Issue Plesk 18.0.81 Update #7 breaks AJP connectors for some applications

[Fede Marsell]

Server operating system version

AlmaLinux release 8.10

Plesk version and microupdate number

18.0.81 Update #7

Hello,

After updating to Plesk Obsidian 18.0.81 Update #7, some applications using AJP connectors stopped working, with Apache logging the following error:

proxy_lock: refused proxy backend ajp://localhost:XXXX

After investigating the issue, we identified the newly installed Apache module mod_proxy_lock (plesk-mod_proxy_lock) as the cause.

Disabling the module by renaming /etc/httpd/conf.d/proxy_lock.conf and restarting Apache immediately restores normal operation of all affected applications.

This module does not appear to be part of standard Apache, but rather a Plesk-specific customization.

We would like to clarify the following:

1. What exactly does mod_proxy_lock do, and what is its intended purpose?
2. Why does it block connections to local AJP backends configured through standard Apache ProxyPass directives?
3. Is this behavior intentional or a regression introduced in Update #7?
4. Is there a way to allow legitimate AJP connections without disabling the module?
5. What are the security or operational implications of leaving this module disabled?

Our environment runs AlmaLinux 8.X with Apache 2.4 and multiple applications using AJP connectors.

We would appreciate clarification, as this update has disrupted previously working applications, and we need to determine whether disabling mod_proxy_lock is a safe workaround or whether an official fix is planned.

Best regards,

Fede

 

[Oscare09]

Hi,

Thanks for flagging this. We'd suggest digging deeper into mod_proxy_lock, especially how it behaves with Apache AJP connectors after Plesk Obsidian 18.0.81 Update #7. Check the module's config and how it actually runs, so you can pin down what's causing it.

 

[Fede Marsell]

Hi,

After further investigation, we have identified the cause of the issue.

Plesk 18.0.81 Update #7 introduces the Apache module mod_proxy_lock, which appears to restrict proxy connections to a specific Unix socket.

The module causes previously working AJP connections to fail with the following error:

proxy_lock: refused proxy backend ajp://localhost:XXXX

Disabling mod_proxy_lock immediately restores normal operation, confirming that the module is responsible.

We understand that this module may have been introduced as a security measure. However, legitimate AJP connections should remain supported, particularly when configured to connect to a specific IP address and port using standard Apache ProxyPass directives (e.g., ajp://127.0.0.1:XXXX). Administrators should be able to explicitly define and authorize these trusted AJP destinations without having to disable the security module entirely.

We believe this limitation should be addressed, particularly as it introduces a breaking change to existing Apache configurations.

Regards,

Fede

 

[mizar]

Hello,

Sorry, but I cannot provide details about the security now, so anwering only on couple of questions:

> 1. What exactly does mod_proxy_lock do, and what is its intended purpose?

It restricts connections for paricular domain only to specified unix/tcp sockets.

> Is this behavior intentional or a regression introduced in Update #7?

This behaivor is intentional.

> Is there a way to allow legitimate AJP connections without disabling the module?

Configure:
<IfModule mod_proxy_lock.c>
ProxyLockSocket "ajp://127.0.0.1:XXXX"
</IfModule>

Disabling the module will effectively remove the checks.

 

[Fede Marsell]

Hello,

Sorry, but I cannot provide details about the security now, so anwering only on couple of questions:

> 1. What exactly does mod_proxy_lock do, and what is its intended purpose?

It restricts connections for paricular domain only to specified unix/tcp sockets.

> Is this behavior intentional or a regression introduced in Update #7?

This behaivor is intentional.

> Is there a way to allow legitimate AJP connections without disabling the module?

Configure:
<IfModule mod_proxy_lock.c>
ProxyLockSocket "ajp://127.0.0.1:XXXX"
</IfModule>

Disabling the module will effectively remove the checks.

Thank you @mizar for the clarification.

One question: Plesk already generates a ProxyLockSocket directive for the domain's PHP-FPM Unix socket.

Can we add a second ProxyLockSocket directive for an AJP backend within the same virtual host, using custom Apache directives?

Will both destinations be allowed, or will the second directive override the first one?

We need to ensure that authorizing an AJP backend does not interfere with the existing PHP-FPM configuration.

Regards,

Fede