Manually deploying Imunify360 hardened-php on Ubuntu with Plesk

Issue

There might be some issue with Hardened-PHP on Ubuntu with Plesk. This mini guide provides instructions on how to manually address common issues related to Hardened-PHP feature on Ubuntu 20.04 or 22.04 distributives, and registering Plesk PHP handlers for alt-php packages provided.

Environment

• Imunify360
• Ubuntu 20.04/22.04
• Plesk

Installing hardened-php on Imunify360

Imunify360 agent provides CLI to Install the hardened-php feature:

imunify360-agent features install hardened-php
imunify360-agent features status hardened-php

This will install alt-php metapackage and should register handlers for the supported environment. The alt packages availability in the Imunify360 repositories can be checked with:

apt list | grep alt-php

Whether packages are installed can seen from:

dpkg -l | grep alt-php

And whether the PHP handlers were registered is evident in the below's commands output:

plesk bin php_handler --reread
plesk bin php_handler --list | grep alt-php

As of May 2023, the issue ALTPHP-1433 can be reproduced on Ubuntu 20.04-22.04, no handlers are registered after Hardened PHP feature installation/meta package scripts execution:

plesk bin php_handler --list | grep alt-php | wc -l
0

1. Workaround on Ubuntu 20.04. Installing alt-php-config 

Install the alt-php-config package, run the alt-php-panel-configuration script:

apt install alt-php-config
python3 /opt/alt/alt-php-config/alt-php-panel-configuration.py --mode=install

2. Workaround on Ubuntu 22.04. Registering Handlers manually

As of now there is no alt-php-config package available in Ubuntu 22.04 repos, although registering handlers manually is an option.

For CGI handler:

plesk bin php_handler --add -displayname "HardenedPHP 74 CGI (manual)" -path /opt/alt/php74/usr/bin/php-cgi -clipath /opt/alt/php74/usr/bin/php -phpini "/opt/alt/php74/etc/php.ini" -type cgi -id alt-php74cgi

For FPM handler:

plesk bin php_handler --add -displayname "HardenedPHP 74 FPM (manual)" -path /opt/alt/php74/usr/sbin/php-fpm -clipath /opt/alt/php74/usr/bin/php -phpini "/opt/alt/php74/etc/php.ini" -type fpm -id alt-php74fpm -service alt-php74-fpm -poold /etc/php/7.4/fpm/pool.d

As well as it is posisble to manually deploy this package:

echo "deb [arch=amd64] https://repo.imunify360.cloudlinux.com/imunify360/ubuntu/20.04/ focal main" | sudo tee /etc/apt/sources.list.d/imunify360-2004.list
apt update
apt download alt-php-config
apt install alt-php-config
mv /etc/apt/sources.list.d/imunify360-2004.list{,.old}
apt update

The above script enumerates alt PHP paths and execute Plesk commands to register PHP handlers, so should not be an issue, although adding repos might be, so at leas worth disabling those afterwards to avoid conflict when repository for 22.04 will be released.

Domain settings can be altered for example as per:

plesk bin domain --update-php-settings site1.local.loc -php_handler_id alt-php74-fpm

3. Uninstaling alt-php group

Before uninstalling alt-php meta package (hardened php feature) it is required to check whether alt-php handlers are used

plesk db "SELECT d.name, h.php_handler_id FROM domains d JOIN hosting h ON h.dom_id = d.id WHERE h.php_handler_id LIKE 'alt-php%'"

And proceed with:

python3 /opt/alt/alt-php-config/alt-php-panel-configuration.py --mode=uninstall

Useful Links

How to add a custom PHP version in Plesk for Linux?