Skip to main content
protocols.pageprotocols.page
9500

Port 9500 – ISPConfig

TCP

Port 9500 is the ISPConfig server management panel port. ISPConfig provides web hosting, email, DNS, and database management for Linux servers. The panel on port 9500 gives full server control. Restrict to admin IPs and enforce HTTPS – compromised ISPConfig access means complete server takeover.

Port Number

9500

Protocol

TCP

Service

ISPConfig Control Panel

Range

IANA Registered (1024–49151)

Description

ISPConfig on port 9500 is an open-source hosting control panel (alternative to cPanel/Plesk) for Debian/Ubuntu servers. It manages Apache/Nginx vhosts, Postfix/Dovecot mail, BIND DNS zones, MySQL/MariaDB databases, and FTP accounts through a web interface. The ISPConfig panel on port 9500 provides root-equivalent access to all hosted services. An attacker with panel credentials can: create shell accounts, modify DNS to redirect traffic, read all email, access all databases, and upload webshells. Secure with: strong admin password, IP restriction via iptables, HTTPS with a valid certificate (not self-signed), and fail2ban monitoring of login attempts.

Security risks

  • 1Full server control exposure – ISPConfig manages DNS, mail, web, databases, and FTP. A compromised panel grants root-equivalent access to all hosted services.
  • 2Default self-signed certificate – installations ship without a valid TLS cert, training admins to ignore browser warnings and enabling MITM of credentials.
  • 3CVE-2020-7110 – Authenticated remote code execution via the PHP-FPM version field in ISPConfig < 3.1.15p3 allows shell injection as root.
  • 4Shared hosting privilege escalation – misconfigured suexec or PHP-FPM pools allow one hosted client to read another client's files through the panel's user isolation.

Firewall guidance

Restrict port 9500 to specific administrator IPs only. Never expose to the public internet. Use a VPN or SSH tunnel for remote administration. If multiple admins need access, front with a reverse proxy providing client certificate authentication.

Diagnosis commands

Verify ISPConfig is responding and identify version from login page

shell
curl -sk https://localhost:9500/login/ | grep -i ispconfig

Check which process is listening on port 9500

shell
ss -tlnp sport = :9500

Verify ISPConfig's configured port in server configuration

shell
grep -r 'server_port' /usr/local/ispconfig/server/lib/config.inc.php

Usage examples

Port 9500 – ISPConfig
shell
https://server:9500/ (ISPConfig login)
iptables -A INPUT -p tcp --dport 9500 -s ADMIN_IP -j ACCEPT
ispconfig_update.sh (updates panel)

Common services on this port

ISPConfigcustom admin panelsSAP HANA (alternate deployments)

Related ports

8080

HTTP alternate (Webmin/Virtualmin)

2087

cPanel WHM (competing panel)

10000

Webmin admin panel

History

ISPConfig originated in 2005 as an open-source alternative to cPanel. Port 9500 was chosen to avoid conflicts with common web ports. The project migrated from a custom web server to Apache/nginx with PHP-FPM, keeping 9500 as the convention for the control panel vhost.

FAQ

How do I change the ISPConfig port from 9500?

Edit /etc/apache2/sites-available/ispconfig.conf (or nginx equivalent), change the Listen and VirtualHost port, then update the ISPConfig server config at /usr/local/ispconfig/server/lib/config.inc.php. Restart both the web server and ISPConfig.

Is ISPConfig on port 9500 safe to expose publicly?

No. Even with strong passwords, the panel surface is too large (file manager, shell access, database admin). Always restrict via firewall to admin IPs or access through VPN/SSH tunnel.