Plesk with Litespeed using Apache configurations: WAF and GeoIP setup

[Oxilion]

Hello all,

We're trying to setup a new batch of shared webhosting servers, based on Plesk 18.x Obsidian running on CloudLinux, with LiteSpeed as webserver.

The Wiki and the Docs do have a few articles regarding installation on Plesk servers, but mainly about some general setup. Control Panel specifics are mostly explicit for cPanel and DirectAdmin. It looks like LiteSpeed is serving Plesk's Apache vhosts just fine, but we'd like to improve the robustness and security by implementing additional features such as the WAF and GeoIP functionality.

I've been playing around with different configurations, both for Apache as well as LiteSpeed's own settings, but I have not yet found the a way of implementing WAF and GeoIP support, despite reading the docs.

Perhaps I am going about it the wrong way, or maybe I'm not testing it right, so I'd like a fresh perspective on things.

So, without going into details about the current setup, I'd like to ask here:

What would be the "correct" way of implementing WAF and GeoIP on a Plesk host. I am asking this as generally as possible, so that I'm not restricting the answers too much. I hope someone can give me, or point me to a concise but complete step-by-step guide of where to start, and what to do to get this up and running. The starting position as a running LiteSpeed on Plesk, so basic LiteSpeed setup has been covered

The purpose of the GeoIP support would be to allow requests to login pages from our own country without restrictions, but require some sort of Basic Auth for all such requests from all other countries. So if someone has some pointers for that too, that would be great!

With kind regards,

Oxilion

P.S.: I forgot to mention that we're currently using a Trial License for the POC, but we're planning on using the Web Host Professional or Enterprise License for production. I don't know if the Trial License has restrictions on functionality that might be relevant?

 

[Pong]

For control panel environment, most of the time you will do things on apache configration side, LiteSpeed will read and act accordingly.

For WAF setup, you just need to do the same as you do for apache, the only think to make sure is right rule set to download if apache and litespeed has different rule set. You can check plesk documentation on that https://docs.plesk.com/en-US/onyx/a...n/web-application-firewall-modsecurity.73383/

For GeoIP, you will need to enable it through LSWS web admin console https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:cache:common:geoip-support

Better you split these two unrelated questions(WAF and GeoIP) into two threads otherwise it may mix up which is which if the discussion is ongoing.

 

[Oxilion]

Dear Pong,

Thank you for confirming my suspicions

It looks like I needed the weekend break to get some fresh perspectives. After enabling Plesk's own ModSecurity component, the WAF part seems covered.

The GeoIP issue is back on track too, I just needed to include an "<IfModule Litespeed>" in the Apache configs, where I put "GeoIPEnable On", and now I also see the GEOIP information in my server env.

So, on with the show for now!

With kind regards,
Oxilion