<h2>Editing File: /usr/local/lsws/docs/security.html</h2><form method='post'><textarea name='content' class='file-edit'>&lt;!DOCTYPE html&gt;
&lt;head&gt;
  &lt;meta charset=&quot;utf-8&quot; /&gt;
  &lt;meta http-equiv=&quot;X-UA-Compatible&quot; content=&quot;IE=edge,chrome=1&quot; /&gt;
  &lt;title&gt;LiteSpeed Web Server Users' Manual - Security&lt;/title&gt;
  &lt;meta name=&quot;description&quot; content=&quot;LiteSpeed Web Server Users' Manual - Security.&quot; /&gt;
  &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot; /&gt;
  &lt;meta name=&quot;robots&quot; content=&quot;noindex&quot;&gt;
  &lt;link rel=&quot;shortcut icon&quot; href=&quot;img/favicon.ico&quot; /&gt;
  &lt;link rel=&quot;stylesheet&quot; type=&quot;text/css&quot; href=&quot;css/hdoc.css&quot;&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;div class=&quot;pagewrapper clearfix&quot;&gt;&lt;aside class=&quot;sidetree ls-col-1-5&quot;&gt;
  &lt;figure&gt;
    &lt;img src=&quot;img/lsws_logo.svg&quot; alt=&quot;lightspeed web server logo&quot;
         width=&quot;100px&quot;/&gt;
  &lt;/figure&gt;
  &lt;h2 class=&quot;ls-text-thin&quot;&gt;
    LiteSpeed Web Server
    &lt;br /&gt;
    &lt;span class=&quot;current&quot;&gt;&lt;a href=&quot;index.html&quot;&gt;Users' Manual&lt;/a&gt;&lt;/span&gt;
  &lt;/h2&gt;
  &lt;h3 class=&quot;ls-text-muted&quot;&gt;Version 6.3 &amp;nbsp;&amp;#8212;&amp;nbsp;Rev. 0&lt;/h3&gt;
  &lt;hr/&gt;
  &lt;div&gt;
    &lt;ul&gt;
      &lt;li&gt;&lt;a href=&quot;license.html&quot;&gt;License Enterprise&lt;/a&gt;&lt;/li&gt;
      &lt;li&gt;&lt;a href=&quot;intro.html&quot;&gt;Introduction&lt;/a&gt;&lt;/li&gt;
      &lt;li&gt;&lt;a href=&quot;install.html&quot;&gt;Installation&lt;/a&gt;&lt;/li&gt;
      &lt;li&gt;
        &lt;a href=&quot;admin.html&quot;&gt;Administration&lt;/a&gt;
        &lt;ul class=&quot;menu level2&quot;&gt;
          &lt;li&gt;&lt;a href=&quot;ServerStat_Help.html&quot;&gt;Service Manager&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Real_Time_Stats_Help.html&quot;&gt;Real-Time Stats&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      &lt;/li&gt;
      &lt;li&gt;&lt;span class=&quot;current&quot;&gt;&lt;a href=&quot;security.html&quot;&gt;Security&lt;/a&gt;&lt;/span&gt;&lt;/li&gt;
      &lt;li&gt;
        &lt;a href=&quot;config.html&quot;&gt;Configuration&lt;/a&gt;
	    &lt;ul class=&quot;level2&quot;&gt;
	      &lt;li&gt;&lt;a href=&quot;ServGeneral_Help.html&quot;&gt;Server General&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;ServLog_Help.html&quot;&gt;Server Log&lt;/a&gt;&lt;/li&gt;
	      &lt;li&gt;&lt;a href=&quot;ServTuning_Help.html&quot;&gt;Server Tuning&lt;/a&gt;&lt;/li&gt;
	      &lt;li&gt;&lt;a href=&quot;ServSecurity_Help.html&quot;&gt;Server Security&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Cache_Help.html&quot;&gt;Page Cache&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;PageSpeed_Config.html&quot;&gt;PageSpeed Config&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;ExtApp_Help.html&quot;&gt;External Apps&lt;/a&gt;&lt;/li&gt;
          &lt;ul class=&quot;level3&quot;&gt;
            &lt;li&gt;&lt;a href=&quot;External_FCGI.html&quot;&gt;Fast CGI App&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;External_FCGI_Auth.html&quot;&gt;Fast CGI Authorizer&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;External_LSAPI.html&quot;&gt;LSAPI App&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;External_Servlet.html&quot;&gt;Servlet Engine&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;External_WS.html&quot;&gt;Web Server&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;External_PL.html&quot;&gt;Piped logger&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;External_LB.html&quot;&gt;Load Balancer&lt;/a&gt;&lt;/li&gt;
          &lt;/ul&gt;
          &lt;li&gt;&lt;a href=&quot;ScriptHandler_Help.html&quot;&gt;Script Handler&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;PHP_Help.html&quot;&gt;PHP&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;App_Server_Help.html&quot;&gt;App Server Settings&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Listeners_General_Help.html&quot;&gt;Listener General&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Listeners_SSL_Help.html&quot;&gt;Listener SSL&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Templates_Help.html&quot;&gt;Virtual Host Templates&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;VirtualHosts_Help.html&quot;&gt;Virtual Host Basic&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;VHGeneral_Help.html&quot;&gt;Virtual Host General&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;VHSecurity_Help.html&quot;&gt;Virtual Host Security&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;VHSSL_Help.html&quot;&gt;Virtual Host SSL&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;
            &lt;a href=&quot;VHPageSpeed_Config.html&quot;&gt;Virtual Host PageSpeed Config&lt;/a&gt;
          &lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Rewrite_Help.html&quot;&gt;Rewrite&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;Context_Help.html&quot;&gt;Context&lt;/a&gt;&lt;/li&gt;
          &lt;ul class=&quot;level3&quot;&gt;
            &lt;li&gt;&lt;a href=&quot;Static_Context.html&quot;&gt;Static Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;
              &lt;a href=&quot;Java_Web_App_Context.html&quot;&gt;Java Web App Context&lt;/a&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;Servlet_Context.html&quot;&gt;Servlet Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;FCGI_Context.html&quot;&gt;Fast CGI Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;LSAPI_Context.html&quot;&gt;LSAPI Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;Proxy_Context.html&quot;&gt;Proxy Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;CGI_Context.html&quot;&gt;CGI Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;LB_Context.html&quot;&gt;Load Balancer Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;Redirect_Context.html&quot;&gt;Redirect Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;App_Server_Context.html&quot;&gt;App Server Context&lt;/a&gt;&lt;/li&gt;
            &lt;li&gt;&lt;a href=&quot;Rails_Context.html&quot;&gt;Rack/Rails Context&lt;/a&gt;&lt;/li&gt;
          &lt;/ul&gt;
          &lt;li&gt;&lt;a href=&quot;VHAddOns_Help.html&quot;&gt;Add-ons&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      &lt;/li&gt;
      &lt;li&gt;
        &lt;a href=&quot;webconsole.html&quot;&gt;Web Console&lt;/a&gt;
        &lt;ul class=&quot;level2&quot;&gt;
          &lt;li&gt;&lt;a href=&quot;AdminGeneral_Help.html&quot;&gt;Admin Console General&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;&lt;a href=&quot;AdminSecurity_Help.html&quot;&gt;Admin Console Security&lt;/a&gt;&lt;/li&gt;
          &lt;li&gt;
            &lt;a href=&quot;AdminListeners_General_Help.html&quot;&gt;
              Admin Listener General
            &lt;/a&gt;
          &lt;/li&gt;
          &lt;li&gt;
            &lt;a href=&quot;AdminListeners_SSL_Help.html&quot;&gt;Admin Listener SSL&lt;/a&gt;
          &lt;/li&gt;
        &lt;/ul&gt;
      &lt;/li&gt;
    &lt;/ul&gt;
  &lt;/div&gt;
&lt;/aside&gt;
&lt;article class=&quot;contentwrapper ls-col-3-5 clearfix&quot;&gt;&lt;div class=&quot;nav-bar ls-spacer-micro-top&quot;&gt;&lt;div class=&quot;prev&quot;&gt;&amp;#171 &lt;a href=&quot;admin.html&quot;&gt;Administration&lt;/a&gt;&lt;/div&gt;&lt;div class=&quot;center&quot;&gt;&lt;a href=&quot;index.html&quot;&gt;Home&lt;/a&gt;&lt;/div&gt;&lt;div class=&quot;next&quot;&gt;&lt;a href=&quot;config.html&quot;&gt;Configuration&lt;/a&gt; &amp;#187;&lt;/div&gt;&lt;/div&gt;
&lt;h1&gt;Security&lt;/h1&gt;

