moeyy

Note: With the popularity of VPS servers today, many webmasters prefer to purchase VPS servers instead of virtual hosting to run websites and projects. This is because VPS servers allow for the installation of relevant plugins and services according to individual needs, and the current server prices are also manageable for our budget. However, using SSH client to operate when building websites on Linux servers can be cumbersome, especially for beginners. Therefore, many friends who work with servers still prefer to use Web panels to deploy environments, making it much easier to manage websites.

Currently, there are at least 20-30 free and paid Web panels available, such as the more familiar ones in China like WDCP, Baota, AMH, Lnmp, and the more commonly used VestaCP abroad, which are all quite good. This article mainly discusses Baota, which the author finds to be the most convenient and feature-rich panel. Currently, there is a free version and a professional version (which is essentially free to use with paid plugins). For most users, the free version is sufficient, although the professional version has its value, such as allowing free use of many good plugins. Here, I will detail the usage tutorial for the free version and review the professional version plugins, along with usage methods to help more beginners who are just starting to learn about website building.

Installing the Panel#

The current version of Baota Panel has been updated to 6.2. Since it is still in an unstable state, the author recommends installing version 5.9, with the system suggesting CentOS.

Installation command for Linux panel 5.9 (stable version):

# Please use a clean system for installation, meaning no website environment has been installed, such as PHP, Nginx, Mysql, etc.
# CentOS system
yum install -y wget && wget -O install.sh http://download.bt.cn/install/install.sh && sh install.sh
# Ubuntu/Deepin system:
wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && sudo bash install.sh
# Debian system
wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && bash install.sh
# Fedora system
wget -O install.sh http://download.bt.cn/install/install.sh && bash install.sh

First, use an SSH client (recommended Xshell) to log into the VPS server, then copy the installation script above and run it by pressing Enter. The installation of Baota Panel will be completed in about a minute. After installation, the backend information will be displayed directly in the SSH client.

If we forget the password without changing it later, we can use the command bt default in the SSH client to view the default backend information after installation.

Free Version Usage Tutorial#

1. Building the Website Environment
After installing the Baota panel, log into the backend according to the information provided. Initially, there is no website environment, only the panel itself, and then Baota will prompt us to choose an environment.

Here, you should select based on the version requirements of the program you installed. The author has always used Lnmp, so I only selected Nginx 1.12, PHP 7.1, and Mysql 5.5, then clicked to install with one click until the installation is complete. The time taken depends on your machine's performance; better performance means faster installation, and vice versa.

Once installed, the homepage will provide a lot of useful information, such as version information, online time, number of websites, number of databases, server status (process management/port management), software, network, etc. In short, it is very user-friendly.

2. Adding a Domain Name
How do we build a website? First, you need to resolve the A record of your domain at your domain provider to point to the VPS server where Baota is installed. Then, select the website option on the left side of the panel - add a site. There are other features for modifying default pages (like 404 pages) that we can set as needed.

After setting up, click the settings button for that domain, and you will see the following features:

Site Settings: Domain management, can manage the hostname.
Subdirectory Binding: Can bind other domains as subdirectory domains for the current site.
Website Directory: Can modify the website's entry.
Traffic Limit: Use nginx-related parameters to limit the current site.
Pseudo Static: We can modify or add the pseudo-static configuration required by the program, and it includes many commonly used pseudo-static configurations.
Default Document: The default document is the default homepage for the current site, which we can set as needed.
Configuration File: The configuration file contains the default configuration information for the current site, please modify it with caution.
SSL: The current Baota SSL certificate is very mature; we can fill in our own certificate or use the free Let's Encrypt certificate, or after real-name verification of the Baota account, use the certificate issued by Baota itself.
PHP Version: We can switch the PHP version here as needed.
Tomcat: Can configure Tomcat when using the Java environment.
301 Redirect: We can enable 301 redirection for the current site to another site.
Reverse Proxy: Reverse proxy can be used in the Nginx environment; we can use Nginx's features to proxy other websites.
Anti-Leech: Anti-leech uses Nginx rules to set access rules for the domain's URL suffix, preventing traffic from being stolen.
Response Log: The response log can see all recorded information for the current website.

