moeyy

Note: With the popularity of VPS servers today, many webmasters prefer to purchase VPS servers instead of virtual hosting to run websites and projects. This is because VPS servers allow for the installation of relevant plugins and services according to one's needs, and the current server prices can also meet our cost burden. However, using a Linux server for website building can be cumbersome when relying solely on an SSH client, especially for beginners. Therefore, many server enthusiasts still prefer to use a Web panel to deploy environments, making website management much easier.

Currently, there are at least 20-30 free and paid Web panels available, such as the more familiar WDCP, Baota, AMH, Lnmp, and the widely used VestaCP among foreign users. This article mainly discusses Baota, which the author finds to be the most convenient and feature-rich panel. It currently offers a free version and a professional version (which essentially means free use of paid plugins). For most users, the free version is sufficient, although the professional version has its value, such as allowing free use of many good plugins. Here, we will detail the usage tutorial for the free version and review the professional version plugins, while also explaining the usage methods to help more beginners understand website building.

Installing the Panel#

The current version of Baota Panel has been updated to 6.2, but since it is still unstable, the author recommends installing version 5.9, with the system suggesting CentOS.

Installation commands for Linux panel 5.9 (stable version):

# Please use a clean system for installation, meaning no website environment has been installed, such as PHP, Nginx, Mysql, etc.
# CentOS system
yum install -y wget && wget -O install.sh http://download.bt.cn/install/install.sh && sh install.sh
# Ubuntu/Deepin system:
wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && sudo bash install.sh
# Debian system
wget -O install.sh http://download.bt.cn/install/install-ubuntu.sh && bash install.sh
# Fedora system
wget -O install.sh http://download.bt.cn/install/install.sh && bash install.sh

First, use an SSH client (recommended Xshell) to log in to the VPS server, then copy the installation script above and run it by pressing Enter. The Baota panel will be installed in about a minute. After installation, the backend information will be displayed directly in the SSH client.

If we forget the password without changing it later, we can use the command bt default in the SSH client to view the default backend information after installation.

Free Version Usage Tutorial#

1. Building the Website Environment
After installing the Baota panel, log in to the backend according to the information provided. Initially, there is no website environment, just the panel, and then Baota will prompt us to choose an environment.

Here, you should select based on the version requirements of the program you installed. The author has always used Lnmp, so they only selected Nginx 1.12, PHP 7.1, and Mysql 5.5, then clicked to install with one click until the installation is complete. The time taken depends on your machine's performance; better performance means faster installation, and vice versa.

Once installed, the homepage will provide us with a lot of useful information, such as version information, online time, number of websites, number of databases, server status (process management/port management) software, network, etc. In short, it is very user-friendly.

2. Adding a Domain Name
How do we build a website? First, you need to resolve the A record of your domain to the VPS server where Baota is installed with your domain service provider. Then select the website option on the left side of the panel - add a site. There are other functions for modifying default pages (like 404 pages) that we can set as needed.

After setting it up, click the settings button for that domain, and you will see the following functions:

Site Settings: Domain management, can manage hostnames.
Subdirectory Binding: Can bind other domains as subdirectory domains for the current site.
Website Directory: Can modify the website's entry point.
Traffic Limitation: Use nginx-related parameters to limit the current site.
Pseudo-static: We can modify or add pseudo-static configurations required by the program, and it includes many commonly used pseudo-static configurations.
Default Document: The default document is the homepage of the current site, which we can set as needed.
Configuration File: The configuration file contains the default configuration information for the current site, please modify it with caution.
SSL: Currently, Baota's SSL certificate is very mature, we can fill in our own certificate, or use the free Let's Encrypt certificate, or after real-name verification of the Baota account, use the certificate issued by Baota itself.
PHP Version: We can switch the PHP version here as needed.
Tomcat: Can configure Tomcat when using a Java environment.
301 Redirect: We can enable 301 redirects for the current site to other sites.
Reverse Proxy: Reverse proxy can be used when using the Nginx environment, we can use Nginx's features to proxy other websites.
Anti-hotlinking: Anti-hotlinking uses Nginx rules to set access rules for the URL suffix of the domain, preventing traffic from being stolen.
Response Log: The response log can show all recorded information for the current website.

