---
title: "InterNetX Server Assist"
description: "InterNetX Server Assist is the central self-service solution for your Managed Server in Plesk. The extension empowers administrators and resellers to carry out critical routine administrative actions in real time—eliminating wait times for support tickets. Additionally, resellers can grant their end customers selective access to their own domain-scoped email delivery logs."
url: "https://help.internetx.com/en/server/internetx-server-assist/"
lang: "en"
section: "Server & Cloud"
reviewed: "Wed Nov 11"
---
# InterNetX Server Assist
## The Plesk extension is only available for InterNetX Managed customers.
***
> **This extension is currently being rolled out automatically to our Managed customers in phases. Because we prioritize quality over quantity as always, the extension may not yet be available on your server.**
***
> **Note on User Perspectives:**
> * **Resellers & Administrators** access the full management cockpit with all modules (Mail Logs, Fail2ban, and Server Certificates).
> * **Customers** receive a streamlined menu item for **Mail Logs** once enabled in their Service Plan, strictly scoped to their own domains (see [Section 3.4](#34-customer-perspective-end-user-view) and [Chapter 5](#5-role-concept--permission-assignment-service-plans)).
***
## Table of Contents
1. [Overview & Getting Started](#1-overview--getting-started)
2. [Module: Unban IP Address (Fail2ban Self-Service)](#2-module-unban-ip-address-fail2ban-self-service)
- [Common Use Cases](#common-use-cases-fail2ban)
- [Step-by-Step Instructions](#step-by-step-instructions-fail2ban)
- [Security Policies & Restrictions](#security-policies--restrictions-fail2ban)
3. [Module: Mail Logs (Mail Log Inspector)](#3-module-mail-logs-mail-log-inspector)
- [Common Use Cases](#common-use-cases-mail)
- [Step-by-Step Instructions (Reseller / Admin)](#step-by-step-instructions-mail)
- [Result Table Structure](#result-table-structure)
- [Customer Perspective (End-User View)](#34-customer-perspective-end-user-view)
4. [Module: Manage Server Certificates](#4-module-manage-server-certificates)
- [Important Distinction from Website Certificates](#important-distinction-from-website-certificates)
- [Certificate Types: Custom Certificate vs. Let's Encrypt](#certificate-types-custom-certificate-vs-lets-encrypt)
- [Section 1: Currently Active Certificates](#section-1-currently-active-certificates)
- [Section 2: Import & Validate Custom Certificate](#section-2-import--validate-custom-certificate)
- [Section 3: Assign Managed Certificates](#section-3-assign-managed-certificates)
- [Section 4: Rollback (Restore Certificate Baseline)](#section-4-rollback-restore-certificate-baseline)
- [Section 5: Request Free Let's Encrypt Certificate](#section-5-request-free-lets-encrypt-certificate)
5. [Role Concept & Permission Assignment (Service Plans)](#5-role-concept--permission-assignment-service-plans)
- [Role Matrix Comparison](#role-matrix-comparison)
- [Step-by-Step: Enabling Customer Access to Mail Logs](#step-by-step-enabling-customer-access-to-mail-logs)
- [Reseller Permissions for Server Certificates](#reseller-permissions-for-server-certificates)
6. [Frequently Asked Questions (FAQ)](#6-frequently-asked-questions-faq)
***
## 1. Overview & Getting Started
### Entry Points for Administrators and Resellers
Within the Reseller interface, you can access **InterNetX Server Assist** as follows:
**Via the Left Main Navigation:**
In the left Plesk sidebar, click on **InterNetX Server Assist** under *Additional Services*. You will be directed to the overview page featuring three tiles:
- **Mail Logs** (Mail log inspection)
- **Unban IP Address** (Fail2ban self-service)
- **Server Certificates** (Manage hostname & core service encryption) *[where enabled]*
***
## 2. Module: Unban IP Address (Fail2ban Self-Service)
To protect your server, the security service **Fail2ban** blocks IP addresses temporarily if repeated invalid login attempts occur (e.g., mail clients, SSH, or web logins).
