Skip to content

Network and security

This page is about the IP addresses of the server and its protections: the firewall, the bans of fail2ban, the blocking of the Internet scanners and the security overview.

IP addresses

Server › IP addresses lists the addresses of the server.

  • Detect the addresses reads those configured on the server, which stay read only. The first time you open the page it does it by itself.
  • Add an address puts a secondary address on an interface: the panel configures it at once and at every boot. It stays In progress until the server confirms it.
  • Public address is needed only when the server is behind NAT: it is the address the server has as seen from the Internet.

An address is Shared, if it serves all the customers, or Dedicated, if it belongs to a reseller or a customer, within the limits of their subscriptions. A dedicated address is needed, for example, for a CSP (Central Syslog) subscription to receive logs on the standard ports 514 and 6514. The shared addresses a reseller gives to their customers come from their pool.

An added address is written in the network configuration of the server, so it comes back at every boot. At every boot the panel checks it: if it is missing it becomes Failed. Run esapanel-setup again to write the addresses again; if it stays failed, its interface no longer exists or the network of the server was changed by hand.

The security overview

Security › Overview shows the protections of the server at a glance:

  • Firewall: whether the rules of the panel are active, and whether there are changes waiting to be applied;
  • IP bans: the addresses fail2ban blocks now, and those blocked in the last day;
  • Internet scanners: how many networks and addresses the firewall stops;
  • Failed sign-ins: wrong passwords and second factor codes in the last day;
  • Certificate of the panel: how long it still lasts;
  • Second factor: how many active people have turned it on.

Each box leads to its page.

The firewall

Security › Firewall: inbound traffic is closed, except what the rules open.

  • Rules of Esapanel: they protect the server and serve the modules, for example the reception ports of CSP and port 514 of the dedicated addresses. The panel writes them and they are read only.
  • Your rules: checked in their order, the first that matches decides. They come after the connections already established and before the openings of the modules: a rule that drops a network blocks it on the ports of the modules too. The SSH and Panel rules were created by the installation and you can change them.
  • SSH access: from any address, or only from the addresses and networks you list, such as the office and the home of the administrator. The page warns you when the address you are using now is not in the list. The panel stays reachable: only SSH is closed.

Applying changes without locking yourself out

Changes are a draft: the server keeps its firewall until you review and apply them.

  1. Make the changes and open the preview: it shows the whole firewall that will be loaded, with the lines added and removed.
  2. Apply the firewall: the server loads it at once.
  3. Go back to the Firewall page and confirm within 60 seconds. The confirmation reaches the server only if you still reach the panel.

If a rule locked you out, you cannot confirm, and the server goes back to the previous firewall by itself.

Even when SSH is closed to your address, the console of the provider still works.

IP bans

Security › IP bans shows the bans applied by fail2ban.

  • Active bans: the addresses blocked now, by fail2ban after their failed attempts or by hand, with the expiry. Unban removes a ban at once.
  • Ban an address: blocks an address for a while or for ever, for example one that scans the server. A ban by hand ends by itself at its expiry.
  • Jails: for SSH, for the sign-in of the panel and for the web server (bad bots, searches for weak applications, failed logins), how many failed attempts within how many minutes ban an address, and for how long. With WFP (Web File) installed, a row also watches FTPS, SFTP, rsync and WebDAV; an attempt there bans the address on all ports.
  • Never banned: addresses and networks fail2ban never bans. Put the network of your office here, so a wrong password does not lock you out. The system entries keep the server from banning itself.

The register of the bans is updated every minute.

Internet scanners

Services such as Censys, Modat or Shodan probe every address of the Internet and catalogue the services that answer. By themselves they do no harm, but they fill the quarantine of CSP and tell whoever reads their catalogues what the server exposes.

Security › Scanners: the firewall stops them before they reach anything on the server, panel and SSH included:

  • the networks the scanners publish, listed in Scanners known;
  • the addresses found: every few minutes the panel looks up the reverse name of the unauthorized senders of CSP, and those with the name of a scanner are blocked for 30 days. An authorized source, an address of the server and an address that is never banned are never blocked.

Unblock removes an address; if it comes back with the name of a scanner, it is blocked again.

Research scanners, such as Shadowserver, warn the national CERTs and the owners of the networks about services exposed by mistake or vulnerable. Blocking them, those warnings about this server no longer arrive: think about it before doing it.