The Hosting Agent is built for Linux hosting environments, including Plesk-managed hosts. It collects service and panel signals, attaches observation-only network programs, and reports category-safe events to the Manager. Those network programs pass traffic. Enforcement belongs on Virtualization Agents and explicit block paths — not on the shared hosting node.
Shared hosting environments require visibility into tenant services without risking tenant uptime through aggressive global blocking. Mixing observation and enforcement on that node is an operational error, not a configuration cleverness.
Zwall's Hosting Agent is that observation profile. It is part of Zwall Enterprise, not Zwall Community.
The Hosting Agent process runs as an unprivileged zwall-hosting identity. A separate privileged loader loads pass-only eBPF programs and exposes a UNIX socket for category-safe network metadata. Hosting enforcement must remain false. Assigning firewall rules or Agent restart commands to a Hosting Agent returns HTTP 409.
Where sources exist and zwall-hosting can read them, implemented classes include various authentication and service logs. Exact paths are operator-owned examples, not a universal ACL pack.
Several example sources start as permission_blocked or source_not_present until you grant read on the real files. Events shown in Hosting APIs are category-safe: Hosting event APIs are not a raw-payload or customer-IP dump.
| Class | Description |
|---|---|
| SSH, FTP, and Mail | Authentication observation |
| Plesk | Panel authentication (documented panel class) |
| Nginx & Apache | Web server observation |
| PHP-FPM | Application worker observation |
| MySQL / MariaDB | Database observation |
| DNS | Service observation |
| Fail2Ban | Observation of Fail2Ban logs |
| ModSecurity | Global metadata only |
| System | Service-unit health, disk/inode snapshots, loopback certificate-expiry metadata |
The Hosting Agent network programs pass traffic. Zwall implements conservative detector classes: scan, SYN-rate, UDP heuristic, burst, and related Hosting network signals as investigation signals. They do not drop packets. Hosting observation is not a lossless full-packet capture product. See Reliability.
The Hosting Agent is not a WAF replacement and not an enforcement firewall. ModSecurity path is global metadata observation.
Events land in the Manager console Hosting views and status. Source health includes states such as active, permission_blocked, source_not_present, parser_unsupported. Operators investigate in the same control plane as Virtualization and security logs. Hosting sources stay out of automatic provider-backed AI analysis.
| Feature | Hosting Agent |
|---|---|
| Job | Observation-first |
| Packet Enforcement (Drop) | No. Programs pass traffic. |
| VM Topology | No VM topology / not Virtualization inventory |
| Available in Community | No (Enterprise only) |
| AI Preview | Excluded from automatic provider-backed analysis |
The Hosting Agent is a capability of Zwall Enterprise. It is designed for multi-tenant service observation where global firewalling is dangerous. Zwall Community has no Hosting Agent v2 profile.
No. Observation programs pass. Rules assignment returns HTTP 409.
No.
It is built for Linux hosting including Plesk-managed hosts. Plesk is the documented panel class, not a claim that every panel is integrated.
No. Many sources need production permissions; status will say so.
No. Provider-backed AI does not automatically analyze Hosting Agent sources.
That config leaf is not the Hosting Agent profile. Do not use hybrid as 'policy works everywhere'.
Speak with an engineer to discuss Zwall Enterprise for your hosting environment.
