OpenLiteSpeed on AWS User Guide

Overview

This image runs OpenLiteSpeed, the open source edition of the LiteSpeed web server: an event driven, high performance HTTP server that serves static and dynamic content, runs PHP applications through its LSAPI handler, speaks HTTP/2 and HTTP/3, and is administered entirely through a browser based WebAdmin console rather than hand edited configuration files.

OpenLiteSpeed is installed from the official LiteSpeed apt repository (rpms.litespeedtech.com) into /usr/local/lsws, together with the lsphp83 (PHP 8.3) runtime wired as the default LSAPI handler. The server serves its default web site on TCP 8088 and the WebAdmin console on TCP 7080 over HTTPS.

The WebAdmin console ships with no known password. On the first boot of every deployed instance, openlitespeed-firstboot.service mints a strong random password unique to that instance, regenerates the console's self signed certificate, and writes the password to /root/openlitespeed-credentials.txt with mode 0600. No two instances ever share a WebAdmin password, and no usable credential is baked into the image.

What is included:

• OpenLiteSpeed from the official LiteSpeed apt repository, installed to /usr/local/lsws
• lshttpd.service starting automatically on boot, serving the default site on TCP 8088 and the WebAdmin console on TCP 7080 over HTTPS
• openlitespeed-firstboot.service, a systemd oneshot that mints a per instance WebAdmin password and regenerates the console certificate
• The lsphp83 PHP 8.3 runtime as the default LSAPI handler, with the mysql, opcache and curl extensions
• A dedicated EBS volume mounted at /usr/local/lsws carrying the whole server root, independently resizable from the operating system disk
• Brute force login throttling on the WebAdmin console (five failed sign ins block the source IP for fifteen minutes)
• Ubuntu 24.04 LTS base fully patched at build time, with unattended security upgrades enabled
• 24/7 cloudimg support

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound TCP 22 and TCP 7080 from your management network, and inbound TCP 80, 443 and 8088 from the networks your visitors will reach the site on

Restrict TCP 7080 to trusted management addresses only — it is the full administrative console for the server.

Connecting to your instance

The SSH login user depends on the operating system variant you launched:

Step 1: Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for OpenLiteSpeed. Select the cloudimg listing, choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group as described in the prerequisites. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes approximately one minute after the instance state becomes Running — the first boot service mints the WebAdmin password, regenerates the console certificate, and starts the server.

Step 2: Launch the instance from the AWS CLI

The following block launches an instance from the cloudimg OpenLiteSpeed Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens the ports described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openlitespeed-01}]'

Step 3: Retrieve the per instance WebAdmin password

On first boot a strong random password is generated for the admin user and written to /root/openlitespeed-credentials.txt. Read it over SSH:

ssh ubuntu@<public-ip> "sudo cat /root/openlitespeed-credentials.txt"

You will see the per instance credentials, for example:

ADMIN_USER=admin
ADMIN_PASSWORD=<a strong random per instance password>
WEBADMIN_PORT=7080
WEBADMIN_URL=https://<public-ip>:7080/
HTTP_PORT=8088
HTTP_URL=http://<public-ip>:8088/

Keep this password safe. After your first sign in you can change it again from the WebAdmin console.

Step 4: Sign in to the WebAdmin console

Browse to https://<public-ip>:7080/ and accept the self signed certificate warning — the certificate is regenerated uniquely on every instance at first boot, so your browser has no way to vouch for it. Sign in as admin with the password from Step 3.

After signing in you land on the dashboard, which shows the running server version, uptime, real time request and connection statistics, and the count of active listeners and virtual hosts.

The WebAdmin console throttles brute force sign in attempts: five failed attempts block the source IP for fifteen minutes. If you are locked out, wait for the block to clear or connect from a different address.

Step 5: Confirm the server is running

SSH into the instance and confirm the lshttpd service is active, enabled at boot, and listening on the default site port (8088) and the WebAdmin port (7080):

sudo systemctl is-active lshttpd.service
sudo systemctl is-enabled lshttpd.service
sudo ss -tln | grep -E ':8088|:7080'

Expected output:

active
enabled
LISTEN 0      4096         0.0.0.0:7080      0.0.0.0:*
LISTEN 0      4096         0.0.0.0:8088      0.0.0.0:*

Request the default site over HTTP on port 8088 and confirm the WebAdmin login page answers over HTTPS on port 7080:

curl -s -o /dev/null -w 'Default site (:8088): HTTP %{http_code}\n' http://127.0.0.1:8088/
curl -ks -o /dev/null -w 'WebAdmin login page (:7080): HTTP %{http_code}\n' https://127.0.0.1:7080/login.php