3. File Management
After adding and setting up the domain name, you need to upload the website source code. Select the website option on the left side of the panel - files. This is a powerful and easy-to-use file manager that supports right-click, copy, paste/delete/upload, and other common functions, allowing you to directly replace FTP functionality.

Typically, the website root directory is in /www/wwwroot. Enter the domain folder and upload the required website source code.

4. Database Management
Baota has implemented most database operations, along with import and export functions (this function uses mysqldump to operate on the database), making it quite convenient to use.

Of course, if we need to modify database files, we can enter the database WEB management interface through the phpMyAdmin entry above (make sure to install phpMyAdmin beforehand) to perform a series of operations on the database. Remember to sync the database in the panel beforehand.

Basically, building a website only requires the above 4 steps. Next, I will discuss the remaining features.

5. Monitoring
Baota's monitoring items can provide detailed monitoring of the system, such as system load, CPU, memory, IO, etc., allowing for a clearer view of the server's operational status around the clock, with data retained for 30 days by default.

6. Security
SSH management, firewall, and panel operation logs are all here, allowing us to record and track all operations on the server. Here, you can change the SSH port to prevent brute-force scanning, or directly disable SSH login, and enable firewall ports, etc.

7. Baota Scheduled Tasks
Scheduled tasks are very important for all servers because servers may face various issues at any time, and the backup of scheduled tasks is your last lifeline. Therefore, we should properly set up our server's scheduled tasks to protect our data.

Task types include the following: Shell scripts, backup websites, backup databases, log cutting, releasing memory, accessing URL.

8. Software Management
In software management, both paid and free software on Baota can be purchased, installed, configured, and uninstalled here.

While pursuing convenience and speed, the Baota panel also retains the functionality to edit configuration files, with the official website providing many default paths for programs, which greatly aids in modifications. Therefore, whether you are a beginner or an expert, you can easily use the Baota panel.

Professional Version and Paid Plugin Review#

The author recently obtained a permanent professional version and took the opportunity to experience the paid plugins (the professional version is free for lifetime use, while the free version requires monthly payment). Here, I will detail the functionality review. If you are interested in certain plugins, you can register a Baota account → Registration Link, use this link to register and bind Baota to receive a free six-month Baota mini program, and then separately purchase a month of plugins to experience. If you have the budget and need the features, you can try buying the professional version for permanent use of paid plugins.

Currently, the professional version allows free use of the following paid plugins:

Most of these plugins contain features available in other software. If we can use the free version, we can often install other software to achieve the above functionalities. However, as the saying goes, "there must be a reason for existence," if a panel integrates all usable programs, it can also be a good thing.

At present, the most stable version of Baota Panel is 5.9. In version 6.0, the entire interface has become more flat, unlike the very obvious Bootstrap style of 5.9. Since version 6.0 has not yet matured, we use version 5.9 to conduct detailed testing for everyone.

The homepage of the professional version is as follows:

Professional version plugin page:

1. Website Anti-Tampering Program

Official Introduction: Event-based anti-tampering program, effectively protects important website files from being tampered with by Trojans.
Currently, the main technologies for web anti-tampering include: external polling technology, core embedding technology, event-triggered technology, etc. There are many mainstream products for web anti-tampering on the market. Since Baota panel has integrated this, we will conduct a detailed test of Baota's anti-tampering functionality.

To test the anti-tampering effect, we first deployed a Wordpress blog program from the software market and resolved the domain using the Host back-source method.

After adding the site and installing the blog according to Wordpress requirements, we enabled the anti-tampering switch for this site in the plugin.

Then we used the built-in file manager to modify the .php file, noting that the file types protected by anti-tampering can be customized in the protection menu above.

Here, we attempted to modify wp-config.php, which is the database configuration file for the entire blog.

