Pterodactyl Panel — The Free & Open-Source Server Control Panel

[Fishfish0001]

Github :|: Website :|: Discord Chat :|: Community
Licensed under a MIT License​

Check out spoiler pictures of our [email protected] release!​

Looking to control all of your game and voice servers from a single unified interface? Looking for open-source software that allows you to extend and customize every aspect to match your company branding? Looking for software that doesn't require you to pay for every server, and is built using modern standards? Look no further.

Features:

• Designed from the ground up with security in mind, we make use of BCrypt hashing, AES-256-CBC encryption, and have always supported Two-Factor Authentication out of the box. HTTPs support is also included, and it is possible for all nodes to communicate with the panel and users over secure protocols.
  • All server processes run inside Docker containers on the nodes preventing malicious users from having access to your filesystem. These containers employ a variety of different hardening mechanisms including read-only filesystems, strict resource limits (which can be changed on-the-fly), and limited networking. Only ports and IPs that you define in the panel are open for each server, so no more worrying about a user running their servers on the wrong IP or port.
  • SFTP is used rather than FTP to provide a more secure management interface. SFTP is also isolated from the main host by using a specialized Docker container. While each server has their own SFTP account, this account does not physically exist on the machine itself, only in the Docker container.
• Design is a major factor in today's world, but all too often panels fall short by either using a poor design, or going overboard and spending more time designing their views than designing how the software should work. We've taken the middle ground and included a simple, pleasing theme that can be easily extended to match your companies branding if necessary, but can also be used out of the box and is intuitive and mobile friendly.
• Truly live console and server statistics. Pterodactyl Panel leverages Websockets to display your server console in realtime, as well as live memory and CPU usage. No server plugins necessary, and no taxing file reads to show the log.
• Custom designed file manager to easily edit, upload, and handle all of your files. Need to unzip a file on your server? Easy, just select the decompress option from the file manager. None of that Net2FTP stuff here.
• Sub-Users are supported out of the box. Have a friend or two (or twenty) that you want to let access your server to manage configurations and keep an eye on the console? Easily add friends and select specific permissions that they have. Only want them to be able to view the console and make sure the server stays on but not be able to read any files? Easy as checking a few boxes. Want them to be able to help you manage other subusers on that server? Also as easy as checking a few boxes.
• Scheduled Tasks are all the rage now-a-days, and Pterodactyl ships with a powerful command scheduler. We might not have all of the fancy scheduler gimicks that other panels have, but we support extremely configurable cron syntax, and are actively working on adding even more task options. Want your server to restart at 3:32am every third Tuesday of the month? We got you.
• Per-Server Databases allow you to easily create a new database for a server right from the panel, and let the user control the password.
• Easy-peasy memory, swap, disk IO, and CPU throttling and limits all from the panel, and without having to restart servers.
• Custom designed control daemon to control servers, no need to install any plugins on your servers.

Since everyone really just wants to see pictures:

Spoiler: Pictures

Server Statistics (live output, updates every 2 seconds):

Server File Manager:

Admin Server Overview:

API Controls:

Scheduled Tasks

User Editable Startup Parameters:

Advanced Server Configurations:

Reviews:

Spoiler: Vouches/Reviews of Pterodactyl

I got to say, Pterodactyl is one of the best panels, if not the best panel, I've ever used. The developers are both active and super friendly. It's Laravel so I'm confident in the security. The support team is very helpful, especially for being community volunteers. The documentation is on point too.

Along with that, the API is pretty awesome too. So if you're a developer and you're wanting to integrate something like this into your site or create a standalone product. It's pretty straight-forward and easy to get use too.

All around, it's just a fantastic product. Totally worth a try. If you use something like Multicraft, it may be a change...but totally worth it! If you use PufferPanel, it's worth the migration time. If Pterodactyl was a paid product, I would be on board in a heartbeat.

as a terminal (l)user, I can honestly say that using panels really isn't for me, however pterodactyl is the only software that I've seen so far that even remotely looks and handles sanely, as well as uses modern technologies instead of re-inventing the wheel with daemons that are either closed source, so you have no idea what they're up to behind the scenes, or a severely insecure setup.

At the heart of everything is Docker, which provides a nice boost in terms of security, and doesn't cost you in terms of performance, allowing for games that run in the system to perform just as if they're running directly on the system!

