ihttpd web-server configuration
A built-in web-server is automatically set up for software products based on COREmanager.
Automatic configuration of the built-in web-server
The built-in web-server automatically listens to port 1500 of the main IP address (both IPv4 and IPv6).
Different ways to configure the built-in web-server
You can configure the web-server to listen to certain IP addresses and ports either through the command line or the configuration file.
If you specify settings in the configuration file, the configuration parameters that were specified in the command line will be ignored.
When starting the web-server you can specify a specific IP address and port to listen. For more information about this function start the web-server using the -h key.
For more flexible configuration of your built-in web-server, you can use the file etc/ihttpd.conf of a COREmanager 5-based software.
In the listen section of that file you can specify IP addresses to listen:
ip <IP address to listen>
port <port to listen>
certkey <path to the file key of the SSL-certificate>
cert <path to the SSL-certificate's file>
- The IP address is a mandatory parameter
- Other parameters are optional
- If the "port" parameter is not specified, the default port (1500) of the built-in web-server will be used
- Both the "certkey" and "cert" parameters must be specified. You cannot specify only one parameter.
- If the certificates' paths are not specified, the built-in web-server will use a self-signed SSL certificate that was created automatically
- If the redirect parameter is specified, users won't be able to access the panel through HTTP. HTTP requests will be sent to the same URL through the HTTPS protocol. (we do not recommend that you use this option for VMmanager and DCImanager, as it may cause errors when running OS installers). If you install the panel from packages, redirect is specified by default except for VMmanager and DCImanager.
- If the status parameter is present, when accessing the specified URL, the built-in web server will generate the status page (displaying, in particular, the number of active connections). This function is disabled by default;
- If the nochunked parameter is present, the built-in web server will add the Connection: close header to all responses: this will force clients to use a new connection for each new request. This parameter has been added to integrate the built-in web server with nginx;
- The parameters allow_ip or deny_ip allow or deny access to certain URLs. URL must not contain domain or port — only the path after the port, for example mancgi/dbadmin. The rules are processed in the order they appear in the list. If there are conflicting rules, the rule higher in the list will be applied first. If there is an allowing rule, then for the specified url, all IPs which do not fall under the rule are considered prohibited;
- ssl_cipher — the parameter for configuring SSL encryption. The format of the string corresponds to the priorities parameter of the gnutls_priority_init function. E.g., NORMAL:-AES-128-CBC. Default value: NORMAL:-VERS-SSL3.0.
- timeout — maximum time of inactivity of the session. Default value — 600 sec.
The IPMI proxy via ihttpd module has been developed for DCImanager. In this connection, a new section — ipmiproxy — has been added:
ipmiproxy_startport <Port range start>
ipmiproxy_endport <Port range end>
- Port range start — the start of the range of ports that use proxying when opening the JAVA console by a user. Default value — "49000". This field is available in version 5.157 or higher;
- Port range end — the end of the range of ports that use proxying when opening the JAVA console by a user. Default value — "50000". This field is available in version 5.157 or higher.
The built-in web-server will listen to all IPv4 addresses available using the default port ("*" equals "0.0.0.0")
The built-in web-server will listen to IPv4-address 18.104.22.168
The built-in web-server will listen to IPv4-address 22.214.171.124 on port 1700
The built-in web-server will listen to IPv4-address 126.96.36.199 on port 1700 and the etc/my.crt file of the etc/my.key SSL certificate with the key for SSL requests (https)
The built-in web-server will listen to all IPv6 addresses available on the default port
The built-in web-server will listen to IPv6-address 2001:db8::ae21:ad12 on port 1800
For the client with the address 188.8.131.52/24, access to 184.108.40.206/ispmgr is allowed, and for all others /ispmgr is prohibited:
allow_ip ispmgr 220.127.116.11/24
For clients with the address in the range 18.104.22.168-22.214.171.124. access to 126.96.36.199/ispmgr is prohibited, and for all others /ispmgr is allowed.
deny_ip ispmgr 188.8.131.52-184.108.40.206
After you have modified the ihttpd configuration file, restart the service:
CentOS 7, Debian 8:
systemctl restart ihttpd
By default COREmanager opens at
E.g. to open ISPmanager by default, create the file containing ispmgr
The connection remains active for one hour.