KoaPanel
IT Try it free
All manual sections

DocumentationWeb terminal

Web terminal

Administrators can open a server shell in the browser, without an SSH client.

  • Server › Terminal: the server's root shell.
  • In a site's details, Terminal tab: a shell as the site's Linux user, in its folder, with the site's PHP version, composer and wp-cli already in the PATH. It is not a root shell: it sees and changes only what the site user can see and change.

Opening a session

Click Open terminal and enter your password again. Copy and paste: select the text and use Copy/Paste or Ctrl+Shift+C and Ctrl+Shift+V (Ctrl+C still interrupts the command). The window follows the size of the page.

Security

  • administrators only, never while impersonating another user or with an API key;
  • password required every time; after 5 wrong attempts in 15 minutes you have to wait;
  • not available when the panel is opened without HTTPS, nor in the public demo;
  • the session closes after 15 minutes of inactivity (configurable) and in any case after 8 hours; at most 5 sessions at the same time;
  • every opening and closing goes into the activity log with user, IP address, duration and reason for closing;
  • if you turn on recording, session output is saved in /var/log/panel/terminal, readable only by root, and deleted after 30 days.

Open sessions are listed under the terminal and can be closed from there.

Settings

In Server › Security, Web terminal box:

  • Terminal enabled: turn it off to disable it completely;
  • Who can open the root shell: only the main administrator (the first one created, default), all administrators, or nobody. Only the main administrator can change this choice;
  • Record session output;
  • Close after minutes of inactivity (1 to 240).

The shell of the accounts

From 0.73.0 the accounts can also have a terminal in their site (Terminal tab of the site page), like cPanel's jailshell. It is off until the administrator turns on Shell for the accounts in the terminal settings; a package can take it away with the included functions.

The account's shell is closed in the site: it runs as the site user, the system is read-only, it writes only in the site's folder, the other sites and the panel's files can't be seen, it has its own temporary folder and can't gain privileges (no sudo). The site's PHP, WP-CLI, Composer and Git are there. Opening it needs the account's password again; the people of the Team don't have it. Every session goes into the activity log.