Since the 0.9.0 public beta in August, SecLayer has gone from covering the core of server security to covering essentially all of it. This release adds deeper attack detection, country and reputation-based blocking, multi-server ban sync, statistics and graphs, CloudFlare integration, and a rebuilt configuration screen — along with a long list of fixes found by testing everything against real traffic on real servers.
🚀 Here's everything that's new in SecLayer 0.9.3
The login-failure watcher used to focus on SSH. It now watches your whole stack.
FTP, SMTP-AUTH, POP3/IMAP, Apache .htaccess, ModSecurity, BIND, Suhosin, Webmin and control-panel logins are all monitored for failed logins and abuse, with automatic bans.
Apache 403/404 abuse detection — catch scanners hunting for files that aren't there.
Symlink-race attempt detection.
Cross-service correlation — an attacker who fails a little on SSH, a little on FTP and a little on mail is now counted as one attacker, not three innocents (LF_TRIGGER, LF_GLOBAL).
Distributed attack detection — many IPs going after one account together are spotted as a single coordinated attack (LF_DISTATTACK, LF_DISTFTP, LF_DISTSMTP).
Permanent-block alerting — get told when a burst of permanent blocks happens in a short window (LF_PERMBLOCK).
Inbound-only bans, reverse-DNS enrichment in ban alerts, and IPv6 netblock escalation (previously IPv4 only).
Dynamic DNS allow-lists — allow-listed hostnames are re-resolved periodically, so your home IP changing doesn't lock you out (LF_DYNDNS).
Firewall and network protection
Full ICMP control — inbound/outbound policy, rate limiting, timestamp-request dropping, and a strict IPv6 ICMP mode.
Flood mitigation — SYN flood, per-source connection limits, per-port flood limits, and UDP flood protection, on both the nftables and iptables backends.
Independent IPv4 and IPv6 port lists — TCP6_IN/TCP6_OUT/UDP6_IN/UDP6_OUT now genuinely control IPv6 separately from IPv4.
Per-subnet connection limiting (CT_SUBNET_LIMIT) and a cap on total temporary bans (DENY_TEMP_IP_LIMIT).
Network interface scoping — apply or skip the firewall per interface (ETH_DEVICE, ETH6_DEVICE, ETH_DEVICE_SKIP).
Docker coexistence — container networks keep working alongside SecLayer's rules instead of fighting them (DOCKER_NETWORK4/DOCKER_NETWORK6).
Invalid-packet dropping (PACKET_FILTER) and verbose rule logging for troubleshooting (VERBOSE).
Kernel drop logging, which switches on port-scan tracking and UID tracking — two detectors that previously had nothing to read.
Dedicated port-knocking log, separate from the email alert.
Allow-list mode — permit only the countries you choose, block everything else (CC_ALLOW_FILTER).
Per-port country rules — allow or deny a country on specific TCP/UDP ports, independent of your main port lists.
Per-IP country lookups for ban decisions, with an ignore-by-country list (CC_IGNORE), and independent IPv4/IPv6 lookup controls.
ASN blocking — AS12345 entries in your allow/deny lists now resolve for real and block the whole network.
Choose your GeoIP source — ipdeny.com by default (no account needed), or MaxMind GeoLite2 using your own license key.
Minimum CIDR filtering and configurable refresh intervals across every country list.
Third-party blocklist support — subscribe to public IP reputation and bogon feeds and have them refreshed and enforced automatically.
A dedicated Blocklists admin page to manage feeds, with background refresh (no waiting on downloads while your firewall rules build).
Bogon exemptions per interface, so private/internal links aren't caught by bogon filtering.
Mail and relay protection
Outbound SMTP restriction — stop compromised scripts from spamming directly, with an option to redirect outbound SMTP to your own mail service instead of dropping it (SMTP_BLOCK, SMTP_REDIRECT).
SMTP-AUTH restriction — limit authenticated SMTP to allow-listed sources, including by country.
Relay tracking now actually bans — previously it worked out that an IP should be blocked and then never blocked it. Fixed, plus POP-before-SMTP and localhost relay tracking added.
Process and account tracking
Automatic remediation — kill or run your own script against suspicious processes, high-load events, and processes running from deleted files (PT_USERKILL, PT_USER_ACTION, PT_LOAD_ACTION, PT_DELETED_ACTION).
Hung and unauthenticated SSH session cleanup (PT_SSHDHUNG, PT_SSHDKILL).
