OpenLiteSpeed

In the Azure Portal, open the Marketplace, search for OpenLiteSpeed, select the SecureAnyCloud publisher entry and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range. Also allow TCP 7080 from your management IP range for the WebAdmin console. Once you have configured the site you want to serve, open TCP 80 and 443 (and/or 8088) to your visitor networks.

Restrict TCP 7080 to trusted management addresses only. It is the full administrative console for the server.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

RG="openlitespeed-prod" LOCATION="eastus" VM_NAME="openlitespeed-01" ADMIN_USER="azureuser" GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-sac/providers/Microsoft.Compute/galleries/sacGallery/images/openlitespeed-ubuntu-24-04/versions/<version>" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name openlitespeed-vnet --address-prefix 10.60.0.0/16 \
  --subnet-name default --subnet-prefix 10.60.1.0/24 az vm create \
  --resource-group "$RG" \
  --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username "$ADMIN_USER" \
  --ssh-key-values "$SSH_KEY" \
  --vnet-name openlitespeed-vnet --subnet default \
  --public-ip-sku Standard

Open the WebAdmin console (TCP 7080) and your site ports (TCP 80 / 443) to the appropriate source ranges. This example opens the console to your management range:

az network nsg rule create \
  --resource-group "$RG" \
  --nsg-name "${VM_NAME}NSG" \
  --name allow-webadmin \
  --priority 1010 --access Allow --protocol Tcp --direction Inbound \
  --destination-port-ranges 7080 --source-address-prefixes "<your-mgmt-cidr>"

The WebAdmin console ships with no known password. On first boot, the image generates a strong random password for the admin user and writes it to /root/openlitespeed-credentials.txt. Read the file over SSH:

ssh azureuser@<vm-ip> "sudo cat /root/openlitespeed-credentials.txt"

The output lists the per-VM credentials, for example:

ADMIN_USER=admin ADMIN_PASSWORD=<a strong random per-VM password> WEBADMIN_PORT=7080 WEBADMIN_URL=https://<vm-ip>:7080/ HTTP_PORT=8088 HTTP_URL=http://<vm-ip>:8088/

Keep this password safe. After your first sign-in, you can change it from the WebAdmin console.

Browse to https://<vm-ip>:7080/ and accept the self-signed certificate warning. The certificate is regenerated uniquely on each VM at first boot. Sign in as admin with the password from Step 3.

After you sign in, you land on the dashboard. It shows the running server version, uptime, real-time request and connection statistics, and the count of active listeners and virtual hosts.

The WebAdmin console throttles brute-force login attempts: five failed sign-ins block the source IP for fifteen minutes. If you are locked out, wait for the block to clear or connect from a different address.

SSH into the VM and confirm that the lshttpd service is active and listening on the default site port (8088) and the WebAdmin port (7080):

sudo systemctl is-active lshttpd.service
sudo ss -tln | grep -E ':8088|:7080'

Request the default site over HTTP on port 8088, and confirm that the WebAdmin login page answers over HTTPS on port 7080:

curl -s -o /dev/null -w 'Default site (:8088): HTTP %{http_code}\n' http://127.0.0.1:8088/
curl -ks -o /dev/null -w 'WebAdmin login page (:7080): HTTP %{http_code}\n' https://127.0.0.1:7080/login.php

The WebAdmin console authenticates through a PHP form login. Confirm that the per-VM password in the credentials file signs in successfully.

A correct sign-in answers HTTP 302, a redirect into the console. A wrong password is rejected with HTTP 200 and an "Invalid credentials" message:

ADMIN_PASS=$(sudo grep '^ADMIN_PASSWORD=' /root/openlitespeed-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
curl -ks -c "$CJ" https://127.0.0.1:7080/login.php >/dev/null
curl -ks -o /dev/null -w 'WebAdmin sign in: HTTP %{http_code} (302 = signed in)\n' \
  -c "$CJ" -b "$CJ" \
  --data-urlencode userid=admin --data-urlencode "pass=$ADMIN_PASS" \
  https://127.0.0.1:7080/login.php rm -f "$CJ"

You administer OpenLiteSpeed entirely from the WebAdmin console. Two areas cover most day-to-day work.

Listeners define the ports and protocols the server accepts connections on. The image ships a single Default listener bound to TCP 8088. To serve production traffic, add listeners on TCP 80 and TCP 443 (with a certificate) from the Listeners page.

Virtual Hosts map a site's document root, index files, PHP handler, rewrite rules and security to a name. The image ships the sample Example virtual host so that PHP works out of the box. Add your own virtual host and map it to a listener to serve your site.

After you change the configuration, click the graceful restart control, the circular arrow next to the server status. The running server then picks up the new configuration without dropping live connections.

Check the installed OpenLiteSpeed version and the packages that were installed from the apt repository:

VER=$(sudo /usr/local/lsws/bin/lshttpd -v 2>&1)
echo "$VER" | grep -i litespeed dpkg-query -W -f='${Package} ${Version}\n' openlitespeed lsphp83

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for OpenLiteSpeed. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group as described in the prerequisites. Leave the root volume at the default size or larger.

