This update brings a new capability to ASL which we are initially piloting for Plesk environments. It is a separate independent Web Application Firewall(WAF) for other web based services. In the context of plesk this both blocks attacks against the Plesk control panel, and adds in upload scanning to the Plesk file manager. The functionality of this module can be used on any web service, from control panel software like Plesk, Cpanel, Interworx, to web front ends on applications like Vmware and Oracle , or alternate web servers like Nginx, and litespeed. We will continue to expand this functionality on other control panels over the next few releases, and we encourage everyone to let us know via support, or in the forums about other web environments that you are interested in supporting.

Changelog

- Add Plesk WAF module for 8.6 thru 10.x
- Add vulnerability check for Plesk CVE-2011-4734
- Update to default audit log retention policy, lowered from 30 to 14 days
- Update to RBL configuration, this will now warn the user about performance considerations
- Update ASL Web to include debug messages if the mysql db has become corrupted
- Feature Request #XXX, add support for multiple users of posteasyapache
- Feature Request #XXX, Add support for CPANEL_DISABLE_POSTEASYAPACHE, this disables modification of posteasyapache
- Bugfix #XXX, rkhunter has been disabled test
- Bugfix #XXX, asl.repo will be generated if it does not exist
- BugFix #741, Add detection for ossec-hids-server


To Upgrade:

1) yum upgrade asl asl-web

2) (Plesk only) Set up the Plesk WAF

/var/asl/bin/plesk-waf-setup

Remeber to run as su, not with sudo!

Something failed:

I looked into how the ASL Plesk WAF is configured. I see an iptables rule is used to redirect all external traffic to port 8443 to port 8445 on which tortixd is listening and running a reverse proxy to https://127.0.0.1:8443 (see /var/asl/etc/httpd/conf.d/plesk_waf.conf).

As far as I can see HTTPS access to Plesk (tcp/8443) is secured this way, but HTTP access (tcp/8880) isn't, so unless 8880 is specifically firewalled Plesk is still accessible without being protected by mod_security. I guess this is not too hard to add and otherwise this looks like a great addition to ASL, so thanks for that.

Yeah absolutely, in the interest of time that was tabled til after we got this out.

I just went through the upgrade process and configured the Plesk WAF. Everything appeared to go smoothly, however, now I can't bring up Plesk in a browser. I seem to be blocked. Any ideas?

Same problem, just times out... no errors during install and no access to port 8443. The detected IP address is correct and both /asl_ssl_error_log
and /asl_ssl_access_log are empty. Might it be to do with other iptables rules? I can see no traffic reaching 8443 in iptables (which incidentally is assigned the same destination IP as asl detected during install). Can see port 8445 rule accepts a small number of packets each time PSA:8443 is requested.

UPDATE: It is an iptables issue, had specific IP address tied to 8443, adjusted rule, restarted iptables and connected straight away...

Cannot access ASL GUI, thought it was iptables again, but no joy.

ps auxwww | grep tortixd shows nothing running.

/etc/init.d/tortixd status
tortixd dead but subsys locked

/etc/init.d/tortixd stop
rm /var/lock/subsys/tortixd
/etc/init.d/tortixd start && /etc/init.d/tortixd status
tortixd dead but subsys locked

Tried stopping tortixd, yum reinstall asl-web same result: tortixd dead but subsys locked. What else to try?

Grrrr!

Is there a tortix log somewhere? Database connection problem maybe? Is Mysqld running?

Everything else running fine and not found a single clue in any log relating to tortix

I'm now seeing an error when I try to restart tortixd...

Hey lucky you! You have an error to go on...

My /var/asl/etc/httpd/modsecurity.d/tortix_waf.conf on line 3 says "SecRuleEngine: on"

That's not the only problem.

de plesk file manger for users won't work any more.
If they wanna edit there files and save it then they got a forbidden page.

Permissions...

That 403 Forbidden might be coming from mod_security which is used by the ASL Plesk WAF. Any related events in the ASL web interface?