Admin Guide

This guide is for the server administrator. You work in the admin panel at https://your-hostname:2087.

The menu is grouped into Accounts, Websites, Email, Security, Server, Move to this server and Account. Type in the Find a feature… box at the top of the menu to find a page fast.

Resellers use the same admin panel with fewer pages. See the Reseller guide.

Dashboard

The Dashboard shows at a glance:

• the number of accounts (and how many are suspended), domains and resellers;
• server load, memory and disk use;
• websites that are down right now;
• a notice when a new version of Sahaab is available;
• the newest accounts and the most recent tasks, with failed tasks of the last 24 hours.

Accounts and packages

Create a package

A package is a plan. Every account needs one, so create packages first.

1. Go to Accounts → Packages → Add Package.
2. Enter a Package name.
3. Set the limits. Enter 0 for unlimited.
4. Disk quota (MB), Monthly bandwidth (MB)
5. Max files and folders (inodes): limits how many files an account's home folder can hold (needs disk quotas). Customers see their count under Resource Usage.
6. Max addon domains, Max subdomains, Max parked domains (aliases)
7. Max email accounts, Max databases, Max cron jobs, Max FTP accounts, Max mailing lists
8. Emails per hour (0 = server default)
9. Processor (% of one core): 100 = one full core, 200 = two
10. Memory (MB) and Processes
11. Choose a Feature list (or Every tool) and a PHP version.
12. Tick Shell (SSH) access if customers on this package may use SSH and the browser terminal.
13. Tick Resellers can use this package for their accounts to share it: resellers can then create accounts on it, but not change or delete it.
14. Click Add package.

How the resource limits work: over its processor limit, an account is slowed down. Over its memory limit, only its biggest process is stopped. Other accounts are never affected. PHP, cron jobs, SSH sessions and applications all count.

When you change a package, the accounts on it get the new limits (including the disk quota).

Choose the tools with feature lists

A feature list decides which tools customers see in their control panel.

1. Go to Accounts → Feature Lists → Add feature list.
2. Enter a Name.
3. Tick the tools to include. Home, password and language are always available.
4. Click Save changes.
5. Open a package and choose the list under Feature list.

A tool that is left out disappears from the customer's menu and home page, and its pages are refused. Turning off FTP Accounts also turns off FTP sign-in. A package without a list includes every tool. If you delete a list, its packages include every tool again.

Create an account

1. Go to Accounts → Create Account.
2. Enter the Domain, a Username (2–16 lowercase letters or digits, starting with a letter), a Password (or click Generate) and the Contact email.
3. Choose a Package.
4. Click Create.

Sahaab creates the system user, the website, the DNS zone and the home folder. The website gets a free SSL certificate as soon as its domain points to the server.

Tip: everything in /etc/whm/skel on the server is copied into the home folder of every new account (for example public_html/.htaccess or a README). See Server Settings → Files for new accounts.

Find and manage accounts

Accounts → List Accounts shows every account with its domain, package, owner and disk use. Search by username, domain or email, and filter by status (All, Active, Suspended).

• Click Log in to open the customer's control panel as them.
• Click Manage to open the account page.

On the account page you can:

Change the main domain. Subdomains, the DNS zone, email addresses, forwarders, FTP and Web Disk logins follow the new domain. Certificates are issued again. Websites keep their content. Sites that store their own address (like WordPress) need it changed in their own settings.

Rename (change the username). The system user, home folder, cron jobs and applications follow. The old home path keeps working through a link. Websites, email and applications stop for a few seconds. Databases keep their names. The customer signs in with the new username.

Move an addon domain. Choose the domain and the account to receive it, and tick the databases to move along. The domain's subdomains, website files, DNS zone, mailboxes (with their mail), forwarders, mailing lists, FTP and Web Disk logins of the domain, and installed WordPress or applications go to the other account. Their databases always move with them; databases keep their names. The receiving account needs room in its package (addon domains, subdomains, databases) and a free folder of the same name. A domain with a Node.js or Python application, or one that uses the main public_html folder, cannot be moved. The website is unavailable for a moment.

Web server configuration of one website. In the Domains table, click server configuration next to a domain. Enter extra OpenLiteSpeed settings for that site only, for example a context block, rewrite rules or headers, and click Save and apply. The website is opened once afterwards: if it worked before and now answers an error, the previous configuration is put back and you see why. Settings the panel manages itself (SSL, PHP handler, user, document root) cannot be changed here. Leave the field empty to remove it.

