Linked servers

If you manage several servers with the panel you can link them together: you see them in the menu under the logo and move from one to another already logged in, without typing the password again. The Linked servers page is reserved to administrators.

The server menu

The box under the logo (on the phone under More) shows the name and IP address of the server you are on. Press it to open the menu:

• at the top the current server, with a check mark;
• then the linked servers, each with a status dot: green online, red unreachable, orange error (for example revoked token or changed certificate), grey never checked;
• at the bottom Manage servers, which opens this page.

The menu also works from the keyboard: arrows to move, Enter to choose, Esc to close.

When you choose a linked server the panel asks that server for a one-time sign-on ticket (valid 60 seconds) and takes you to its panel already inside, as the user set in the link. If direct sign-on is not possible (server down, user missing, token revoked) the login page of the remote server opens and you log in with its password.

Only administrators see linked servers and move between them. Resellers and users see only the server they are on: for them the menu shows just the current server.

Linking a server

1. On the remote server, as root, create an API token with sudo panel-agent token -name link. The command prints the token (it starts with pnl_; keep it, it is not shown again) and the lines to add to /etc/panel/agent.yaml under auth.tokens; then restart the remote panel with sudo systemctl restart panel-agent.
2. Here, press Add server and enter the name (as you see it in the menu), the panel address (for example https://server2.example.com:8443), the token and the user on the remote server (the administrator you log in as, usually admin).
3. Press Continue: the panel connects to the remote server and shows name, version and certificate.
4. Check the certificate fingerprint. If the remote server uses the panel's self-signed certificate, compare the fingerprint shown with the one the remote server shows on its Linked servers › This server page (or with openssl x509 -in /etc/panel/tls/agent.crt -noout -fingerprint -sha256). If they match tick I compared the fingerprint and press Link server. With a certificate from a public authority (for example Let's Encrypt) the check is automatic.

From then on the panel connects to the remote server only if it presents the same certificate: if it changes, the status becomes “error” and direct sign-on is blocked until you verify the new certificate (Edit button).

The token is stored encrypted and is never shown or returned by the panel again; with Edit you can replace it.

Status and checks

The panel checks every linked server every 60 seconds (version, hostname, IP address, disk space) and shows the result in the list. Check now repeats the check right away. Remove deletes only the link: the remote server is not touched; remember to revoke its token by removing it from auth.tokens in /etc/panel/agent.yaml on the remote server.

This server

At the top of the page you find hostname, IP address, version and certificate fingerprint of this server: the data needed to link it from another panel.

Activity log

Every hop between servers ends up in the activity log of both servers: on the starting one “direct sign-on to …”, on the destination the ticket login, with the origin address.