Question Some security questions

[amba1980]

Server operating system version

Ubuntu 22.04 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.60, last updated on April 7, 2024 01:33 PM

Hi!

I run several pretty generic Plesk installations on Strato VMs.

Everything is uptodate, but I found some weird security settings in my machines.

I run some HTML websites, plenty of Wordpress with minimal plugins, and one Moodle instance.

I'm not a great sysadmin, if anyone has explanations, I'd appreciate it.

1.

fail2ban had been switched off. Why might this have happened?

ModSecurity had been switched off. Why?

2.

Diagnose & repair tells me one issue in the file system:

The permissions on the /etc/domainkeys directory are incorrect

They are

drwxr-xr-x 9 root root 4096 Mär 13 21:34 domainkeys

Within this, for an example domain settings are

-r--r----- 1 root popuser 1704 Dez 24 21:35 default

(Elsewhere they are 640, not 440)

Repair could fix this.

3.

Some of my servers have, under security/firewall

MySQL server: Allow incoming from all

Sounds suspicious to me; there is no reason I can think of why this should be allowed.

How does it come about? When trying to set it to deny, applying the firewall config fails.

'['/usr/local/psa/var/modules/firewall/firewall-active.sh']' timed out after 14.999970197677612 seconds
Emergency rollback to configuration without rules was performed. Firewall is now disabled. Fix your rules and try again.

4.

Looking at fail2ban.log, I see stuff like

2024-04-10 07:29:14,160 fail2ban.actions [2504]: NOTICE [plesk-modsecurity] Unban 92.222.212.88

I assume unban happens after a grace period after a ban? Ten minutes earlier:

2024-04-10 07:19:14,944 fail2ban.filter [2504]: INFO [plesk-modsecurity] Found 92.222.212.88 - 2024-04-10 07:19:14

----

Thanks for any help!

Amba

 

[Kaspar]

1. fail2ban had been switched off. Why might this have happened?

Wasn't it before? To my knowledge there is noting in Plesk that would disable fail2ban for you.

You can look trough the fail2ban log (/var/log/fail2ban.log) to see when it got stopped. Look for entries like

2024-04-11 13:09:30,335 fail2ban.server         [71335]: INFO    Shutdown in progress...
or
2024-04-11 13:09:31,309 fail2ban.server         [71335]: INFO    Exiting Fail2ban

If you can find a date and time when fail2ban got stopped, you can use the time and date to search for clues in the system log or in the action log.

ModSecurity had been switched off. Why?

2. Diagnose & repair tells me one issue in the file system:
The permissions on the /etc/domainkeys directory are incorrect

They are
drwxr-xr-x 9 root root 4096 Mär 13 21:34 domainkeys

Within this, for an example domain settings are
-r--r----- 1 root popuser 1704 Dez 24 21:35 default

(Elsewhere they are 640, not 440)
Repair could fix this.

Not sure why that's the case for you. However there had been some issues with domain keys permission that got fixed in Plesk version 18.0.60.

3. Some of my servers have, under security/firewall
MySQL server: Allow incoming from all
Sounds suspicious to me; there is no reason I can think of why this should be allowed. How does it come about?

The default firewall configuration is to allow for incoming MySQL connections. Which is to accommodate for remote database connections. Note that in order for remote database connections to work, the database server most have the option to allow for external connections enabled. (Which is disabled by default).

When trying to set it to deny, applying the firewall config fails.

'['/usr/local/psa/var/modules/firewall/firewall-active.sh']' timed out after 14.999970197677612 seconds
Emergency rollback to configuration without rules was performed. Firewall is now disabled. Fix your rules and try again.

Try to increase the confirmTimeout value as explained in the Resolution of this support article:

https://support.plesk.com/hc/en-us/articles/14698752460951-Plesk-Firewall-cannot-be-started-after-18-0-52-update

4. I assume unban happens after a grace period after a ban?

IP's are automatically unbanned after the ban time has expired.

 

[amba1980]

Thanks! Makes me feel better. I worried these might have been some known malware behavior.

fail2ban still has problems; it is running now, in the log I have the following errors:

----
2024-04-11 06:26:10,253 fail2ban.utils [2504]: ERROR 7f6e05c23270 -- exec: iptables -w -I f2b-plesk-modsecurity 1 -s 164.92.97.121 -j REJECT --reject-with icmp-port-unreachable
2024-04-11 06:26:10,254 fail2ban.utils [2504]: ERROR 7f6e05c23270 -- stderr: 'iptables: No chain/target/match by that name.'
2024-04-11 06:26:10,254 fail2ban.utils [2504]: ERROR 7f6e05c23270 -- returned 1
2024-04-11 06:26:11,189 fail2ban.utils [2504]: ERROR 7f6e07750e70 -- exec: for proto in $(echo 'tcp' | sed 's/,/ /g'); do
iptables -w -C INPUT -p $proto -m multiport --dports http,https,7080,7081 -j f2b-plesk-modsecurity
done
2024-04-11 06:26:11,189 fail2ban.utils [2504]: ERROR 7f6e07750e70 -- stderr: "iptables v1.8.7 (nf_tables): Chain 'f2b-plesk-modsecurity' does not exist"
2024-04-11 06:26:11,189 fail2ban.utils [2504]: ERROR 7f6e07750e70 -- stderr: "Try `iptables -h' or 'iptables --help' for more information."
2024-04-11 06:26:11,189 fail2ban.utils [2504]: ERROR 7f6e07750e70 -- returned 2
2024-04-11 06:26:11,189 fail2ban.CommandAction [2504]: ERROR Invariant check failed. Trying to restore a sane environment
2024-04-11 06:26:11,198 fail2ban.utils [2504]: ERROR 7f6e05c14470 -- exec: for proto in $(echo 'tcp' | sed 's/,/ /g'); do
iptables -w -D INPUT -p $proto -m multiport --dports http,https,7080,7081 -j f2b-plesk-modsecurity
done
iptables -w -F f2b-plesk-modsecurity
iptables -w -X f2b-plesk-modsecurity
2024-04-11 06:26:11,198 fail2ban.utils [2504]: ERROR 7f6e05c14470 -- stderr: "iptables v1.8.7 (nf_tables): Chain 'f2b-plesk-modsecurity' does not exist"
2024-04-11 06:26:11,198 fail2ban.utils [2504]: ERROR 7f6e05c14470 -- stderr: "Try `iptables -h' or 'iptables --help' for more information."
2024-04-11 06:26:11,198 fail2ban.utils [2504]: ERROR 7f6e05c14470 -- stderr: 'iptables: No chain/target/match by that name.'
2024-04-11 06:26:11,198 fail2ban.utils [2504]: ERROR 7f6e05c14470 -- stderr: 'iptables: No chain/target/match by that name.'
2024-04-11 06:26:11,198 fail2ban.utils [2504]: ERROR 7f6e05c14470 -- returned 1

----

This looks like a fail2ban bug to me, I'll watch it some more.