Suspend. Websites, email and cron jobs stop. Visitors see the "suspended account" page (you can edit it in Branding). Applications of the account stop too.

Terminate. This permanently deletes the system user, home folder, websites, email, databases and DNS zones. It cannot be undone.

Change owner. Move an account to a reseller, or back to Administrator (no reseller). The reseller's limits are checked.

Resource Usage

Accounts → Resource Usage shows each account's disk use (files, mail and databases) and this month's website traffic against its limits. Accounts over a limit are counted at the top.

Disk use is measured every 10 minutes. Customers get email warnings at 90% and 100% of their disk, and at 80% and 100% of their monthly bandwidth. You get a copy.

Resellers

Resellers sell hosting under their own brand. They sign in to the admin panel and see only their own accounts and packages.

Create a reseller

1. Go to Accounts → Resellers.
2. Under Create reseller, enter the Username, Email and Password.
3. Set Max accounts, Disk allocation MB and Bandwidth allocation MB (0 = unlimited).
4. Leave Can create own packages ticked if the reseller makes their own plans.
5. Click Create reseller.

Set limits, privileges and nameservers

Click Edit limits next to a reseller.

• Limits: the maximum number of accounts, and the disk and bandwidth the reseller can hand out. The packages of all their accounts are added up. When a disk or bandwidth allocation is set, the reseller cannot use packages with unlimited disk or bandwidth.
• Privileges: tick what this reseller may do. Listing their own accounts and their usage is always allowed. Each privilege is explained in the Reseller guide. Privileges apply in the admin panel and in the APIs.
• Nameservers: the reseller's own nameservers, for example ns1.their-brand.com. They are used in the zones of the reseller's accounts. Leave them empty to use the server's nameservers. If the nameservers' domain is hosted on this server, their address records are added automatically. Otherwise, the reseller must point them at the server's IP.

Click Save limits. To put new nameservers into the zones of the reseller's existing accounts, click Apply nameservers to existing zones.

Delete a reseller

Click Delete. First move the reseller's accounts to another owner (or terminate them). Their packages are deleted with them.

DNS

Websites → DNS Zones lists every zone on your nameservers, with its owner, number of records and serial.

Edit a zone

1. Click Edit next to the zone.
2. To add a record, enter the Name (@ or www), TTL, Type, Priority (for MX and SRV) and the value. Click Add.
3. To remove a record, click Delete next to it.

Record types: A, AAAA, CNAME, MX, TXT, NS, SRV and CAA. Hostnames in CNAME, MX and NS records should end with a dot (for example mail.example.com.).

Add a standalone zone

For a domain that has no hosting account (for example, a domain that only needs DNS):

1. On DNS Zones, find Add a standalone zone.
2. Enter the Domain and the IP address.
3. Click Add zone.

DNSSEC

Open a zone and click Turn on DNSSEC. The server signs the zone and rolls its keys. Then add the DS record shown on the page at the domain's registrar.

Important: to turn DNSSEC off, first remove the DS record at the registrar and wait a day. Turning it off while the DS record exists makes the domain unreachable.

The zone template

The zone template is the list of records every new zone starts with.

1. On DNS Zones, click Zone template.
2. Write one record per line: name, type, (priority for MX and SRV), value.
3. Use the placeholders {domain}, {ip}, {ipv6}, {ns1}, {ns2} and {hostname}. Lines starting with # are ignored.
4. Check the Preview for example.com, then click Save template.

Existing zones are not changed. {ns1} and {ns2} are the reseller's nameservers when the account belongs to a reseller who set them. Click Reset to default to go back to the built-in template.

The default template creates NS records, A and AAAA records for the domain, www, mail and ftp, an MX record, an SPF record and a DMARC record.

Reseller nameservers

See Set limits, privileges and nameservers.

DNS on several servers

To put your nameservers on different servers, use the DNS cluster. See Servers (cluster).

IP addresses and IPv6

Server → IP Addresses lists the addresses configured on the server.

Dedicate an IP address to an account

1. Ask your provider for more IP addresses and add them to the server.
2. Click Detect addresses. The new addresses appear in the list.
3. Next to an address, choose the account under Dedicate to and click Apply.

