0

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for some reason crashes, any user can start a new server on port 8443 and imitate Plesk (right?).

Of course, this user won't have the right certificate. But especially cheap hosts use a self-signed certificate for the Plesk panel anyway, so nobody would notice if it's a different self-signed certificate.

Supposing someone could get access to some normal account on the server, and he could somehow (possibly being lucky) get the Plesk server to crash, he could imitate the Plesk panel and steal the credentials of users who are logging in.

All of this wouldn't be a problem if Parallels Plesk would be using a port under 1024. Am I right in this? Is this a real issue, or does it not really matter?

  • theres also the concern that if it were running under a privileged account a controlled crash could lead to a full system compromise, which is worse? – Ajaxasaur May 12 '15 at 21:15
  • @Ajaxasaur it depends on the way you could get it to crash I suppose. Not all crashes allow for a full compromise, right? – Keelan May 12 '15 at 21:16
  • Correct, not all. My concern is that if plex crashes and gets exploited youre looking at a completely compromised system. If plex crashes and then a faux plex server is spawned youre only looking at the compromise of plex accounts. There are compensating controls you can institue, only allowing one account the access to run the server, not allowing that account to be logged in remotely, removing local shell access. Running it as root isnt the best idea if those are your concerns. – Ajaxasaur May 12 '15 at 21:19
  • Just spitballing here, but if you have enough distrust for the other users of the host running plex that you consider they might be capable of 1.) compromising plex to generate a crash AND 2.) spawn a honeypot while the plex server is down... then maybe that host isn't a machine that should be trusted to run a plex server, privileged port or not. Or maybe you shouldn't be using the host at all based on its users. – killermist May 12 '15 at 22:25
  • These panels are just piles of shell scripts, Perl scripts and similar nastyness duct-taped together and running as root. If you're worried about the security of this, the fact that someone can impersonate the web interface is the least of your issues. – user42178 May 14 '15 at 14:55
1

While Linux has a file security model similar to that of early Unix, I think there has been a change in how the computers are used. In the 70's and 80's, Unix was run on large computers hosting many concurrent users. For example, a single computer could be used by all students in a computer science program. With that type of usage, protecting machine resources from other users was paramount.

Now Linux is frequently run as a single-user OS or in server situations where usage is heavily regulated. As such, protecting resources from malicious users isn't really much of a concern. Personally, I can't recall the last time I was on a Linux machine and didn't have full sudo privileges.

I think that as Linux/Unix's usage model changed, worrying about root-only accessible sockets has become less of a concern. This doesn't mean that it shouldn't be thought about as, while many machines effectively have one user or a small group of cooperating users (eg: for server maintenance), processes should be be run with least privilege. Still, fewer actual users has led to a loosening of security processes.

None of this means that Plesk running on an unprotected port is safe given your deployment model. If you are on a shared host, this deployment of Plesk would make me somewhat concerned. That said, shared hosts have lots of security concerns and maybe this isn't the worst one. You'll have to make the decision as to whether this deployment model is too great a risk for you or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.