Server administration
Security
Brute force protection, firewall, two-factor authentication and security policies.
Brute Force Protection
Security Center › Brute Force Protection counts failed logins to the panel, webmail, mail (IMAP, POP3, SMTP), FTP and SSH, on this server and its nodes.
- An IP address that keeps failing is blocked at the firewall for a while; repeat offenders are blocked longer.
- An account name that keeps failing is locked for the panel (other services keep working), so a distributed attack can't guess a password either.
- The thresholds and durations are adjustable.
Blocked lists what's blocked now (unblock with one click); History shows what happened. Your current IP can't block you out if it's on the allow list; add your office or VPN there.
Allow and block lists
IPs, ranges (CIDR) and countries. Allowed entries are never blocked; blocked entries can't reach the server at all. Country rules use a GeoIP database that you can update from the page.
Firewall
Networking Setup › Firewall shows the open ports and opens or closes them. KyPanel manages firewalld (AlmaLinux, Rocky, CloudLinux) or ufw (Ubuntu); don't change the same rules by hand.
Security Center › Host Access Control adds rules by address: allow or deny a source to a port, for example the panel port (7711) only from your office. Nodes have their own firewall in Link Server Nodes. The ports KyPanel uses are in ports.
Two-factor authentication
Everyone can protect their login with an authenticator app (TOTP) and recovery codes:
- admins: your name (top right) › Password & 2FA;
- customers: Two-Factor Authentication in their panel.
Security Center › Two-Factor Authentication shows who has it and turns it off for an admin who lost their device. For customers: List Accounts › Reset two-factor sign-in.
Security policies
Security Center › Configure Security Policies:
| Policy | |
|---|---|
| Require 2FA for administrators | Admins without it set it up right after signing in. |
| Require 2FA for customers | Customers set it up the next time they sign in. Logging in as a customer from Ky Admin isn't affected. |
| Administrator sign-in | IPs or ranges allowed to sign in to Ky Admin. Your own IP must be on the list. API tokens have their own lists. |
| Minimum password strength | Per kind of password (panel, mail, FTP, databases). Applies to the next password chosen. |
| Password maximum age | Forces a new password after a number of days. |
| Restrict outgoing SMTP to the mail server | Only Exim and root may connect to ports 25, 465 and 587 on other servers, so a hacked script can't send spam directly. |
API tokens
Scripts and billing systems use API tokens instead of passwords: scoped, optionally limited to IPs, with an expiry. See the API.
Audit log
Every change made in the panels or through the API is recorded with who made it, from where and through what (panel, API token, system). Account-related entries are shown with the account.