HostPanel 2.2.0 · Linux hosting control panel
Sixty-nine verbs, each with validated arguments, in one audited file. No generic
sudo rule, no shell escape, no plugin that quietly widens the surface.
Anything not on the list is refused — including by us.
Ubuntu 22.04 / 24.04 · Debian 12 / 13 · Rocky 9 / 10 · AlmaLinux 9 / 10 · one script · no agent, no phone-home
01 / Why
Every panel lists the same features. Fewer can tell you what an attacker reaches after compromising one customer's PHP — or one panel account. Three answers HostPanel is built around.
The panel process is not root. Privileged work goes through a single wrapper
with an enumerated verb list and validated arguments. A rule like
sudo certbot * is root by another name — --deploy-hook
runs whatever it is handed — so those rules do not exist here.
Each account gets its own PHP-FPM pool running as its own user, its own
directory tree, and database grants scoped to its own databases. There is no
server-wide GRANT ALL to hand out, and remote database access is
never opened by default.
Administrator actions are written to a hash-chained audit log that can be verified from the panel. Least-privilege profiles narrow what each administrator may do at the API boundary, and API tokens carry scopes rather than full authority.
02 / What it runs
Linux only, on purpose. Windows hosting is not included and is not planned.
03 / Migrating
Accounts, sites, mail and databases import from cPanel, DirectAdmin and Plesk. The comparison below is about architecture, not feature counts — everyone has the features.
| HostPanel | Typical panel | |
|---|---|---|
| Panel process | Unprivileged service account | Often root, or root-capable |
| Root actions | 69 enumerated verbs | Broad sudo rules or a daemon |
| Extensions | Ed25519 signature required | Frequently unsigned archives |
| Admin authority | Least-privilege profiles | Usually all-or-nothing |
| Audit trail | Hash-chained, verifiable | Plain log file |
| Firewall | In the panel, cannot lock you out | A separate tool, usually CSF |
| Licence | Unlicense — public domain | Per-account fee, and rising |
04 / Billing
Modules for the systems below turn an order into a signed event. Events enter the same audited job queue as every other provisioning action, so a failed signup is a job you can read, retry and explain — not a silent gap between two systems.
One script on a clean Ubuntu 22.04/24.04, Debian 12/13, Rocky Linux 9/10 or AlmaLinux 9/10 machine. It selects APT or DNF, UFW or firewalld, AppArmor or SELinux, the correct service names and the correct PHP/vhost layout from the detected platform. Existing firewall policy is preserved.