### Common Use Cases
- A colleague or customer entered an email password incorrectly multiple times; the entire static office IP address is now prevented from sending or receiving emails.
- Repeated incorrect FTP, SSH, or Plesk login attempts have inadvertently locked you out.
### Step-by-Step Instructions
1. Open the page **Unban IP Address (fail2ban)**.
2. **Specify the IP Address:**
- **Automatic Detection:** In the *Public IP Addresses* box, the system detects your current public IPv4 (and IPv6 if available). Click on **`Use this IP`** to transfer the address directly into the input field.
- **Manual Input:** Alternatively, type the affected public IP address (e.g., `62.116.161.144` or `2001:db8::1`) into the *“IP address to unban”* field.
> *Note:* For some internet service providers utilizing Carrier-Grade NAT (CGNAT), the automatically detected address may differ from your actual connection path. In this case, please verify the IP address manually.
3. **Inspect the Ban Reason (Recommended):**
- Click **`Check ban history`**.
- The system inspects the Fail2ban database and historical log archives in the background, providing information under *Recent ban events* regarding the root cause (e.g., failed authentication attempts against Postfix or Dovecot).
4. **Execute the Unban:**
- Click **`Unban from all jails`**.
- The system immediately removes the ban across all active server filters.
- **Status Feedback:**
- **Green (Success):** The IP address was actively blocked and has been successfully released.
- **Yellow (No active ban):** The IP address was not blocked in any active jail.
- **Red (Error):** The operation could not be verified; please contact support.
### Security Policies & Restrictions
- **Local & Private IP Addresses:** Private network ranges (e.g., `192.168.0.0/16`, `10.0.0.0/8`, `172.16.0.0/12`, `127.0.0.0/8` / loopback as well as IPv6 link-local) are blocked for security reasons and cannot be unbanned via the web interface.
- **Audit Logging:** Every unban request is permanently recorded in Plesk's system-wide Action Log with user login, IP address, timestamp, and result.
***
## 3. Module: Mail Logs (Mail Log Inspector)
The Mail Log Inspector allows you to trace the delivery path and status of emails within seconds.
### Common Use Cases
- A sender claims to have sent an important message that allegedly never arrived.
- Analyzing bounce reasons (rejection messages from external mail servers).
- Checking whether local mail clients (e.g., Outlook or Thunderbird) successfully handed messages off to the server.
### Step-by-Step Instructions (Reseller / Admin)
1. Open **Mail Logs**.
2. **Define Search Filters:**
- **Date from / Date to:** Narrow down the timeframe (defaults to the current day).
- **Sender contains:** Email address or sender domain (e.g., `billing@` or `example.com`).
- **Recipient contains:** Email address or recipient domain.
- **Status:** Filter specifically by status (e.g., *All*, *Delivered*, *Rejected*, or *Deferred*).
3. **Run Query:**
- Click **`Search`**.
- The search runs asynchronously as a protected background task. As soon as the Postfix logs have been streamed, the table updates automatically.
### Result Table Structure
Matching entries are displayed chronologically under **E-Mail Activity**:
| Column | Description |
| --- | --- |
| **Timestamp** | Exact timestamp of the recorded log event |
| **Queue ID** | Unique Postfix Queue ID identifying the message transaction |
| **Direction** | Incoming or outgoing email traffic |
| **Address** | Communication address recorded in the log row |
| **Domain** | The corresponding domain hosted on your Managed Server |
| **Status** | Delivery result (e.g., delivered, temporarily deferred, mailbox full, or rejected) |
***
### 3.4. Customer Perspective (End-User View)
Once a reseller has granted permissions in the customer's Service Plan, the customer sees a streamlined, customized view:
1. **Seamless Menu Integration:**
In the customer's left main navigation, a dedicated item with an envelope icon appears beneath standard web hosting services (*Websites & Domains*, *Mail*, *Files*, *Databases*):
**`Mail Logs`**
2. **Distraction-Free Interface:**
The customer sees **neither** the overarching *InterNetX Server Assist* hub nor the tiles for *Fail2ban* or *Server Certificates*. The interface stays strictly focused on what the customer requires.
