WebAdmin Security Tips
Recently we’ve had some reports of brute force attacks on LiteSpeed WebAdmin Console. So we thought it would be a good time to share our WebAdmin Security tips. Here are five things you can do to protect your WebAdmin Console and give yourself more peace of mind:
- Verify the Administrator Email
- Restrict access via the Allowed List
- Change the Listener Port
- Set a strong password
- Obtain a CA-signed SSL certificate
Let’s look at each of those steps in more detail.
Verify the Administrator Email
First thing’s first: it’s crucial that your Administrator email is configured correctly. This email address is used to keep you informed about important events such as:
- Failed login attempts to WebAdmin Console
- LiteSpeed Web Server crashes
- License expiration
To verify that your admin email address is correct, navigate to Configuration > Server > General > General Settings section and check the Administrator Email setting.
This field accepts a comma-delimited list, in case you want admin alerts to go to multiple people. For example:
email@example.com, firstname.lastname@example.org, email@example.com, firstname.lastname@example.org
If you update this field, click Save and then perform a Graceful Restart to apply your changes.
Restrict access via the Allowed List
One very effective way to avoid brute force login attacks is to prevent attackers from reaching your server login page in the first place. You can do this through the Allowed List.
Your own IP address should be added to that list first. If you have a fixed IP address, you can add it directly. If you don’t have a fixed IP address, we recommend that you set up VPN access with a fixed IP, and then add that fixed IP to the Allowed List.
To add IP addresses to the WebAdmin Console, navigate to Web Console > General > Security > Access Control. Click the Edit link and set the Denied List to
all. In the Allowed List field, type in a comma-separated list of the IP addresses allowed to access the WebAdmin Console. Click Save and then perform a Graceful Restart to apply your changes.
To test if the configuration is working as expected, try connecting to your WebAdmin Console from a public IP address that is not listed in the Allowed List. If access control is set up correctly, you will see a
403 forbidden error message.
Change the Listener Port
The standard way to access the WebAdmin Console for your domain is by visiting
https://example.com:7088 in a Plesk environment). This is the place that attackers would expect to find your LSWS admin. You can effectively “hide” your WebAdmin Console by changing the listener Port to a custom value.
Navigate to Web Console > Listeners > Action. Find the listener called
adminListener and edit it. Set Port to any unused number between
65535. Click Save.
Adjust your firewall settings to allow the new port, if necessary, and then perform a Graceful Restart to apply your changes.
TIP: You may choose to always keep the new port blocked at the firewall until you need it. You would have to update your firewall config every time you wanted to use the WebAdmin Console, but you would be guaranteed nobody else can access it in the meantime.
Set a strong password
We highly recommend that you set a strong password for the WebAdmin Console. You can use a password generator such as Avast to create a secure password. We recommend a password that is at least 8 characters long, contains mixed capitalization, numbers, and special characters.
If multiple admins need to access this server, it’s best to set up an account for each admin. Do not share passwords.
To update your password, navigate to Web Console > General > Security > WebAdmin Users, and edit your user. Enter your old WebAdmin Console password. Type or paste the new password into the New Password and Retype Password fields. Click Save to apply the changes.
Obtain a CA-Signed SSL certificate
Our final recommendation is to obtain an SSL certificate from a Certificate Authority (or CA), instead of using the default self-signed certificate. This will ensure that you always access the console using a secure HTTPS connection verified by an SSL certificate authority.
Obtain a certificate from the CA of your choice. They will provide the following three files:
Copy these files to the
Change the owner of the files to
lsadm, like so:
chown -R lsadm:lsadm /usr/local/lsws/admin/conf/cert/*
Return to the WebAdmin Console, navigate to the
adminListener listener, and click Edit. Set Secure to
Yes. Navigate to SSL and click Edit. Set the following:
- Private Key =
- Certificate =
- Chained Certificate =
- CA Certificate Path =
- CA Certificate File =
Click Save and then perform a Graceful Restart to apply your changes.
We hope that implementing these tips will give you some peace of mind. If you’d like to see these suggestions demonstrated, have a look at our recent YouTube video:
For more information about LiteSpeed WebAdmin Console, please see the documentation.