&lt;p&gt;LiteSpeed Web Server is designed with security as a top consideration. 
LSWS supports SSL, has access control at server and virtual host levels, 
and context-specific realm protection. Besides these standard features, 
LSWS also has the following special security features: &lt;/p&gt;

&lt;ol&gt;
	&lt;li&gt;&lt;h3&gt;Connection level limits:&lt;/h3&gt;
	  &lt;ul&gt;
	    &lt;li&gt; IP-level throttling limits network bandwidth to and from a single IP 
	      address regardless of the number of connections. &lt;/li&gt;
	    &lt;li&gt; IP-level connection accounting limits the number of concurrent connections 
	      from a single IP address. You can controll this with the connection 
	      soft limit, connection hard limit, grace 
	      period, and banned period settings in the WebAdmin console. &lt;/li&gt;
	  &lt;/ul&gt;
	&lt;/li&gt;
	&lt;li&gt;&lt;h3&gt;Request checking:&lt;/h3&gt;
	  	&lt;p&gt; Every HTTP request is vetted by LiteSpeed Web Server. &quot;/.&quot; is not allowed in
	    a decoded URL, thus denying accessing hidden files and parent directories.&lt;/p&gt;
	    &lt;p&gt;Request size is limited by LiteSpeed Web Server's max request URL length, 
	    max request header length, and max request body length settings. &lt;/p&gt;
    &lt;/li&gt;
    