3. **Strict Domain Scoping:**
Directly below the filter bar, the scope of domains searched is transparently shown to the customer:
*`Domains: test.domain`*
Customers can only view log lines belonging to their own domains. Viewing logs from other customer domains or administrative server domains is strictly prevented at the system level.
4. **Equal Usability:**
End customers benefit from the same asynchronous background search, live filters, and clear tabular layout—without having to submit a support ticket.
***
## 4. Module: Manage Server Certificates
### Important Distinction from Website Certificates
- **Website Certificates** (for customer websites and domains) continue to be managed as usual under *Websites & Domains > SSL/TLS Certificates*.
- **Server Certificates** in *Server Assist* control the core system encryption endpoints:
1. Direct access to the **Plesk Panel** itself (Port 8443).
2. The **server-wide mail service** for IMAP/POP3 (Ports 993/995) and SMTP (Ports 465/587).
### Certificate Types: Custom Certificate vs. Let's Encrypt
Plesk only supports having one active certificate assignment active per service at any time (either a custom-uploaded certificate or an automated Let's Encrypt certificate).
***
### Section 1: Currently Active Certificates
The topmost section displays the current live certificate status:
- **Plesk Panel:** SHA-256 fingerprint and expiration date (`Valid until`) of the active panel certificate.
- **Server-Wide E-Mail Service:** SHA-256 fingerprint and expiration date of the shared Postfix and Dovecot TLS certificate.
***
### Section 2: Import & Validate Custom Certificate
Use this section if you wish to deploy a purchased certificate (e.g., from DigiCert, Sectigo, etc.) for the server hostname.
**InterNetX Server Assist** checks uploaded certificates for cryptographic validity automatically, even without running an explicit pre-check. If, for instance, the intermediate CA chain is incomplete, you will receive a descriptive error message.
1. **Enter Details:**
- **Certificate Name:** A unique reference name (e.g., `Wildcard-Plesk`).
- **Service Hostname:** The server's FQDN (e.g., `plesk.your-domain.com`).
2. **Upload Files:**
- **Server Certificate (PEM):** The primary server certificate.
- **Private Key (PEM):** The matching private key (transferred securely via stdin into the root-only storage vault).
- **CA Certificate Chain (PEM):** The intermediate CA certificates.
3. **Pre-Check (Recommended):**
- Click **`Check certificate`**. The system verifies key matching, hostname alignment, and chain completeness **without** applying changes to active services.
4. **Import:**
- Click **`Import certificate`**. The certificate is stored in the secure vault and appears in the managed certificates table. *(Note: Importing alone does not alter any live service!)*
***
### Section 3: Assign Managed Certificates
In the table **Certificates Managed via InterNetX Server Assist**, you will find all available certificates along with their validity period and status.
1. In the **Assign certificate** column, select the desired target service from the dropdown:
- `Plesk-Panel` (activates the certificate on administration port 8443)
- `Server-Wide E-Mail Service` (activates the certificate for Postfix & Dovecot)
2. Click the **`Assign certificate`** button.
***
### Section 4: Rollback (Restore Certificate Baseline)
Prior to every certificate switch, the system automatically captures a snapshot of the prior configuration. Should any unexpected issue occur following a change, you can revert at any time.
1. Navigate to the **Rollback** section.
2. Under **Plesk-Panel** or **Server-Wide E-Mail Service**, select the desired backup snapshot from the dropdown:
- Entries are identified by timestamp and hash (e.g., `26.10.2026 16:11:34 CET / c9801a90b7a33e6e`).
