Staff Access for Pterodactyl 2.0: look at a customer's server with their consent
When a customer opens a ticket, your staff usually need to look at the server: read the console, check a config, restart it. Today that means asking for the customer's password, or an administrator opening the server with full power and no record of who looked or why.
Available on Gumroad.
- Requires
- Pterodactyl Panel 2.0, with the panel's scheduler and queue worker
- Tested with
- Pterodactyl 2.0.0-beta.2 (PHP 8.4): 128 browser and API checks and 7 unit tests (version 1.0.1)
- Package
- Official extension (.pteroext). No panel file is edited.
- Price
- $9.99, one panel
Staff Access gives your staff a proper way in. A staff member asks for access to one server, with a reason, a time limit and the permissions they need. The server owner sees the request in their panel and decides. Once approved, the staff member is a normal subuser with exactly those permissions, until the time runs out or the owner revokes it.
What Staff Access for Pterodactyl 2.0 does
Staff request access
From a Staff Access page in their account menu: server ID, reason, how long (up to the maximum you set) and the permissions, picked from Pterodactyl's own subuser permission list.
The owner decides
A notice above the server list and a Staff Access tab on the server show who is asking, their email, the reason, the duration and the permissions. The owner can untick permissions before approving, or deny.
Exactly those permissions
On approval the staff member becomes a subuser with the approved permissions. Subuser management (user.*) and database passwords can never be requested, so no added user or seen password outlives the access.
Access ends on its own
The panel's scheduler removes the subuser within a minute of the end time, through the panel's own subuser removal, which also tells the node to drop SFTP and console sessions. The owner can revoke at any time.
Everything is logged
Request, cancellation, approval, denial, revocation and expiry go to the server's activity log as readable sentences, with the reason and permissions in the entry details.
Admins stay in control
Choose whether root administrators count as staff, add other staff accounts, set the maximum length and see every waiting request and running grant in one list. Administrators who do not own a server cannot approve for its owner.
How it works
- Install. Copy
staff-access.pteroextto the panel server and runphp artisan p:extension:install staff-access.pteroext --enable, thenchown -R www-data:www-data extensions public/assets/extensions(use your web user). - Open the admin page. Reload the panel. Admin → Staff Access appears.
- Configure. Root administrators as staff (on by default), the maximum access length (24 hours by default, up to 720) and your staff accounts, added by email or username.
Screenshots
Pricing
One Pterodactyl panel installation; a test or staging copy is included. Updates within version 1.x. The source is readable.
Good to know
- For Pterodactyl 2.0 only. For Pterodactyl 1.x there is Staff Access for Blueprint.
- Tested on Pterodactyl 2.0.0-beta.2 with a stand-in Wings that records the calls the panel makes. A real Wings, other 2.0 versions, mobile layouts, browsers other than Edge and languages other than English are untested.
- The six activity sentences are added to the panel's activity translation group through Laravel's translation loader. If a future panel version reads them differently, the entries show as raw keys and everything else keeps working.
- Access ends only while the extension is enabled. Run
php artisan staff-access:revoke-allbefore you disable it.
FAQ
Can staff give themselves more than the owner approved?
No. They get exactly the approved permissions. Subuser management and database passwords are never grantable, so they cannot add other users, raise their own access or keep a password after access ends. Schedules they create keep running after it ends; the owner can delete them on the Schedules page.
What if the owner changes their mind?
Revoke removes the staff member from the server immediately.
Do administrators still have their usual access?
Yes, nothing in Pterodactyl is changed. Staff Access adds a way in that has the customer's consent and a record.
Where is the data?
In your panel database (two tables) and the server activity log. Nothing is sent anywhere.
Related tools
Staff Access for Blueprint
Staff request access to a customer's Pterodactyl server, the owner approves the permissions, and access ends on its own. Logged. Blueprint, no core edits.
Crash Detector for Pterodactyl 2.0
Notices Pterodactyl 2.0 servers that stop without anyone stopping them, keeps the last console lines, alerts the owner and your staff, and stops crash loops.
Discord Notifications for Pterodactyl 2.0
Pterodactyl 2.0 panel events in Discord: power actions, sign-ins, file edits, backups and admin changes. 138 events, per-server webhooks, rate limits handled.
More from Karelia Labs
Updated