The account's DNS records are updated. Visitors follow once DNS refreshes. Use Note to remember what an address is for. Choose — shared (nobody) — to give an address back.

IPv6

When the server has an IPv6 address, websites answer on it, and new DNS zones publish it (AAAA records, and ip6 in the SPF record).

To add IPv6 to existing zones, click Publish IPv6 in all zones. Only zones whose names point to this server are changed.

Outgoing email stays on IPv4, because mail providers accept IPv4 without extra reverse-DNS setup.

Disks

When the server's disk fills up, add another disk.

1. Ask your provider to add a disk to the server.
2. Mount it (ext4), for example at /home2.
3. Go to Server → Disks. The new disk appears in the list.
4. Click Use for accounts. Disk quotas are turned on for it.

New accounts are then placed on the disk with the most free space, with their disk quota on that disk. For the accounts, nothing changes: their folder is always /home/<username>.

To stop placing new accounts on a disk, click No new accounts here.

SSL certificates

AutoSSL

Every website gets a free certificate as soon as its domain points to this server. Sahaab checks every 3 hours and renews certificates 30 days before they expire. Only names that really point here are included, so a www or alias that is not pointed yet does not block the domain.

Server Settings → Certificates shows how many websites are secured. Click Run AutoSSL now to check at once.

Customers see the status of each domain on their SSL/TLS page ("Secured", "Waiting for DNS" or the reason). They can also install their own certificates, request wildcard certificates and create certificate requests. See the Customer guide.

The hostname certificate

One certificate for the server hostname is used by both panels, webmail and the mail server (IMAP, POP3, SMTP). It is issued automatically when the hostname's A record points to the server. To issue it by hand, click Issue hostname certificate in Server Settings → Certificates.

When you change the hostname in Server Settings, the system and the mail server name are updated and the new certificate is requested.

Email

The Email menu has Mail Queue & Spam and Message Customers. The Mail Queue & Spam page has four tabs.

Mail queue

See messages that are waiting or deferred, with the reason. You can view the headers, Retry selected, Delete selected, Retry all or Delete all deferred. The top line shows how many messages were sent, deferred, bounced and rejected in the last 24 hours.

Delivery reports

Every delivery attempt of the last 30 days: sent, deferred, bounced or rejected. Search by address or message ID, result, direction (incoming or outgoing) and period. Customers see the same report for their own domains.

Spam filter

1. Tick Filter incoming mail for spam.
2. Optional: tick Greylisting to briefly delay suspicious senders. Real mail servers retry; most spam bots do not.
3. Set Move to Junk from score (typical 5–7). Lower catches more spam but risks real mail.
4. Set Refuse from score (typical 15). The sender gets an error.
5. Click Save.

Spam goes to the recipient's Junk folder. Customers can change the score and keep allow and block lists per mailbox.

Sending limits

Every account may send a limited number of emails per hour. Each recipient counts, whether the mail comes from a website, a script, a cron job or a mailbox. A hacked website then cannot send thousands of spam messages and get your server blocklisted.

1. Enter the Default emails per hour, per account (0 = no limit). The default is 500.
2. Click Save.

A package can set its own limit (Emails per hour in the package). Over the limit, messages wait and go out later. The customer and you are told. The page shows each account's sending in the last hour, accounts that reached their limit, and messages held back.

Email routing

Each domain receives email either on this server or on another mail service (for example a hosted business email). Customers set this per domain on their Email Accounts page: Automatic (from the MX record), Local mail server or Remote mail server. Automatic is checked every hour, also for MX records changed at other DNS providers. With remote routing, mail from websites and mailboxes on this server reaches the real mailboxes at the other service.

Message Customers

Send an email to your customers, for example about maintenance or price changes.

1. Go to Email → Message Customers.
2. Choose To: All customers, Active customers only or Customers on a package….
3. Enter the Subject and the Message (plain text).
4. Click Send.

The message is sent from your brand name. Replies go to the contact email in Server Settings.

Security

Protection Shield

Security → Protection Shield watches every website's traffic about once a minute, with no extra load.

