How accounts are separated

Account separation

Each hosting account runs in its own set of containers, on its own network. CPU and memory limits are set on each container. Turning an optional service off (the file manager, Adminer, SFTP, cron or MariaDB) removes that listening service for the account.

Sign-in

Two-factor authentication is required for administrators, and it cannot be turned off for them. Resellers must use it as well. Panel forms use a CSRF token. Sign-in attempts are limited to 15 in 15 minutes. You can also restrict the admin area to a list of IP addresses.

There is no default admin password. The installer writes a generated password to a root-only file on the server. The web file manager has its own user, created when the account is provisioned, not a shared default login.

Database passwords are encrypted at rest with AES-256-GCM. The panel reaches Docker through a proxy that only allows the calls it needs. Image builds and image patching through that proxy are turned off.

The server

Administrators manage host firewall rules, Fail2Ban jails and banned addresses. Clients can limit their SFTP port to an allow list of IPs. A cPanel import can scan files with ClamAV, when it is installed, and with PHP webshell checks.

Reviews

SmashPanel has had internal code reviews. It has not had an independent security audit.

Report a vulnerability

Read the vulnerability disclosure policy. Email security@smashpanel.com. A contact file is at /.well-known/security.txt.

The longer version of this page, written as a guide, is in the security article.