Secure the server in 15 minutes

A new HF Panel server is already locked down in many ways: the firewall is on, fail2ban bans password guessers, every account has its own Linux user, and every website sits behind a web application firewall. This checklist closes the remaining gaps in about 15 minutes.

You need: an administrator login and root SSH access to the server.

1. Turn on two-factor login for yourself

1. In Server Admin, open your username at the top right › Password & security.
2. Click Set up two-factor login, scan the QR code with an authenticator app and enter the code. Click Turn on.
3. Save the backup codes somewhere safe.

Better still, add a passkey on the same screen: it can't be phished. See Password & security.

2. Require it for all staff

1. Open Server Admin › System › Settings.
2. Tick Require two-factor login for administrators and resellers.
3. Click Save settings.

The setting can only be saved after your own two-factor login is on, so you can't lock yourself out. While you are there, check Risky actions: Another administrator must approve makes account deletes and full restores need a second person. See Approvals.

3. Give staff their own logins

Never share the main admin login. Open Server Admin › Accounts › Staff logins and give each person their own login with Make login. Choose Read-only — see everything, answer tickets unless they really need Full access — a second administrator. See Staff logins.

4. Use SSH keys for root

HF Panel does not change how you sign in to the server itself, so do this once at the command line:

1. On your computer, make a key if you have none: ssh-keygen -t ed25519.
2. Copy it to the server: ssh-copy-id root@server.yourdomain.com.
3. Check that you can sign in with the key in a new terminal window.
4. Only then, in /etc/ssh/sshd_config, set PasswordAuthentication no and restart SSH with systemctl restart ssh.

Warning: keep your first SSH session open until you have tested the key in a second one. Take a snapshot at your provider first if you are unsure.

Customers sign in to SFTP with their own keys under Control Panel › Security › SSH / SFTP keys.

5. Check the firewall

1. Open Server Admin › Security › Firewall.
2. In Rules, delete any port you opened for a test and no longer need. The SSH rule shows keeps you logged in and can't be deleted here.
3. Under Banned by fail2ban, see who has been guessing passwords. Addresses that fail SSH 5 times are banned for an hour.

To block an attacker everywhere, enter the address or range under Block an IP from the whole server and click Block. See Firewall.

6. Keep accounts apart

1. Open Server Admin › Accounts › Packages and, under CPU & memory limits, click Enforce limits. One busy or hacked site can then no longer slow down the others.

2. Open Server Admin › Security › Account isolation and choose:

   Setting	Choose
   Private filesystem view	On
   Private /tmp	Each account its own
   Hide other accounts' processes	Hidden
   SSH access	SFTP only, unless customers need a shell

3. Click Check first, read the findings, then click Apply.

See Account isolation.

7. Block attacks on websites

1. Open Server Admin › Security › Malware & web firewall.
2. In Web application firewall, click Block attacks. If you are cautious, run Log only for a few days first and check the activity for false alarms.
3. In Malware scanner, keep Scan every account every night ticked and click Save.

8. Stay up to date

1. Open Server Admin › Server › HF Panel updates.
2. Tick Install new versions automatically at night and click Save.

Then open Server Admin › Server › Server health and fix anything red or amber in the Security group, such as a restart needed after system updates.

9. Check that backups leave the server

A secure server still needs a way back. Follow Back up off-server if you haven't yet.

Related

• Firewall
• Account isolation
• Malware & web firewall
• Activity log
• Server health