• Login protection: blocks addresses that guess passwords on WordPress, Joomla, Drupal and similar sites. Set the Failed logins per minute (all sites) and Block for (minutes) (60 by default). An address that comes back within a day is blocked for 24 hours.
• Web application firewall: recognises SQL injection, reading server files, command and script injection, attack tools and searches for secret files (.env, .git, configuration backups).
• Monitor — record only (the default): attacks are recorded but not stopped.
• Protect — refuse attacks and block attackers: attacks are refused before they reach the website, and an address that keeps attacking is blocked.
• Off.
• Sensitivity: Low, Normal or High.
• Start in monitor mode. Check the events for a few days, then switch to protect. Customers can turn the firewall off for a single site.
• File watcher: new and changed website files are checked for malicious code every 2 minutes. Malicious files are reported, or moved to quarantine if automatic quarantine is on in the Malware Scanner. The customer is emailed.

Never blocked: this server, allow-listed addresses (Firewall) and anyone who signed in to the panel in the last day.

The page shows attacks stopped in 24 hours, addresses blocked now (with Unblock), the most active attackers of the last 7 days and recent events.

Two more protections are on for every website. Customers can turn them off per site:

• Upload-folder protection: scripts cannot run from upload folders, a common backdoor on hacked sites.
• Security headers: browsers block content-type tricks and framing by other sites.

Security Advisor

Security → Security Advisor checks the server's configuration and explains each finding. It checks SSH root logins, the firewall, brute-force protection, automatic security updates, pending updates, a needed restart, the database administrator, open ports, two-factor sign-in of admins, the panel certificate, backups off the server, disk space and quotas.

Findings are marked Good, Improve or Fix now. Where a fix is safe, click Fix it. Click Check again after changes.

Firewall

Security → Firewall manages the server's firewall rules.

Port filtering

1. Tick Enable port filtering (drop everything not listed below).
2. Check Open TCP ports and Open UDP ports (comma separated; ranges like 30000-30100). Port 22 (SSH) and 2087 (admin panel) always stay open.
3. Optional: tick Block brute-force attackers at the firewall (all services), not only at the login page.
4. Click Save.

You have 90 seconds to confirm. If the page still works, click Keep these rules. Without confirmation, the previous rules come back. This protects you from locking yourself out. Your own IP address is added to the allow list automatically when you turn the firewall on.

Allow or block an address

1. Under Allow or block an IP, choose Block or Always allow.
2. Enter the IP or range (for example 198.51.100.0/24) and an optional Note.
3. Choose the Duration: Permanent, 1 hour, 1 day, 1 week or 30 days.
4. Click Add rule.

The Rules table lists every rule. Click Remove to lift it.

Block known attackers (reputation lists)

Tick the public lists of attackers and spammers you want to use (Spamhaus DROP, blocklist.de, CINS, abuse.ch) and click Save and update now. Addresses on these lists are blocked before they reach any service. The lists are updated every 6 hours. The page shows the last update and how many addresses and ranges are blocked.

Addresses you allow, private addresses and anyone who signed in to the panel in the last 30 days are never blocked by these lists.

Brute force bans

The bottom of the page shows addresses banned for failing to sign in to SSH, email and outgoing mail (SMTP authentication). Click Unban to lift a ban.

Brute Force Protection (panel logins)

Security → Brute Force Protection blocks addresses after repeated failed logins to the admin panel, the control panel and the API.

• Set Max failures, Window (min) and Block for (min) (5 failures in 15 minutes, blocked for 15 minutes, by default).
• Add Whitelisted IPs that are never blocked.
• See Blocked IPs and click Unblock to free one.
• See Recent failed logins.

Admin panel access by IP: enter the only IPs or ranges that may open the admin panel (port 2087). The control panel and the API are not affected. Leave it empty to allow everyone. If you get locked out, run whm whm:allow-ip clear on the server.

Malware Scanner

Security → Malware Scanner scans website files with the antivirus and Sahaab's own signatures (web shells, obfuscated code, PHP hidden in images, cryptominers). Signatures update every day.

• Scan now: choose an account or All accounts and click Start scan.
• Automatic scans: choose Off, Daily or Weekly and the hour. Tick Quarantine detected files automatically if you want infected files isolated at once. Click Save.
• Detected files: for each finding, choose Quarantine, Ignore, Restore (only for a false positive) or Delete. Use Show history to see older findings.

