1. Home
2. /
3. Server & Cloud
4. /
5. InterNetX Server Assist

InterNetX Server Assist

11 min read · Reviewed 2026-11-11

Machine-translated and not yet editorially reviewed.

The Plesk extension is only available for InterNetX Managed customers.

This extension is currently being rolled out automatically to our Managed customers in phases. Because we prioritize quality over quantity as always, the extension may not yet be available on your server.

Note on User Perspectives:

• Resellers & Administrators access the full management cockpit with all modules (Mail Logs, Fail2ban, and Server Certificates).
• Customers receive a streamlined menu item for Mail Logs once enabled in their Service Plan, strictly scoped to their own domains (see Section 3.4 and Chapter 5).

Table of Contents

1. Overview & Getting Started
2. Module: Unban IP Address (Fail2ban Self-Service)
   • Common Use Cases
   • Step-by-Step Instructions
   • Security Policies & Restrictions
3. Module: Mail Logs (Mail Log Inspector)
   • Common Use Cases
   • Step-by-Step Instructions (Reseller / Admin)
   • Result Table Structure
   • Customer Perspective (End-User View)
4. Module: Manage Server Certificates
   • Important Distinction from Website Certificates
   • Certificate Types: Custom Certificate vs. Let’s Encrypt
   • Section 1: Currently Active Certificates
   • Section 2: Import & Validate Custom Certificate
   • Section 3: Assign Managed Certificates
   • Section 4: Rollback (Restore Certificate Baseline)
   • Section 5: Request Free Let’s Encrypt Certificate
5. Role Concept & Permission Assignment (Service Plans)
   • Role Matrix Comparison
   • Step-by-Step: Enabling Customer Access to Mail Logs
   • Reseller Permissions for Server Certificates
6. Frequently Asked Questions (FAQ)

1. Overview & Getting Started

Entry Points for Administrators and Resellers

Within the Reseller interface, you can access InterNetX Server Assist as follows:

Via the Left Main Navigation:
In the left Plesk sidebar, click on InterNetX Server Assist under Additional Services. You will be directed to the overview page featuring three tiles:

• Mail Logs (Mail log inspection)
• Unban IP Address (Fail2ban self-service)
• Server Certificates (Manage hostname & core service encryption) [where enabled]

2. Module: Unban IP Address (Fail2ban Self-Service)

To protect your server, the security service Fail2ban blocks IP addresses temporarily if repeated invalid login attempts occur (e.g., mail clients, SSH, or web logins).

Common Use Cases

• A colleague or customer entered an email password incorrectly multiple times; the entire static office IP address is now prevented from sending or receiving emails.
• Repeated incorrect FTP, SSH, or Plesk login attempts have inadvertently locked you out.

Step-by-Step Instructions

1. Open the page Unban IP Address (fail2ban).

2. Specify the IP Address:

   • Automatic Detection: In the Public IP Addresses box, the system detects your current public IPv4 (and IPv6 if available). Click on Use this IP to transfer the address directly into the input field.
   • Manual Input: Alternatively, type the affected public IP address (e.g., 62.116.161.144 or 2001:db8::1) into the “IP address to unban” field.

   Note: For some internet service providers utilizing Carrier-Grade NAT (CGNAT), the automatically detected address may differ from your actual connection path. In this case, please verify the IP address manually.

3. Inspect the Ban Reason (Recommended):

   • Click Check ban history.
   • The system inspects the Fail2ban database and historical log archives in the background, providing information under Recent ban events regarding the root cause (e.g., failed authentication attempts against Postfix or Dovecot).

4. Execute the Unban:

   • Click Unban from all jails.
   • The system immediately removes the ban across all active server filters.
   • Status Feedback:
     • Green (Success): The IP address was actively blocked and has been successfully released.
     • Yellow (No active ban): The IP address was not blocked in any active jail.
     • Red (Error): The operation could not be verified; please contact support.

Security Policies & Restrictions

• Local & Private IP Addresses: Private network ranges (e.g., 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 127.0.0.0/8 / loopback as well as IPv6 link-local) are blocked for security reasons and cannot be unbanned via the web interface.
• Audit Logging: Every unban request is permanently recorded in Plesk’s system-wide Action Log with user login, IP address, timestamp, and result.

