Architecture

Understand how SecLayer components work together to protect your server.

Overview

SecLayer is a server security suite with multiple integrated modules. All modules read configuration from /etc/seclayer/seclayer.conf and are managed through the seclayer command-line interface.

Core Components

• Login Failure Daemon (LFD) — Monitors authentication logs in real time. Detects brute-force attacks across SSH, FTP, SMTP, cPanel, and 20+ services.
• Dynamic Firewall — Manages iptables rules automatically. Discovers listening ports and builds precise allow/deny rules.
• DDoS Daemon — Protects against network-layer attacks. Tracks per-IP connections, rate limits, and bandwidth usage.
• Intrusion Detection (IDS) — Analyzes traffic patterns and detects suspicious activity.
• Alert Engine — Sends email notifications for security events.
• Account Hardening — Applies security hardening measures to system accounts.

How Data Flows

LFD tails log files, matches entries against patterns, and writes block decisions to iptables. The DDoS daemon monitors connection tracking tables independently. All alerts are dispatched through the alert engine via email.