Scripting Options

To isolate sites in shared hosting environments, you can apply a server-wide security policy. The policy enforces execution of PHP scripts through FastCGI handlers and prohibits Panel users from switching on insecure hosting features and options.

You can set the policy to prohibit the Panel users from changing the following hosting options:

• PHP support
• PHP handler type (Apache module, ISAPI, FastCGI, CGI)
• PHP safe mode
• Python support
• Perl support
• FastCGI support
• Miva support
• SSI support
• SSL support
• Access to the server console over SSH or Remote Desktop
• ASP support
• ASP.NET support (applicable only to Windows-based servers)
• ColdFusion support
• Additional write/modify permissions (applicable only to Windows-based servers)
• Dedicated IIS application pool (applicable only to Windows-based servers)

To set up and apply the policy:

1. Modify the file site_isolation_settings.ini located in /usr/local/psa/admin/conf/ directory on Linux systems, and %plesk_dir%\admin\conf\ on Windows systems, where %plesk_dir% is an environment variable for the Parallels Plesk Panel installation directory on Windows systems.

   The file contains the following predefined entries:

   ;php = any

   ;php_handler_type = fastcgi

   ;python = off

   ;perl = off

   ;fastcgi = any

   ;miva = off

   ;ssi = any

   ;ssl = on

   ;shell = /usr/local/psa/bin/chrootsh

   ;asp = any

   ;php_safe_mode = on

   ;coldfusion = off

   On means that an option should be switched on, off means switched off, and any means that an option is not restricted.

   You can uncomment the corresponding lines by removing the semicolons (;) and use the predefined values, or use custom settings for the policy. The policy settings can take the following values:

   php = on | off | any

   php_handler_type = (Unix: module | Windows: isapi) | fastcgi | cgi | any

   python = on | off | any

   perl = on | off | any

   fastcgi = on | off | any

   miva = on | off | any

   ssi = on | off | any

   ssl = on | off | any

   shell = (Unix: <string> Windows: on | off) | any

   asp = on | off | any

   asp_dot_net = on | off | any

   php_safe_mode = on | off | any

   coldfusion = on | off | any

   write_modify = on | off | any

   iis_app_pool = on | off | any

2. To ensure that your policy settings are applied to newly created accounts and hosting service subscriptions, set the following settings when creating service plans:
   • In reseller plan properties, click the Permissions tab, clear the checkbox Setup of potentially insecure hosting web scripting options that override provider's policy.
   • In hosting plan properties, click the Permissions tab, and clear the checkbox Hosting settings management. If you decide to allow your users to manage hosting settings, then clear the checkbox Setup of potentially insecure hosting web scripting options that override provider's policy. Alternately, you can apply the policy and override any previously allowed permissions for hosting settings management by clicking the Hosting Parameters tab, and then clicking the link apply secure settings preset.

If the Hosting settings management permission is granted, but the permission Setup of potentially insecure hosting web scripting options that override provider's policy is not, the users will be able to change only the hosting options that are not restricted by the server-wide security policy. If these both permissions are granted, the users will be able to change all available hosting options, regardless of the security policy. When a Panel user, who is allowed to override the security policy, changes through the Control Panel an option restricted by the policy, the Panel warns them about that and asks to confirm the operation.

If you want to allow a specific user to override the policy, go to Subscriptions > subscription name > Customize > Permissions tab, and select the option Setup of potentially insecure hosting web scripting options that override provider's policy.

If you want to allow all users subscribed to a service plan to override the policy, go to Service Plans > plan name > Permissions tab, or Service Plans > Reseller Plans > plan name > Permissions tab, and select the option Setup of potentially insecure hosting web scripting options that override provider's policy.

Please send us your feedback on this help page.