3. Module: Mail Logs (Mail Log Inspector)

The Mail Log Inspector allows you to trace the delivery path and status of emails within seconds.

Common Use Cases

• A sender claims to have sent an important message that allegedly never arrived.
• Analyzing bounce reasons (rejection messages from external mail servers).
• Checking whether local mail clients (e.g., Outlook or Thunderbird) successfully handed messages off to the server.

Step-by-Step Instructions (Reseller / Admin)

1. Open Mail Logs.

2. Define Search Filters:

   • Date from / Date to: Narrow down the timeframe (defaults to the current day).
   • Sender contains: Email address or sender domain (e.g., billing@ or example.com).
   • Recipient contains: Email address or recipient domain.
   • Status: Filter specifically by status (e.g., All, Delivered, Rejected, or Deferred).

3. Run Query:

   • Click Search.
   • The search runs asynchronously as a protected background task. As soon as the Postfix logs have been streamed, the table updates automatically.

Result Table Structure

Matching entries are displayed chronologically under E-Mail Activity:

3.4. Customer Perspective (End-User View)

Once a reseller has granted permissions in the customer’s Service Plan, the customer sees a streamlined, customized view:

1. Seamless Menu Integration:
   In the customer’s left main navigation, a dedicated item with an envelope icon appears beneath standard web hosting services (Websites & Domains, Mail, Files, Databases):
   Mail Logs
2. Distraction-Free Interface:
   The customer sees neither the overarching InterNetX Server Assist hub nor the tiles for Fail2ban or Server Certificates. The interface stays strictly focused on what the customer requires.
3. Strict Domain Scoping:
   Directly below the filter bar, the scope of domains searched is transparently shown to the customer:
   Domains: test.domain
   Customers can only view log lines belonging to their own domains. Viewing logs from other customer domains or administrative server domains is strictly prevented at the system level.
4. Equal Usability:
   End customers benefit from the same asynchronous background search, live filters, and clear tabular layout—without having to submit a support ticket.

4. Module: Manage Server Certificates

Important Distinction from Website Certificates

• Website Certificates (for customer websites and domains) continue to be managed as usual under Websites & Domains > SSL/TLS Certificates.
• Server Certificates in Server Assist control the core system encryption endpoints:
  1. Direct access to the Plesk Panel itself (Port 8443).
  2. The server-wide mail service for IMAP/POP3 (Ports 993/995) and SMTP (Ports 465/587).

Certificate Types: Custom Certificate vs. Let’s Encrypt

Plesk only supports having one active certificate assignment active per service at any time (either a custom-uploaded certificate or an automated Let’s Encrypt certificate).

Section 1: Currently Active Certificates

The topmost section displays the current live certificate status:

• Plesk Panel: SHA-256 fingerprint and expiration date (Valid until) of the active panel certificate.
• Server-Wide E-Mail Service: SHA-256 fingerprint and expiration date of the shared Postfix and Dovecot TLS certificate.

Section 2: Import & Validate Custom Certificate

Use this section if you wish to deploy a purchased certificate (e.g., from DigiCert, Sectigo, etc.) for the server hostname.
InterNetX Server Assist checks uploaded certificates for cryptographic validity automatically, even without running an explicit pre-check. If, for instance, the intermediate CA chain is incomplete, you will receive a descriptive error message.

1. Enter Details:

   • Certificate Name: A unique reference name (e.g., Wildcard-Plesk).
   • Service Hostname: The server’s FQDN (e.g., plesk.your-domain.com).

2. Upload Files:

   • Server Certificate (PEM): The primary server certificate.
   • Private Key (PEM): The matching private key (transferred securely via stdin into the root-only storage vault).
   • CA Certificate Chain (PEM): The intermediate CA certificates.

3. Pre-Check (Recommended):

   • Click Check certificate. The system verifies key matching, hostname alignment, and chain completeness without applying changes to active services.

4. Import:

   • Click Import certificate. The certificate is stored in the secure vault and appears in the managed certificates table. (Note: Importing alone does not alter any live service!)

