Brand Configuration & Dynamic Security Token for White Label CyberPanel
The core White Label engine provides zero-code brand asset replacements including custom logos, favicons, text titles, and a 3-method dynamic security code mechanism to protect admin login endpoints without reliance on external authenticator apps or NTP time synchronization.
Operational Problem and Context
Standard CyberPanel installations present two distinct challenges for service providers:
- Brand Exposure: Enterprise hosts require their own brand identity (e.g., FlexiPanel) across admin dashboards and client portals, but standard CyberPanel binaries lock logos and links to default assets.
- Brute-Force Vulnerability: Default administration login pages operate on static paths (
/loginSystemor/), making them prime targets for automated credential stuffing and brute-force attacks. Standard two-factor authentication solutions (such as Google Authenticator) rely heavily on synchronized system clocks, which can lock out administrators if VPS NTP time drifts occur.
Brand Restructuring Engine
The branding subsystem is configured centrally via white_label_config.json. The middleware dynamically scans and modifies outgoing HTML response buffers before sending them to client browsers:
- Replaces Admin Bar Logo, Login Page Logo, and Web Panel Favicon.
- Updates application titles and taglines across HTML
<title>tags. - Injects custom CSS rules directly into the document
<head>to override interface colors, font families, and container paddings.
3-Method Dynamic Login Security Token System
To eliminate brute-force attack vectors without introducing mobile app sync dependencies, White Label Core implements a daily dynamic security code algorithm:
$$\text{Daily Security Code} = \text{Prefix} + \text{SUM(Day + Month + Year)} + \text{Suffix}$$
For example, on July 5, 2026, with prefix MT and suffix Utilities:
$$\text{SUM} = 5 + 7 + 2026 = 2038 \rightarrow \text{Security Code: } \mathbf{MT2038Utilities}$$
Administrators can choose from three flexible protection methods targeting specific user access levels (e.g., admin, reseller, user):
- Security Code Input Field in UI: Injects an additional security field into the login form. To maintain a clean user experience, this field remains hidden until a user enters an account username associated with a security-protected group.
- Password Suffixing: Keeps the default login form UI unchanged. Protected users append the daily security code directly to the end of their password when logging in (e.g.,
passwordMT2038Utilities). The middleware verifies the token and strips it before passing the original password to CyberPanel's authentication backend. - Hidden Login Path via URL Token: Serves a standard 404 (Not Found) response to any visitor attempting to access the login page directly. Access is granted only when navigating to a URL containing the valid security token (e.g.,
/?code=MT2038Utilities), which installs a trusted 30-day authentication cookie on the browser.
Security Value and Emergency Rescue
Key Security Benefits:
- Neutralizes Automated Brute-Force Attacks: Dynamic daily rotation prevents replay attacks and automated password dictionary tools.
- Conceals Attack Surfaces: Hidden URL tokens hide the login page entirely from port scanners and vulnerability crawlers.
- Zero NTP Dependency: Mathematical daily calculation avoids lockouts caused by server clock drift or lost mobile devices.
Emergency Rescue Procedure:
If an administrator is unable to compute the daily code or needs immediate emergency access, security enforcement can be bypassed via SSH:
touch /usr/local/CyberCP/whiteLabel_data/disable_login_security
Creating this bypass file instantly disables login token checks until normal operations are restored.