Features / Security
Built like it controls root. Because it does.
A hosting panel runs with root power, so we treat it that way. Below is what ships today. Every mechanism is implemented and verifiable in the source, and is awaiting independent review. That outside testing is what the beta is for.
Logins
Strong sign-in for everyone, required for staff.
- Passkeys: fingerprint, face, screen lock or security key
- Authenticator 2FA, which can be required for admin and reseller accounts
- Login lock after 4 failed attempts, with a fail2ban jail behind it
- New-IP login alerts and a session manager
- Hashed API tokens with scopes, expiry and IP pinning
- Bcrypt passwords; passwords never on a command line or in logs
Account isolation
Each hosting account is isolated by design.
- One PHP master per account with its own CPU, memory and process limits
- Sandboxed website PHP: system files read-only, other accounts' processes hidden
- Homes closed to other accounts by permissions
- Private /tmp for cron jobs and app daemons
- No symlink creation from PHP or cron
- Separate limits for cron jobs and daemons
- No PHP in upload folders for new domains
- The panel runs as its own user, apart from the web server
At the edge
Jails, shields and a firewall at the edge.
- Fail2ban jails for SSH, web, mail, FTP and the panel
- Scanner jail bans IPs probing for .env and .git files
- Bot shield per domain blocks mass-scan traffic
- UFW firewall manager with SSH guard and a never-ban list
- SSH keys first: password login only switches off once a key is in place
- FTPS only, chrooted, with shell-less users
Watching & updating
Notice changes and stay current.
- Security Advisor: a scored checklist with a fix link for each item
- Signed releases and updates, checked before anything runs
- Auto-rollback if an update fails its health check
- File integrity watch and egress watch for new outbound connections
- Upload antivirus and nightly malware scans
- Mail guard holds mail from mailboxes that look hacked
Honest limits
What isolation does not cover yet. We'd rather you hear it from us.
The panel reads every home. It runs as its own user, but it can read all hosting accounts' files so it can manage them.
The web server reads website folders. OpenLiteSpeed can read every docroot, including config files such as wp-config.php.
Shared /dev/shm for websites on the same PHP version. Website PHP is kept apart from cron jobs, apps and the host, but sites on the same PHP version still share one.
Native code ignores open_basedir. PHP's folder limits don't stop compiled programs a customer runs.
The database server and disk are shared. Per-account limits cover PHP, cron and daemons; MariaDB and storage are shared by all accounts on the server.
Not yet independently reviewed. Everything here is implemented and awaiting independent review. Found something? Email info@karnakpanel.com.