使用宝塔管理网站：安装、权限与日常检查

BaoTa Panel (aaPanel / BaoTa Linux Panel) acts as the application orchestration layer in an operations stack, turning Nginx, PHP, databases, SSL certificates, and scheduled backups into intuitive management units. However, the panel itself runs on the Linux kernel and distribution and cannot override the underlying system's networking, security, and hardware resource constraints.

Installing directly on a server already altered by many custom configurations can easily cause port conflicts, service mount failures, or tangled permissions. Efficient, secure production practice starts at system initialization: account for provider differences, clarify the boundaries of the three firewall layers, and establish off-site disaster recovery to withstand single-server failures.

1. Base System Initialization and Provider Console Differences#

The first principle before installing the panel is to use a clean, official minimal operating system image. Standard Debian 12 or Ubuntu 22.04 LTS is recommended. Avoid application images with preinstalled LAMP, LEMP, or Docker templates, which may cause conflicts between underlying systemd services and the runtime environments later compiled by the panel.

When establishing the initial SSH connection and planning emergency access, cloud providers differ clearly in architecture and access control:

When preparing the environment in the server terminal, first update the package index and synchronize the time zone to avoid time discrepancies in later log audits and automated certificate signing:

# 同步系统时区为目标业务时区（例如上海时间）
timedatectl set-timezone Asia/Shanghai

# 更新底层基础包
apt update && apt upgrade -y

2. 规范安装、安全入口与三层 Networking 放行#

2.1 Install and Save the Credentials#

Run the unattended installation script for BaoTa's current official branch through an SSH terminal. Installation automatically configures the Python runtime sandbox and basic dependencies.

At the end of installation, the terminal prints four critically important pieces of credential information:

1. Public Control Panel Address(including a specific port and a randomized secure entry path, such as http://198.51.100.1:28888/a8b9c0d1）。
2. Private Network Panel Address。
3. 初始系统用户名（Username）。
4. Initial Random Password（Password）。

Key Operations: Immediately save this output in your local password manager. The part at the end of the URL/安全入口/是宝塔抵御自动化探测扫描的第一道屏障，若在浏览器中缺失该路径，服务器会直接丢弃连接或返回 404 错误。

2.2 Configure Allow Rules Across Three Firewall Layers#

许多运维人员常犯的错误是在遇到面板打不开时直接执行 ufw disable 或清空 iptables，这会使底层 Databases 与管理端口暴露在 public network 扫描之下。规范的 Networking 策略应维持清晰的“三层架构”：

客户端请求
   │
   ▼
┌──────────────────────────────────────────────┐
│ 第一层：服务商安全组 / 外部硬件防火墙        │ ── 默认策略：仅放行 80, 443 及自定 SSH/面板端口
└──────────────────────────────────────────────┘
   │
   ▼
┌──────────────────────────────────────────────┐
│ 第二层：系统级防火墙（nftables / iptables）  │ ── 由系统服务控制，拦截未定义端口的入站连接
└──────────────────────────────────────────────┘
   │
   ▼
┌──────────────────────────────────────────────┐
│ 第三层：宝塔系统防火墙插件                   │ ── 业务层限制：面板端口绑定独立域名与特定 IP
└──────────────────────────────────────────────┘

1. 业务端口放行: Expose only the following TCP ports fully to the public internet: 80 and 443。
2. Protect the Panel Port：
   • After logging in, open “Panel Settings” and change the default random high-numbered port to another uncommon port, preferably in the range 10240-65535）。
   • Bind a subdomain whose DNS is already configured and that is dedicated to administration, then enable a dedicated SSL certificate for the panel.
   • If your local broadband connection has a static public IP, restrict access to the management port to that IP in the panel's security rules.
3. Restrict SSH Port Exposure：
   • In BaoTa's “Security” menu, change the default port 22 to a custom high-numbered port.
   • Completely Disable SSH Password Authentication and Require ED25519 or RSA 4096-Bit Key Pairs for Login.

3. Runtime Configuration and Matching VPS Hardware Specifications#

Open “Software Store → Runtime Environment” in the panel and select the mainstream LNMP stack:Nginx + MySQL / MariaDB + PHP。在选择具体软件 Version 时，必须结合 instance 的硬件 resources 与上游应用的要求进行规划。

3.1 Memory and Storage Constraints#

Common entry-level to midrange VPS plans, such as BandwagonHost's basic plans or DMIT's PVM instances, typically provide 1GB to 2GB of RAM:

• Web Server: Choose the stable version of Nginx. Under high concurrency, its event-driven model uses far less memory than Apache.
• Database Components：
  • 1GB-Memory Plans: Avoid MySQL 8.0: its buffer pool and dictionary services have high startup overhead, making Linux OOM (Out Of Memory) process termination likely. The recommended installation is MariaDB 10.6+ or MySQL 5.7。
  • Open the database settings in the BT Panel, switch to “Performance Tuning,” and select the corresponding “1-2GB” optimization preset based on your server's memory.
• 虚拟 Memory （SWAP）托底：
  • With 1GB of memory, concurrent image cropping or resource-intensive SQL queries can easily crash the system.
  • Install “Linux Toolbox” from the software store and manually allocate 1024MB - 2048MB of SWAP space to keep services running during sudden memory spikes.