The support team is brilliant, always running around for people (even if they do go further than any sane person would in terms of trying to provide a good user experience...), and it's the type of software that you'd expect them to charge for, yet they provide it for free! (Honestly though, watching the dev team run around the software, if you're using it and can donate, I'd suggest considering the fact that alternatives generally are subscription based, I think the guy deserves a pizza every once in a while!)

 

[XMario]

Looks very good!

 

[Fishfish0001]

TL;DR — Authentication verification code was evaluating true wrongly, which allowed users who were able to guess, or previously knew a servers (s)UUID to access the overview page. No sensitive information was disclosed, nor were users who did not already have approved access able to see or do anything with the server.

Security Vulnerability Disclosure
Sunday, February 5th, 2016, 00:20 GMT

Affected Versions: v0.5.0-pre.3 through v0.5.6

Attn:

Today (06/02/2016) at approximately 00:20 GMT we became aware of a flaw in a core authentication validation function within our software. This flaw allows users who know the UUID or Short-UUID (sUUID) for a server to modify the application's URL and view the server overview page, even when they do not have permissions to do so.

This security flaw was introduced in commit 125856d [1] and is present in all versions of Pterodactyl Panel from v0.5.0-pre.3 through v0.5.6. The cause of this flaw was a minor change to core validation code [2] which was intended to allow validating against either a UUID or sUUID for servers. Unfortunately, this change modified the SQL statement to be in a different order than it was previously, and caused our statement to always evaluate to true.

The SQL query that was intended is:

sql select * from `servers` where (`uuidShort` = ? or `uuid` = ?) and `id` in (?, ?, ?) and `servers`.`deleted_at` is null limit 1

The SQL query that was being built was:

sql select * from `servers` where (`uuidShort` = ? or `uuid` = ? and `id` in (?, ?, ?)) and `servers`.`deleted_at` is null limit 1

For the less SQL inclined, effectively this check was validating as true immediately because the sUUID (uuidShort) was matching within the parenthesis and the rest of the checking was terminated.

It is important to note that this vulnerability did not disclose any sensitive information to users who did not already have permission to access the server. Unapproved users were able to view the console overview page and see the server name, however due to our additional layers of application security they were not authenticated against the daemon, and were therefore unable to see the console, send commands, or otherwise control the server or daemon. Additional permission layers in the panel prevented users from being able to access any other server-specific pages.

We have addressed this vulnerability as of 4a320c2 [3] in our mainline release branch and 0d61417 [4] in our new-feature branch which will be merged into the development branch.

This notice was posted as part of our continued commitment to our product's security. Please do not hesitate to get in contact with us via Discord or email ([email protected]) if you should have any comments, questions, or concerns about the content of this notification.

[1] - https://github.com/Pterodactyl/Panel/commit/125856d92f02f7cc2182d058fe3173b488111d31

[2] - https://github.com/Pterodactyl/Pane...d31#diff-3dd8f3d382459350ae3d8c43039ed472R180

[3] - https://github.com/Pterodactyl/Panel/commit/4a320c29a8d7ab8874b34e92c11925f0bac7687a

[4] - https://github.com/Pterodactyl/Panel/commit/0d61417814db55d840f6b04aeee4c604bbeb991a

 

[RazorStatic]

Github :|: Website :|: Discord Chat :|: Community
Licensed under a MIT License​

Check out spoiler pictures of our [email protected] release!​

Looking to control all of your game and voice servers from a single unified interface? Looking for open-source software that allows you to extend and customize every aspect to match your company branding? Looking for software that doesn't require you to pay for every server, and is built using modern standards? Look no further.

Features:

