Security
A control panel holds the keys to every site, mailbox and database on a server. LamaCP is built so that a mistake in one place does not hand those keys over.
An unprivileged panel
The web panel runs as its own user in a systemd sandbox. It cannot change the system itself; it asks a small root service, which accepts only a fixed list of operations.
No shell
Programs are started with argument lists, never through a shell. Every name, domain and path is checked before it reaches the root service, and paths are confined to the account's home.
A sign-in page nobody finds
The panel answers on its own port, at a secret address chosen at installation. Everything else returns nothing, so scanners do not find it.
Two-factor sign-in
With any authenticator app, and backup codes for when the phone is lost. Failed sign-ins are slowed down and banned by fail2ban.
Separated accounts
Each customer is a Linux user with its own PHP pool, files, quotas and database users. Customers cannot see each other; resellers see only their own customers.
Signed updates
Releases are signed. The installer and the updater refuse anything whose signature or checksum does not match, and an update that does not start is rolled back.
A firewall
nftables opens only the ports the server's services need, and keeps your SSH port open.
An audit log
Every privileged action is written down with who did it and when, including actions taken while signed in as someone else.
Found a security problem? Please tell us first at security@lamacp.com so we can fix it before it is known.