/PLAYBOOK · 2026-08-27

BT Panel Security Hardening in Practice: Server Management Panel Defensive Configuration

Hands-on BT Panel security hardening: change the security entry, bind a domain, restrict source IPs, enable BasicAuth and SSH key login. Stops panel takeover from weak passwords and unauthorized access.

Applicable scenarios

BT Panel (Baota) hardening for Linux servers managed with BT Panel. The panel defaults to port 8888 and, once logged in, holds near-total server admin rights. If the entry URL or password leaks, or a public scanner hits it, an attacker can take the host in one shot. This procedure covers initial hardening of a fresh panel and remediation of existing servers.

Prerequisites

BT Panel installed (7.x or later); `bt` command available
root via SSH
Management workstation has a fixed public IP (for the source allowlist) or a standby domain is ready
Snapshot backup of panel data and site directories before hardening

How it works

Default BT Panel config has three risks: fixed port 8888 is mass-scannable, security entry is a fixed path, login is password-only. Once a scanner finds the port and brute-forces a weak or reused password, the attacker gets file manager, databases, cron—everything. Hardening model: hide + isolate + second factor. Change port and security entry to cut scan hit rate. Bind a domain and source IP for access isolation. Enable BasicAuth as an extra HTTP auth layer.

Procedure

1. Change panel port and security entry

`bt
# In the interactive menu, enter the number:
# 8  = change panel port (e.g. 28888)
# 14 = change security entry (generate a random path, e.g. /a1b2c3d4)
# 9  = change panel username
# 10 = change panel password
# After the changes, run
/etc/init.d/bt restart`

2. Bind domain and source IP

Panel Settings > Security:

Panel domain: bind `bt-admin.example.com` and point DNS at this host. Requests without a matching Host header are rejected.
Server IP: allow only the management workstation's fixed public IP; all other sources get 403.
In the cloud security group / firewall, open the new port 28888 and delete the old 8888 allow rule.

3. Enable BasicAuth second factor

`# Panel Settings > Security > BasicAuth, set a username/password and enable it
# Effect: when the browser visits the panel URL, a BasicAuth prompt appears first; only after it succeeds do you reach the panel login page`

4. SSH and firewall fallback

`# Generate a key pair and disable root password login
ssh-keygen -t ed25519
ssh-copy-id root@SERVER_IP
sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
# Firewall: allow only the required ports
firewall-cmd --permanent --add-port=28888/tcp --add-port=22/tcp
firewall-cmd --reload`

5. Stay current and back up

`# On the panel home page, run Update regularly and watch security advisories
# Settings > Backup, enable daily automatic backup of sites and databases to object storage`

Verification

From a non-allowlisted IP, access `https://SERVER_IP:28888/SECURITY_ENTRY`; expect 403.
Hit old port 8888 from a public IP; expect timeout or refused.
Browse to the panel domain; BasicAuth prompt must appear first.
Run `ss -tlnp | grep 8888`; confirm the old port is not listening.

FAQ

FAQ 1: Forgot panel password or security entry?

SSH in, run `bt`, pick 10 (change panel password) and 14 (view/change security entry). If you forgot the server root password, reset it from the cloud console first.

FAQ 2: Cannot reach the panel after binding a domain?

Confirm the domain resolves to this host IP and CDN proxy is off. Confirm the browser uses `https` (panel SSL is on by default). Confirm the cloud security group allows the new port. Any one missing blocks access. Fall back to IP + security entry for troubleshooting.

Summary

BT Panel hardening is cannot-find, cannot-enter: randomize port and security entry, bind a domain and restrict source IP, stack BasicAuth, fall back to SSH keys and a firewall. After hardening, check panel updates and login logs on a schedule. Put the panel in the server security baseline so a lost admin entry does not take the whole site.