue, the whole 18.0.61 release should get a red flag and not rolled out anymore.

 

[learning_curve]

@Kaspar@Plesk The big problem behind this issue is, that our clients cannot handle it and this triggers support requests. If there is no fast patch release with version 18.0.61 Update #2 addressing this issue, the whole 18.0.61 release should get a red flag and not rolled out anymore.

Whilst empathizing with the difficulties and problems that you / your clients are having, it's not the same for everybody who has upgraded to Obsidian 18.0.61.

We (as an example) have zero problems with MFA and / or Grafana and / or anything else, since the upgrade to Obsidian 18.0.61 / 18.0.61 Update #1 on our cloud servers. It sounds like these might be conditional bugs that only cause these issues, if, certain criteria are met within the configuration / setup / OS choice etc. That's far from ideal obviously, but usually Plesk are reasonably fast at providing fixes when this occurs. Hopefully you'll see Obsidian 18.0.61 Update #2

 

[Hangover2]

@learning_curve This bug is a clear indicator, that Plesk does not make a proper (automatic) testing before new releases are deployed. It just cannot be, that the admin panel gets inaccessible after a normal update. We do not have a fancy setup, we are just using the normal options, the admin panel offers to us. In this case "Customizing Plesk URL".

We did install version 18.0.61 Update #1 on our development servers and within 3 minutes my developers were affected by this bug. How can Plesk not be aware of these problems before deploying new updates to their clients? We had this discussion already several times for some of the latest releases.

I expect from Plesk to make an intensive automatic and manual testing before every new release. This is just not the case. There seems to be no real test-driven development - at least not for all official features.

I make this annotations because we like to have the best Plesk server panel possible. Maybe if this lack of testing is discussed more often by us - the paying clients - Plesk will focus more on that to have much more stable releases. The hosting business is hard enough and doesn't allow too much mistakes.

For us this release is dead with this bug as we do want to have this "login-failure-discussions" with our own clients. On our test-/development servers we do not care too much as we have workarounds in place. But it shows again, disabling automatic-updates for Plesk servers in live systems is a must-to-have nowadays.

 

[learning_curve]

~~~ But it shows again, disabling automatic-updates for Plesk servers in live systems is a must-to-have nowadays.

Everyone's experience & demands differ, but as posted, can empathise with your current predicament. The extract from your post quoted above, fully agree with FWIW. We've only manually run all of the Plesk updates for the past 5 years now. It's a far more controlled process this way (back-ups/test upgrades et al)

 

[J.Wick]

We are aware of both (MFA & Grafana) issues. Unfortunately there is no ETA on a permanent fix yet. The suggested workaround is to access Plesk via port 8443. Does that work for you?

I'm able to log in using the customized Plesk URL, which goes through port 443 and works with Cloudflare. If I were to open my server to use port 8443, I'd have to use a Let's Encrypt certificate and expose the server IP address to the world, breaking a part of our security.

This change to use port 8880 is causing the problem. Everything needs to run through 443 to be Cloudflare compatible, which I'm shocked it wasn't considered or tested for before pushing out this release.

 

[Hangover2]

Sad to see that this issue has a low priority.




Based on the weekly update release strategy of Plesk we have to live with it for at least one more week or even more.

 

[svehei]

The problem persists for me, even with the update to 18.0.61 Update 2

 

[Hangover2]

Sure, it was not patched / solved yet. Better not update your live systems.

 

[Kaspar@Plesk]

It's actually not a low priority. The issues with MFA and Monitoring are still (actively) being worked on.

We wanted to release an update for the issues mentioned in the Update 2 as those where already fixed.

 

[Erik73]

Same issue here: after the update to Obsidian v18.0.61 the Grafana can not access serverport 8880 anymore. I am using Cloudflare DNS. MFA extension is installed but not activated yet. A fix would be greatly appreciated since I love watching the Grafana dashboard

 

[Ricardo_altertable]

I have solved it by updating Plesk to update 3 and activating the new extension (Multi-Factor Authentication (MFA)

 

[Kaspar@Plesk]

The port 8880 issue with the MFA extension and issue with Grafana have fixed with the release of the Update 3 for Plesk 18.0.61.

 

[Hangover2]

This issue did also disappear in other affected areas (e.g. PHPMyAdmin / [...]).

And most important: we have special domains that are reverse proxying the Plesk admin panel to have individual login URLs for our clients and resellers. This was not working anymore since Plesk 18.0.61, when the proxy_pass URL was different from the individual login URL. With Update 3 for Plesk 18.0.61 the problem was luckily washed away too.

Please take care this issue when you make a new run for HTTP/3. Thanks in advance @Plesk Heroes!

 

[svehei]

Everything is working perfectly again for me. Many thanks for the support!