Facebook
Twitter-
Debian 11 is approaching its end-of-life (vendor EOL date - August 31, 2026). Plesk Obsidian 18.0.80 will be the last release to support it.
If you are running Plesk Obsidian on Debian 11, we recommend you upgrade those servers to Debian 12 using our dist-upgrade tool.
Issue Protocol version '1.6.3.0' is deprecated. Current protocol version is '1.6.9.1'.
- Thread starter Azurel
- Start date
Do you use WHMCS by any chance? If yes, please check:
Azurel
Silver Pleskian
No, I do not use WHMCS and I am not aware of any WHMCS installation or integration on this server.
The warning first appeared in panel.log on August 8 at 15:04:02 and stopped about two seconds later, after hundreds of identical entries:
I checked /var/log/plesk/httpsd_access_log and found requests from an external IP address at exactly the same timestamps. This IP does not belong to me:
There are hundreds of these requests corresponding to the protocol-version warnings. The same IP had also accessed the Plesk login page several times the previous evening:
What exactly is generating these requests to /enterprise/control/agent.php?
Is this expected Plesk behavior, or could this indicate an unauthorized access attempt?
What would you recommend to prevent or restrict such API access if I do not use WHMCS?
I would especially appreciate clarification on whether these requests indicate a successful authentication as the Plesk admin user, or whether the 200 HTTP status is also returned for rejected/invalid API requests.
The warning first appeared in panel.log on August 8 at 15:04:02 and stopped about two seconds later, after hundreds of identical entries:
I checked /var/log/plesk/httpsd_access_log and found requests from an external IP address at exactly the same timestamps. This IP does not belong to me:
There are hundreds of these requests corresponding to the protocol-version warnings. The same IP had also accessed the Plesk login page several times the previous evening:
What exactly is generating these requests to /enterprise/control/agent.php?
Is this expected Plesk behavior, or could this indicate an unauthorized access attempt?
What would you recommend to prevent or restrict such API access if I do not use WHMCS?
I would especially appreciate clarification on whether these requests indicate a successful authentication as the Plesk admin user, or whether the 200 HTTP status is also returned for rejected/invalid API requests.
If not WHMCS, there must be another external API trying to reach Plesk using the deprecated version. The same has a critical security vulnerability and it's not advisable to use it. I can't really tell what's the source of the requests or whether they are legitimate. The 200 status code doesn't indicate a successful authentication, but that the request reached the API endpoint.
If you do not recognize the IP address, it's worth consider limiting its access to the server. Also, you can completely disable XML API, or only allow specific IP addresses if it's in use:
If you do not recognize the IP address, it's worth consider limiting its access to the server. Also, you can completely disable XML API, or only allow specific IP addresses if it's in use:
Azurel
Silver Pleskian
I checked my /usr/local/psa/admin/conf/panel.ini and API access is already disabled:
Since the XML API is already disabled, I have more questions:
I also do not have any other users or customers on this server. It is my own server and I am the only user.
Since the XML API is already disabled, I have more questions:
- Does enabled = off also prevent requests to /enterprise/control/agent.php from being processed, or does it only disable API functionality for authenticated clients?
- If XML API is disabled, why do requests from this external IP still reach /enterprise/control/agent.php and generate the Protocol version '1.6.3.0' is deprecated messages in panel.log?
- Is there a way to determine from Plesk logs exactly what API request was sent by 209.*.*.84 and whether authentication was attempted or successful?
Thank you for the confirmation. I've further inquired with our team about the behavior. My understanding is the option should block such API requests. I will follow up with more details as soon as I hear back.
Can you please share what else is being logged at
The version of Plesk you are running, 18.0.80 update 1 is already pathed for the mentioned vulnerability.
Can you please share what else is being logged at
panel.log before/after the API errors?The version of Plesk you are running, 18.0.80 update 1 is already pathed for the mentioned vulnerability.
If it's just about the messages, you can suppress them by adding
deprecationWarning = off to panel.ini, see this thread: Issue - Protocol version '1.6.5.0' is deprecated. Current protocol version is '1.6.9.1'.
Azurel
Silver Pleskian
@King555
Thanks, but if the API is “disabled,” these entries shouldn’t exist in the logs in the first place, since the API shouldn’t be responding to requests at all. At first glance, this looks more like a successful intrusion into a system that was supposedly locked down.
So far, only this one IP address has generated these log entries, and it hasn’t made any further attempts since August 8.
Thanks, but if the API is “disabled,” these entries shouldn’t exist in the logs in the first place, since the API shouldn’t be responding to requests at all. At first glance, this looks more like a successful intrusion into a system that was supposedly locked down.
So far, only this one IP address has generated these log entries, and it hasn’t made any further attempts since August 8.
Similar threads
