A user asked me a blunt question: "If I give FlashPanel SSH access to my servers, how do I know it won't leak? Even you can't guarantee that."
Fair. And this week I got a good example to answer it with.
I'm trialing another popular server management panel. Last week they sent me two emails. The first said they couldn't connect to my demo server, which means their system connects to customer VPSes every day. The second said PHP had shipped a security fix and they were already installing it on my servers, nothing for me to do.
That's genuinely convenient. It also means their system can get into your server at any time, without you being there.
FlashPanel goes the other way:
- The root password you enter when adding a server is used once for the initial setup and never stored.
- Each server gets its own SSH key, and private keys are encrypted per account.
- The panel never connects to your server on a schedule. Things only run while you're using the dashboard, or through automations you turned on yourself, like SSL renewal or deploy on push.
- You can cut access any time: remove FlashPanel's key from
authorized_keys and that's it.
The trade-off showed up during last week's PHP CVEs. The hotfix was ready, but it only ran on a server once its owner opened the dashboard, so I had to go remind people to log in and update. Slower, but the keys stay in your hands.
There's no right answer for everyone. Some people want the panel to handle everything, some want to hold the keys themselves. Which side are you on?commit 1fcaad9