SSH attack tracking, firewall, open ports, processes, Docker, a terminal in your browser and Telegram alerts. A lightweight agent installed with one command, real-time data. Free, and it stays free.
Instead of installing separate tools and SSH-ing into each box, see all your servers on one screen.
A real PTY session to every server from the panel. Multiple tabs, command history, live metrics in the side panel.
IPs trying brute force, attempt counts and one-click blocking. DDoS detection from packet rate, SYN-RECV, kernel counters and access logs; target container/port, source blocks, connection rate limits and SYN hardening.
Manage ufw rules and Docker-published ports in one place; close a port or restrict it to specific IPs. Switch to 1.1.1.1 / 8.8.8.8 with one click when the provider DNS breaks.
CPU, RAM, disk, load and network traffic updated every 10 seconds; events on disk and RAM thresholds.
CPU, RAM, disk and network history kept for 30 days. Go back from 1 hour to 30 days, see when the load started and how much traffic you used in 30 days.
Firewall, SSH settings, fail2ban, pending security updates, exposed database ports, passwordless accounts. Every item fixed with one click.
Sort running processes by CPU/RAM and terminate them; read journal and file logs with filters. Change the server time zone from the panel.
Containers, their state and logs. Start, stop and restart from the panel.
Critical / warning / info event stream: new attacker IPs, SSH logins, offline servers, critical findings.
Generate a key pair in the panel, distribute the public key to all servers, disable password login safely.
A message from your own Telegram bot when a server goes down, when CPU / RAM / disk crosses a threshold and on critical security events. It also tells you when things are back to normal.
Two-factor login with an authenticator app. Every user sees only their own servers; admins manage accounts, open or close registration and can open a user's panel as that user when needed.
A full PTY session without opening an SSH client. Connect to several servers at once with tabs, see your command history, watch CPU, RAM and load flow in the side panel. The session runs over encrypted WebSocket, behind 2FA.
root@web-01:~# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 3 | `- Total failed: 412 `- Actions |- Currently banned: 27 `- Total banned: 1.204 root@web-01:~# systemctl status nginx | head -3 ● nginx.service - web server Loaded: loaded (nginx.service; enabled) Active: active (running) since Mon 09:12:04 root@web-01:~#
CPU, RAM, disk and network metrics are recorded continuously and kept for 30 days. Go back 1 hour, 6 hours, 24 hours, 7 or 30 days and see on the chart when that 3 AM load or the filling disk started.
Create a bot with BotFather, paste the token, find the chat ID with one click. Critical events reach your phone even when the panel is closed.
When a provider's DNS servers fail (it happens at Hetzner too), apt, API calls, webhooks and e-mail all stop at once. AdminXO notices, tells you, and turns the fix into a single button.
Every 10 seconds the agent reads packet/bit rate, SYN-RECV, kernel counters and access logs and decides against the last 10 minutes' baseline. Large-packet backup/CDN transfers never alert; small-packet floods are caught immediately.
Every server gets a 0–100 security score. Each item that lowers the score maps to an action: enable the firewall, close root login, install fail2ban, close the open port. Applied without touching the command line; you see the result in the score instantly.
Username, email and password. No credit card, plan selection or trial period.
Run the one-liner the panel gives you on the server. The agent is a single Python file, open source, running as a systemd service.
The server appears in the list within seconds; the first security scan and score are ready.
AdminXO started as a tool we wrote to manage our own servers. No paid tier, server limit or "pro" feature; everyone runs the same version.
Yes. No server or feature limits. There is no paid plan.
Around 20 MB of RAM idle and under 0.1% CPU. A single Python file running as a systemd service; it installs no extra packages.
Only your account. Terminal and command execution are protected by optional 2FA. The agent only opens outbound connections; it never listens on a new port.
Ubuntu 20.04+, Debian 11+, x86_64 and ARM64. Other systemd-based distributions usually work.
Metrics and events live in this panel's database; metric history is kept for 30 days (raw 10-second samples for 2 days, 5-minute summaries after that), events for 60. The panel is open source and you can self-host it.
"Delete server" in the panel or `sudo /opt/adminxo/uninstall.sh` on the server. It leaves no files behind.
The panel keeps testing name resolution on the server; when it breaks you get a Telegram alert and can switch to Cloudflare 1.1.1.1 / Google 8.8.8.8 with one click on the Overview tab. The agent caches the panel's IP, so it stays connected even while DNS is down.
It detects: from packet rate, SYN-RECV, kernel counters and access logs it tells volumetric, SYN/UDP/ICMP and HTTP floods apart and shows the target container/port and source blocks. SYN and HTTP floods and small-to-medium attacks are stopped on the server (blocking, connection limits, SYN hardening). A large volumetric attack that saturates the uplink can only be stopped by provider protection or Cloudflare; the panel tells you so explicitly.
Setup takes 2 minutes. Free, no card, no limits.