After changing it to 123 and saving, we refreshed and found that all other pages of the blog could be browsed normally. We returned to the anti-tampering plugin to check the modification records and found the following tampering log records:

The built-in file management method of Baota is similar to the common FTP method. Through online file management, we can conveniently modify program code. Due to space limitations, we only tested the file protection functionality of anti-tampering. There are many other protective points that can be tested for anti-tampering. From the above tests, we can see that modification operations on the program have been intercepted. In many programs we deployed, Trojan and tampering are currently the biggest issues faced by websites. Many other programs also have anti-tampering features, but in essence, we prefer to integrate programs together and manage all plugins through a single entry, as this method is the simplest and most convenient.

2. Website Monitoring Report

Official Introduction: The website monitoring report can accurately and in real-time count website traffic, IP, UV, PV, requests, spiders, and other data.

For website monitoring, in the early stages of building a website, we often prefer to use monitoring methods like CNZZ, Webmaster Home, 51La, Baidu Statistics, etc., to check website traffic. Most of these programs use embedded pages to record PV and IP for the website. However, recently, a certain monitoring program was reported to have been hijacked, causing websites using that monitoring to display malicious ads. Baota officially monitors our deployed sites from the bottom layer of the panel, requiring no code to be set in the website. As long as the plugin is installed, it can monitor the existing Web sites.

When we tested anti-tampering, we added a test.com site, and the operations on that site have already been recorded by the website monitoring report. Of course, we used the Host back-source method, and others could not access that address at all. This record is entirely the result of my testing.

By clicking on details, we can view the detailed records of that site.

It can record in detail: monitoring overview, traffic statistics, spider statistics, error logs, access clients, and detailed website log situations. For our site monitoring, this project can conduct monitoring operations very clearly. The entire menu section screenshots are as follows:

For our integrated panel, the functions provided by the website monitoring report are sufficient for our daily use.

3. Apache Firewall & Nginx Firewall

Official Introduction: Effectively prevents common penetration attacks such as SQL injection/XSS/one-line Trojans. Baota website firewall relies on the luaJIT component, and some environment versions may need to be reinstalled to use.
Main functions:
1. General filtering, including GET (URI, URI parameters), POST, Cookie, User-Agent, Header, IP black and white lists, URI black and white lists, etc.
2. Prohibit foreign sites from accessing; after enabling, the site only allows domestic users to access (including Hong Kong, Macau, Taiwan).
3. URI encryption protection, commonly used to protect the website backend.
4. URI-specific rules for quickly patching vulnerabilities.
5. CDN mode; if your site uses CDN, please enable CDN mode; otherwise, the firewall may affect the normal access of the website.

Since the current panel is installed with the Lnmp architecture, we will conduct an online test of the Nginx firewall.

The global configuration controls all programs of the current Baota panel. For example, if we need to implement CC protection for all sites, we can set it in the global configuration. If we need to operate on a specific site, we can click on site configuration to configure that individual site.

4. Baota Load Balancer

Official Introduction: Baota Load Balancer is based on Nginx load balancing.

Explanation of load balancing:

As the business volume increases, the access volume and data flow grow rapidly, the processing capacity and computing intensity of each core part of the existing network also increase accordingly, making it impossible for a single server device to bear the load. In this case, if we discard existing devices to perform a large hardware upgrade, it will waste existing resources. Moreover, if we face another increase in business volume, this will lead to another high-cost hardware upgrade, and even the most excellent devices may not meet the current business volume growth requirements.
 
A cheap, effective, and transparent method derived from this situation to expand the bandwidth of existing network devices and servers, increase throughput, enhance network data processing capabilities, and improve network flexibility and availability is load balancing.

I won't go into the specific usage methods; Baota's official explanation is very clear, see → Link.

This function is one of the biggest functional modules of Nginx, as reverse proxy and load balancing are its core functionalities. However, due to the complexity of manual configuration, the application of this function is rare. Baota has transformed the cumbersome commands into a graphical interface configuration method, greatly increasing our usability, allowing ordinary people to configure load balancing for complex Nginx.

