{"id":2125,"date":"2020-08-27T14:49:45","date_gmt":"2020-08-27T11:49:45","guid":{"rendered":"https:\/\/upcloud.com\/global\/us\/resources\/tutorials\/install-openlitespeed-fast-secure-web-server\/"},"modified":"2020-08-27T14:49:45","modified_gmt":"2020-08-27T11:49:45","slug":"install-openlitespeed-fast-secure-web-server","status":"publish","type":"tutorial","link":"https:\/\/upcloud.com\/global\/resources\/tutorials\/install-openlitespeed-fast-secure-web-server\/","title":{"rendered":"How to install OpenLiteSpeed fast and secure web server"},"content":{"rendered":"\n

OpenLiteSpeed is an easy-to-use, open-source web server<\/a>. It offers unbeatable features and performance to your sites along with top-notch security.<\/p>\n\n\n\n

The server understands all the Apache rewrite rules and has intelligent cache acceleration features that let you implement the fastest caching on your server. Apart from all these, you get to install a customized PHP processor that is optimized for the OpenLiteSpeed server.<\/p>\n\n\n\n

\n
Test hosting on UpCloud!<\/a><\/div>\n<\/div>\n\n\n\n

In this tutorial, we will install the OpenLiteSpeed server on a simple cloud server running Ubuntu 20.04 or CentOS 8.<\/p>\n\n\n\n

    \n
  1. Deploying Cloud Server<\/li>\n\n\n\n
  2. Configuring firewall rules<\/li>\n\n\n\n
  3. Installing OpenLiteSpeed server<\/li>\n\n\n\n
  4. Setting the admin password<\/li>\n\n\n\n
  5. Configuring the domain name<\/li>\n\n\n\n
  6. Obtaining SSL certificates<\/li>\n\n\n\n
  7. Enabling HTTPS for the admin panel<\/li>\n\n\n\n
  8. Enabling HTTPS on the frontend<\/li>\n<\/ol>\n\n\n\n

    1. Deploying Cloud Server<\/h2>\n\n\n\n

    Go ahead and deploy a new UpCloud server with Ubuntu 20.04 or CentOS 8 by logging in to your UpCloud Control Panel<\/a> and clicking Deploy server.<\/b> If you are new to UpCloud, you can get started with the free trial by signing up.<\/p>\n\n\n\n

    Once you\u2019ve deployed a cloud server, connect to your cloud server<\/a> using your preferred SSH client.<\/p>\n\n\n\n

    2. Configuring firewall rules<\/h2>\n\n\n\n

    OpenLiteSpeed uses a couple of non-standard ports which means you need to accept incoming traffic to port 8088 and port 7080 to be able to access the admin panel and the default page of the server.<\/p>\n\n\n\n

    If you are running Ubuntu<\/strong>, you won\u2019t have a firewall enabled by default but you should set up one for security purposes.<\/p>\n\n\n\n