Scope controls — track all users or just customers, skip HTTP processes, and set a minimum process age (PT_ALL_USERS, PT_SKIP_HTTP, PT_USERTIME).
Cluster ban sync — an attacker blocked on one server is blocked across the whole cluster, over an authenticated, replay-protected protocol. No extra daemon to run.
Config push — send settings from a master node to its members, with both sides required to agree before anything is applied.
13 cluster CLI commands for adding, denying, removing, ignoring, listing and restarting across the cluster.
DDoS bans now propagate too, not just login-failure bans.
Push bans to CloudFlare — blocked IPs are added as IP Access Rules across all your zones using a modern scoped API token.
Block or challenge mode, plus automatic expiry so temporary bans are cleaned up on CloudFlare's side too.
A new Statistics page with real graphs over 1, 7, 30 or 90 days — no third-party charting scripts, nothing loaded from outside your server.
System, disk write, MySQL and Apache metrics collected continuously, with counters converted to meaningful per-second rates rather than an endlessly climbing line.
Blocked-packet reporting from the kernel log, with optional reverse lookups.
Run your own script on every block and unblock (BLOCK_REPORT, UNBLOCK_REPORT) — feed bans into your own tooling, ticketing or reporting.
Treat allow-listed IPs as ignored everywhere with a single setting (IGNORE_ALLOW).
On-demand Log Scanner runs via the new seclayer --logrun command.
Rebuilt Firewall Configuration page — every setting now gets a proper label, a plain-English explanation, an example, and the right input control, with valid ranges enforced per setting.
Scheduled RBL Report — have SecLayer check your server's IPs against blacklists hourly, daily, weekly or monthly and email you the result. It also now detects your server's real IPs automatically instead of guessing.
Custom CSS support (CUSTOM_CSS_PATH) for hosts who want the panel to match their branding.
A working "Enable DDoS protection" button on the dashboard, and the removal of misleading "restart the firewall to apply" messages from the DDoS pages — nothing there ever needed a restart.
An honest configuration file — every setting in seclayer.conf was audited against the actual code, and anything not yet wired up now says so instead of quietly pretending to work.
-g / --grep — search logs for an IP.
-i / --iplookup — look up ownership of an IP, with no whois binary required.
-m / --mail — mail log lookup.
-p / --ports — show listening ports.
--trace — watch live what the firewall is doing with a specific IP.
-df / --denyf — flush the entire deny (ban) list in one command.
-tf / --tempf — flush all temporary bans in one command.
--fix-permissions — repair file ownership and permissions across the install.
Hardening and access control
Syslog restriction — stop spoofable, locally-writable system logs from being used to trigger bans, and lock down write access to the syslog socket itself (RESTRICT_SYSLOG).
UI restriction — block the web interface from changing security-critical settings, or from changing settings at all, so a compromised panel session can't quietly weaken your protection (RESTRICT_UI).
Stable and release-branch update channels, with per-server control over whether updates apply automatically or just notify you.
Update debug logging — every check, download, extract and install step is recorded.
Safer CSF migration — migrating no longer uninstalls your existing setup. Its services are stopped and disabled, and every file is left untouched on disk.
IPv6 connectivity through the firewall was broken. ICMPv6 — which IPv6 depends on for basic address resolution — was being silently dropped unless strict mode was on.
DDoS floods from dual-stack clients went undetected — IPv4 clients arriving on a dual-stack listener weren't being counted at all.
DDoS bans didn't survive a firewall restart — the ban list is now consulted when rules are rebuilt.
Outbound connections could self-trigger a ban — only genuinely inbound connections are counted now.
DDoS settings lived in two files that could disagree — merged into one, so the dashboard, the daemon and the CLI can never again show different answers.
Process age was compared against CPU time, not wall-clock time, because of an operator precedence bug.
A shipped default value failed its own validator, silently rejecting firewall configuration saves that didn't touch that field.
The Security Check page reported the recommended syslog mode as "Disabled", and the auto-update badge read a setting that didn't exist.
iptables performance — the fallback backend now uses named IP sets instead of one rule per IP, so large country and blocklist feeds scale properly.
Translations support and a standalone messenger that shows blocked visitors and a self-unblock page. Both are next up.
SecLayer 0.9.3 is available now. If you're already running SecLayer, update from the Updates page or run
seclayer --update
Thank you for choosing SecLayer to protect your servers. We hope you enjoy this release!
Regards,
The SecLayer Team