Expected output:

Default site (:8088): HTTP 200
WebAdmin login page (:7080): HTTP 200

Step 6: Verify the per instance credential

The WebAdmin console authenticates through a PHP form login. Confirm that the per instance password in the credentials file signs in successfully — a correct sign in answers HTTP 302 (a redirect into the console), while a wrong password is rejected with HTTP 200 and an "Invalid credentials" message. The password is read straight into a shell variable and never printed:

ADMIN_PASS=$(sudo grep '^ADMIN_PASSWORD=' /root/openlitespeed-credentials.txt | cut -d= -f2-)
CJ=$(mktemp)
curl -ks -c "$CJ" https://127.0.0.1:7080/login.php >/dev/null
curl -ks -o /dev/null -w 'WebAdmin sign in: HTTP %{http_code} (302 = signed in)\n' \
  -c "$CJ" -b "$CJ" \
  --data-urlencode userid=admin --data-urlencode "pass=$ADMIN_PASS" \
  https://127.0.0.1:7080/login.php
rm -f "$CJ"

Expected output:

WebAdmin sign in: HTTP 302 (302 = signed in)

Step 7: Confirm the dedicated server volume

The whole OpenLiteSpeed server root — virtual host document roots, configuration, certificates and logs — lives on its own EBS volume mounted at /usr/local/lsws, so you can grow web content storage without touching the operating system disk:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /usr/local/lsws
df -h /usr/local/lsws | tail -1

Expected output:

/dev/nvme1n1 /usr/local/lsws ext4   19.5G
/dev/nvme1n1     20G   87M   19G   1% /usr/local/lsws

To grow it, modify the EBS volume in the AWS console, then run sudo resize2fs /dev/nvme1n1 on the instance.

Step 8: Configure listeners and virtual hosts

OpenLiteSpeed is administered entirely from the WebAdmin console. Two areas cover most day to day work.

Listeners define the ports and protocols the server accepts connections on. The image ships a single Default listener bound to TCP 8088. To serve production traffic, add listeners on TCP 80 and TCP 443 (with a certificate) from the Listeners page.

Virtual Hosts map a site's document root, index files, PHP handler, rewrite rules and security to a name. The image ships the sample Example virtual host so PHP works out of the box; add your own virtual host and map it to a listener to serve your site.

Server wide settings — process limits, tuning, security, external applications and script handlers — live under Server Configuration.

After changing configuration in the console, use the graceful restart control (the circular arrow next to the server status) so the running server picks up the new configuration without dropping live connections.

Step 9: Confirm the software version

Confirm the installed OpenLiteSpeed and PHP runtime versions:

VER=$(sudo /usr/local/lsws/bin/lshttpd -v 2>&1)
echo "$VER" | grep -i litespeed
dpkg-query -W -f='${Package} ${Version}\n' openlitespeed lsphp83

Expected output:

LiteSpeed/1.9.1 Open (BUILD built: Sun Jul 12 18:16:07 UTC 2026)
lsphp83 8.3.32-1+noble
openlitespeed 1.9.1-2+noble

Serving your first site

1. Upload your site to a directory under /usr/local/lsws — for example /usr/local/lsws/sites/example.com/html.
2. In the WebAdmin console open Virtual Hosts, select Add, and set the virtual host root and document root to your directory. Set the index files and, if you are serving PHP, confirm the lsphp script handler is mapped.
3. Open Listeners, add a listener on TCP 80, and map your new virtual host to it under the listener's Virtual Host Mappings tab.
4. Perform a graceful restart from the dashboard.
5. Once DNS points at the instance, add a TCP 443 listener with a certificate authority signed certificate and redirect HTTP to HTTPS.
6. Remove the sample Example virtual host and the Default listener on TCP 8088 before serving production traffic.

Security notes

• Rotate the WebAdmin password after first sign in. The generated password is unique per instance, but changing it from the console means the value in /root/openlitespeed-credentials.txt is no longer live.
• Restrict TCP 7080 to trusted management addresses. The WebAdmin console can reconfigure every aspect of the server; it should never be exposed to the public internet.
• Replace the self signed console certificate with a certificate authority signed certificate if you administer the server across untrusted networks.
• Remove the sample Example virtual host and the default TCP 8088 listener once your own site is serving.
• Unattended security upgrades are enabled on the instance, so the operating system continues to receive security patches after launch.

Support

cloudimg provides 24/7 technical support for this image via email and live chat at support@cloudimg.co.uk. Include your instance ID and AWS Region to expedite troubleshooting.