Hi team,
I'd like to share some feedback regarding a security concern with the panel's built-in terminal feature.
In my environment, I have already disabled direct root SSH login for security purposes. To manage the server through the panel's built-in terminal, I added the login private key for my ubuntu user.
However, I noticed that the panel's terminal configuration displays and handles sensitive credential information (such as private keys and passwords) in plaintext within the interface/storage. Given that web panels can sometimes be a target or accessed by unauthorized scripts if compromised, storing or exposing private keys in plaintext raises significant security risks regarding credential leakage.
Could you consider enhancing how the terminal manages or encrypts these credentials (or providing an option to use agent-forwarding/session-based auth without saving raw keys)?
Thanks for your attention to security!
