HF PanelHardening checklist
The security steps an administrator follows on every new HF Panel server, and checks again every month.
A checklist for administrators. A new HF Panel server already has its firewall on, fail2ban, a separate Linux user per account and a web application firewall. Work through these steps once after installing, then repeat the monthly checks. For a step-by-step walk-through with every click, see Secure the server in 15 minutes.
After installing
| Done | Step | Where |
|---|---|---|
| ☐ | Turn on two-factor login, or add a passkey, for your own login, and keep the backup codes safe | your name › Password & security (details) |
| ☐ | Tick Require two-factor login for administrators and resellers | Server Admin › System › Settings (details) |
| ☐ | Give every member of staff their own login; choose read-only unless they need full access | Server Admin › Accounts › Staff logins (details) |
| ☐ | Make risky actions need a second administrator | Server Admin › System › Settings › Risky actions (details) |
| ☐ | Sign in to SSH with a key, then set PasswordAuthentication no in /etc/ssh/sshd_config |
the server's command line |
| ☐ | Check the firewall: only the ports you need are open | Server Admin › Security › Firewall (details) |
| ☐ | Check that fail2ban is banning password guessers | Server Admin › Security › Firewall › Banned by fail2ban |
| ☐ | Turn on the strongest account isolation, after Check first shows no problems | Server Admin › Security › Account isolation (details) |
| ☐ | Enforce CPU and memory limits in your packages | Server Admin › Accounts › Packages (details) |
| ☐ | Set the web application firewall to Block attacks and keep the nightly malware scan on | Server Admin › Security › Malware & web firewall (details) |
| ☐ | Copy backups to storage off the server, encrypted, and test one restore | Server Admin › System › Backup storage (details) |
| ☐ | Tick Install new versions automatically at night | Server Admin › Server › HF Panel updates (details) |
| ☐ | Keep API tokens to Read only where you can, and fill in Allowed IPs | your name › Password & security › API tokens (details) |
Warning: keep your first SSH session open until you have signed in with your key in a second one. Take a snapshot at your provider first if you are unsure.
Every month
| Done | Check | Where |
|---|---|---|
| ☐ | Fix anything red or amber in the Security group, such as a restart needed after system updates | Server Admin › Server › Server health (details) |
| ☐ | Read the activity log for sign-ins and changes you don't recognise | Server Admin › Security › Activity log (details) |
| ☐ | Run Check first again on the account isolation screen and read the findings | Server Admin › Security › Account isolation |
| ☐ | Delete staff logins and API tokens nobody uses any more | Staff logins, Password & security |
| ☐ | Restore one account from the off-server copy to prove backups work | Back up off-server |