You can switch DirectAdmin to use SSL instead of plain text. → https instead of http on port 2222. Note that this is for the DirectAdmin connection on port 2222, *not* for apache.
If you do not have your own certificates, you'll need to create your own:
/usr/bin/openssl req -x509 -newkey rsa:1024 -keyout /usr/local/directadmin/conf/cakey.pem -out /usr/local/directadmin/conf/cacert.pem -days 9999 -nodes <code> <code> chown diradmin:diradmin /usr/local/directadmin/conf/cakey.pem chmod 400 /usr/local/directadmin/conf/cakey.pem
This is the old method, use either the one above, or this one. The end result is the same, but takes more steps.
openssl req -new -x509 -keyout /usr/local/directadmin/conf/cakey.pem.tmp -out /usr/local/directadmin/conf/cacert.pem -days 3653
openssl rsa -in /usr/local/directadmin/conf/cakey.pem.tmp -out /usr/local/directadmin/conf/cakey.pem
rm -f /usr/local/directadmin/conf/cakey.pem.tmp chown diradmin:diradmin /usr/local/directadmin/conf/cakey.pem chmod 400 /usr/local/directadmin/conf/cakey.pem
Paste these one at a time as the first 2 require user input)
If you already have your own certificate and key, then paste them into the following files:
certificate: /usr/local/directadmin/conf/cacert.pem key: /usr/local/directadmin/conf/cakey.pem
Edit the /usr/local/directadmin/conf/directadmin.conf and set SSL=1 (default is 0). This tells DA to load the certificate and key and to use an SSL connection. DirectAdmin needs to be restarted after this change.
If you also have a CA Root Certificate, this can be specified by adding:
carootcert=/usr/local/directadmin/conf/carootcert.pem
into the /usr/local/directadmin/conf/directadmin.conf file (won't exist by default) and by pasting the contents of the caroot cert into that file.
Note, as of 1.30.2, you can set the value of the SSL redirect should a User connect to an https connection with plaintext http. option to specify the redirect host value when http is used on an https protocol
As of 1.33.3, you can enable a ssl cipher to force SSLv3, and disable SSLv2: ssl_cipher option to force SSLv3