DirectAdmin
Let Konrado check the user behind each ticket, through the DirectAdmin API or the Konrado plugin.
With DirectAdmin connected, Konrado checks the user behind a ticket: the package, the domains, DNS, mail, SSL and backups. It only reads. Nothing on your server changes.
You connect a server in one of two ways. With the API, Konrado reads DirectAdmin with a login key and nothing is installed. With the Konrado plugin, you run one command as root and Konrado also reads the firewall, CloudLinux, Imunify, cron jobs and Git repositories. The API is the current way. The plugin is the legacy way: it keeps working where it is installed, and a new server should use the API. Pick a tab below: every section follows your choice.
What Konrado reads
Konrado works out whether the login key belongs to an admin, a reseller or a user. It reads only what DirectAdmin lets that account see, for the user and domain in the ticket.
| Data | How it helps |
|---|---|
| Account | Package, usage, limits, the reseller above the user, and the domains |
| Website | Document root, subdomains, domain pointers, the DNS zone and SSL status |
| Mailboxes, forwarders, autoresponders, filters and delivery logs of the last 24 hours | |
| Files | The document root, a short file listing and the FTP accounts |
| Databases | The databases the user can see |
| Backups | DirectAdmin backups, and JetBackup 5 backups where it is installed |
| Server | CPU, memory, disks, load, services and uptime. Only with an admin key |
| Data | How it helps |
|---|---|
| User and owner | Username, account type, reseller, domains, package, quota and usage |
| Domain setup | Main domain, subdomains, pointers and aliases, IP, document root, DNS records, SSL, logs and the file tree |
| Mail accounts, forwarders, autoresponders, filters, SpamAssassin settings, mailbox size and recent Exim delivery logs | |
| Account services | FTP accounts, MySQL databases and users, cron jobs, Git repositories, SSH keys, PHP versions and backup files |
| System | DirectAdmin system information, usage summaries, and CloudLinux (LVE) history where it runs |
| Backups and security | JetBackup 5 data, the CSF status of an IP, and Imunify360 or ImunifyAV malware, scan and WAF results where they run |
What Konrado cannot do
| Not possible | Why |
|---|---|
| Create, suspend, upgrade or delete a user | Konrado reads. User changes stay in DirectAdmin or your billing system |
| Change DNS, SSL, mail, filters, databases, files, FTP, cron, Git or SSH settings | Konrado can read them, not change them |
| Restore a backup, clean malware, unblock an IP or clear the mail queue | Backup, security and mail data are for diagnosis only |
| Show passwords, keys or the contents of mail | Secrets and private messages never go into a reply |
| See past the server | A problem at the registrar, a CDN or another mail host needs its own check |
| Run shell commands | Konrado uses fixed lookups, not a terminal |
| Read past the login key's role | DirectAdmin decides what the key's account may see |
Konrado calls DirectAdmin over HTTPS with one login key you can revoke at any time. Never type the account password into Konrado. After you save the key, the console shows only its last characters.
- Only
https://addresses work, and the TLS certificate must be valid. - The address must lead to a public IP. Konrado refuses private, loopback and other internal ranges.
- Konrado removes secrets from errors before the console shows them.
- Konrado uses seven fixed lookups. It cannot run any other DirectAdmin command.
The install command carries a key that links the server to your organization, so treat it like a password. Konrado then calls the plugin on port 8000, the default. Open that port to Konrado's IP addresses and to no one else.
- "The customer cannot find their domain. Which user or reseller owns it?"
- "Mail from this domain bounces. Do DNS, the mailbox, the filters or the logs explain it?"
- "The customer says the SSL certificate is invalid. What does the SSL status show?"
- "This user hits the quota. Which usage numbers belong in the reply?"
- "A domain pointer loads the wrong site. How is it set up?"
- "The customer suspects malware or a missing backup. Is there anything worth escalating?"
Before you start
- DirectAdmin 1.670 or newer, on the
currentorstableupdate channel. Konrado was tested end to end on 1.707 and 1.708. - DirectAdmin at a public HTTPS address with a valid certificate, on port 2222 unless you enter another.