3. File Management
After adding and setting up the domain name, you need to upload the website source code. Select the website option on the left side of the panel - files. This is a powerful and easy-to-use file manager that supports right-click, copy, paste/delete/upload, and other common functions, which can directly replace the functionality of FTP.

Typically, the website root directory is in /www/wwwroot, enter the domain folder to upload the required website source code.

4. Database Management
Baota has implemented most database operations, and it also has import and export functions (this function uses mysqldump to operate on the database), which is quite convenient to use.

Of course, if we need to modify the database files, we can enter the database WEB management interface through the phpMyAdmin entry above (make sure to install phpMyAdmin beforehand) to perform a series of operations on the database. Remember to synchronize the database in the panel in advance.

Basically, to build a website, you only need to complete the above 4 steps. Next, we will discuss the remaining functions.

5. Monitoring
Baota's monitoring items can provide detailed monitoring of the system, such as system load, CPU, memory, IO, etc., allowing for a clearer view of the server's operational status around the clock, with a default retention of 30 days.

6. Security
SSH management, firewall, and panel operation logs are all here, allowing us to record and track the entire operation of the server. Here, you can change the SSH port to prevent brute force scans, or directly close SSH login, enable firewall ports, and other operations.

7. Baota Scheduled Tasks
Scheduled tasks are very important for all servers, as servers may face various issues at any time, and the backup of scheduled tasks is your last lifeline. Therefore, we should properly set up our server's scheduled tasks to protect our data.

Task types include the following: Shell scripts, website backups, database backups, log cutting, releasing memory, accessing URL.

8. Software Management
In software management, both paid and free software on Baota can be purchased, installed, configured, and uninstalled here.

While pursuing convenience and speed, Baota also retains the ability to edit configuration files, and the official website provides many default paths for programs, which greatly assists us in making modifications. Therefore, whether you are a beginner or an expert, you can easily use the Baota panel.

Review of Professional Version and Paid Plugins#

The author recently obtained a permanent professional version and took the opportunity to experience the paid plugins (the professional version is free for lifetime use, while the free version requires monthly payment). Here, we will detail the functionality review. If you are interested in certain plugins, you can register for a Baota account → Registration Link, and by using this link to register and bind Baota, you will receive a free six-month Baota mini program. Then, you can purchase a month of plugins to experience. If you have the budget and need the features, you might consider buying the professional version for permanent access to paid plugins.

Currently, the professional version allows free use of the following paid plugins:

Most of these plugins contain functionalities found in other software. If we can use the free version, we can usually install other software to achieve the above functionalities. However, as the saying goes, there is a reason for everything's existence. If a panel can integrate all usable programs, it might not be a bad thing.

The most stable version of Baota Panel currently is 5.9. In version 6.0, the entire interface has become more flat, unlike the very obvious Bootstrap style of 5.9. Since version 6.0 has not yet matured, we use version 5.9 for detailed testing.

The homepage of the professional version is as follows:

Professional version plugin page:

1. Website Anti-tampering Program

Official Introduction: Event-based anti-tampering program that effectively protects important website files from being tampered with by malware.
The current implementation technologies for web anti-tampering mainly include: external polling technology, core embedded technology, event-triggered technology, etc. There are many mainstream products for web anti-tampering on the market. Since Baota Panel has integrated this, we will conduct a detailed test of Baota's anti-tampering functionality.

To test the anti-tampering effect, we first deployed a Wordpress blog program from the software market and resolved the domain using the Host back-source method.

After adding the site and installing the blog according to Wordpress requirements, we enable the anti-tampering switch for this site in the plugin.

Then we use the built-in file manager to modify the .php file. Note that the file types protected by anti-tampering can be customized in the protection menu shown above.

Here, we attempt to modify wp-config.php, which is the database configuration file for the entire blog.

