Hi, I was running your panel.sh installer and I found several items that look problematic or unexpected. Please clarify and fix the points below:
1. Hardcoded domain
- Script uses /etc/letsencrypt/live/chandpurtelecom.xyz and other chandpurtelecom.xyz references (see copy_conf_for_ols).
- Why is a third-party domain hardcoded in an installer? This causes my server to create/point SSL and config for a domain I do not own.
2. Remote downloads & execution
The script downloads and executes multiple remote scripts at runtime, e.g.:
Why are you fetching and executing code from these external URLs without verification? This is a high risk for supply-chain injection.
3. Plaintext credentials on disk
4. Automatic cronjobs & restart triggers
Script installs multiple cron jobs (backup, limit_check, fail2ban task, and a watcher that restarts OpenLiteSpeed on certain .htaccess conditions).
Explain what each cron job does and why automatic service restarts are triggered by file changes (this could be abused to cause instability).
5. Random port and service changes
Script replaces port 2083 with a random port saved to /root/item/port.txt. Why is this randomized and how should I find/control the port?
It also installs a systemd cp.service and replaces Python paths to /root/venv/bin/python. Please provide the service file sources and explain behavior.
6. Files and paths modified
7. Commands executed as root
- A lot of sudo/root operations happen automatically (package installs, systemctl, iptables/ufw modifications). I need an explicit list of required changes before running the script.
8. Supply / source verification
- Please provide:
- Link to the canonical source repository for this project (not a raw file).
- Release tag or commit hash used to generate this panel.sh.
- SHA256 checksum or signed release of any downloaded artifacts (panel_setup.zip, extra scripts).
- License and contact for security issues.
9. Security audit / assurance
- Has this installer been security audited? If not, will you allow a short third-party review or provide a safe mode that does not download/execute remote scripts or touch LetsEncrypt for domains I don’t own?
Immediate requests (please reply):
- Confirm you will remove or parameterize the hardcoded domain (or provide a version that prompts for domain).
- Stop curl | bash without checksum/signature — provide checksums or repository to verify.
- Provide a quick checklist of what the script will modify (packages, files, services, ports).
- Provide a safe, non-destructive installer or a dry-run mode.
Thanks, I need these answers before I continue using this installer on any server with real data.