    Check that the ufw firewall is installed with the command below.<\/p>\n\n\n\n

    sudo apt install ufw<\/pre>\n\n\n\n
    Then allow the following ports, set default rule to reject other connections and enable the firewall.<\/p>\n\n\n\n
    sudo ufw allow 22,53,80,443,7080,8088\/tcp\nsudo ufw default reject\nsudo ufw enable<\/pre>\n\n\n\n
    CentOS<\/strong> servers come with firewalld<\/em> enabled out of the box which requires configuration before OpenLiteSpeed can be installed.<\/p>\n\n\n\n
    Allow HTTP and HTTPS access as well as the custom ports used by OpenLiteSpeed with the commands below. Then reload the firewall rules to enable the changes.<\/p>\n\n\n\n
    sudo firewall-cmd --add-service={http,https} --permanent\nsudo firewall-cmd --add-port={8088\/tcp,7080\/tcp} --permanent\nsudo firewall-cmd --reload<\/pre>\n\n\n\n
    Once you\u2019ve configured your firewall to allow the necessary ports and services, continue on with the OpenLiteSpeed install itself.<\/p>\n\n\n\n
    3. Installing OpenLiteSpeed server<\/h2>\n\n\n\n
    Since the OpenLiteSpeed project maintains repositories for both CentOS and Ubuntu, we need not compile it ourselves. Simply add the repository on the server using the commands below.<\/p>\n\n\n\n
    On Ubuntu<\/strong>, use the script provided by OpenLiteSpeed to add the correct repository to your OS version. Afterwards, update the repo lists.<\/p>\n\n\n\n
    wget -O - http:\/\/rpms.litespeedtech.com\/debian\/enable_lst_debian_repo.sh | sudo bash\nsudo apt update<\/pre>\n\n\n\n
    On CentOS<\/strong>, download the repository configuration file. Also, install the extra packages repository and update the repo lists.<\/p>\n\n\n\n
    sudo rpm -Uvh http:\/\/rpms.litespeedtech.com\/centos\/litespeed-repo-1.1-1.el8.noarch.rpm\nsudo dnf install epel-release\nsudo dnf update<\/pre>\n\n\n\n
    Once the repository has been added, the OpenLitespeed server is available for installation using the commands below. In OpenLiteSpeed, we have customized PHP processors. For this tutorial, we will use the latest version of it \u2013 lsphp74<\/p>\n\n\n\n
    For Ubuntu<\/strong><\/p>\n\n\n\n
    sudo apt install openlitespeed lsphp74<\/pre>\n\n\n\n
    For CentOS<\/strong><\/p>\n\n\n\n
    sudo dnf install openlitespeed lsphp74<\/pre>\n\n\n\n
    We have then installed OpenLiteSpeed and a PHP processor for that. However, we still need to let our server know which PHP processor it should be utilized for normal operations. To do that, create a soft link to the PHP processor we have just installed.<\/p>\n\n\n\n
    sudo ln -sf \/usr\/local\/lsws\/lsphp74\/bin\/lsphp \/usr\/local\/lsws\/fcgi-bin\/lsphp5<\/pre>\n\n\n\n
    That\u2019s it! OpenLiteSpeed should now be up and running. However, there are still a few things we need to configure to secure the site.<\/p>\n\n\n\n
    4. Setting admin password<\/h2>\n\n\n\n
    Just like any other web hosting control panel, the OpenLiteSpeed server has an admin dashboard. To access it securely, create an admin account and set a password using the following command.<\/p>\n\n\n\n
    sudo \/usr\/local\/lsws\/admin\/misc\/admpass.sh<\/pre>\n\n\n\n
    Once you run the above script, you will be prompted to input the admin username. If you do not type in a username, the system will use the default admin<\/em> as a username.<\/p>\n\n\n\n
    A password follows the username input. It will then ask you to confirm the password by retyping it. Retype the password and hit enter.<\/p>\n\n\n\n
    Voila. If the passwords match, you\u2019ll get a confirmation like the output below.<\/p>\n\n\n\n
    Administrator's username\/password is updated successfully!<\/pre>\n\n\n\n
    At this stage, you can visit your server\u2019s default frontend and the admin control panel in your web browser going to the public IP address of your server followed by the port number.<\/p>\n\n\n\n
    The Frontend (default page)<\/p>\n\n\n\n
    http:\/\/<your-server-public-IP>:8088<\/p>\n\n\n\n
    \"OpenLiteSpeed<\/figure>\n\n\n\n
    The backend (admin console)<\/p>\n\n\n\n
    https:\/\/<your-server-public-IP>:7080<\/p>\n\n\n\n
    Log in to the Admin panel of your OpenLiteSpeed server. In the login screen, simply enter the username and password you created in the previous step and hit the Login<\/em> button.<\/p>\n\n\n\n
    \"Logging<\/figure>\n\n\n\n
    You\u2019ll then be greeted by the OpenLiteSpeed dashboard view.<\/p>\n\n\n\n
    \"OpenLiteSpeed<\/figure>\n\n\n\n
    Once logged into the admin dashboard, continue to the next section for further configurations.<\/p>\n\n\n\n
    5. Configuring the domain name<\/h2>\n\n\n\n
    At this stage, your server resolves and serves the site for any domain that has your server\u2019s IP in its DNS records. You may want your server to resolve only for your domain and return a 404 error page for any other domain.<\/p>\n\n\n\n
    To accomplish this, navigate to the Listeners<\/em> in your left sidebar menu and click the View<\/em> icon on the right under Actions<\/em>.<\/p>\n\n\n\n
