Security Settings
Hardening controls for the host and panel: root password, unattended updates, SSH policy, Two-Factor Authentication, and IP allowlists. Changes are immediate and system-wide.
Access: root only.
Sections at a glance
| Section | What it does |
|---|---|
| Password | Change the server’s root password. Includes a secure generator and show/hide toggle before saving. |
| System Update | Enable daily auto-updates, optionally exclude kernel packages, or run an on-demand update with live output. |
| SSH | Change SSH port and enforce AllowUsers (user / user@host / wildcards) to restrict who can log in. |
| Two-Factor Authentication | Protect panel sign-in with TOTP (Google Authenticator, etc.). Scan QR or use the secret key to enroll. |
| IP Access Control | Limit panel access to trusted IPs or CIDR ranges (IPv4/IPv6). Add comments for audit clarity. |
Password (root)
- Enter the new password twice and save. The generator creates a 20-char strong password you can reveal to copy.
- Effect: updates the operating system’s
rootcredential used across SSH and panel auth.
System Update
- Daily Auto Update: toggle unattended updates; optionally exclude kernel packages.
- Update now: runs an immediate update and streams progress in a live log area.
- Tip: for production systems, test kernel updates during a window or keep them excluded if you have a separate process.
SSH
- Port: set a custom SSH port (22–65535). The service is validated and restarted after a successful change.
- AllowUsers: restrict SSH login to specific users or patterns such as
root,deploy, oradmin@10.10.*. Deleting all entries removes the restriction; adding the first entry enables the policy. - Safety: open the new port in your firewall and keep an existing session active until you confirm access on the new port.
Two-Factor Authentication (2FA)
- When no 2FA is set, the page shows a QR code and secret key. Scan with a TOTP app (Google Authenticator, etc.), then enter the 6-digit code to enable.
- When 2FA is enabled, you can disable it with a single action (requires current access).
- Scope: protects panel login with a one-time code in addition to your password.
IP Access Control
- Allowlist specific IPs or networks (supports IPv4/IPv6 and CIDR, e.g.,
203.0.113.5,203.0.113.0/24,2001:db8::/64). - Only sources matching at least one entry can reach the panel once the list is populated.
- Use the table to add/remove entries and annotate each with a comment (e.g., “office”, “VPN”).
Don’t lock yourself out: before changing the SSH port or enabling AllowUsers / IP Access Control, confirm firewall rules and add a fallback admin access (e.g., another user or trusted IP). Test from a second session before closing the current one.