• Designed from the ground up with security in mind, we make use of BCrypt hashing, AES-256-CBC encryption, and have always supported Two-Factor Authentication out of the box. HTTPs support is also included, and it is possible for all nodes to communicate with the panel and users over secure protocols.
  • All server processes run inside Docker containers on the nodes preventing malicious users from having access to your filesystem. These containers employ a variety of different hardening mechanisms including read-only filesystems, strict resource limits (which can be changed on-the-fly), and limited networking. Only ports and IPs that you define in the panel are open for each server, so no more worrying about a user running their servers on the wrong IP or port.
  • SFTP is used rather than FTP to provide a more secure management interface. SFTP is also isolated from the main host by using a specialized Docker container. While each server has their own SFTP account, this account does not physically exist on the machine itself, only in the Docker container.
• Design is a major factor in today's world, but all too often panels fall short by either using a poor design, or going overboard and spending more time designing their views than designing how the software should work. We've taken the middle ground and included a simple, pleasing theme that can be easily extended to match your companies branding if necessary, but can also be used out of the box and is intuitive and mobile friendly.
• Truly live console and server statistics. Pterodactyl Panel leverages Websockets to display your server console in realtime, as well as live memory and CPU usage. No server plugins necessary, and no taxing file reads to show the log.
• Custom designed file manager to easily edit, upload, and handle all of your files. Need to unzip a file on your server? Easy, just select the decompress option from the file manager. None of that Net2FTP stuff here.
• Sub-Users are supported out of the box. Have a friend or two (or twenty) that you want to let access your server to manage configurations and keep an eye on the console? Easily add friends and select specific permissions that they have. Only want them to be able to view the console and make sure the server stays on but not be able to read any files? Easy as checking a few boxes. Want them to be able to help you manage other subusers on that server? Also as easy as checking a few boxes.
• Scheduled Tasks are all the rage now-a-days, and Pterodactyl ships with a powerful command scheduler. We might not have all of the fancy scheduler gimicks that other panels have, but we support extremely configurable cron syntax, and are actively working on adding even more task options. Want your server to restart at 3:32am every third Tuesday of the month? We got you.
• Per-Server Databases allow you to easily create a new database for a server right from the panel, and let the user control the password.
• Easy-peasy memory, swap, disk IO, and CPU throttling and limits all from the panel, and without having to restart servers.
• Custom designed control daemon to control servers, no need to install any plugins on your servers.

Since everyone really just wants to see pictures:

Spoiler: Pictures

Server Statistics (live output, updates every 2 seconds):

Server File Manager:

Admin Server Overview:

API Controls:

Scheduled Tasks

User Editable Startup Parameters:

Advanced Server Configurations:

Can it only do MC servers?

 

[Fishfish0001]

Can it only do MC servers?

It can do other game types such as Source Engine, Ark, and Voice Servers. Rust and other games are in the design phase.

 

[to_er]

Great work

 

[DFCOfficial]

This is much easier to use than puffer panel, I love it

 

[Fishfish0001]

THE UPDATE YOU'VE BEEN WAITING FOR!

[email protected] (codename Courageous Carniadactylus) and [email protected] (codename Candid Comodactylus) have now been released for pre-release testing. You should only update if you are using a development system and can stand to encounter potential breaking bugs, data loss, or downtime.

Upgrade Guides:
https://docs.pterodactyl.io/v0.6.0/docs
https://daemon.pterodactyl.io/v0.4.0/docs/upgrading-from-previous-versions

Update Notes:
https://github.com/Pterodactyl/Panel/releases/tag/v0.6.0-pre.1
https://github.com/Pterodactyl/Daemon/releases/tag/v0.4.0-pre.1

Spoiler

[DOUBLEPOST=1487464518][/DOUBLEPOST]Whats this, a new theme for the Admin CP...?

 

[minecraftcafe]

Whats up folks. I created a installation script for this panel. The script works for Ubuntu 16.x and lets you choose from having either nginx or apache installed. Also setups SSL for you.

The script should be ran on a properly setup server and not ran under root. If i get around to it, I may add a user creation section to it.

https://github.com/crombiecrunch/Pterodactyl-Panel-Install

curl -Lo install.sh https://raw.githubusercontent.com/crombiecrunch/Pterodactyl-Panel-Install/master/install.sh
bash install.sh -i [nginx] [apache]
i.e. bash install.sh -i nginx

You will be prompted for email, FQDN (do not enter http://), time zone, and portal password.

This will install all of the necesary files and update the system including SSL.

You will not be prompted again until you need to copy and paste the core code from your node. As shown here, https://daemon.pterodactyl.io/docs/configuration

 

[Fishfish0001]

minecraftcafe — Very cool, glad to see someone was able to get an auto-installer setup!

 

[minecraftcafe]

No worries. I have a few other plans for it, crating a user if one doesn't exist and also to be able to be used on either centos or ubuntu.
Feel free to let me know of any changes or to post it on the Pterodactyl site.

 

[Fishfish0001]

Progress Updates!

I've just finished the re-implementation of service and service options in the panel with our newly implemented theme. Along with some front-end polish, there has been a lot of back-end code refactoring and re-writing to make use of more Laravel features, as well as generally make things more extensible in the future. Since 0.6.0 is focusing primarily on scalability of the panel and making management significantly easier for large multi-server networks and hosts I'll show off some of those changes here.

