InfraFence on Plesk servers

The extension brings the agent's view into Plesk, for the administrator who manages the server from there. It has the same screens as the WHM plugin:

• Overview: protection status, agent version and last heartbeat, plan, AutoMode, a link to the server in the dashboard.
• Bans and the Allow list: unban an address on this server only, or allow it.
• Findings and Events: malware and file integrity findings, recent security events.
• Coexistence: the other security tools found on the server, and what InfraFence does next to each.
• Domains: the domains and document roots, with a malware scan of one site.

Like the WHM plugin, it stores no credentials: it asks the agent on the same server, through a local socket that only root can open. Only the Plesk administrator can open it, and each change is also written to Plesk's Action Log. The details are in Plesk extension and Hosting panels.

Planned requirements: Plesk Obsidian 18.0.60 or later on Linux, and a Basic, Pro or AutoMode plan, as for the WHM plugin. These can still change before the extension is released.

Install the agent like on any Linux server. On a Plesk server it adapts to the panel by itself:

• It recognises Plesk from /usr/local/psa and reads its version, and the dashboard shows it on the server's page.
• It never edits the web server configuration. Plesk owns the nginx and Apache configuration and may rewrite it, so the agent adds no ModSecurity rules and no user-agent blocks there. Bots you set to Block are banned at the firewall instead (Bots).
• It reads every site's traffic. The web firewall finds the per-domain access logs under /var/www/vhosts, with the domain of each log, and applies its rules to every request (Web firewall).
• It scans the sites for malware: httpdocs, subdomains and additional domains under /var/www/vhosts (Malware).
• It reports PHP, never changes it. The PHP versions Plesk installs are checked for risky settings, which are reported with the file they come from; on Plesk the agent changes no PHP configuration.
• It stops SSH brute force at the firewall, closes database ports open to the internet when you ask from the dashboard, and watches outbound traffic, DNS and file integrity, like on any Linux server.

The local side the extension will talk to is already there: on a Plesk server the agent turns on its panel socket by itself, so the extension will need no change to the agent.

The agent detects these tools read-only and keeps all its rules in its own chains (INFRAFENCE, INFRAFENCE-RULES, INFRAFENCE-PORTS, INFRAFENCE-EGRESS). It never edits, flushes or reorders a rule of theirs.

This is how the agent is designed; the full list is in Coexistence. It is not a certification by Plesk or any of these vendors.

1. Check the server first, read only: the installer's --dry-run downloads the agent, runs its check and prints what a real install would do. Nothing is installed or changed, and no token is needed.
2. In the dashboard, Servers › Add server creates an install token, valid for one hour.
3. Run the install command as root over SSH. The agent starts in a few seconds and the server appears in the dashboard.

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --dry-run

Plesk runs on many Linux distributions; the agent is tested on 15 of them before every release (Supported distributions). The full install guide is in Installation.