- A DirectAdmin admin, reseller or user account that can create a login key.
- If DirectAdmin sits behind a firewall, allow Konrado's IP addresses to reach port 2222.
- Your help desk connected, with the customer's hosting service in your billing system. Konrado finds the user through that service, so its server needs the same hostname or IP as the DirectAdmin address.
- Root SSH access to the DirectAdmin server, with
curl,unzipand systemd. - Outbound internet access. The installer downloads the plugin and reports to
app.konrado.ai. - Port 8000 open to Konrado's IP addresses (see the list).
- Your help desk connected, with the customer's hosting service in your billing system. Konrado finds the user through that service, so its server needs the same hostname or IP as the server you install on.
Connect
Create a login key
Sign in to DirectAdmin as the account Konrado should use. Open User Level › Login Keys. If
you do not see it, open /CMD_LOGIN_KEYS on your panel. Click Create Key and name it, such as
Konrado. Leave Allow HTM off, so the key works only for the API. Set an expiry, and no
request limit or a high one. If you use Allowed IPs, enter Konrado's IP addresses (see the list), one per line.
Allow the commands
In Commands, search for each command below and tick Allow for the exact match:
| # | Command |
|---|---|
| 1 | emailvacation |
| 2 | domain-tls |
| 3 | email-logs |
| 4 | filemanager |
| 5 | db-show |
| 6 | resource-usage |
| 7 | search |
| 8 | system-info |
| 9 | CMD_API_FILE_MANAGER |
| 10 | CMD_API_FTP |
| 11 | CMD_API_DATABASES |
| 12 | CMD_API_SHOW_USER_USAGE |
| 13 | CMD_API_SHOW_USER_CONFIG |
| 14 | CMD_API_EMAIL_FILTER |
| 15 | CMD_API_EMAIL_AUTORESPONDER |
| 16 | CMD_API_EMAIL_FORWARDERS |
| 17 | CMD_API_EMAIL_POP |
| 18 | CMD_API_SSL |
| 19 | CMD_API_ADDITIONAL_DOMAINS |
| 20 | CMD_API_DOMAIN_POINTER |
| 21 | CMD_API_SUBDOMAINS |
| 22 | CMD_API_DNS_CONTROL |
| 23 | CMD_API_DNS_ADMIN |
| 24 | CMD_API_DOMAIN |
| 25 | CMD_API_SHOW_DOMAINS |
| 26 | CMD_API_SHOW_RESELLERS |
| 27 | CMD_API_USER_BACKUP |
Take only the exact result: resource-usage, not global-resource-usage; search, not
CMD_AJAX_SEARCH; CMD_API_DOMAIN, not CMD_API_DOMAIN_OWNERS. Never allow CMD_LOGIN_KEYS or
CMD_API_LOGIN_KEYS. For JetBackup 5 backups, also allow the plugin command of the key's level:
CMD_PLUGINS_ADMIN, CMD_PLUGINS_RESELLER or CMD_PLUGINS.
Save and copy the key
Enter the account's current password and click Create. DirectAdmin shows the key once. Copy it into your password manager. If you lose it, rotate the key rather than share the password.
Connect in Konrado
Open Workspace SettingsIntegrations, click Add integration and choose DirectAdmin. Login Key is already picked under How should Konrado reach this server?
| Field | What to enter |
|---|---|
| Integration Name | A name for your team, such as DirectAdmin EU |
| DirectAdmin URL | The panel address, such as https://panel.example.com:2222. Port 2222 is used when you leave it out |
| Username | The account that created the key. A key made by admin goes with admin |
| Login Key | The key from DirectAdmin |
Click Test Connection. A green box confirms the key and shows the DirectAdmin version. Click Connect.
The plugin is the legacy way to connect. Servers already connected with it keep working. For a new server, pick the API tab, unless you need the firewall, CloudLinux or Imunify data that only the plugin reads.
Choose the plugin. Open Workspace SettingsIntegrations, click Add integration and choose DirectAdmin. Under How should Konrado reach this server? pick Konrado plugin. The sheet shows three steps and the install command.