Customers see scan results on their Security page and can start a scan of their own websites.

Two-factor sign-in

Protect your admin login with a code from an authenticator app.

1. Go to Account → Two-Factor Auth.
2. Scan the QR code with your app (or enter the key by hand).
3. Enter the 6-digit code and click Enable two-factor authentication.
4. Save the 10 recovery codes somewhere safe. Each works once if you lose your phone.

To get new recovery codes, enter your current password and click Generate new codes. Resellers and customers can turn on two-factor sign-in the same way.

Account isolation

Each account runs in its own sandbox. Cron jobs, SSH sessions and applications see only their own folder in /home, their own processes and a private /tmp. SFTP is confined to the account. Customers cannot see other accounts or the server's configuration. There is nothing to set up.

Backups and snapshots

Daily snapshots

Websites → Daily Snapshots copies each account's files, email and databases (MySQL and PostgreSQL) every night. Unchanged files are shared with the previous snapshot, so two weeks of snapshots take little more space than one.

1. Tick Daily snapshots of all active accounts (on by default).
2. Set At hour (server time) (2 by default) and Keep (days) (14 by default).
3. Click Save.

To take one now, choose an account and click Snapshot now.

Restore from a snapshot: click Restore… next to a snapshot. Choose what to restore:

• Files: all files, or only a file or folder you pick. Put them into a new folder "restored-date" (nothing is overwritten) or back to the original place.
• Databases: each chosen database is replaced by its snapshot copy.
• Email: messages are put back; newer messages are kept.

Click Restore selected. Customers can browse and restore their own snapshots.

Full backups

Websites → Full Backups makes complete account backups: files, email, MySQL databases, DNS and settings.

• Back up now: choose an account (or All active accounts) and click Create backup.
• Schedule: tick Daily backups of all active accounts, set Run at hour (server time) and Keep last N backups per account, then Save.

Each backup can be downloaded, restored or deleted. A restore works like a snapshot restore: all files, a single file or folder, chosen databases and/or email.

External storage

Copy every backup off the server, so a lost server does not mean lost backups.

1. Under External storage, choose the Storage: S3-compatible (Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, MinIO…), SFTP server or FTP server (TLS).
2. Enter the server or S3 endpoint, access key or username, secret key or password, bucket and folder, port and region as needed.
3. Set Keep per account.
4. Click Test connection, then save.

Google Drive, Microsoft OneDrive or Dropbox:

1. Choose the service as Storage, enter the folder and Keep per account, and click Save.
2. Click Connect, then Sign in at …. Sign in with the account that should hold the backups and allow access.
3. Your browser then shows an error page at localhost:53682. This is expected. Copy the whole address from the address bar, paste it into the field and click Finish within 15 minutes.

The connection is tested at once. The server keeps the sign-in by itself; connect again only if you remove its access in your account. With Google Drive, the server sees only the files it creates, nothing else in your Drive.

Restores fetch the external copy automatically when the local file is gone.

WordPress Sites

Websites → WordPress Sites lists every WordPress site on the server: its version, pending updates, automatic updates and security settings (file editing, XML-RPC). Sites are found every day, including uploaded or transferred ones. Click Scan all accounts now to look at once.

Customers manage their sites from their own WordPress page. See the Customer guide.

Server

Server Status

Server → Server Status shows load, CPU, I/O wait, memory, network and the number of processes, sampled every minute. Switch the charts between 24 hours and 7 days. It also shows the disks and the busiest processes. You can Stop a process that belongs to a hosting account.

Click Daily process log to see, for each account and day, the CPU time, peak memory and peak processes, and how often the account reached its package's limits. 90 days are kept.

Service Manager and the watchdog

Server → Service Manager shows the status of the core hosting services. Click Restart to restart one.

The watchdog checks every service every minute: it must be running and really answering. A service that hangs or stops is restarted and you get an email. After three failed restarts in an hour, it is left for a person to look at. The page lists what the watchdog did: Restarted, Could not restart or Failing repeatedly — not restarted any more this hour.

Terminal

Server → Terminal opens a root shell on the server in your browser. Everything you run there acts on the whole server, so be careful. Each connection uses a one-time sign-in, and it closes when you leave the page or after 30 minutes without activity.

