Security model

Nội dung này hiện chưa có sẵn bằng ngôn ngữ của bạn.

MZPanel is designed so the customer VPS opens no inbound ports and the control plane never stores more secrets than it needs.

Three auth layers

Layer	From → to	Mechanism
A	User → dashboard	Session cookie (httpOnly, SameSite=Strict, Secure)
B	Dashboard → API	The same session cookie (same-origin / credentialed CORS)
C	Agent → API (WS)	Long-lived agent token, rotated when the license changes

The agent’s first contact uses a one-time install token (1-hour TTL); it swaps that for the long-lived agent token during registration.

Agent tokens & rotation

The install token is single-use and short-lived — safe to paste into a one-liner.
The long-lived agent token is rotated when your license changes.
Tokens authenticate the WebSocket; there is no inbound port to attack on the VPS.

Credential sealing (zero-knowledge)

When you store credentials for an external destination (e.g. an offsite backup target), MZPanel acts as a blind broker: it keeps only ciphertext. The plaintext is sealed client-side and the control plane cannot read it. See docs/17-credential-sealing.md.

Audit log

Every action on the control plane is recorded: who did it, when, the command, its exit code, and the log output. This is far more than shell history — it’s the system of record for everything done across your fleet.