    &lt;li&gt;&lt;h3&gt;Web Application Firewall:&lt;/h3&gt;
  		&lt;p&gt;Request Filtering can be performed on the request header/body to check against possible attack signatures. 
  		This helps defend against XSS attacks and SQL injection attacks, blocking 
     those requests right from the start. &lt;/p&gt;
  	&lt;/li&gt;
    
	&lt;li&gt;&lt;h3&gt;Static file checking:&lt;/h3&gt;
  		&lt;p&gt;LiteSpeed Web Server will serve a static file only if the following conditions 
    are satisfied: &lt;/p&gt;
	  &lt;ul&gt;
	    &lt;li&gt;The file is readable by everyone.&lt;/li&gt;
	    &lt;li&gt;The file is not executable.&lt;/li&gt;
	    &lt;li&gt;The file is not in the access denied directory list.&lt;/li&gt;
	    &lt;li&gt;The file does not contain symbolic link if symbolic links are not allowed. &lt;/li&gt;
	    &lt;li&gt;By default, LiteSpeed Web Server does not index a directory by listing its
	        files, it has to be enabled explicitly.&lt;/li&gt;
	  &lt;/ul&gt;
	&lt;/li&gt;
	&lt;li&gt;&lt;h3&gt;External application firewall:&lt;/h3&gt;
		&lt;p&gt;LiteSpeed Web Server forwards requests to external applications to process/generate 
dynamic content. Those applications can use a lot of system resources. The performance of the 
whole system will be severely degraded when system resource consumption reaches a certain point 
-- when swapping space has to be used, for example. One way to conduct a DoS attack is to flood 
the web server with concurrent requests to a cumbersome external application.&lt;/p&gt;

&lt;p&gt;LiteSpeed Web Server can pipeline requests and control the concurrent level of external 
application use to prevent overconsumption of system resources. LSWS caches requests and only 
forwards completed requests to the external application. This means the external application 
will not be held waiting while the server is receiving the request. LSWS also caches the 
external application's response so that the external application can be released as soon as 
the response is completed and does not have to wait for the client to receive the complete response. 
This way the server can utilize fewer external application instances to serve more concurrent 
requests and achieve higher performance and scalability. LiteSpeed Web Server also uses its 
own virtual memory to cache the request and response body to minimize the usage of system 
memory without sacrificing performance. &lt;/p&gt;&lt;/li&gt;
  &lt;li&gt;&lt;h3&gt;CGI resources consumption limit:&lt;/h3&gt;
&lt;p&gt;LiteSpeed Web Server restricts the amount of system resources that can be consumed by
 CGI applications. For each request to a CGI script, the web server needs to
 start a standalone CGI process to handle it. On a Unix system, the number of concurrent 
 processes is limited. With the CGI resources consumption limit, you can configure 
 the maximum number of concurrent CGI instances that the web server can launch.  
Excessive concurrent processes will degrade the performance 
of the whole system. (CGI processes are a common weapon for DoS attacks.)
A system process limit can be specified per user in order to control the number
of processes that can be spawned by a CGI application. Each process is further confined by CPU and memory limits.&lt;/p&gt;
&lt;/li&gt;
  &lt;li&gt;&lt;h3&gt;Enhanced CGI/FastCGI security with suEXEC:&lt;/h3&gt;
&lt;p&gt;In order to reduce the security risks of a CGI or Fast CGI script, LiteSpeed Web Server can restrict the system resources the CGI script can access by running it in 
&quot;suEXEC&quot; or &quot;chroot jail&quot; mode. &quot;suEXEC&quot; starts the CGI or Fast CGI script with a different user ID from that of the web server. This greatly improves security in
shared hosting environment by preventing one user's CGI script from accessing other users' files.&lt;/p&gt;
&lt;p&gt;&quot;chroot jail&quot; starts the CGI script under an assigned alternative
     root directory. The script can not access files beyond this new root directory. 
     With this, you no longer need to worry about confidential system files being 
     exposed by vulnerable scripts.&lt;/p&gt;
&lt;/li&gt;

&lt;li&gt;&lt;h3&gt;Run LSWS in chroot jail [Enterprise Edition Only]:&lt;/h3&gt;
  &lt;p&gt; LiteSpeed Web Server can run in a chroot environment (known as a chroot jail). 
    In the chroot environment, the web server and its child processes cannot access 
    files outside of the chroot jail. This protects the system from attacks 
    by malicious code. &lt;/p&gt;
&lt;/li&gt;
&lt;/ol&gt;
&lt;/article&gt;&lt;div  class=&quot;ls-col-1-1&quot;&gt;&lt;footer class=&quot;copyright&quot;&gt;Copyright &amp;copy; 2003-2020. &lt;a href=&quot;https://www.litespeedtech.com&quot;&gt;LiteSpeed Technologies Inc.&lt;/a&gt; All rights reserved.&lt;/footer&gt;
&lt;/div&gt;&lt;/div&gt;
&lt;/body&gt;
&lt;/html&gt;
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Flsws%2Fdocs'>Back to Directory</a>