PremiumComes with the add-on reqad-account. Installing add-ons
Account panel
The account panel gives each hosting account a control panel of its own, at https://<your server>:2083/. The people you host manage their own sites, mail, databases, files and WordPress there, without access to the server panel on port 2087 or to any other account.
reqad-account, see installing an add-on. It is separate from Reqad Hosting Pro: each works without the other. This page is for the server's admin; the pages after it describe what accounts find in their panel.Install
dnf install reqad-account
The install sets everything up: the panel's service, an nginx server on port 2083 with the same certificate as the server panel, port 2083 in the firewall, and Accounts > Account panel in the server panel. Every hosting account can sign in right away.
The account panel uses Reqad's own code for everything it changes, so the two packages must fit each other. dnf update updates both. If they do not fit, for example after updating only one, the account panel stops rather than doing something wrong: Accounts > Account panel and the dashboard's Needs attention card say so, and updating both packages brings it back. If its service does not run, run /usr/local/reqad-account/setup/reqad-account-setup.sh as root to repair it.
How it is kept apart
- The panel's pages run as their own system user, which cannot read the server panel's files or any home folder.
- Everything an account asks for goes to a small service running as root that checks first that the thing belongs to that account: a site, a mailbox, a database, a file. It does the work with the same functions as the server panel, the reqad command and the REST API.
- Files, WordPress and everything else inside a home folder are handled as the account, never as root, so the system's file permissions are the last word.
- Accounts never get the server panel's settings: no services, no firewall, no other account.
How accounts sign in
An account signs in with its user name and system password: the same password as SSH, SFTP and FTP, which you set in Accounts > Manage. Accounts moved from another server keep the password they had. They can add two-factor authentication and passkeys, and change their password themselves (see Signing in & security). The login page has the same brute-force protection as the server panel.
Give your customers the address https://<your server's hostname>:2083/. Their mailbox users read mail at https://<hostname>:2083/webmail/ with their own address and password, without the panel.
Per account
- Accounts > Manage: Enable the account panel (port 2083) turns an account's panel on or off. It is on for every account at first. Turning it off signs out the account's sessions at once.
- For an account that turned on two-factor authentication and lost both its phone and its recovery codes, Turn off 2FA in Manage lets it sign in with its password again. Its passkeys stay.
- The Panel icon in the accounts list opens that account's panel in a new tab, signed in for you. A bar at the top says you opened it from the server panel, and what you change is logged under your admin name. You can see but not change the account's password, two-factor settings or sessions: those belong to the account.
reqad account panel bob # is the panel on for bob, and how does it sign in reqad account panel bob --off # or --on
Accounts > Account panel
| Card | What it does |
|---|---|
| Features | Turns Backups, Terminal and SSH access off for every account, whatever its hosting package. A part that is off is gone from the menu and refused. |
| What accounts see | Hosted by: your company's name, in the menu and the footer. Support line: shown under "Need help?". Help pages: a Help link in the menu, also behind your name on the login page ("Lost your password? Contact ..."). |
| Last logins | The last 25 sign-ins to the account panel: when, which account, from where and how (password, two-factor, passkey, or opened by an admin). |
The default theme and language accounts get are in /etc/reqad-account/panel.ini. Each account can choose light or dark on its Profile page.
What each account sees
The menu is made for each account from what the server and the account have. A part that is not offered is not only hidden: the panel refuses it too.
| Part | Shown when |
|---|---|
| WordPress Toolkit | The WordPress Toolkit is on on the server (wptoolkit=1). It moves to the top of the menu once the account has a WordPress site. |
| Email is on on the server and for the account, and its package allows mailboxes. | |
| Files | Always. The file manager needs filemanager=1; the terminal needs a full or jailed shell; FTP accounts need the FTP server add-on (without it the page says to ask you). |
| Backups | Backups are on on the server (backup=1) and not turned off under Features. |
| Databases | Its package allows databases. |
| Domains | Always. The DNS zone editor only when the server has a DNS provider. |
| PHP | Always. |
| Deploy & apps | Deployments are on on the server (deployments=1) and its package allows them. Setting them up needs a full shell. Apps need nginx in front. |
| Security | Always. SSH access can be turned off under Features. |
| Advanced > Cron jobs | Its package allows cron jobs. |
With Hosting Pro, a package limit of 0 removes that part, and the account's Home page shows its disk space and monthly bandwidth against the package.
The account's Home page
- Needs attention: the account's own items from the health checks (a certificate about to expire, missing mail DNS records, an end-of-life PHP version, a full mailbox...), checked every 30 minutes, most with a button that fixes it. The tools they belong to carry a badge.
- Cards the account can reorder: its websites with their SSL and WordPress state, usage, the account (package, last sign-in, name servers), the web server and how PHP runs, and the groups of tools.
- A search box over every tool ("password", "SSL", "database"), and a QR code that opens the panel on a phone.
Messages to accounts
An account that adds a contact address on its Profile page (confirmed by a 6-digit code mailed to it) gets mail about its own problems as the health checks find them (each one once, then at most once a week while it lasts), about sign-ins from a browser it has not used before, and about password and two-factor changes. It chooses which kinds on its Profile page. The messages carry your Hosted by name and a link to the panel.
Nothing is sent until the server has a way to send mail: set it up under Settings > Sending method. Setting one also makes the server panel offer mailed login codes to admins without two-factor authentication, so do not leave a test sending method on a server.
Need a hand? Create a free account or contact us.