• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • Support for BIND DNS has been removed from Plesk for Windows due to security and maintenance risks.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS.

Security Auditing on Pleak 8.4

F

fatangel

Guest
Hello,

We have a Unix server with Plesk 8.4 installed. We're currently working with SecurityMetrics to tighten the security of a website. Right now, they're complaining about the services on port 8443. Example:

Synopsis : The remote web server uses a version of PHP that is affected by multiple flaws.
Description : According to its banner, the version of PHP installed on the remote host is older
than 5.2.6.

As we understand it, the various services and modules for the Plesk Control Panel (on port 8443) work separately from the services and modules for customer websites (port 80); and thus, the security vulnerabilities of the control panel do NOT affect the security of the customer's website.

However, SecurityMetrics is refusing to listen to the explanation above.

1) Is our understanding of how the server works correct?
2) Can the above be explained in a different manner that will help them understand?
3) Beyond upgrading to Plesk 8.6 are there any other ways to work around the complaints?

thanks,

Ken
 
Back
Top