Repository navigation
New: Panel Apps
Five optional modules, installed from the App Store. Each adds its own page to the panel.
- Website Statistics: visitors, page views, IPs, traffic, search-engine bots and AI crawlers, countries, top pages, browsers and devices, status codes, error log. Hourly and daily trends with comparison, plus live requests.
- Network Scan Detection: detects port scanners and blocks them. Includes block records, a real-time probe log and a whitelist.
- Network Threat Detection: checks traffic against threat lists (watch-only or block mode) and catches outbound connections to botnet servers. Has an IP lookup and optional deep packet inspection (Suricata).
System Hardening:
- watches or locks users, SSH, scheduled tasks, services, start-up files, system programs and your own folders, with a pause for maintenance
- a process guard for things like crypto miners
- a security score with one-click fixes
- a log of sign-ins and admin commands
PHP Security: a PHP protection module (Snuffleupagus) built for each PHP version. Each rule can block, log only or be off. You can mark trusted folders, and each event shows the script, line and visitor.
Every App is isolated: its own data folder, firewall table, services and code. If an install, update or removal fails, it goes back automatically. No App ever blocks an address an admin signed in from in the last 7 days.
App Store
- Server software and Apps are in one list.
- “Update available” is a button. It shows the packages involved and updates in place, keeping your configuration files.
- Update badges appear only when your server can actually install the update. Distribution fixes with the same version number show as “Security update”.
- PHP’s “Add version” list hides versions that are already installed.
- Version lists show plain versions, without “recommended”.
- Version pickers are tighter and sit on one line with Install.
- BIND9 shows real versions: 9.20.30 stable, 9.21.27 development, 9.18 end of life.
Fixes (19 from the audit)
- Uninstall safety: uninstalling Python or PHP could remove the system’s own Python or every PHP version.
- ModSecurity: removing it no longer breaks Nginx reloads. On RHEL-family servers it now works with Apache.
- Firewall:
- UFW block rules now take effect.
- firewalld changes no longer wipe fail2ban bans.
- firewalld “Limit” is now a real rate limit.
- Load Balancer:
- re-saving no longer resets the domain, port or cookie name
- it can’t take over all traffic on ports 80/443
- health checks are fixed for backends without a port, IPv6 backends and local sockets
- it refuses ports already in use, and simultaneous saves no longer conflict
- The broken “Nginx Load Balancer” App Store entry is removed. Its Uninstall could delete your live configuration.
- Anti-CC no longer bans visitors for loading CSS, JS, images and fonts.
- Malware scan: long scans are no longer reported as stopped, so a second scan can’t start on top of one.
- WAF: deleting the last region rule no longer disables country conditions, large IP blacklists work, and simultaneous saves no longer overwrite each other.
- Viewer role can no longer read server logs.
- App Store no longer shows MySQL as unavailable when PostgreSQL or MongoDB is installed.
- Plugins can’t override panel code or each other’s code, and plugin pages no longer reset when another plugin page loads.
An independent code review of the new code also found 13 problems, mostly race conditions; all are fixed and re-tested in this release.