    \"Summary<\/figure>\n\n\n\n
    On the default listener\u2019s configuration, open the Example Virtual Host Mapping<\/em> settings by clicking the Edit<\/em> button.<\/p>\n\n\n\n
    \"OpenLiteSpeed<\/figure>\n\n\n\n
    In the domains field, type your domain name and click on the Save<\/em> icon at the top right corner.<\/p>\n\n\n\n
    \"Editing<\/figure>\n\n\n\n
    Once you hit the save button, the OpenLiteSpeed server will notify you to gracefully restart your server to apply the changes. Click the green Graceful Restart<\/em> button to enable the new settings.<\/p>\n\n\n\n
    \"Restarting<\/figure>\n\n\n\n
    At this point, we have installed the OpenLiteSpeed server on a cloud server. But the site is still served at port 8088 and uses simple HTTP. Continue on with obtaining SSL certificates and enabling HTTPS.<\/p>\n\n\n\n
    6. Obtaining SSL certificates<\/h2>\n\n\n\n
    SSL certificates allow your website to the authenticated by a known trusted Certificate Authority such as Let\u2019s Encrypt. They provide free certificates via an easy-to-use client called Certbot.<\/p>\n\n\n\n
    Note that obtaining certificates requires a valid domain name. You can find out more about how to create domain name records<\/a> in its guide.<\/p>\n\n\n\n
    To obtain trusted certificates, install the Let\u2019s Encrypt Certbot using one of the following commands depending on your operating system.<\/p>\n\n\n\n
    Ubuntu<\/strong><\/p>\n\n\n\n
    sudo apt install certbot<\/pre>\n\n\n\n
    CentOS<\/strong><\/p>\n\n\n\n
    sudo dnf install certbot<\/pre>\n\n\n\n
    Then obtain certificates using the command below. Replace the <your-domain><\/span> with a valid domain name pointing to your OpenLiteSpeed server.<\/p>\n\n\n\n
    sudo certbot certonly --standalone -d <your-domain><\/span><\/pre>\n\n\n\n
    The command starts an interactive installation script which will ask a few questions to help you set up the certificate.<\/p>\n\n\n\n
      \n
    1. On the first installation on any specific host, you will need to enter a contact email.<\/li>\n\n\n\n
    2. Next, go through the Let\u2019s Encrypt Terms of Service and select Agree if you accept the terms and wish to use the service.<\/li>\n\n\n\n
    3. Then, select whether you want to share your email address with the Electronic Frontier Foundation, a founding partner of Let\u2019s Encrypt and the non-profit developers of Certbot.<\/li>\n<\/ol>\n\n\n\n
      After you\u2019ve entered all the necessary details, Certbot will perform several challenges to confirm the authority for the domain. If Certbot is successful, you\u2019ll see an output similar to the example below.<\/p>\n\n\n\n
      IMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at:\n   \/etc\/letsencrypt\/live\/openlitespeed.example.com\/fullchain.pem\n   Your key file has been saved at:\n   \/etc\/letsencrypt\/live\/openlitespeed.example.com\/privkey.pem\n   Your cert will expire on 2020-11-24. To obtain a new or tweaked\n   version of this certificate in the future, simply run certbot\n   again. To non-interactively renew *all* of your certificates, run\n   \"certbot renew\"\n<\/pre>\n\n\n\n
      Now that we have valid certificates, we can set the admin panel and frontend to use them.<\/p>\n\n\n\n
      7. Enabling HTTPS for the admin panel<\/h2>\n\n\n\n
      Once you have obtained trusted SSL certificates from Let\u2019s Encrypt, you can use them to enable HTTPS access to the admin dashboard.<\/p>\n\n\n\n
      First, go to the WebAdmin Settings and Listeners<\/em>, then click the View<\/em> icon under Actions<\/em>.<\/p>\n\n\n\n
      \"Summary<\/figure>\n\n\n\n
      Then, go to the SSL tab while still in the admin listener settings and open the SSL Private Key & Certificate<\/em> section by clicking the edit icon on the same row.<\/p>\n\n\n\n
      \"OpenLiteSpeed<\/figure>\n\n\n\n
      Let\u2019s Encrypt saved the newly obtained certificates in \/etc\/letsencrypt\/live\/<your-domain>\/<\/tt> where <your-domain><\/tt> is the domain name you used to obtain the certificates. Set the key and certificate files as follows. Replace <your-domain><\/tt><\/span> on each row with your OpenLiteSpeed server\u2019s domain.<\/p>\n\n\n\n
        \n
      • Private Key File: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/privkey.pem<\/tt><\/li>\n\n\n\n
      • Certificate File: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/fullchain.pem<\/tt><\/li>\n\n\n\n
      • Chained Certificate: Yes<\/tt><\/li>\n\n\n\n
      • CA Certificate Path: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/fullchain.pem<\/tt><\/li>\n\n\n\n
      • CA Certificate File: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/fullchain.pem<\/tt><\/li>\n<\/ul>\n\n\n\n
        Once all set, save the new settings by clicking the Save<\/em> icon on the right.<\/p>\n\n\n\n
        \"Editing<\/figure>\n\n\n\n