After changing it to 123 and saving, we refresh and find that all other pages of the blog can be accessed normally. We return to the anti-tampering plugin to check the modification records and can see the following tampering log records:

The built-in file management method of Baota is similar to the common FTP method. Through online file management, we can easily modify program code. Due to space limitations, we only tested the file protection functionality of anti-tampering. There are many other protective points that can be tested for anti-tampering. From the above test, we can see that the modification operation of the program has been intercepted. Tampering and malware are currently the biggest issues faced by websites, and while many other programs also have anti-tampering features, we still prefer to integrate programs together and manage all plugins through a single entry, as this method is the simplest and most convenient.

2. Website Monitoring Report

Official Introduction: The website monitoring report can accurately and in real-time count website traffic, IP, UV, PV, requests, spiders, and other data.

In the early stages of website building, we often prefer monitoring methods like CNZZ, Webmaster Home, 51La, Baidu Statistics, etc., to check website traffic. Most of these programs use embedded pages to record PV and IP for the website. However, recently, a certain monitoring program was reported to have been hijacked, causing websites using that monitoring to display malicious ads. Baota officially monitors the sites we deploy from the bottom layer of the panel, requiring no code to be set on the website. As long as the plugin is installed, it can monitor the existing Web sites.

When we tested anti-tampering earlier, we added a test.com site. The operations performed on that site have already been recorded in the website monitoring report. Of course, we used the Host back-source method, so others cannot access that address. This record is entirely the result of my testing.

By clicking on the details, we can view the detailed records of that site.

It can record in detail: monitoring overview, traffic statistics, spider statistics, error logs, access clients, and detailed website logs. For our site monitoring, this project can perform monitoring operations very clearly. The entire menu section screenshots are as follows:

For our integrated panel, the functions provided by the website monitoring report are sufficient for our daily use.

3. Apache Firewall & Nginx Firewall

Official Introduction: Effectively prevents common penetration attacks such as SQL injection/XSS/single-line malware. The Baota website firewall relies on the luaJIT component, and some environment versions may need to be reinstalled to use it.
Main functions:
1. General filtering, including GET (URI, URI parameters), POST, Cookie, User-Agent, Header, IP black and white lists, URI black and white lists, etc.
2. Prohibit access from foreign sites. Once enabled, the site only allows access from domestic users (including Hong Kong, Macau, Taiwan).
3. URI encryption protection, commonly used to protect the website backend.
4. URI-specific rules for quickly patching vulnerabilities.
5. CDN mode. If your site uses a CDN, please enable CDN mode; otherwise, the firewall may affect the normal access of the website.

Since the current panel is installed with the Lnmp architecture, we will conduct an online test of the Nginx firewall.

The global configuration controls all programs of the current Baota panel. For example, if we need to perform CC protection for all sites, we can set it in the global configuration. If we need to operate on a specific site, we can click on site configuration to perform configuration operations for that individual site.

4. Baota Load Balancer

Official Introduction: Baota Load Balancer is based on Nginx load balancing.

Explanation of load balancing:

As the business volume increases, the access volume and data flow grow rapidly, the processing capacity and computing intensity of each core part of the existing network also increase accordingly, making it impossible for a single server device to bear the load. In this case, if we discard the existing equipment to perform a large-scale hardware upgrade, it will waste existing resources. Moreover, if we face another increase in business volume, this will lead to another high-cost hardware upgrade. Even the most excellent devices may not meet the current business growth demands.
 
A cheap, effective, and transparent method derived from this situation to expand the bandwidth of existing network devices and servers, increase throughput, enhance network data processing capabilities, and improve network flexibility and availability is load balancing.

We won't go into specific usage methods here, as Baota's official explanation is very clear. For more details, check → Link.

This function is the biggest functional module of Nginx, as reverse proxy and load balancing are its core features. However, due to the complexity of manual configuration, this function is rarely used. Baota has transformed cumbersome commands into a graphical interface configuration method, greatly increasing our usability, allowing ordinary people to configure load balancing for complex Nginx.

