Security baked into
every layer
Closed-by-default firewall, scoped deploy keys, masked SSH keys, localhost-bound services, sandboxed file manager, and security audit logs. We don't just expose the switch — we tell you which way to flip it.
HTTP
TCP:80 · 0.0.0.0/0
HTTPS
TCP:443 · 0.0.0.0/0
MySQL
TCP:3306 · 127.0.0.1
SSH
TCP:22 · 10.0.0.0/8
Closed by default — nothing reachable unless you open it
0
Ports open by default
3
Independent SSH permissions
6
Rule presets
1
Click to sync rules
Security at every layer
From the firewall to the file manager, every layer is designed with a closed-by-default posture. The panel doesn't just expose the switch — it tells you which way to flip it.
UFW Firewall
Inbound/outbound rules, presets, country-based filtering
SSH Key Management
Generate, upload, mask — three independent permissions
Audit Log
Every request parsed — status, method, path, IP, user agent
Sandboxed File Manager
Server-enforced root boundary, editing only in htdocs
Localhost-Bound Services
Database and internal services bound to localhost by default
Closed-by-default firewall
Nothing is reachable unless you explicitly open it. UFW rules are written in the panel and pushed to the actual machine. The panel and the live machine can drift — Sync Rules reconciles them.
- Inbound and outbound rules with Rule Name, Type, Protocol, Port, Source/Destination
- Presets: HTTP, HTTPS, MySQL, PostgreSQL, DNS, or Custom
- Protocol: TCP, UDP, ICMP
- Source: single IP, CIDR, 0.0.0.0/0, all IPv6, or country-based
- Action: Allow or Deny (deny carves exceptions out of broader allows)
- Status: Enabled/Disabled per rule (disable without losing config)
HTTP
TCP:80 · 0.0.0.0/0
HTTPS
TCP:443 · 0.0.0.0/0
MySQL
TCP:3306 · 127.0.0.1
SSH
TCP:22 · 10.0.0.0/8
Closed by default — nothing reachable unless you open it
SSH key management, built secure
Three independently-gated permissions let admins grant terminal access without granting key management. Public keys are masked in the UI to prevent shoulder-surfing.
- Access_Keys — view and manage keys
- Access_Upload — add a key
- Access_Console — browser terminal access
- Generate keypairs — private key shown once, copy immediately
- Upload existing public keys — private key never touches the panel
prod-deploy-key
ssh-rsa AAAA••••••••••
ci-pipeline
ssh-rsa AAAA••••••••••
dev-terminal
ssh-rsa AAAA••••••••••
Public keys masked to prevent shoulder-surfing
Security audit log
Every request that reaches your application is parsed into readable entries — who asked for what, what they got back, and what they were using. This is where you see scanning, probing, and brute-force attempts.
- Status code, method, path, IP, timestamp, user agent, referer
- Color-coded status: green (2xx), blue (3xx), amber (4xx), red (5xx)
- Filter by level and search by IP, path, status, or user agent
- A 2xx on a probe path is the real signal — someone succeeded
200GET/index.html192.168.1.10
301GET/old-blog10.0.0.4
404GET/.env185.2.x.x
401POST/api/login45.9.x.x
500GET/api/health10.0.0.4
200GET/wp-login.php185.2.x.x
tail -f audit.log
Account security — the other half of the job
Protecting the server is half the job — the panel account that controls it needs the same care. SharkCluster supports app-based two-factor authentication, passkeys, and single sign-on, with failed-login tracking and automatic lockout.
- TOTP two-factor authentication
- Passkeys (WebAuthn) — phishing-resistant
- SSO via Google, GitHub, LinkedIn and DigitalOcean
- Failed-login tracking with automatic lockout
Phishing-resistant authentication by default
Sandboxed file manager
Edit files in the browser — scoped to your application root, with editing restricted to htdocs. The server refuses any path outside it, enforced on the machine, not just hidden in the interface.
- Server-enforced application root boundary
- Editing only enabled inside htdocs
- Monaco editor (VS Code engine) with syntax highlighting
- Team members cannot delete — create, edit, upload only
Files
/var/www
htdocs
index.php
.htaccess
config.php
logs
.ssh
<?php
echo "Hello";
// boundary enforced on server
require "./config.php";
Server-enforced root boundary — editing restricted to htdocs
Security guidance built in
The panel doesn't just expose the controls — it tells you what to do with them. Warnings against exposing database ports to 0.0.0.0/0. Country rules labeled as approximate. Alert-fatigue guidance for thresholds. We tell you which way to flip the switch.
Warnings against exposing database ports to 0.0.0.0/0
Country rules labeled as approximate — narrowing tool, not sole control
Quick Activation for diagnostics, Reset for recovery from tangled rulesets
Sync Rules
Push panel state to server
Enable / Disable
Toggle UFW entirely
Quick Activation
Temporarily allow all
Reset
Clear all rules
View Logs
Blocked & allowed traffic
Everything around your server
Pair firewall & security with the tools that keep your applications fast, secure, and resilient.
Ready to take control
of your hosting?
Deploy servers, run self-hosted business apps, and keep your data on your own VPS — with a dedicated DevOps manager by your side.