ShahanPanel: user accounts, traffic accounting and expiry for SSH and VPN servers

What the panel manages

ShahanPanel is a panel for managing SSH users, monitoring traffic and configuring server settings, and the licence is MIT.

The model is a subscription service for a server you operate. Each user gets an account with a traffic limit and a subscription period, the panel tracks what that user has consumed, and the account expires when the period ends. The features are grouped into user management with adding, removing and editing users, traffic monitoring of each user's traffic, server settings such as the SSH port, backup and restore of the database, and a simple API for interacting with the panel.

The protocols involved are named in the repository topics, and they are the ones you would expect for this kind of server. SSH and Dropbear are the SSH side, and there is OpenVPN, WireGuard, Xray and V2Ray, Shadowsocks, Hysteria2, TUIC, Napsternetv and a Cisco AnyConnect entry in the list, plus the sing-box tooling the shell scripts refer to.

The distinction between the SSH side and the protocol side matters, because the feature table in the README lists capabilities per protocol, and the columns are add, delete, online, limit, traffic, multi session, backup, API and QR code. The SSH row is fully supported across all of them, while the other protocols are supported to different degrees, with some cells marked as coming later. So the panel is not a uniform abstraction over all of these protocols; it is a full account system with SSH at its centre and partial coverage elsewhere.

The last push to the repository was on 2026-09-15, and the recent releases are 11.0 from 2026-06-30, 10.3.1 from June and 10.3 from February 2026.

The dashboard and the users list

The dashboard is described as a real-time overview of server and user activity, and it is split into three areas.

The user statistics block counts four things: total users, which is the number of user accounts in the system, online users, which is the number currently connected to the server, active users, meaning the enabled accounts, and deactivated users, which are the disabled or expired ones.

The server health block covers RAM usage as a percentage of memory in use, CPU usage as the current processor load, HDD usage as the amount of disk space used, server traffic as the total data transferred by upload and download, and users traffic as the total data consumed by all users combined. That last pair is the distinction that matters for billing, since one is what the server moved and the other is what your customers moved.

The users list is the operational table, and the columns are worth reading because they are the account model. There is the username and password. There are start and finish dates, the activation and expiration of the account. There is contact information, a mobile number and an email address, and a referral field recording who referred the user, which is how a panel tracks where an account came from.

Then traffic, showing the assigned data limit and current usage, and a connection status that shows how many devices are currently connected for a user out of their allowed limit. Then the account status, active, inactive or expired, and an operations column with the actions you can perform: editing, activating or deactivating, resetting traffic, deleting and viewing connection QR codes.

Settings: ports, bot, backups, tokens and gifts

The settings page is a set of tabs, and the list is long enough to be worth grouping.

The first group is about the server and the administrator. You can change the admin password and set a new subdomain for the server. You can change the connection ports for the various services, with an SSH port for the primary SSH connections, a UDP port for UDP based protocols such as gaming or streaming, a DropBear port for the alternative lightweight SSH server, and a Tuic port for the TUIC protocol. There is a connection message, a custom message displayed to users upon connecting to the server, and OpenVPN configuration including the port and whether the protocol is UDP or TCP.

The second group is the Telegram bot. You configure the bot token and the admin id, and you customise the automated messages for account renewals, traffic limits and other events, and there are actions to test the connection, fix webhook issues and submit the configuration. There is also a separate Telegram message action that sends a custom message to all users who have linked their Telegram accounts.

The third group is data management. You can upload a backup to restore the panel from an SQL, JSON or sqlite3 file, create a new backup, delete all backups, and delete all users, which is described as a quick way to clear all user accounts. There is also an action to import server users, which adds existing system users to the panel. A backups list lets you view, restore, delete or download existing backup files, and there is an auto backup option that schedules automatic backups of the panel database at regular intervals, with every 6 or 12 hours given as the example.

The fourth group is operational policy. There is an expired users setting that automatically removes users after their subscription has expired, with a time frame in days. There is a daily gift action, either adding gift days to extend the subscription for all users by a number of days, or adding gift traffic to grant additional traffic to all of them. And there is the API token management, where you create a new token and specify the allowed IP address and a description, and view, renew or delete existing tokens.

Creating users, in bulk and by renewal

The How to Use section covers the three operations an operator performs most often, and the interface design is consistent across them.

To create a single user, you click the green plus icon on the main dashboard to open the Add New User dialog, fill in the user's details including username, password, traffic limit and subscription duration, and submit.

