Resolved Plesk admin appears on client domain

[theywill]

Plesk 12.x
CentOS 6.x

I've configured an SSL certificate for my Plesk admin login and direct my clients to something like this:
https://www.[hosting domain].com:8443

I just discovered that the Plesk admin panel is available on client domains. So a domain on the server, such as clientdomain1.com provides the admin login when hit on port 8443.
https://www.clientdomains1.com:8443/

Is there a way to turn the latter off, such that the admin is only reachable by a single domain?

Thank you.

 

[Bitpalast]

This is a daunting task and requires your individual Nginx configuration for the Plesk panel. I discourage doing that, because noone knows the implications that a change to the Plesk panel configuration will bring about to other services running on the system. For instance a service like drweb may expect a response from port 8443 even though it might not request data through from host URL, but through another locator or none at all. Limiting the panel's server configuration to a specific domain may result in failures of other services who require free access to the web server running on port 8443.

Here is a solution for your task in THEORY! By default, /etc/sw-cp-server/conf.d/plesk.conf defines only a default server. This server will react on everything that is directed to port 8880 and 8443. The default does not include a server_name directive. You could add a server_name directive to that block and name it like your hosting domain. In that case you must add a new instruction block before the existing server block which becomes your new default server. In that default server, instruct the web server to respond with a 404 not found error. This will ensure that a call to port 8443 from a domain other than the one defined in server_name will fail.

Theoretical example:

Existing entry:

server {
listen 8443 ssl;
listen 8880;
listen 127.0.0.1:8880 default_server;
include conf.d/*ipv6_ports.inc;


ssl_certificate /usr/local/psa/admin/conf/httpsd.pem;
ssl_certificate_key /usr/local/psa/admin/conf/httpsd.pem;

include conf.d/*plesk.inc;
include conf.d/*wpb.inc;
}


Modified setting:

server {
listen 8443 ssl;
listen 8880;
return 404;
}
server {
server_name your-hosting-domain.com
listen 8443 ssl;
listen 8880;
listen 127.0.0.1:8880 default_server;
include conf.d/*ipv6_ports.inc;

ssl_certificate /usr/local/psa/admin/conf/httpsd.pem;
ssl_certificate_key /usr/local/psa/admin/conf/httpsd.pem;

include conf.d/*plesk.inc;
include conf.d/*wpb.inc;
}

I do not recommend to make this change. The panel is a complex matter, and it is difficult enough to maintain a stable server through all updates and upgrades without such individuall changes. A major change like the one described here has a high potential to break the system.

 

[theywill]

Thanks for your detailed reply. I'll have to consider this more.