Plesk websites return Apache error 403 on May 26, 2023: client denied by server

[mahesh]

Symptoms
Starting from May 26, 2023 Plesk domains are not accessible in a browser with either the 403 Forbidden error or with the 123 Apache Test Page.

Cause
With the update of the aum package provided by Atomicorp, the Apache module mod_evasive was installed, and this module false-positively blacklisted the server's IP address - errors like below are found in the log file /var/log/messages or in the Apache log:

Code Select Expand

mod_evasive[177717]: Blacklisting address 192.0.2.2: possible DoS attack
The issue is resolved in the further update of the aum package 6.0.48-29386.

Resolution
1.Connect to the server using SSH.

2.Update aum to the latest version and remove the Apache module mod_evasive:

Code Select Expand

#aum -uf ; yum -y remove mod_evasive ; aum -u
3.Go to Tools & Settings > Web Application Firewall > Settings, switch to other ruleset, press Apply, switch back to initial ruleset and press Apply.