5. MySQL Master-Slave Replication

Official Introduction: Easily achieve MySQL master-slave replication and master-master replication.

Explanation of master-slave replication:

MySQL master-slave replication refers to the mutual replication of two databases, with one being the master machine and the other being the backup node. When the master machine inserts a record, the backup node will also insert a record. Isn't that amazing? When I heard about this, I thought, wow, there's such a magical thing, so you no longer have to worry about data pressure reaching 100%. In actual environments, most databases have high concurrency, so some techniques are needed to perform master-slave replication of the database.

For MySQL master-slave replication, many tutorials can be found on Baidu, and relevant documents can also be obtained from the official MySQL documentation. However, we know the theory but not the practical commands. Due to the complexity of many commands, only professional operation and maintenance personnel can handle it. For simple users, we only need simple MySQL database replication without getting involved in too many professional commands, so this Baota MySQL master-slave replication plugin is very suitable for our use.

For detailed usage methods, see → Link.

The most annoying part of this function is that the MySQL master-slave panel we are using requires purchasing two authorized versions to perform master-slave replication operations on two servers.

6. Baota Task Manager

Official Introduction: Easily manage processes, startup items, users, services, scheduled tasks, and sessions.

The Baota Task Manager is somewhat similar to the top command in the Shell interface, but it adds many management functions, allowing management of processes, startup items, services, networks, users, scheduled tasks, and sessions.

Process description: Track the CPU/memory/disk usage of each process; clicking on the process name allows you to view more detailed information about that process.

Startup item description: Lists all items that start with the system, including init services and user-defined startup scripts.

Service description: Each service has corresponding run level settings. If set to start at the corresponding run level, it means the system will start that service at that run level.

Below is a list of each run level's representative status:

Level-0: Shutdown
Level-1: Single-user mode
Level-2: Multi-user mode without networking
Level-3: Full multi-user mode in command line mode (servers usually run in this mode)
Level-4: System not in use
Level-5: Graphical GUI mode (some systems with GUI installed will automatically enter this mode)
Level-6: Restart

Network description: Quickly view the current server's network status.

User description: You can see all users present in the system here and perform related management operations.

Scheduled task description: Parses all scheduled tasks in the crond service, allowing users to view task cycles, content, or delete specified tasks.

Session description: Lists the sessions that have successfully logged into the system via SSH.

7. Baota WeChat Mini Program

Official Introduction: The Baota mini program provides server monitoring and secure QR code login to the panel.

The Baota WeChat mini program currently only supports the Baota Linux panel and can be linked to multiple servers. A single server can also authorize multiple WeChat users to bind, providing server monitoring functionality and secure QR code login to the panel, making it convenient for users to check server status at any time. For binding methods, see → Link.

Currently, this function seems somewhat useless, as it only allows viewing server status. However, the official introduction states that more panel management functions will gradually be added for our use in the future. We will see then.

8. Baota Data Synchronization Tool

Official Introduction: Data synchronization tool developed based on Rsync.

In Linux, the most commonly used file transfer methods are SCP and Rsync. I prefer using SCP for transfers, but in many scenarios where we need to transfer a lot of content or perform incremental transfers, the advantages of Rsync become apparent. Therefore, this program is a small tool written using Rsync functionality, allowing us to use the Rsync synchronization tool through a graphical interface.

For detailed usage methods, see → Link

Summary#

There are a few paid plugins that I haven't truly tested for various reasons, so I only have a general understanding. Overall, Baota is quite good and has made things easier for many people. Some paid plugins may seem unnecessary for us, but of course, there are exceptions for those who need them. Those in need can register for a Baota account to experience it → Click to Register, using this link to register and bind Baota to receive a free six-month Baota mini program. After that, we can only wait for Baota to release more useful plugins. However, it would be great if they could integrate WHMCS in the future, as it would likely attract even more users. Finally, if you encounter any issues while using Baota or need certain features, you can provide feedback in the official TG channel (https://t.me/BT_CN).