        With the admin panel settings configured, apply the changes by clicking the Graceful Restart<\/em> button.<\/p>\n\n\n\n
        Afterwards, confirm that the changes were successfully applied by re-opening the admin panel domain in a new browser tab.<\/p>\n\n\n\n
        https:\/\/<your-domain>:7080<\/p>\n\n\n\n
        Your web browser should then show the appropriate icon to indicate that the website is using valid certificates and the connection is secure.<\/p>\n\n\n\n
        8. Enabling HTTPS at the frontend<\/h2>\n\n\n\n
        By default, the OpenLiteSpeed front listens to port 8088. Since we\u2019ve got valid SSL certificates, we can change it to use port 443 instead which is the default port for HTTPS requests.<\/p>\n\n\n\n
        To do this, log in to your OpenLiteSpeed admin panel and click on Listeners<\/em> from the left sidebar menu. Then on the right under Actions<\/em>, click on the View<\/em> icon.<\/p>\n\n\n\n
        \"Summary<\/figure>\n\n\n\n
        It will land you on the page where you can further configure the listener with your custom values. In the next default listener general settings, click the Edit<\/em> icon on the Address Settings<\/em>.<\/p>\n\n\n\n
        \"OpenLiteSpeed<\/figure>\n\n\n\n
        In the default listener address settings, make the following two changes:<\/p>\n\n\n\n
          \n
        • Replace the port 8088 with 443<\/li>\n\n\n\n
        • Select Secure: Yes<\/em><\/li>\n<\/ul>\n\n\n\n
          Then click the Save<\/em> icon on the right of the Address Settings<\/em> row.<\/p>\n\n\n\n
          \"Editing<\/figure>\n\n\n\n
          Next, go to the SSL<\/em> tab in the default listener settings and open the SSL Private Key & Certificate<\/em> configuration by clicking the Edit<\/em> icon on the right.<\/p>\n\n\n\n
          \"OpenLiteSpeed<\/figure>\n\n\n\n
          Use the same certificates saved in \/etc\/letsencrypt\/live\/<your-domain>\/<\/tt> by setting the key and certificate files as follows. Replace <your-domain><\/tt><\/span> on each row with your OpenLiteSpeed server\u2019s domain.<\/p>\n\n\n\n
            \n
          • Private Key File: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/privkey.pem<\/tt><\/li>\n\n\n\n
          • Certificate File: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/fullchain.pem<\/tt><\/li>\n\n\n\n
          • Chained Certificate: Yes<\/tt><\/li>\n\n\n\n
          • CA Certificate Path: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/fullchain.pem<\/tt><\/li>\n\n\n\n
          • CA Certificate File: \/etc\/letsencrypt\/live\/<your-domain><\/span>\/fullchain.pem<\/tt><\/li>\n<\/ul>\n\n\n\n
            \"Editing<\/figure>\n\n\n\n
            When you are all set, click the Save<\/em> icon on the right of the SSL Private Key & Certificate<\/em> row to store the new settings.<\/p>\n\n\n\n
            Again after making changes to the server configuration in the admin panel, you need to restart the OpenLiteSpeed server to reflect the change live. Click the Graceful Restart<\/em> icon to apply the changes.<\/p>\n\n\n\n
            If everything was done correctly, you should now be able to open your OpenLiteSpeed frontend by going to your domain without specifying a port and be redirected to the secure HTTPS version.<\/p>\n\n\n\n
            Conclusions<\/h2>\n\n\n\n
            OpenLiteSpeed is one of the fastest web servers available for Linux servers. On any hardware, the performance of the OpenLitespeed server is unbeatable. You are then ready to start hosting websites and here are a few tidbits to help you get started:<\/p>\n\n\n\n
              \n
            • OpenLiteSpeed server is installed in \/usr\/local\/lsws<\/tt> that is also set as the $SERVER_ROOT<\/tt> environmental variable<\/li>\n\n\n\n
            • The server has a default virtual host block \u2013 For example<\/i>. The document root of this virtual host is \/usr\/local\/lsws\/Example\/html\/<\/tt><\/li>\n\n\n\n
            • You can add more virtual hosts to accommodate additional domains on this server. Note that you will need to create the virtual host directories manually before you add new virtual hosts, e.g.
              sudo mkdir -p \/usr\/local\/lsws\/NewSite\/html\/<\/tt><\/li>\n<\/ul>\n","protected":false},"author":47,"featured_media":16624,"comment_status":"open","ping_status":"closed","template":"","community-category":[223,250],"class_list":["post-2125","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/2125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/types\/tutorial"}],"author":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/users\/47"}],"replies":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/comments?post=2125"}],"version-history":[{"count":0,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/2125\/revisions"}],"wp:attachment":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/media?parent=2125"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/community-category?post=2125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}