PHP Versions

Server → PHP Versions lets you install the PHP versions your customers need (7.4 to 8.5). New servers come with 8.2, 8.3 and 8.4.

PHP 7.4 and 8.0 are for old websites that do not run on newer PHP. PHP itself no longer fixes their security problems, so use them only for the sites that need them and plan to update those sites. They come from Sahaab's own package repository and receive Sahaab's updates with the system updates. ionCube Loader is not available for them.

• Click Install or Remove next to a version.
• Click Make default to choose the server default. It applies to websites whose account, package and domain have no own choice.
• The page shows how many websites use each version.

Extra extensions: add or remove optional extensions per PHP version: APCu, Memcached, igbinary, MessagePack, IMAP, LDAP, Mailparse, Tidy, Pspell, SNMP, Sybase / SQL Server and ionCube Loader (8.1 and newer). Websites use them from their next request.

Database Server

Server → Database Server shows the MariaDB version. To move to a newer long-term version (11.4 or 11.8), for example because an application needs it, choose it and click Upgrade:

1. A safety copy of every database is saved in /backup/mariadb-before-<version>-<date>.sql.gz (the upgrade stops if the disk has no room for it).
2. MariaDB's own packages are installed and the data is upgraded. Your settings are kept.
3. Websites using databases, email sign-in and the panel pause for a minute or two.

The page shows the progress. Going back to an older version is not possible except by restoring the safety copy, so choose a quiet time and check that your applications support the new version.

Server Settings

Server → Server Settings has these sections:

• Web server: shows OpenLiteSpeed or Nginx. Click Rebuild all website configs if website settings look wrong.
• Basic: server or brand name, Hostname, Shared IP address and Contact email.
• DNS & SSL: Nameserver 1 and 2, Default language (login pages and new users), Time zone (for dates shown in the panels), Default TTL and the Let's Encrypt account email.
• Certificates: hostname certificate and AutoSSL (see SSL certificates).
• Limits:
• Disk quotas: "Enforced" when the filesystem limits each account to its package's disk. On older servers, click Enable disk quotas (no reboot needed). "Not available" means the kernel or filesystem has no quota support; usage is then measured and customers are warned by email.
• When an account uses up its monthly bandwidth: either Email the customer and admin, keep websites online, or Email, and show a "bandwidth limit reached" page until next month.
• Files for new accounts: what is in /etc/whm/skel (see Create an account).
• Fixes and error reports:
• Install fix releases automatically at night (on by default): fix releases of your version line (for example 0.31.0 → 0.31.1) install themselves around 3 am. Versions with new features (0.32) are always your choice, under Server → Updates.
• Send error reports (on by default): when the panel itself fails — a page, a task, an install or update — a short report goes to Sahaab so it is fixed quickly. Before anything is sent, domains, email and IP addresses, account names, paths in customers' homes and secrets are replaced. Expected situations (a domain not pointing here yet, a wrong password typed by a customer) are not reported.

Click Save settings after changes.

Updates

Server → Updates has two parts:

• Sahaab: new panel versions, with their changes. Click Update to … to install one. Websites, email and databases stay online.
• Operating system: the system packages waiting for an update, with security fixes marked. The list is checked every day; click Check now to check at once.
• Install security fixes installs only the security fixes.
• Install all updates installs everything. Nothing is removed and changed configuration files are kept. Services that are updated (for example the web or database server) restart for a moment.
• The page shows the progress and keeps the log of the last installation.
• When an update needs a restart (for example a new kernel), a notice names it. Click Restart now at a quiet time; websites are back within a minute or two.

AI assistant

The AI assistant explains why a task failed (Explain with AI on a failed task) and helps customers with their PHP errors and with Site Check ("why is my website down?"). It answers in the panel's language. It is off until you turn it on in Server Settings → AI assistant:

• Provider: Anthropic (Claude) or OpenAI.
• Paid by:
• My own API key: enter the key from your Anthropic or OpenAI account; you pay them directly.
• Sahaab credit: no key needed. Questions are paid from the AI credit of your license, shown in your customer area.
• Model: leave empty for the recommended one.
• Customers can ask too: shows the buttons on the customers' Errors and Site Check pages. To hide them for some packages, leave "AI assistant" out of their feature list.
• Questions per account and month: a limit per customer account (0 = no limit). Anyone can ask at most 5 questions a minute.

