Back to Changelog
Panel Backend
v1.0.399
SSH/SFTP account isolation and per-account resource limits were rebuilt, a server-wide outage caused by the resource-visibility service was fixed, and Let's Encrypt became reliable during domain creation — including expired certificates that had silently stopped renewing.
New Features
3- Unified SSH/SFTP account management: the account list now shows every account that can reach the server, including ones a plan grants automatically. Per-account command allowlists restrict a full-shell account to a chosen set of commands plus a baseline that cannot be removed; an in-panel terminal opens directly into the account's own isolation.
- Full-shell accounts get PID and mount namespace isolation on top of the filesystem jail (on by default for new installs); where the system cannot provide it, the panel now records the isolation the account actually has instead of claiming otherwise. Namespace-isolated accounts now survive server reboots (bind mounts are rebuilt automatically if missing).
- Deleting an SSH account now asks whether to keep or remove its files (defaulting to keep) and never removes a directory the account did not exclusively own, such as a shared home.
Improvements
3- The SSH session prompt is now rendered correctly (previously could print its own template on jailed accounts) and is consistent across every supported distribution; it correctly labels the session as isolated, jailed, or restricted instead of always saying "restricted". htop/top inside a session now draw one CPU meter per core the account owns and follow live limit changes. Custom-home accounts now see the same home directory from both the terminal and SFTP.
- New bundled lxcfs 6.x is deployed automatically on distributions whose native lxcfs predates 6.0, restoring accurate swap reporting inside tenant sessions; distributions already on 6.0+ are left untouched, and it now appears correctly in the installed-services list.
- Changelog entries now carry the product they describe, so a language-pack or frontend version number is never displayed as the panel/backend version.
Bug Fixes
4- Fixed several SSH jail construction bugs from this rework: jails could end up with dash silently installed as /bin/bash instead of a real bash; SFTP-only jails on AlmaLinux/Rocky could be built without the SFTP server binary; a path layout change briefly broke every new SSH login with "failed to run command /bin/bash: No such file or directory". All three are detected and repaired automatically at startup for accounts already affected.
- Let's Encrypt is now actually attempted during domain creation: a self-signed bootstrap step was silently overwriting the certificate-provider flag before Let's Encrypt could run, so success was falsely reported without a real certificate ever being issued. SSL failures are now recorded with a reason and the domain owner is notified, and a new automatic retry scheduler upgrades temporary self-signed certificates to Let's Encrypt once DNS resolves (checked at startup, then every 6 hours, rate-limit safe with backoff). SSL is no longer restricted by plan and is enabled by default for every domain.
- Certificates that had already expired were dropped from the renewal query entirely — because it required an unexpired ssl_expiry_date — so an expired Let's Encrypt certificate was never retried again, and the "expiring in 7 days" warning skipped it too, meaning the site kept serving an expired certificate with no automatic renewal and no notice to the customer. The expiry condition was removed; the existing per-certificate renewal backoff (3 failures -> 3 days, 5 -> 7 days) still protects against hammering the ACME rate limit.
- User deletion is now refused while one of the user's domains is still provisioning, preventing an orphaned web-server config from a race between deletion and domain creation. A new startup self-heal quarantines poisoned or orphaned vhost files and restarts Apache automatically when its configuration is clean but the service is down, so one failed domain creation can no longer take other customers' sites offline.
Security Fixes
4- Per-account resource limits (CPU, memory, swap, process count) and disk quota are enforced by the kernel for every SSH/SFTP account, including standalone accounts created without a panel user, which previously had no ceiling at all. Limits are written to durable systemd configuration so they persist across sessions and reboots, not just the transient cgroup created at account creation, and edits made in the panel now take effect immediately.
- Tenant filesystems are mounted nosuid,nodev, so SUID binaries reachable inside a jail (pkexec, su, mount) can no longer be used to escalate privileges.
- Fixed a background cleanup task that could delete a healthy standalone SSH or FTP account: it recognised accounts from the wrong table, so any account created without a panel user looked unowned and had its Linux user, home directory and resource limits silently removed while the panel still listed it as active.
- Critical stability fix: lxcfs is no longer restarted while its filesystem is in use — doing so could leave the mount unusable and hang every service on the server, including SSH logins (root cause of a full server outage). Added an automatic startup repair that detects and recovers an unusable lxcfs mount, a longer/safer restart budget, and consistent use of the Central-managed lxcfs build on every distribution.