Select Launch instance. First boot takes approximately one minute after the instance state becomes Running. The first-boot service generates the WebAdmin password, regenerates the console certificate and starts the server.

The command below launches an instance from the SecureAnyCloud OpenLiteSpeed Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens the ports described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openlitespeed-01}]'

On first boot, the image generates a strong random password for the admin user and writes it to /root/openlitespeed-credentials.txt. Read the file over SSH:

ssh ubuntu@<public-ip> "sudo cat /root/openlitespeed-credentials.txt"

The output lists the per-instance credentials, for example:

ADMIN_USER=admin ADMIN_PASSWORD=<a strong random per instance password> WEBADMIN_PORT=7080 WEBADMIN_URL=https://<public-ip>:7080/ HTTP_PORT=8088 HTTP_URL=http://<public-ip>:8088/

Keep this password safe. After your first sign-in, you can change it from the WebAdmin console.

Browse to https://<public-ip>:7080/ and accept the self-signed certificate warning. The certificate is regenerated uniquely on every instance at first boot, so your browser cannot vouch for it. Sign in as admin with the password from Step 3.

After you sign in, you land on the dashboard. It shows the running server version, uptime, real-time request and connection statistics, and the count of active listeners and virtual hosts.

The WebAdmin console throttles brute-force sign-in attempts: five failed attempts block the source IP for fifteen minutes. If you are locked out, wait for the block to clear or connect from a different address.

SSH into the instance and confirm that the lshttpd service is active, enabled at boot, and listening on the default site port (8088) and the WebAdmin port (7080):

sudo systemctl is-active lshttpd.service
sudo systemctl is-enabled lshttpd.service
sudo ss -tln | grep -E ':8088|:7080'

Expected output:

active enabled LISTEN 0 4096 0.0.0.0:7080 0.0.0.0:* LISTEN 0 4096 0.0.0.0:8088 0.0.0.0:*

Request the default site over HTTP on port 8088, and confirm that the WebAdmin login page answers over HTTPS on port 7080:

curl -s -o /dev/null -w 'Default site (:8088): HTTP %{http_code}\n' http://127.0.0.1:8088/
curl -ks -o /dev/null -w 'WebAdmin login page (:7080): HTTP %{http_code}\n' https://127.0.0.1:7080/login.php

Expected output:

Default site (:8088): HTTP 200 WebAdmin login page (:7080): HTTP 200

The WebAdmin console authenticates through a PHP form login. Confirm that the per-instance password in the credentials file signs in successfully.

A correct sign-in answers HTTP 302, a redirect into the console. A wrong password is rejected with HTTP 200 and an "Invalid credentials" message. The command reads the password straight into a shell variable and never prints it:

ADMIN_PASS=$(sudo grep '^ADMIN_PASSWORD=' /root/openlitespeed-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
curl -ks -c "$CJ" https://127.0.0.1:7080/login.php >/dev/null
curl -ks -o /dev/null -w 'WebAdmin sign in: HTTP %{http_code} (302 = signed in)\n' \
  -c "$CJ" -b "$CJ" \
  --data-urlencode userid=admin --data-urlencode "pass=$ADMIN_PASS" \
  https://127.0.0.1:7080/login.php rm -f "$CJ"

Expected output:

WebAdmin sign in: HTTP 302 (302 = signed in)

The whole OpenLiteSpeed server root lives on its own EBS volume mounted at /usr/local/lsws. This includes virtual host document roots, configuration, certificates and logs. You can grow web content storage without touching the operating system disk:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /usr/local/lsws df -h /usr/local/lsws | tail -1

Expected output:

/dev/nvme1n1 /usr/local/lsws ext4 19.5G /dev/nvme1n1 20G 87M 19G 1% /usr/local/lsws

To grow it, modify the EBS volume in the AWS console, then run sudo resize2fs /dev/nvme1n1 on the instance.

You administer OpenLiteSpeed entirely from the WebAdmin console. Two areas cover most day-to-day work.

Listeners define the ports and protocols the server accepts connections on. The image ships a single Default listener bound to TCP 8088. To serve production traffic, add listeners on TCP 80 and TCP 443 (with a certificate) from the Listeners page.

Virtual Hosts map a site's document root, index files, PHP handler, rewrite rules and security to a name. The image ships the sample Example virtual host so that PHP works out of the box. Add your own virtual host and map it to a listener to serve your site.

Server-wide settings live under Server Configuration. These include process limits, tuning, security, external applications and script handlers.

After you change the configuration, use the graceful restart control, the circular arrow next to the server status. The running server then picks up the new configuration without dropping live connections.

Check the installed OpenLiteSpeed and PHP runtime versions:

VER=$(sudo /usr/local/lsws/bin/lshttpd -v 2>&1)
echo "$VER" | grep -i litespeed dpkg-query -W -f='${Package} ${Version}\n' openlitespeed lsphp83

Expected output:

LiteSpeed/1.9.1 Open (BUILD built: Sun Jul 12 18:16:07 UTC 2026) lsphp83 8.3.32-1+noble openlitespeed 1.9.1-2+noble