Removing/Modifying open_basedir In Plesk

Let’s think about a situation where you have a subdomain and you want it to be able to access files from the domain httpdocs directory. You cannot do that by default in Plesk, because of open_basedir. You can edit the httpd.include file in:

/var/www/vhosts/domain.com/conf/httpd.include

but that will only work until the next plesk restart or major modification.

But, the httpd.include file that manages a domain and subdomain explicitly says:

# ATTENTION!
# DO NOT MODIFY THIS FILE OR ANY PART OF IT. THIS CAN RESULT IN IMPROPER PLESK
# FUNCTIONING OR FAILURE, CAUSE DAMAGE AND LOSS OF DATA. IF YOU REQUIRE CUSTOM
# MODIFICATIONS TO BE APPLIED TO THE CONFIGURATION, PLEASE, PERFORM THEM IN THE
# FOLLOWING FILE(S):
# /var/www/vhosts/domain.com/conf/vhost.conf
# /var/www/vhosts/domain.com/subdomains/subdomain-name/conf/vhost.conf

So, disabling open_basedir is *usually* as simple as editing the vhost.conf file (or create it if it does not exist), and adding:

< Directory /var/www/vhosts/domain.com >
      php_admin_flag engine on 
      php_admin_value open_basedir none
< /Directory>

or if you want to add a new location to open_basedir instead of disabling open_basedir, you would have:

php_admin_value open_basedir "/var/www/vhosts/domain.com/httpdocs:/tmp:/new/path/comes/here"

If the client has both php4 and php5 things get a little more complicated, and you have to add the “IfModule” directive from the apache syntax, e.g.:

< Directory /var/www/vhosts/domain.com/subdomains/SUBDOMAIN/httpdocs>
< IfModule sapi_apache2.c>
      php_admin_flag engine on
      php_admin_flag safe_mode off
      php_admin_value open_basedir none
< /IfModule>
< IfModule mod_php5.c>
      php_admin_flag engine on
      php_admin_flag safe_mode off
      php_admin_value open_basedir none
< /IfModule>
      Options +Includes -ExecCGI
< /Directory>

or if you want to add a new location to open_basedir instead of disabling open_basedir, you would have:

php_admin_value open_basedir "/var/www/vhosts/domain.com/httpdocs:/tmp:[B]/new/path/comes/here[/B]"

then rerun the plesk websrvmng for that domain/subdomain:

/usr/local/psa/admin/sbin/websrvmng -u --vhost-name=subdomain.domain.com

and then restart apache. Things should work out fine after that.

$ apachectl restart

If you are not sure enough you can do this, just send us a ticket at support@solarvps.com and we will do it for you.

Remember that disabling open_basedir could result in a SECURITY BREACH, data loss, and so on, so it would be better to just ADD the paths you need to access via php to the open_basedir directive rather than disabling it.

Wayne Egerer

Leave a Reply