Issue Plesk 18.0.81 Update #7 breaks AJP connectors for some applications

[HostaHost]

We're finding evidence that http over socket is broken by this. Does anyone have a working http over socket? Example, this fastcgi-based setup worked fine before this module was deployed, broke, and was fixed by adding the conditional + proxylocksocket:

<IfModule mod_proxy_lock.c>
ProxyLockSocket "/var/www/vhosts/DOMAIN/application.sock"
</IfModule>
SetHandler "proxy:unix:/var/www/vhosts/DOMAIN/application.sock|fcgi://localhost/"


This version is broken and remains broken:

<IfModule mod_proxy_lock.c>
ProxyLockSocket "/var/www/vhosts/DOMAIN/application.sock"
</IfModule>
ProxyPass / "unix:/var/www/vhosts/DOMAIN/application.sock|http://127.0.0.1/"
ProxyPassReverse / "unix:/var/www/vhosts/DOMAIN/application.sock|http://127.0.0.1/"

 

[tessa67]

Hi @HostaHost, hi everyone,

I tried to help with the unix socket question from post #21 and ran a few tests on a small test box. Quick disclaimer first: it's plain Apache 2.4.58 on Ubuntu 24.04, no Plesk, so no mod_proxy_lock. As far as I can tell the module isn't publicly available and I couldn't find any docs or release note entry for it. Everything I say about the module itself comes from this thread only, and I'll point to the post numbers.

What I tested (stock Apache, backend listening on a unix socket, no mod_proxy_lock involved):

- ProxyPass / "unix:<SOCKET_PATH>|http://localhost/" at vhost level: works
- the same with http://127.0.0.1/ (that's the form from post #21): works
- ProxyPass / ProxyPassReverse inside <Location />: works
- SetHandler "proxy:unix:<SOCKET_PATH>|http://localhost/": in my test the backend got the filesystem path (/var/www/html/x) instead of the request URI. So for an http backend I'd stick to ProxyPass; SetHandler is the right tool for fcgi, as in your working example.

So the syntax in #21 is fine on plain Apache. If it's still refused with ProxyLockSocket set, the difference has to come from the module's handling. I can't tell more than that.

What the thread says (staff and users):

- ProxyLockSocket only accepts "none" or an absolute unix socket path (error message in #14 and #19). That's why the ajp:// line from #3 gets rejected.
- A later ProxyLockSocket overrides an earlier one, and it can be set in directory scope, e.g. <Location> (#9, #13).
- http(s) proxies are intentionally allowed (#20), which matches what Fede saw in #19.
- A fix for AJP is planned for the next update, and mizar offered an RPM for AlmaLinux (#16, #20).

Things you could try. I could not test these against the module, so please treat them as ideas:

1) First look at what exactly gets refused, it shows which address the module checks:

grep "proxy_lock" /var/www/vhosts/system/<DOMAIN>/logs/error_log | tail

2) For the unix socket + http case, set both directives in directory scope (based on #9 and #13):

<IfModule mod_proxy_lock.c>
ProxyLockSocket "<SOCKET_PATH>"
</IfModule>
<Location />
ProxyPass "unix:<SOCKET_PATH>|http://localhost/"
ProxyPassReverse "unix:<SOCKET_PATH>|http://localhost/"
</Location>

3) For AJP/Tomcat, the HTTP connector instead of AJP should work according to #19 and #20:

ProxyPass / http://127.0.0.1:<TOMCAT_HTTP_PORT>/
ProxyPassReverse / http://127.0.0.1:<TOMCAT_HTTP_PORT>/
ProxyPreserveHost On

Two questions for @mizar, if you have a minute:

- Is the unix socket + ProxyPass + http combination from #21 expected to be allowed with ProxyLockSocket, and if so, in which scope?
- The error message mentions "none" as a valid value. What does it do exactly, and is it meant to be used per domain or location?

One more thing: the official change log for Update 7 only says it addresses a critical security issue, that the web server vhost templates changed, and that the configs of all domains get regenerated. If you use custom vhost templates, it's worth checking them after the update.

Hope this helps a bit!

Regards
Tessa

 

[mizar]

This version is broken and remains broken:

<IfModule mod_proxy_lock.c>
ProxyLockSocket "/var/www/vhosts/DOMAIN/application.sock"
</IfModule>
ProxyPass / "unix:/var/www/vhosts/DOMAIN/application.sock|http://127.0.0.1/"
ProxyPassReverse / "unix:/var/www/vhosts/DOMAIN/application.sock|http://127.0.0.1/"

Thanks for the report, I'll investigate this. Am I right that this directives are added using additional apache directives, and not framed by location / directory?

 

[mizar]

@mizar Thank you for the update and for confirming the issue.

I would appreciate it if you could provide the updated RPM package for AlmaLinux 8 and 9, so we can test the fix before the next official update.

Could you also confirm whether the updated module will automatically allow existing AJP connections configured through standard Apache ProxyPass directives, without requiring any additional configuration changes?

Thanks,

Fede

I upload proxy_lock with the fix for AJP proxies to https://autoinstall.plesk.com/plesk-mod_proxy_lock-04.11.2026/ (release redhat.8 for AlmaLinux 8 and redhat.9 for AlmaLinux 9). Theese version of module should handle AJP proxied connections without extra configuration (even ProxyLockSocket exists for virtual host).

The short instruction - install approprate rpm package with rpm -Uvh, restart apache. To rollback - download previous version module from Index of /pool/PSA_18.0.82_20369 (for 18.0.82) or Index of /pool/PSA_18.0.81_20371 (for 18.0.81), they are in dist-rpm-RedHat-el8-x86_64/opt/hosting/proxylock/ for AlmaLinux8 or dist-rpm-RedHat-el9-x86_64/opt/hosting/proxylock/ for AlmaLinux 9, then rpm -Uvh --oldpackage and restart apache. Please let me know if you have any problems with it.

 

[mizar]

- Is the unix socket + ProxyPass + http combination from #21 expected to be allowed with ProxyLockSocket, and if so, in which scope?

I need to check how exactly Apache handle ProxyPass with "unix:/var/www/vhosts/DOMAIN/application.sock|http://127.0.0.1/", for SetHandler expression after | are used as label, but I'm not completely sure how it is handled for ProxyPass.

- The error message mentions "none" as a valid value. What does it do exactly, and is it meant to be used per domain or location?

It is disabling proxy connections except http-based for the virtual host / directory. However, subequent directives can override this.

 

[HostaHost]

Thanks for the report, I'll investigate this. Am I right that this directives are added using additional apache directives, and not framed by location / directory?

I tried it bare (the site doesn't use PHP-FPM so the lock directive is "none", tried it as location /, proxy match, directory /full/path, and filesmatch. All versions fail if it's http over socket. The application is intentionally not exposed via http because the socket listener is using the OS uid of the process accessing the socket as its confirming the intended site is calling it, versus having to build an http auth mechanism.