Install Sahaab

This guide shows you how to install Sahaab on a new server, sign in for the first time, set up your nameservers and keep the panel up to date.

Requirements

Sahaab sets up the whole server: the web server, DNS, email, databases and firewall. So it needs a fresh server with nothing else on it.

The installer stops with a clear message if:

• another control panel is already on the server (install on a separate, fresh server and use the Transfer Tool to move accounts);
• Apache is running;
• one of the ports above is already in use.

Tip: with 4 GB of RAM or more, the virus scanner runs all the time and scans faster. On smaller servers it starts only when needed.

Before you start

Prepare these things:

1. A hostname for the server, for example server1.yourdomain.com. It must have at least three parts.
2. An A record for that hostname that points to the server's IP address. Create it at your DNS provider. The panel needs it to get its own SSL certificate.
3. Two nameserver names, for example ns1.yourdomain.com and ns2.yourdomain.com. Your customers will point their domains at them.
4. An email address for alerts and SSL notices.
5. Optional: a license key from your customer area. Without a key, Sahaab starts as a 15-day trial.

Install with one command

Log in to the server as root and run:

curl -fsSL https://get.sahaab.io/install -o install && sudo bash install

Note: the address get.sahaab.io goes live soon. Until then, use the download address you received with your license.

The script downloads the latest release, checks its checksum, and starts the installer. If the checksum does not match, nothing is installed.

The installer steps

The installer asks five questions:

1. License agreement. Read it, then type yes.
2. Your company. Your company or brand name (shown in the panel) and the administrator email (for alerts and SSL notices).
3. Server name and nameservers. The hostname (the installer checks that it points to this server) and your two nameservers. By default they are ns1 and ns2 under the hostname's domain.
4. Administrator login. The admin username (default root) and a password. Leave the password empty to get a strong generated one. A password you choose needs at least 10 characters with 3 of: lowercase letters, uppercase letters, digits and symbols.
5. Options.
6. Web server: OpenLiteSpeed (recommended) or Nginx. OpenLiteSpeed reads .htaccess files, so websites from other servers work as they are. It also supports the built-in page cache and HTTP/3. With Nginx, .htaccess files are ignored.
7. Move accounts from another server after installing? If you say yes, enter the old server's IP or hostname and its SSH port. Then choose to connect with this server's SSH key (recommended) or with the old server's root password (stored encrypted). See the Migration guide.

You then see a summary. Confirm it, and the installation starts. It takes 10–20 minutes.

On a brand-new server, Ubuntu often installs its own updates during the first minutes. The installer waits for them to finish.

When the installer finishes

The screen shows:

• the admin panel address: https://SERVER-IP:2087 (later https://your-hostname:2087);
• the control panel address for customers: https://SERVER-IP:2083;
• the admin username and password.

Save the password now. It is also saved in /root/whm-install-summary.txt, which only root can read. The full install log is in /var/log/whm-install.log.

Unattended install

To install without questions (for example from a cloud-init script), add --non-interactive and --accept-license and give the settings as options:

curl -fsSL https://get.sahaab.io/install -o install && sudo bash install \
  --non-interactive --accept-license \
  [email protected] --hostname=server1.example.com \
  --company="My Hosting" --license=YOUR-KEY

Read the license agreement before you use --accept-license.

All installer options

What gets installed

• A web server (OpenLiteSpeed or Nginx) with PHP 8.2, 8.3 and 8.4
• MariaDB (MySQL) and PostgreSQL
• A DNS server for your nameservers
• A complete mail server with webmail, a spam filter and DKIM signing
• Free SSL certificates
• A firewall with brute-force protection and a virus scanner
• SFTP and FTP with TLS
• Disk quotas (if the server's kernel and filesystem support them)
• The Sahaab admin panel (port 2087), control panel (port 2083) and webmail (port 2096)

The firewall opens these TCP ports: your SSH port, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 2083, 2087 and 2096. You can change the list later under Firewall.

Sign in for the first time

1. Open https://SERVER-IP:2087 in your browser.
2. Your browser warns about the certificate. This is normal until the panel gets its real certificate (see below). Continue to the page.
3. Sign in with the admin username and password from the installer.

Then do these first steps:

1. Turn on two-factor sign-in: Account → Two-Factor Auth.
2. Set your brand: Branding (name, logo, colour, support email).
3. Check the server settings: Server → Server Settings (hostname, contact email, nameservers, default language, time zone).
4. Create your first package: Accounts → Packages → Add Package.
5. Create an account: Accounts → Create Account.

The admin panel has a Find a feature… box at the top of the menu. Type a word to find a page fast.

Change your password and language

Open Account → Password & Language. Each user picks their own language there. The server's default language (for login pages and new users) is in Server Settings.

Set up your nameservers

Your customers point their domains at your nameservers. For that to work, the nameservers must exist on the internet.

If the hostname's domain uses this server's DNS (the usual case):

1. At your domain registrar, create child nameservers (also called "glue records"):
2. ns1.yourdomain.com → your server's IP
3. ns2.yourdomain.com → your server's IP
4. Set the nameservers of yourdomain.com to ns1.yourdomain.com and ns2.yourdomain.com.

If the hostname's domain is hosted at another DNS provider, the installer did not create a zone for it. It printed the records to add there instead. Add those records at your DNS provider. Then register the child nameservers at the registrar as above, and add their A records too.

You can change the nameservers later in Server Settings. Resellers can also have their own nameservers. See Resellers.

Get the panel's SSL certificate

The panel, webmail and mail server share one certificate for the server hostname.

1. Make sure the hostname has an A record that points to the server.
2. Go to Server → Server Settings → Certificates.
3. Click Issue hostname certificate.

Once the hostname's A record points to the server, the certificate is also issued automatically. After that, use https://your-hostname:2087 and https://your-hostname:2083.

License and trial

Without a license, Sahaab runs as a 15-day trial, counted from the installation date. The admin pages show how many days are left.

When the trial ends:

• everything already hosted keeps working;
• only new accounts and new transfers are paused until you activate the full version.

Activate your license

1. Get a license key from your customer area.
2. In the admin panel, open Server → License.
3. Enter the key under Activate the full version and click Activate.

The License page shows your plan (the number of hosting accounts, or unlimited), who it is licensed to, the renewal date and the status. Click Check now to check it again.

• The license is checked once a day.
• If the license server cannot be reached, the panel keeps working for 7 days.
• The license is tied to this server. To move it, release this server in your customer area. Then activate the key on the new server.

You can also activate the license during installation with --license=KEY.

Update Sahaab

1. Open Server → Updates.
2. Click Check for updates. If a new version exists, you see what is new.
3. Click Update to ….

Before the update, the current code and the panel database are saved as a snapshot on the server (the last three are kept). Websites, email and databases stay online. The panel may be unavailable for about a minute while its services restart. The Update log on the same page shows each step, and the Changelog lists what changed in each version.

The admin dashboard also tells you when a new version is available.

If something goes wrong

• The installer stopped with an error. Read the message. Most errors are about the requirements above. Fix the problem and run the command again.
• Tasks stay "queued" for minutes. The admin panel shows a warning when tasks wait more than 2 minutes. The background agent that carries out the tasks is probably not running. Start it again on the server with systemctl restart whmd, or reboot the server.
• You are locked out of the admin panel by the IP access list. Run whm whm:allow-ip clear on the server (as root) to clear the list.