Web Terminal

The Web Terminal is a full command line to the server, inside your browser: a real shell, no SSH client, no separate login. It is a power tool for the server owner, and because it opens a genuine root shell, it is walled off behind several locks that this page explains plainly.

What it is

The terminal is a real xterm.js console wired to the server over an encrypted WebSocket (WSS), authenticated with your session token. Behind it, the panel opens a genuine PTY running /bin/bash as root. That is the whole point and the whole risk: what you type runs on the server with full privileges, exactly as if you had SSH'd in as root. There is no sandbox, no chroot, no throttle, because this is the administrator's own shell, not a customer feature.

You can open multiple tabs (each its own independent session), resize freely, and click links in output. Copy and paste work as they do in any terminal.

The three locks

Access is enforced independently at three layers, so a gap in one does not open the door:

1. ROOT only. The menu entry, the page and every backend endpoint each require the ROOT role. Administrators, resellers and users never see it and cannot reach it, even by typing the URL.
2. A licensed feature. The terminal is the web_terminal license feature. It ships enabled so existing servers are not broken by the gate, but a provider can switch it off centrally, and when off it disappears for everyone, ROOT included.
3. High Security 2FA. When High Security Mode is enabled, opening the terminal demands a fresh two-factor code for the session before the shell appears. This is the defense against a stolen ROOT session: a hijacked cookie alone no longer opens a root shell.

On top of these, the terminal is completely disabled in demo mode, and the WebSocket checks the request origin to block cross-site connection attempts.

Saved connections: reach other servers

The terminal doubles as an SSH client to remote servers. Save a connection (name, host, port, username, and either a password or an SSH private key) and open a tab straight into that machine. Your saved credentials are encrypted at rest and never returned to the browser, so an edit form shows only that a secret is set, never the secret itself, and each connection is private to the ROOT user who created it.

Access

Strictly ROOT, at the menu, route and backend alike, behind the web_terminal license feature and, when enabled, High Security Mode 2FA. The same root-shell capability is available to the Panelica mobile app and to External API clients through their own ROOT-gated, short-lived-ticket channels; those variants do record a session entry, while this in-panel terminal does not.