Using Plesk for webhosting on Ubuntu - Security risk or reasonably safe?

Question

Sorry for this newb-question I'm pretty clueless about Plesk, only have limited debian (without Plesk) experience. If the question is too dumb just telling me how to ask a smarter one or what kind of info I should read first to improve the question would be appreciated as well.

I want to offer a program for download on my website hosted on an Ubuntu 8.04.4 VPS using Plesk 9.3.0 for web-hosting. I have limited the ssh-access to the server via key only.

1. When setting up the webhosting with Plesk it created an FTP-login & user is that a potential security risk that could bypass the key-only access?

2. I think Plesk itself (even without the ftp-user-account) through it's web-interface could be a risk is that correct or are my concerns exaggerated?

Would you say this solution makes a difference if I'm just using it for the next two weeks and then change servers to a system where I know more about security. 3.In other words is one less likely to get hacked within the first two weeks of having a new site up and running than in week 14&15?

(due to occurring in less search results in the beginning perhaps, or for whatever reason... )

Answer 1

Any code you run on the server could have vulnerabilities, which may or may not have been discovered yet. By running a well known service with a well known footprint (:8443), you're easier to scan for should a vulnerability come to light.

That being said, and please note these answers are from experience with Plesk 9 on CentOS/RHEL not Debian/Ubuntu,

1. It's unlikely to cause you an issue. Plesk creates FTP users with the default shell /bin/false which doesn't allow shell login.

2. Plesk seems to be pretty good. I've not personally seen a server compromised via Plesk and they update regularly. Firewall off :8443 to only allow you access and you should be fine.

3. Yes. In the first two weeks your site is just resolving DNS and trying to crawl its way into Google. No one is likely to be targetting your website except automatic crawlers. But bear in mind that Plesk will probably setup permissions etc. better than you if you're new to this.

Most websites get compromised because the permissions allow anyone/apache to write to the web directory. If you give apache w permission to a directory compromised code can create new PHP files in there and then execute them simply by going to the browser. Plesk has the default user/group/permissions of ftpuser/ftpgroup/rwxr-xr-x for directories, don't go changing them to 777 or apache:apache and you should be fine. Good luck.