Question Possible BUG / Has Plesk CHANGED the Plesk Fire Wall data base configuration, and if so, what is the new one?

[Ehud]

Server operating system version

OS version: Ubuntu 22.04 x86_64 Build date: 2023/05/16 12:00 Revision: a3b74dbc9de2e47afd4e532d02fa7759b29d3fa5 Server version: Apache/2.4.57 (Ubuntu) Server built: 2023-04-08T12:56:02 nginx version: nginx/1.22.1

Plesk version and microupdate number

Product version: Plesk Obsidian 18.0.52.3 OS version: Ubuntu 22.04 x86_64 Build date: 2023/05/16 12:00 Revision: a3b74dbc9de2e47afd4e532d02fa7759b29d3fa5

Hi,

I was using the Plesk Fire Wall for several years.

Few days ago, I have failed an attempt to update it. The Plesk Fire Wall crashed after that attempt.

At first I have restored an AWS Snap Shot. The Fire Wall updated crashed again.

To the best of my memory at that stage of the second crash, the Plesk Fire Wall presented IPs on the Plesk GUI, however those were not seen on IPTABLES.

I then removed the Fire Wall and reinstalled it. Enabled and set few rules.

To the best of my memory I could not set the country blocking rules. I got an error:

curl (22) The requested URL returned error: 404 gzip: stdin: unexpected end of file command '['/opt/psa/admin/sbin/modules/firewall/geoip/db-ip-lite', '--fetch']' returned non-zero rxit status 1.

When I now went to look for the file, so I can post it, it even doesn't exist:

less opt/psa/admin/sbin/modules/firewall/geoip/db-ip-lite
opt/psa/admin/sbin/modules/firewall/geoip/db-ip-lite: No such file or directory

Questions:
1) Regarding the above issue, may I ask for your checking of it?


Now to the main issue...


What I previously knew from Plesk support, was I could access Plesk fire Wall rules, on the Data Base level, and modify them (the "2" and "1" classes, of current and previous revisions), by CLI:

# plesk db "select * from module_firewall_rules where object not like '%custom%'"
ERROR 1146 (42S02) at line 1: Table 'psa.module_firewall_rules' doesn't exist
exit status 1

However
As can be seen, this stopped working.

Questions:
2) Can you please explain changes done to the Plesk Fire Wall data base structure, and

3) Could such changes, bring to a Plesk Fire Wall previously configured according to previous data base structure to fail (on some scenarios) when now coming to update a rule on it?

 

[Peter Debik]

The previous firewall component was upgraded and migrated into an extension. It is very well possible that many changes were applied so that previous custom configurations do no longer work, especially direct manipulations of the database. If you require details for your individual case, please contact Plesk support staff via support.plesk.com.

 

[Ehud]

I also thought so. Countries being blocked most likely involved IPSET..

However, if this has been done, that would most likely BREAK some Plesk servers... And should have NOT been the way it was done...

I consider this Plesk BUG, as some Plesk users would only confront the data base breaking once they come to update it, so it's time for Plesk to fix the data transfer between the different data structures, BEFORE such instance breaking occurs, as it did happen to me.