Architecture

Understand how SecLayer components work together to protect your server.

Overview

SecLayer is a server security suite with multiple integrated modules. All modules read configuration from /etc/seclayer/seclayer.conf and are managed through the seclayer command-line interface.

Core Components

• Login Failure Daemon (LFD) — Monitors authentication logs in real time. Detects brute-force attacks across SSH, FTP, SMTP, cPanel, and 20+ services.
• Dynamic Firewall — Manages nftables/iptables rules automatically. Discovers listening ports and builds precise allow/deny rules.
• DDoS Daemon — Protects against network-layer attacks. Tracks per-IP connections, rate limits, and bandwidth usage.
• Intrusion Detection (IDS) — Analyzes traffic patterns and detects suspicious activity.
• Alert Engine — Sends email notifications for security events.
• Account Hardening — Applies security hardening measures to system accounts.

How SecLayer Selects Your Firewall Engine

SecLayer dynamically selects its firewall backend at boot time:

• 1. Checks for nftables first — Probes for nftables. When available, SecLayer uses the inet seclayer table to manage IPv4 and IPv6 rules together in one atomic transaction.
• 2. Falls back to iptables — If nftables is absent, SecLayer automatically switches to standard iptables / ip6tables.
• 3. Safety verification — If neither engine is active, SecLayer halts and reports an error to prevent silent security failures.

How Data Flows

LFD tails log files, matches entries against patterns, and writes block decisions to nftables/iptables. The DDoS daemon monitors connection tracking tables independently. All alerts are dispatched through the alert engine via email.