Previously, services and options worked well to define what a server was running, however it was notoriously difficult to add new services, especially if you have limited or no knowledge of Docker images. What I set out to fix in this release was allowing new services and options using more generic Docker images, as well as making it all controllable from the panel, and allowing nodes to be updated with a quick daemon reboot (which has no effect on servers).

The image above shows this new configuration management, and while still somewhat complex, it does allow people who have learned the system to easily extend, customize, and implement new services and options very easily. I've also significantly improved option variable setup and display with our new theme, and the validation is now done using Laravel validation rules, rather than pure regex, which should make everyone's lives easier.

Also highly requested and now implemented is the ability to allocate more than one IP and Port at server creation time, as shown in the picture below. As always, this is also possible through our API, which is being improved to return more relevant data and reduce the number of calls you need to make, and reduce the ambiguity in data.

Finally, I thought it might be a good time to showcase some positive reviews we've been receiving on Discord, in a spoiler because there are a ton.

Spoiler

 

[Fishfish0001]

This looks like WHMCS LARA theme

Seeing as they also use AdminLTE it doesn't surprise me.

 

[Fishfish0001]

Choo choo! Thats the pre-release train barreling into the station, this time with a fresh release of [email protected] and [email protected]. These two pre-releases address a host of bugs in prior pre-releases, and also add a fresh new theme to the entire panel, as well as significantly cleaned up code and backend logic! For those of you on pre.4, our upgrade guides have been updated to get you onto this newest version.

For those of you looking for stability and wanting to move from 0.5.7, this latest release is getting there, but you should still chose wisely between known stability and a new theme and features.

Panel: https://git.io/vy57a :|: Upgrade Docs: https://goo.gl/JNsM7j
Daemon: https://git.io/vy57V :|: Upgrade Docs: https://goo.gl/iBK9Kr

For those of you who are waiting to upgrade, enjoy some teaser photos of the new interface and features:
https://docs.pterodactyl.io/v0.6.0/docs/user-tour

Note: The API for this release is not functional due to major backend changes that were not passed back up to the API. This will be addressed in the next release. Sorry.

 

[Fishfish0001]

Happy Friday!

I'm happy to announce the first beta release of [email protected] and [email protected] today! This version has been many months of work, and it is exciting for it to finally reach a point where it can proudly wear the beta tag. For those of you running only Minecraft servers, you should be A-Okay to upgrade from 0.5.7 to this version. Unfortunately for everyone else, we haven't quite finished the installer scripts that allow other games to be easily installed via the daemon automatically.

Upgrade: https://goo.gl/JNsM7j
Install: https://goo.gl/bRUkyZ

Don't forget to upgrade your daemons as well, using https://goo.gl/iBK9Kr

As always, thanks for flying on the back of a giant reptile!

 

[Fishfish0001]

Well howdy do.

We've just shipped the first release candidate for the 0.6.0 branch, introducing a ton of new features, a brand new theme, and major code overhauls to make extending the core that much easier!

I've included a few sneak peaks of the panel below, which you've likely seen if you follow this thread, but feel free to check out our tour to see more!

New Server Listing — Just looks fresh, like your tux.

Sexy New Console — This fancy new console is quicker, more colorful, and includes a fancy little pop-out console! No need for multiple tabs, just click a button and your console is in its own window that you can pretend is a terminal session! Browse the panel, or the web, while keeping an eye on your server at all times.

Speedy File Browser — The filemanager has been re-designed to be even quicker, more feature-full, and do everyone you need from the web. We've also fixed the uploader, so no more "that was instant, do I have Google Fiber?" moments!

Highly Flexible Service Option Scripts — This is one of the biggest features in this release by far. Include the ability to quickly install software for a server on any node without having to ever edit the nodes! This new feature makes it very easy to extend the software offerings of the panel, and create your own services quickly. We even have guides for making your own custom service!

Service Packs — Quickly install software for a server without having to wait on installer processes. This is fairly similar to Multicraft, although a bit more basic.

And so much more! This is just a little sampler of more obvious changes, but there are tons of overhauls to backend code, as well as an even more refined event system to allow you to hook into panel events on your own without having to modify core code!

Whatcha waitin' for!?
Still interested in checking out the panel? Feel free to join us on Discord or hit up our docs and website! You'll need to use the version switcher in the top-left corner of the docs to find the documentation for installing this release candidate.