3. Click **`Restore backup`**.
4. The system reinstates the configuration and verifies local TLS ports. Invalid or expired backups remain in the archive for documentation, but cannot be activated.
***
### Section 5: Request Free Let's Encrypt Certificate
You can request an official Let's Encrypt certificate for the server hostname directly via the extension. Plesk manages future automatic renewals.
> **Important Notice:** Requesting Let's Encrypt through this workflow **always replaces both the Panel and the server-wide Mail certificate simultaneously** to guarantee unified, end-to-end encryption.
1. Enter your **Contact Email Address** for notifications (e.g., `email@domain.tld`).
2. Check the mandatory confirmation box:
☑ *“I confirm the request for a new certificate for [Server Hostname] and the replacement of certificates for Plesk-Panel AND the server-wide mail service.”*
3. Click **`Request and assign new certificate`**.
4. The server requests the certificate via ACME, installs it on Panel (8443), SMTP (465), and IMAP (993), and verifies service reachability.
***
## 5. Role Concept & Permission Assignment (Service Plans)
### Role Matrix Comparison
| Feature | Administrator | Reseller | End Customer (Subscriber) |
| --- | --- | --- | --- |
| **Unban IP Address (Fail2ban)** | Full Access | Available by default | No Access (Hidden) |
| **Manage Server Certificates** | Full Access | Optional via Reseller Plan | No Access (Hidden) |
| **Mail Logs (Mail Log Inspector)** | All Domains | Assigned Domains | **Own Domains Only (if enabled in Service Plan)** |
***
### Step-by-Step: Enabling Customer Access to Mail Logs
End customers have **no** access to mail logs by default. As a reseller, you can activate this feature for customers in your Service Plans:
1. In the left navigation, go to **Hosting Services > Service Plans**.
2. Click on the Service Plan you wish to edit (e.g., *Unlimited*).
3. Switch to the **Permissions** tab.
4. Scroll down through the permissions list to the InterNetX Server Assist entries.
5. Check the box:
☑ **Access to mail logs (InterNetX Server Assist)**
*(Description: “Allows customers to access email logs for their own domains.”)*
6. Click the blue **`Update & sync`** button at the bottom.
> **Effect for the Customer:**
> Once synchronized, the **Mail Logs** menu item appears immediately in the customer's navigation below their hosting tools. The customer can now independently investigate email delivery issues without opening a support ticket.
***
### Reseller Permissions for Server Certificates
The permissions list additionally contains:
- ☐ **Access to server certificates (InterNetX Server Assist)**
*(Description: “Allows resellers access to tools for server-wide Plesk and mail certificates. Does not grant Plesk administrator access.”)*
- **Purpose:** Allows administrators to delegate management of hostname certificates to trusted resellers.
- **Security:** Customer accounts remain strictly blocked from this option, even if a Service Plan inadvertently includes this permission.
***
## 6. Frequently Asked Questions (FAQ)
### Where can my customer find the Mail Logs link?
After activation in the Service Plan, the customer will find **Mail Logs** directly in the left navigation sidebar of their Plesk panel (below WordPress, Laravel, or standard hosting items).
### Can a customer view mail logs belonging to other domains?
**No.** Log inspection runs strictly isolated using a server-resolved domain scope filter. Customers only see logs for domains belonging to their own subscription. This scope is explicitly confirmed under the search form as *`Domains: `*.
### Why can't my customer see the "Unban IP Address" tool?
The *Unban IP Address* module interacts with the server-wide Fail2ban instance. To prevent abuse and security risks, this module is reserved exclusively for Administrators and Resellers. Customers should contact their managing reseller in case of IP blocks.
### What happens if a certificate switch fails?
The system features an automatic **self-healing rollback mechanism**: If activation or the local TLS handshake check on ports 8443, 465, or 993 fails, the process aborts immediately and restores the previous configuration state automatically.