5. MySQL Master-Slave Replication

Official Introduction: Easily achieve MySQL master-slave replication and master-master replication.

Explanation of master-slave replication:

MySQL master-slave replication involves mutual replication between two databases, with one being the master machine and the other being the backup node. When the master machine inserts a record, the backup node will also insert a record. Isn't that amazing? When I first heard about this, I thought, wow, there's such a magical thing! This means we no longer have to worry about data pressure reaching 100%. In practical environments, most databases have high concurrency, so we need to use some technology to perform master-slave replication of the database.

For MySQL master-slave replication, many tutorials can be found on Baidu, and relevant documents can also be obtained from the official MySQL documentation. However, we know what it is but not how it works. Due to the complexity of many commands, only professional operation and maintenance personnel can handle it. For simple users, we only need basic MySQL database replication without wanting to deal with too many professional commands. Therefore, this Baota MySQL master-slave replication plugin is very suitable for our use.

For detailed usage methods, check → Link.

The most frustrating part of this function is that we need to purchase two authorized versions of the MySQL master-slave panel to perform master-slave replication operations on two servers.

6. Baota Task Manager

Official Introduction: Easily manage processes, startup items, users, services, scheduled tasks, and sessions.

The Baota task manager is somewhat similar to the top command in the Shell interface, but it has added many management functions, allowing management of processes, startup items, services, network, users, scheduled tasks, and session information.

Process Description: Track the CPU/memory/disk usage of each process. Click on the process name to view more detailed information about that process.

Startup Item Description: Lists all items that start with the system, including init services and user-defined startup scripts.

Service Description: Each service has a corresponding run level setting. If set to start at the corresponding run level, it means the system will start that service at that run level.

Below is a list of each run level's representative status:

Level-0: Shutdown
Level-1: Single-user mode
Level-2: Multi-user mode without networking
Level-3: Fully multi-user mode in command line (servers usually run in this mode)
Level-4: System not in use
Level-5: Graphical GUI mode (some systems with GUI installed will automatically enter this mode)
Level-6: Reboot

Network Description: Quickly view the current server network status.

User Description: You can see all users existing in the system here and perform related management operations.

Scheduled Task Description: Parses all scheduled tasks in the crond service, allowing users to view task cycles, content, or delete specified tasks.

Session Description: Lists the sessions that have successfully logged into the system via SSH.

7. Baota WeChat Mini Program

Official Introduction: The Baota mini program provides server monitoring and secure QR code login to the panel.

The Baota WeChat mini program currently only supports the Baota Linux panel and can associate and bind multiple servers. A single server can also authorize multiple WeChat users to bind, providing server monitoring functionality and secure QR code login to the panel, making it convenient for users to check server status at any time. For binding methods, check → Link.

Currently, this function seems somewhat useless, as it only allows viewing the server status. However, the official introduction states that more panel management functions will gradually be added for our use in the future. We will see then.

8. Baota Data Synchronization Tool

Official Introduction: Data synchronization tool developed based on Rsync.

In Linux, the most commonly used file transfer methods are SCP and Rsync. I prefer using SCP for transfers, but in many scenarios, we transfer a lot of content or need to perform incremental transfers. In such cases, the advantages of Rsync become apparent. This program is a small tool written using Rsync functionality, allowing us to use the Rsync synchronization tool through a graphical interface.

For detailed usage methods, check → Link

Conclusion#

There are a few paid plugins that I haven't truly tested for various reasons, so I only have a basic understanding of them. Overall, Baota is quite good and has made things easier for many people. Some paid plugins may not be necessary for us, but of course, there are exceptions for those with specific needs. If you have needs, you can register for a Baota account to experience it → Click to Register, using this link to register and bind Baota will directly grant you a free six-month Baota mini program. After that, we can only wait for Baota to release more useful plugins. However, it would be great if they could integrate WHMCS in the future, as it would likely attract even more users. Finally, if you encounter any issues while using Baota or need certain functionalities, you can provide feedback in the official TG channel (https://t.me/BT_CN).