Should Enable access log by default for the Admin/User panel

[julienledut]

CloudPanel version(s) affected

2.5.4

Description

Hello,

I use CloudPanel for on month and very happy with it, Thank you.
CloudPanel is focus on security first.
But the ControlPanel can be sniffed for vulnerability (or brutforced?) and we can't monitor it by default, or after a bad event.
No logs for who access and connect to the Admin/user Panel. If the Admin/user Panel is compromised we could not get the IP and time.
In /etc/nginx/sites-enabled/custom-domain.conf file there is by default :

  #access_log /home/clp/logs/nginx/access.log;
  error_log /home/clp/logs/nginx/error.log;

My point is : we should uncomment it (the #). That what I did. It works.
Note : since /etc/nginx/nginx.conf file contains the directive : access_log off; --> no log.

How to reproduce

By default on a Cloudpanel fresh install.

Possible Solution

From Shell:

1. Just uncomment access_log in /etc/nginx/sites-enabled/custom-domain.conf file
2. sudo systemctl restart nginx
3. nano /home/clp/logs/nginx/access.log to see the access logs for the Admin/User panel.

Additional Context

As an example, my server is protected by CrowdSec but still get attacked (crowdsec is limiting the number of attacks, banning malicious IPs). Here is an example of "not me" access on the cloudpanel interface:

198.235.24.211 - - [23/Aug/2026:13:32:00 +0200] "GET / HTTP/1.1" 302 282 "-" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity"
50.17.101.143 - - [24/Aug/2026:02:17:13 +0200] "GET / HTTP/1.1" 302 282 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0"
50.17.101.143 - - [24/Aug/2026:02:17:13 +0200] "GET /login HTTP/1.1" 200 1342 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0"
195.178.110.209 - - [24/Aug/2026:04:35:06 +0200] "GET /.git/config HTTP/1.1" 302 282 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"
94.154.43.129 - - [24/Aug/2026:06:00:42 +0200] "GET /.env HTTP/1.1" 302 282 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
94.154.43.125 - - [24/Aug/2026:06:00:42 +0200] "GET /login HTTP/1.1" 200 4420 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36"
100.48.20.83 - - [24/Aug/2026:09:40:46 +0200] "GET /robots.txt HTTP/1.1" 200 56 "-" "Mozilla/5.0 (compatible; getdomaindata/1.0; +https://getdomaindata.com/bot)"
161.35.236.232 - - [24/Aug/2026:10:30:25 +0200] "GET / HTTP/1.1" 302 282 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
161.35.236.232 - - [24/Aug/2026:10:30:25 +0200] "GET /login HTTP/1.1" 200 1344 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
195.178.110.211 - - [24/Aug/2026:16:21:59 +0200] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 301 162 "-" "Mozilla/5.0 (compatible; SecurityResearch/1.0; )"
195.178.110.211 - - [24/Aug/2026:16:22:04 +0200] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 302 282 "http://sites.logidut.xyz/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings" "Mozilla/5.0 (compatible; SecurityResearch/1.0; )"

195.178.110.211 : a "very agressive" malicous IP.