Only the facts of each question are sent (the error lines, or the site check results), with passwords, keys and tokens hidden. The answers are advice: check them before changing anything important.

Activity Log and Task Queue

• Server → Activity Log shows the latest 300 actions across the server: time, user, IP, action and details. Use Filter to search.
• Task Queue shows every system change as a task (Queued, Running, Done, Failed). Open a task to see its output. Click Retry to run a failed task again.

Servers (cluster)

Server → Servers (cluster) manages other servers running Sahaab from one place.

Add a server

1. On the other server, open the admin panel and go to API Tokens. Create a token.
2. Here, under Add a server, enter a Name, the Admin panel address (use the hostname with its valid certificate) and the API token.
3. Optional: tick DNS cluster: let that server copy and answer for this server's DNS zones.
4. Click Add server.

The list shows each server's version, load and accounts. Click Manage to see its status and accounts, Log in to a customer's control panel there, or Create an account on this server.

DNS cluster: servers copy each other's zones with signed transfers, so your nameservers can be on different servers. Use Start the DNS cluster or Stop the DNS cluster on a server's page. Zones this server copies from others lists what this server holds for other servers.

Branding

Branding sets your company name, logo and colour across the admin panel, every customer panel, the login pages and webmail.

1. Enter the Company / brand name.
2. Choose the Main colour (buttons, links and highlights).
3. Upload a Logo (PNG, JPG or WebP; shown up to 400×120 pixels). Without a logo, the initials of the name are shown.
4. Enter the Support email, Support / help link, a Message on the login page and the Footer text.
5. Click Save branding.

Pages shown to visitors: edit the Suspended account page, the Bandwidth limit page and the Default page of new websites. HTML is allowed. {company} is replaced by your brand name and {domain} (default page only) by the website's domain. Leave a page empty for the built-in text. Click Save pages.

Resellers can set their own branding for their customers.

API tokens and billing systems

Account → API Tokens connects your billing system so accounts are created, suspended and removed automatically.

Create a token

1. Enter a Token name, for example billing.
2. Click Create token.
3. Copy the token now. It is not shown again.

Click Revoke to cancel a token. The list shows when each token was last used.

Connect WHMCS

1. Click Download the WHMCS module and unpack it into your WHMCS folder. It creates modules/servers/hostpanel.
2. In WHMCS, add a server: module "Hosting Panel", the hostname of this server, port 2087 with SSL, and an API token in "Access Hash".
3. Add the WHMCS server's IP address to the Firewall allow list. Wrong tokens get an address blocked.
4. In each product, choose the module and the package.

Accounts are then created, suspended, unsuspended, upgraded, have their password changed and are removed from WHMCS. Customers get a Log in to Control Panel button (a one-time link, valid 60 seconds). Disk and bandwidth usage are sent to WHMCS daily.

Connect Blesta, HostBill and other billing systems

Sahaab answers the standard /json-api interface on port 2087. The usual server module for hosting control panels in these billing systems works without installing anything.

1. In the billing system, add a server with its standard hosting control panel module (the one that asks for a username and an API token).
2. Hostname: this server, port 2087 with SSL. Username: your admin username. API token: one you created above.
3. Add the billing server's IP address to the Firewall allow list.
4. In each product, enter the package name exactly as it is in Sahaab.

Supported: create, suspend, unsuspend and remove accounts, change package and password, change the domain, username or contact email, list accounts and packages, disk and bandwidth usage, and the customer's sign-in button.

For the technical details, see the API reference.

Support tickets

Customers open tickets under Support in their control panel. A reseller's customers write to their reseller; your own customers and the resellers write to you. You get an email for each new ticket and reply at the contact email in Server Settings.

• Account → Support Tickets lists the tickets waiting for you first. Click Include resellers' customers to see every ticket on the server.
• Open a ticket to read it and reply. The customer gets an email with your answer.
• Click Close ticket when it is solved. Answered tickets with no reply for a week close by themselves.
• Untick Customers and resellers can open tickets if you use another help desk. To hide Support for some packages only, leave "Support tickets" out of their feature list.
• With webhooks, ticket.opened and ticket.replied can notify your help desk or chat.

Move accounts to this server

The Move to this server menu has the Transfer Tool and Import a Backup. See the Migration guide.