To create bulk users, you click the group icon to open the Add Bulk Users dialog. You specify the number of users to create, a starting username and the password preferences, then set the traffic limit and the subscription duration that apply to all the new accounts, and submit to generate them.

To renew a subscription, you find the user in the Users List and click the bolt icon in the Operations column. A dialog offers extensions of one, two, three or six months, or a full year, and selecting one renews the account immediately.

The icon vocabulary is worth noting, because it is how the whole panel works. A plus for a single new user, a group for bulk creation and a bolt for renewal, with the rest of the operations in the table. It is a compact interface, and it is the sort of thing that a panel which has been used by the same person for years tends to accumulate.

The API is described as simple, and it is used by creating a token in the settings page. Since a token carries an allowed IP address, the API is designed to be called from a known machine, which is the sensible constraint for an endpoint that can create and delete accounts.

Installation: a one click script, or a Docker stack

The system requirement is a Linux based operating system, with Ubuntu named, and there are two ways to get the panel running.

The one click route is a single command that pipes a remote script into bash.

bash <(curl -Ls https://raw.githubusercontent.com/HamedAp/Ssh-User-management/master/install.sh --ipv4)

The --ipv4 flag is a hint that the installer negotiates how it reaches the server, which is the kind of detail that matters for a panel whose users are often on networks where IPv6 routing is broken.

The Docker route is more explicit about what you get. The compose file defines two services, an app built from the local Dockerfile and a database.

services:
  app:
    build: .
    container_name: ssh-user-management
    ports:
      - "8080:80"
    volumes:
      - .:/var/www/html
    depends_on:
      - db

  db:
    image: mysql:5.7
    container_name: ssh-db

The Dockerfile is the plainest possible PHP setup, official PHP with Apache, the mysqli, pdo and pdo_mysql extensions installed, mod_rewrite enabled, the project copied into the document root, and the files handed over to www-data with 755 permissions.

FROM php:8.1-apache

RUN docker-php-ext-install mysqli pdo pdo_mysql

RUN a2enmod rewrite

COPY . /var/www/html/

WORKDIR /var/www/html

The database service is MySQL 5.7 with the credentials in the compose environment, a named volume for the data directory, and a restart policy. Those credentials are development defaults, and the compose file is meant to be edited before it is used for anything real.

The repository also carries a long list of shell scripts beyond the installer, covering the server setup, among them xray-install.sh, wg.sh.x, ssl.sh, tls.sh, geo-update.sh, addserver.sh, update.sh and a set of scripts for blocking and unblocking traffic by country. That is the server provisioning layer, separate from the panel itself.

Free and Pro, and what the protocol table really says

The panel is offered in a free version and a paid Pro version, where the free version provides the essential user management and monitoring features and the Pro version unlocks advanced capabilities for more demanding environments.

The feature table at the end of the README is the honest way to read that, because it maps capabilities onto protocols rather than describing the versions in the abstract. The columns are add, delete, online, limit, traffic, multi session, backup, API and QR code. The SSH row is checked across all of them, and the DropBear row is checked for everything except traffic. The TUIC row is partially filled, with the online capability marked as coming later and the limit, traffic and multi session entries empty.

So what the table shows is that the account system is complete for SSH, largely complete for DropBear, and partial for the protocol rows further down. The README even notes that the table will be updated, which tells you it is a work in progress rather than a specification.

Two other things are worth flagging before you rely on this for a real service. The first is the open installation model, where a remote script is piped into bash, and the fact that the panel runs with fixed MySQL credentials in the shipped compose file. Both are normal for this class of self-hosted panel, and both are the kind of thing that should be changed before the panel is exposed to the internet.

The second is the range of protocols in the repository, which spans both ordinary remote access and the censorship circumvention tooling, including scripts for blocking traffic by country and for managing the sing-box installation. The panel itself is an account and accounting system, and the protocol scripts are the server side it manages.

Editorial conclusion

Adopt ShahanPanel if you already run an SSH or VPN server and want to turn it into a subscription service with per user quotas, expiry dates and self service account creation, because the accounting and the expiry automation are the parts you would otherwise write yourself. Do not adopt it if you need a single user or a shared team account, since the whole model assumes many paying accounts with individual limits. Before you install, read the one click install script, and plan the database, because the compose file runs MySQL with fixed credentials in the environment and the panel database is what the backup and restore features protect.

Frequently asked questions

Official sources

1. HamedAp/ShahanPanel on GitHub
2. Issues
3. License: MIT
4. README
5. Releases