Tuxxin Services

Overview

New in 1.29. Tuxxin Services connects iNetPanel to services from Tuxxin, the company behind iNetPanel. Each one works on its free tier with no account; adding a key raises its limits or adds coverage.

Open Admin → Settings → Tuxxin Services. There is a master switch and one switch per module, and each module card states exactly what it sends and where its results appear. A module that is off never runs: nothing is sent anywhere for it, and nothing it would add is shown in the admin panel or the client portal.

• New installs start with the modules on, except the malware scan, which needs a key first.
• Upgrades add the new modules switched off. The External Security Audit, available since 1.27, stays on.

External Security Audit (qsa.sh)

Scans your server's public IPv4 from outside your network with qsa.sh and reports what the internet can actually reach: open TCP ports, service versions, known CVEs and exposure checks. iNetPanel needs no open ports, since sites come in through the Cloudflare Tunnel, so 0 open ports is the expected result. Anything found is usually a router port-forward or a DMZ, and the panel labels each port with what is behind it, for example SSH, phpMyAdmin, or a hosted site answering outside the tunnel.

• Run it from Firewall → Exposure Scan. The scan runs on the server with live progress, so you can leave the page and come back.
• Free: the top 1,000 TCP ports, one scan per 24 hours. A Full token scans all 65,535 ports, one scan an hour. A Deep token adds the complete check set and spends one credit per scan.
• Change monitoring re-scans daily or weekly (hourly with a Full token) at a random time per server, and alerts only when your exposure really changes. A scan cut off at a time limit is never compared with a complete one, and a Deep token is never used for scheduled scans.
• The panel learns whether a token is Full or Deep from qsa.sh on its first scan, so monitoring with a new token starts after you run one scan by hand.

IP Intelligence (worldip.io)

Country, network (ASN), reverse DNS and address range for IP addresses the panel shows, from worldip.io.

• Click any IP address on the Firewall page (banned IPs) or in the Logs page to look it up. Lookups are cached for 24 hours, and private addresses are never sent.
• The Dashboard shows This Server on the Internet: your public IPv4, network, location and reverse DNS, including whether it is forward-confirmed, which mail servers check.
• Free: 1,000 lookups a day per server. A key adds VPN, proxy and Tor classification, a trust score and higher limits.

Domain & Certificate Watch (issued.live)

Domain registration expiry and the certificate the world sees for each hosted domain, from issued.live, refreshed about once a day. Domains and certificates close to expiry are flagged on the Accounts list, and the details appear in each site's details and in the client portal.

Site Screenshots (webshot.site)

A thumbnail of each hosted site from webshot.site, refreshed weekly, as a quick check that a site still renders. Screenshots are taken a few at a time to stay within the free limit of 5 every 15 minutes, so the first set takes a while on a server with many sites. Admins can refresh one on demand; clients can refresh their own once a day.

Malware & Phishing Scan (whack.sh)

Scans a hosted site from outside with whack.sh, which catches compromised sites that hide from ordinary scanners. Start a scan with Scan now in a site's details on the Accounts page, or in the client portal, where a client can scan each of their sites once an hour. A site flagged as malware, phishing or cloaking raises an alert.

whack.sh has no keyless tier. A key from a free whack.sh account covers these scans. Per whack.sh's terms, files a scan confirms as malicious are shared, by hash and type and not with your identity, with malware databases.

Site details

On the Accounts page, the site details button for each domain shows its screenshot, domain and certificate expiry, and the latest malware scan, for the modules that are on. Clients see the same for their own domains on the client portal's Overview tab, along with a short Server security summary.

Alerts

iNetPanel does not run a mail server, so alerts go to a webhook. Save one in Settings → Tuxxin Services → Alerts (or on the Exposure Scan tab): a Discord or Slack incoming webhook, an https://ntfy.sh/<topic> URL, or any https:// endpoint that accepts a JSON POST. Send test confirms delivery. Exposure changes also raise a notice in the panel header until you dismiss them.

Keys and privacy

• Keys, the qsa.sh token and the webhook URL are stored where only root can read them, never in the panel database.
• Each module sends only what its card lists. The External Security Audit sends nothing beyond the request itself, because qsa.sh scans the address the request comes from.
• Services that report a remaining free allowance show it on their module card, and the panel waits for the allowance to reset rather than retrying.

From the command line

inetp tsvc status                 # modules, saved keys, remaining allowance
inetp qsa_scan                    # external exposure scan (also: inetp tsvc qsa run)
inetp tsvc worldip 203.0.113.7    # IP lookup ("self" = this server)
inetp tsvc issued example.com     # domain and certificate expiry
inetp tsvc notify-test            # test the saved webhook

See the CLI reference for the full list.