Administration

Users and permissions

Every person who uses the panel has an account. What they may do is decided by their role, optional per-user overrides, and, for single game servers, service permissions.

Roles

The global permission flags:

“Own” means limited to the reseller’s own customers.

Per-user overrides

On a user’s page an administrator can add extra permissions or deny individual permissions for that one account, on top of the role. settings:write can never be added as an extra; it belongs to SuperAdmins only.

Who can manage whom

• A SuperAdmin can manage every account.
• An Admin can manage Resellers, Users and Sub-users, not other Admins or SuperAdmins.
• A Reseller can manage only their own Users and Sub-users.
• Nobody can change their own role through the users page.
• The last active SuperAdmin cannot be deleted, suspended or demoted.

Accounts that you may not see do not exist as far as the API is concerned (it answers “not found”), so account names cannot be probed.

Service permissions

Access to one game server is decided per service:

Who holds them:

• Owner of the service: all of them.
• Administrators (SuperAdmin, Admin): all of them on every service.
• Resellers: all of them on their customers’ services.
• Sub-users: only those granted to them; a grant always needs view as well.

A suspended service allows nothing but view for everyone except administrators.

A suspended service (billing or an administrator, see Billing and WHMCS) shows the reason to its owner.

Sub-users

Give clan members or helpers access to one game server without sharing your account: open the game server, Sub-users tab (needs the subusers permission on it; owners have it).

1. Enter the person’s e-mail address and tick what they may do. view is always included. You can only hand out permissions you hold yourself on that server.
2. If no account has that address yet, a sub-user account is created in your tenancy and its one-time password is shown once: pass it on safely; it must be changed at the first sign-in.
3. Change the ticks later to change their access; Remove takes it away (the account stays, with its other grants).

An account in another reseller’s tenancy, an administrator or the server’s owner cannot be added; the panel does not say which of these it was. Every grant and removal is in the audit log.

Managing users

Open Users (needs users:read).

• Add a user: e-mail, user name (3-32 characters: lower-case letters, digits, - and _), password, role, status. Optionally force a password change at the first sign-in.
• Status: Active, Suspended or Disabled. Suspended and disabled accounts cannot sign in or use SFTP; their sessions and API keys stop working.
• Reset password: sets a new password and ends the user’s sessions.
• Unlock account: clears a sign-in lockout.
• Turn off two-step verification: for a user who lost their device.
• Delete: ends the user’s sessions and API keys.

Every change is recorded in the audit log.

Signing in

Passwords

Passwords are hashed with Argon2id. The minimum length is a panel setting (12 by default, 8-128); there are no composition rules. Changing your password ends your other sessions.

Two-step verification

Each account can turn on two-step verification with an authenticator app (TOTP) under its account page (Two-step verification):

1. Scan the QR code with an authenticator app.
2. Enter a code to confirm.
3. Store the 10 recovery codes somewhere safe. Each works once, instead of a code, when your phone is not at hand. You can replace them at any time.

A code cannot be used twice. A SuperAdmin can require two-step verification for administrators (Settings -> Security): SuperAdmins and Admins without it must turn it on before they can do anything else.

Accounts with two-step verification need an SSH key for SFTP; see Files and SFTP.

Lockout and rate limits

• After 5 failed sign-ins within 15 minutes, an account is locked for 15 minutes. Each further lockout doubles the time, up to 24 hours. An administrator can unlock it.
• Each IP address may try 10 sign-ins, then one every 6 seconds.
• Unknown user names and wrong passwords give the same answer and take the same time.

Sessions

A session ends after a period without use (12 hours by default) and, at the latest, after a fixed age (7 days by default); both are panel settings. Your account page (Where you are signed in) lists your sessions; you can end one, or sign out everywhere.

Admin IP allow-list

A SuperAdmin can limit where SuperAdmins and Admins may sign in from (Settings -> Security): a list of IP addresses or CIDR ranges. It applies to web sign-in, existing sessions, API keys and SFTP. The panel refuses a list that would lock out the person saving it. Behind a reverse proxy, set NGCP_TRUSTED_PROXIES so the panel sees real client addresses.

API keys

Each account with apikeys:own can create API keys on its account page (API keys):

• a name, an optional expiry date;
• optional scopes: a subset of your own permissions. Without scopes the key can do everything you can.
• The key (ngcpk_...) is shown once. Store it like a password.
• At most 50 keys per account. Revoke a key at any time; the list shows when and from where each key was last used.

API keys cannot create other API keys and cannot change passwords or two-step verification.

A scoped key reaches game servers only if its scopes include services:all or services:create. Users and Sub-users do not hold those permissions, so for them only a key without scopes can manage their services. A key with only the billing scope is meant for a billing system: see Billing and WHMCS.

Using keys: see API.

Audit log

Every change made through the panel, the API or SFTP sign-in is recorded with who, what, when and from which address: sign-ins and failures, user and settings changes, service actions, console and RCON commands, file changes, backups, schedules, game definition changes and more. Open Audit log (needs audit:read; resellers see their own customers’ events) and filter by action, user or target.