3.2 Plan the PHP Worker Pool#

• Production should use versions still within their official support lifecycle, such as PHP 8.2 or 8.3, rather than PHP 5.6 or 7.4, which have long lost security maintenance.
• Install the required extensions:opcache(script execution acceleration, required),redis(cache backend support),fileinfo(file-type detection).
• Note: If the VPS has less than 1.5GB of memory, when compiling and installing fileinfo extensions may fail because memory runs out. First confirm SWAP is active, or choose the precompiled “Fast Install” mode in the software store.

4. Website Deployment Standards and Linux Permission Boundaries#

4.1 虚拟主机与文件系统结构#

Go to “Websites → Add Site” and create the site following least-privilege and directory-isolation principles:

1. 域名绑定：填入根域名及 www subdomain.
2. Root Directory Planning: The default path is /www/wwwroot/yourdomain.com, never place multiple services in the same physical directory.
3. Databases 配置: Create a separate database in the website creation dialog, with a consistent character encoding of utf8mb4, preventing encoding errors when writing emoji or multilingual characters later.

When deploying code, check the directory structure after extracting the source:

/www/wwwroot/yourdomain.com/
├── wp-config.php (或 index.php，直接位于站点根目录下)
├── wp-content/
├── wp-includes/
└── wp-admin/

Do not nest an extra directory level beneath the site root (for example, if extraction results in /www/wwwroot/yourdomain.com/wordpress/index.php), which directly results in 403 or 404 errors.

4.2 Linux 所有权与权限基线#

权限混乱是网站出现“无法上传媒体”、“ Updated 插件提示输入 FTP”或“配置文件遭恶意覆写”的根源。宝塔环境下，Nginx 与 PHP-FPM 的运行身份均为 www user (whose group is www）。

Never resolve write errors by applying a global chmod -R 777. A compliant permissions baseline should follow these settings:

# 1. 递归更正站点所有权为 www 进程账户
chown -R www:www /www/wwwroot/yourdomain.com

# 2. 目录权限设定为 755（所有者可读写执行，访客只读与遍历）
find /www/wwwroot/yourdomain.com -type d -exec chmod 755 {} \;

# 3. 普通文件权限设定为 644（所有者可读写，访客只读）
find /www/wwwroot/yourdomain.com -type f -exec chmod 644 {} \;

# 4. 敏感配置文件加固（如 WordPress 配置文件，仅允许进程读取）
chmod 640 /www/wwwroot/yourdomain.com/wp-config.php

If using a third-party SFTP client as root identity to upload a new file directly, its ownership becomes root:root, causing PHP-FPM processes to be denied write access. Simply select the relevant directories in the panel's file manager and reset their owner and group in bulk to www and that is all.

5. URL Rewriting, SSL Automation, and Responding to Network Changes#

5.1 URL Rewrite Rule Mapping#

Under “Site Settings → URL Rewrite,” select the template that matches your application type:

• WordPress The rule essentially redirects all requests for paths that do not physically exist to index.php resolution.
• After saving the rewrite rules, do not test only by refreshing the homepage. Open an article with a deeply nested Permalink or visit /wp-json/ endpoint and confirm that the returned status code is 200 rather than 404 Not Found。

5.2 A Complete ACME Certificate Issuance and Renewal Workflow#

Go to “Site Settings → SSL” to automatically issue a certificate through a free CA such as Let's Encrypt:

• 签发前提: The domain must already resolve correctly to the current server's public IP, and external connections over TCP port 80 must be able to access /.well-known/acme-challenge/ validation directory.
• Force Redirection: Enable “Force HTTPS” only after the certificate has been successfully issued and the site opens in a browser without security warnings.