Section 3: Assign Managed Certificates

In the table Certificates Managed via InterNetX Server Assist, you will find all available certificates along with their validity period and status.

1. In the Assign certificate column, select the desired target service from the dropdown:

   • Plesk-Panel (activates the certificate on administration port 8443)
   • Server-Wide E-Mail Service (activates the certificate for Postfix & Dovecot)

2. Click the Assign certificate button.

Section 4: Rollback (Restore Certificate Baseline)

Prior to every certificate switch, the system automatically captures a snapshot of the prior configuration. Should any unexpected issue occur following a change, you can revert at any time.

1. Navigate to the Rollback section.

2. Under Plesk-Panel or Server-Wide E-Mail Service, select the desired backup snapshot from the dropdown:

   • Entries are identified by timestamp and hash (e.g., 26.10.2026 16:11:34 CET / c9801a90b7a33e6e).

3. Click Restore backup.

4. The system reinstates the configuration and verifies local TLS ports. Invalid or expired backups remain in the archive for documentation, but cannot be activated.

Section 5: Request Free Let’s Encrypt Certificate

You can request an official Let’s Encrypt certificate for the server hostname directly via the extension. Plesk manages future automatic renewals.

Important Notice: Requesting Let’s Encrypt through this workflow always replaces both the Panel and the server-wide Mail certificate simultaneously to guarantee unified, end-to-end encryption.

1. Enter your Contact Email Address for notifications (e.g., email@domain.tld).

2. Check the mandatory confirmation box:
   ☑ “I confirm the request for a new certificate for [Server Hostname] and the replacement of certificates for Plesk-Panel AND the server-wide mail service.”

3. Click Request and assign new certificate.

4. The server requests the certificate via ACME, installs it on Panel (8443), SMTP (465), and IMAP (993), and verifies service reachability.

5. Role Concept & Permission Assignment (Service Plans)

Role Matrix Comparison

Step-by-Step: Enabling Customer Access to Mail Logs

End customers have no access to mail logs by default. As a reseller, you can activate this feature for customers in your Service Plans:

1. In the left navigation, go to Hosting Services > Service Plans.

2. Click on the Service Plan you wish to edit (e.g., Unlimited).

3. Switch to the Permissions tab.

4. Scroll down through the permissions list to the InterNetX Server Assist entries.

5. Check the box:
   ☑ Access to mail logs (InterNetX Server Assist)
   (Description: “Allows customers to access email logs for their own domains.”)

6. Click the blue Update & sync button at the bottom.

Effect for the Customer:
Once synchronized, the Mail Logs menu item appears immediately in the customer’s navigation below their hosting tools. The customer can now independently investigate email delivery issues without opening a support ticket.

Reseller Permissions for Server Certificates

The permissions list additionally contains:

• ☐ Access to server certificates (InterNetX Server Assist)
  (Description: “Allows resellers access to tools for server-wide Plesk and mail certificates. Does not grant Plesk administrator access.”)
• Purpose: Allows administrators to delegate management of hostname certificates to trusted resellers.
• Security: Customer accounts remain strictly blocked from this option, even if a Service Plan inadvertently includes this permission.

6. Frequently Asked Questions (FAQ)

Where can my customer find the Mail Logs link?

After activation in the Service Plan, the customer will find Mail Logs directly in the left navigation sidebar of their Plesk panel (below WordPress, Laravel, or standard hosting items).

Can a customer view mail logs belonging to other domains?

No. Log inspection runs strictly isolated using a server-resolved domain scope filter. Customers only see logs for domains belonging to their own subscription. This scope is explicitly confirmed under the search form as Domains: <customerdomain>.

Why can’t my customer see the “Unban IP Address” tool?

The Unban IP Address module interacts with the server-wide Fail2ban instance. To prevent abuse and security risks, this module is reserved exclusively for Administrators and Resellers. Customers should contact their managing reseller in case of IP blocks.

What happens if a certificate switch fails?

The system features an automatic self-healing rollback mechanism: If activation or the local TLS handshake check on ports 8443, 465, or 993 fails, the process aborts immediately and restores the previous configuration state automatically.