Run the command as root. Log in to your DirectAdmin server over SSH as root. Click the copy button next to the command and paste it into the session. The sheet hides your key on screen, but the copied command contains it, so treat it like a password. The key works for 24 hours, on as many servers as you like.
bash <(curl -s https://repo.konrado.ai/init.sh) --api-key=YOUR_KEY --callback-url=https://app.konrado.ai/api/integrations/servers/install --platform=directadminAnswer the installer. It asks for a few settings, each with a default: press Enter to keep it. Two answers matter. To update the plugin from the console later, answer Yes to Do you want to be able to upgrade this plugin through the Konrado panel? The server address it suggests, such as http://203.0.113.10:8000/mcp, is where Konrado connects to the plugin.
Wait for the connection. The sheet reads Listening for your server… and checks every 5 seconds. When the plugin reports back it shows Connected successfully and the server's address. Click Done. You can close the sheet earlier: the server joins the list once it connects. Running the command again is safe.
Check it works
The server is on the Integrations page as Connected. Its Type reads DirectAdmin · API, with the DirectAdmin version under it. Konrado tests the connection again every hour. Open the row and the Tools tab lists the seven lookups.
To change the key later, open the row, click Replace next to Login Key, paste the new one and click Save.
The server is on the Integrations page as Connected. Its Type reads DirectAdmin · Plugin, with the plugin version under it. The row is named directadmin Server: click it to rename it. Running the install command again sets the name back. Konrado tests the connection again every hour.
If something is wrong
Open the row on the Integrations page. A server that stopped working says Not working, what to check, and the exact error under Technical details.
| What you see | What to do |
|---|---|
| DirectAdmin URL must use HTTPS. | Enter the full https:// address. Plain HTTP does not work |
| DirectAdmin URL cannot contain credentials, query parameters, or a fragment. | Enter only the address and port, such as https://panel.example.com:2222 |
| DirectAdmin TLS verification failed. | Install a valid certificate for the panel hostname, with the full chain |
| DirectAdmin rejected the configured credentials. | Check that the username created the key and that you copied all of it |
| This DirectAdmin key cannot read that. | Allow the commands above, or check the role of the account that owns the key |
| DirectAdmin request timed out. | Check that the panel answers on its port and that your firewall and the key let in Konrado's IP addresses (see the list) |
| The address points to a private network | Use a public hostname. Konrado refuses private and internal addresses |
| No server health | Server health needs an admin key |
| Backups are missing | Allow CMD_API_USER_BACKUP, and the JetBackup plugin command if you use JetBackup 5 |
| Konrado looks at the wrong user | Check that the ticket's service in your billing system sits on this server |
| What you see | What to do |
|---|---|
| The command stops at once | Run it as root on the DirectAdmin server itself |
| Listening for your server… never changes | Check that the installer finished without errors and that the server reaches app.konrado.ai over HTTPS. After 2 minutes the sheet shows Taking longer than expected? with the same checks |
| Panel data is missing | Check that this server runs DirectAdmin and that you picked DirectAdmin in the console |
| Konrado looks at the wrong user | Check that the ticket's service in your billing system sits on this server |
The install step shows Connection error. It names the server address and the reason. Check both plugin services, read their recent logs and restart them:
systemctl status konrado-server.service konrado-root.service
journalctl -u konrado-server.service -u konrado-root.service --since "15 minutes ago" --no-pager
systemctl restart konrado-server.service konrado-root.service
systemctl enable konrado-server.service konrado-root.service
ss -ltnp | grep ':8000'The last line shows whether the plugin listens on port 8000. Konrado must reach that port: allow Konrado's IP addresses in your firewall. Then run the install command again.
Remove the integration
Open Workspace SettingsIntegrations, open the row menu (three dots) and choose Delete. Then delete the login key in DirectAdmin.
To stop for now and keep the settings, choose Disconnect instead.
Uninstall the plugin from the server, then open Workspace SettingsIntegrations, open the row menu (three dots) and choose Delete.
To stop for now and keep the settings, choose Disconnect instead.
Last updated on