5.3 Cascading Certificate Effects of Provider Network Changes#

When managing multiple nodes, provider-specific networking features may disrupt existing domain-to-certificate mappings:

                    ┌──────────────────────────┐
                    │  域名 DNS 记录指向旧 IP   │
                    └──────────────────────────┘
                                 │
                 机房迁移变更 IP │ 导致映射失效
                                 ▼
┌───────────────────────────┐         ┌───────────────────────────┐
│ BandwagonHost KiwiVM      │ ──────> │ 自动化 ACME HTTP-01 续签   │
│ 执行 Migrate to other DC  │ 变更 IP │ 连接至旧节点失败并被阻断  │
└───────────────────────────┘         └───────────────────────────┘

• Downstream Effects of BandwagonHost Data Center Migration：
  • BandwagonHost supports migration between certain data centers through KiwiVM.The Instance's Public IP Changes After Data Center Migration。
  • Whenever the IP changes, immediately update all DNS records with your DNS provider. If the records are not updated, the ACME certificate renewal job that runs automatically every 60 days in the BaoTa panel will fail HTTP-01 validation, causing the SSL certificate to expire silently.
  • Note: if the instance's IP is on an external blacklist, KiwiVM may directly restrict data center migration.
• CDN 代理层协同：
  • If the site uses an edge proxy service such as Cloudflare, set SSL mode to “Full” or temporarily bypass the proxy while issuing certificates in BaoTa. This prevents CA validation requests from reaching the wrong edge node and timing out.

6. Troubleshooting Matrix, Quota Monitoring, and Lifecycle Disaster Recovery#

6.1 分层排障矩阵#

When a service malfunctions, troubleshoot from the bottom up through the protocol stack and service path instead of restarting the system without a clear purpose:

客户端 ──> Nginx (端口/SSL/反代) ──> PHP-FPM (FastCGI 进程池) ──> MySQL (数据库/Socket)

6.2 Traffic Allowance Monitoring and Provider Metering Rules#

Both providers strictly calculate bandwidth traffic and service periods. Use the BT Panel's “System Monitoring” to stay aware of usage levels during administration:

• DMIT Traffic Usage and Instance Lifecycle：
  • DMIT plan tiers use different traffic accounting rules and peak limits. Regularly check total monthly inbound and outbound traffic in the BT Panel.
  • Billing and Retention Policies: DMIT's monthly renewal invoices are usually7 Days Before Expirationgenerated. If an oversight causes the instance to be suspended for nonpayment, the provider generallyData Retained for Only 3 Days, after the deadline, the instance and disk data are permanently destroyed from the physical storage cluster and cannot be recovered.
  • During the initial testing period, pay attention to DMIT's refund limits under its terms of service: eligible new purchases may be refunded within 3 days with usage not exceeding 30GB; within 30 days, refunds are based on remaining value and subject to detailed conditions. Do not run extensive tests that exhaust the traffic allowance during validation.
• BandwagonHost Billing and Renewal Mechanisms：
  • BandwagonHost's systemDoes Not Automatically Charge the Linked Credit Card or PayPal Account；系统会在服务到期前 7 days生成账单，仅当账户余额充足时才会扣除余额续费。因此必须建立自主续费提醒，防止域名和业务因机器到期离线。
  • Refund requests within 30 days of a new BandwagonHost purchase require monthly traffic usage to remain below 10% of the quota. Data is also destroyed immediately after the refund is processed.

6.3 A Complete Off-Site Disaster Recovery and Backup Workflow#

Storage 在服务器本地磁盘目录（如 /www/backup/) is not a genuine disaster recovery solution. Host hardware failure, a data center network disaster, or deletion after an overdue invoice can wipe out every local image.

You must establish an automated off-site cold-backup pipeline spanning multiple providers:

┌─────────────────────────────────┐
│ 宝塔“计划任务”调度              │
└─────────────────────────────────┘
         │
         ├──── 每晚 03:00 ──> 导出 MySQL 结构与数据 Dump 文件
         └──── 每周日 04:00 ─> 打包站点目录压缩包（排除日志与缓存）
                                       │
                                       ▼
┌─────────────────────────────────────────────────────────────────┐
│ 存储插件分发（S3 协议 / 云存储 API / 异地独立存储服务器）       │
└─────────────────────────────────────────────────────────────────┘
                                       │
                                       ▼
┌─────────────────────────────────────────────────────────────────┐
│ 恢复演练验证：每月抽检归档文件，在测试节点导入以确保数据完整     │
└─────────────────────────────────────────────────────────────────┘

1. Configure the Storage Plugin: install an object-storage plugin from the BT Panel software store (such as standard Amazon S3, an S3-compatible cloud storage platform, or an FTP/SFTP storage client) and mount independent third-party storage separate from the source server.
2. Schedule Tasks：
   • Database Backups: schedule it to run in the early hours every day and retain the latest 14 backup copies.
   • Website Source Code Backup: a full backup once a week is recommended, with archive exclusion rules filtering out cache、tmp and log directories.
3. 备份有效性检验：单纯看到面板提示“任务已添加”并不意味着数据可救命。建议每季度拉取一份最新的异地备份压缩包与 SQL 转储，在本地或备用测试机上执行一次空库导入测试，确认 Databases 表结构无损坏、配置文件解密可用，方能构成真正闭环的运维底座。