Skip to content

Installation

Esapanel is installed on a freshly installed Debian 13 server, physical or virtual (VMware, Hyper-V, Proxmox and the other KVM environments), a VPS too. A script adds the package repository, installs the esapanel package and runs esapanel-setup, which configures the server and the panel.

Before you start

  • Debian 13 freshly installed, amd64 or arm64 architecture, with root access.
  • The final full name of the server, such as log.example.com, and its final address: the panel uses them for its certificate and for the license. The name must resolve to the address.
  • Internet access outbound: the package repository over HTTPS (port 443) and the license server (license.esalogica.com, port 9444). A server without Internet can neither activate nor check the license.
  • The activation code of the license, if you already have it: it can also be entered later, in the panel.
  • For the modules that keep a lot of data (the logs of CSP, the off-site copies of WFP), a separate disk or partition, mounted before the installation.

Installing

As root:

wget -qO install.sh https://repo.esalogica.com/install.sh && bash install.sh --modules=csp

On a minimal Debian without wget, first: apt-get install -y wget ca-certificates.

The script checks the system, the name and the architecture, adds the key and the package repository, installs esapanel and runs esapanel-setup. If the administrator data are missing, it asks for them.

The options

The options of install.sh go to esapanel-setup:

Option What it does
--channel=stable The package channel: stable (default) or testing, for test servers. Of install.sh only
--modules=csp,ucp The modules to install: csp, ucp, drp, wfp, lsp, also together
--license=ESAP-XXXX-XXXX-XXXX-XXXX The activation code
--company=, --name=, --username=, --email= The company and the administrator of the panel
--sender=panel@example.com The sender of the mail of the panel; without it, panel@ followed by the name of the server
--ssh-port=22 The SSH port the firewall leaves open
--backups-path=/var/lib/esapanel/backups The folder of the backups, best on a separate disk
--wfp-datastore=/srv/wfp/ds1 The first datastore of WFP (Web File), best the mount of a disk of its own

The password of the administrator is asked, or read from the environment variable ESAPANEL_ADMIN_PASSWORD: never on the command line.

The modules

Module What it installs
csp CSP (Central Syslog): the reception of the logs
ucp UCP (Uptime Check): the plugins of the checks and the database of the results
drp DRP (DMARC Report): the database of the DMARC reports
wfp WFP (Web File): FTPS and SFTP, rsync on port 60022, WebDAV on 443, the datastore of the copies
lsp LSP (License Server): the license server, on port 9444. Only for whoever sells the licenses

A module can be added later: run esapanel-setup again with all the modules, the previous ones and the new one. The module must also be in the license.

After the installation

At the end esapanel-setup shows the address of the panel:

https://log.example.com:9943
  1. Open the address. The panel starts with a self-signed certificate: the browser warns about it, and that is normal. Replace it right away with a Let's Encrypt one (see Certificates, mail and DNS).
  2. Sign in with the administrator created by the installation.
  3. If you did not give it with --license, enter the activation code (see The license).
  4. Confirm the sender of the mail in Server › Mail: until you do, every page reminds you.
  5. Turn on the second factor on your account.
  6. Check the firewall: for example open SSH only from your office (see Network and security).
  7. Set up the backup of the server to a remote destination (see Disaster recovery).

Running esapanel-setup again

esapanel-setup can be run again whenever you want: what is already configured stays (the database password, the application key, the certificate), the rest is written again, and the panel is installed only once. It is for adding a module, adding a WFP datastore or writing again the IP addresses added by the panel.

Do not edit by hand the files that esapanel-setup writes: run it again.

Security from the start

  • The firewall of the panel is on from the installation: the panel, SSH and the ports of the modules are open.
  • fail2ban protects SSH, the sign-in of the panel and the web server.
  • The security updates of Debian are automatic.