Root password and SSH keys
Change the root password from the panel without the password ever being stored. You see where it is kept, how many days ago it changed and who changed it. The sshd settings, including PermitRootLogin, password login and the SSH port, sit on the same page as the authorised SSH keys.
- Topic
- E · Security
- Order
- 05 / 05
- Points
- 06
- Panel support
- 4 / 4 panels
- 01A 90-day policyA server whose root password is older than 90 days surfaces as a finding in the security centre.
- 02Password never storedOnly the vault path, the last rotation time and who did it are kept; the panel never shows it in clear.
- 03Three jobs, one rotationWrite to the vault, rotate the MySQL root password too, close open root sessions; each is one history line.
- 04sshd policyPermitRootLogin, password auth, port and two-factor are editable; changed fields are logged by name.
- 05Backup key is protectedThe backup agent’s key cannot be revoked; keys unused for 90 days count as dormant and are flagged.
What it does.
When you change the root password, the same screen lets you write it to the vault, rotate the MySQL root password and close open root sessions, so it is one job instead of three. Servers past 90 days appear as a finding, and you don’t need a calendar reminder. When you add a key, the panel checks that it is a valid public key. It also flags keys nobody has used for a long time, so you can remove them.
The password is stored nowhere. The panel keeps only the vault path, the last rotation time and who did it, and it never shows the password in the clear.
A 90-day rotation policy applies; a server past it shows up as a finding.
Rotation options: write to the vault, rotate the MySQL root password too, close open root sessions. Each goes into the history as one line.
The sshd policy is editable: PermitRootLogin, password authentication, port and two-factor. Changed fields are logged in the history by name.
New keys are parsed as real public keys (ed25519 and rsa), and the same fingerprint can’t be added twice.
The backup agent’s key can’t be revoked, because that would stop backups. Keys unused for 90 days count as dormant and are suggested for revocation.
Which panels support it?
Capability Root access and SSH keys
- yesManaged from the panel
- yesManaged from the panel
- yesManaged from the panel
- No panelyesManaged from the panel
Servers without a control panel have no account, reseller or mailbox management, because those come from the panel itself. Firewall, DNS, services and the terminal work over SSH. See the full table
Security
From the firewall to SSH keys, read per server.
- E.01Details Server security centreRun a server security audit across the whole fleet without building the checklist by hand. One table shows the firewall, login protection, WAF, malware scanning and two-factor state of every server. Anything missing becomes a finding with the server’s name on it, and it closes itself once you fix it.
- E.02Details Server firewall managementManage the firewall on every server from one screen, whatever runs it: CSF (ConfigServer Firewall), Plesk Firewall, firewalld or ufw. The panel reads the engine from the server and works through it. You add rules, edit IP lists and block countries on CSF in one place, instead of learning a different command set on each machine.
- E.03Details Brute force protectionWatch failed login attempts and blocked IPs on every server from here, and unblock an IP when a customer locks themselves out. The screen follows the tool your panel already uses: cPHulk on cPanel/WHM, Fail2Ban jails on Plesk, Brute Force Monitor on DirectAdmin. Thresholds and the allow list sit on the same page.
- E.04Details WAF and malware scanner statusSee which WAF rule set and which malware scanner runs on each server: Imunify360, ModSecurity with OWASP CRS, Atomic Basic or ClamAV. A scanner that is installed but stopped shows up as a finding, and so does one that was never installed. For now the screen reports state; rule editing and manual scans are still being built.
- E.05This page Root password and SSH keysChange the root password from the panel without the password ever being stored. You see where it is kept, how many days ago it changed and who changed it. The sshd settings, including PermitRootLogin, password login and the SSH port, sit on the same page as the authorised SSH keys.
Connect your first server today.
Free for 14 days, no card needed. Create your account, add your first server with an API token or an SSH key, and the panel starts filling in a few minutes later.
No setup fee · Cancel anytime · EU-hosted