Security Check

A short checklist of the essentials that must be in place for SecLayer to actually protect your server — each with its current state and, where it is safe, a one-click fix.

About This Page

Security Check lists only what a fresh install needs; advanced settings are deliberately left out. A progress bar at the top shows how many steps are done (for example, 8 of 9 done). The same progress is shown as a Security Check tile on the Dashboard.

The first time an administrator opens the SecLayer admin panel, it opens on this page with a short welcome note. After that it is always available from Security Check in the left menu.

Steps

The steps are ordered so that you cannot lock yourself out: allowing your own IP and keeping SSH and the control panel reachable come before starting the firewall, and turning off testing mode comes after the firewall is running.

Allow your own IP address — Checks that the IP you are connected from is on the allow list (permanent or an active temporary allow). Fix: Allow <your IP> adds it. If your IP changes often, allow your office or VPN range instead. Shown as Not applicable when your address cannot be determined.
Keep SSH and the control panel reachable — Checks that the ports SSH listens on, and your control panel's own login ports, are in TCP_IN (and TCP6_IN when IPv6 is enabled). Fix: Open these ports adds the missing ones and restarts the firewall if it is running.
Start the firewall — Nothing is blocked until the firewall is running. Fix: Start the firewall starts it and enables it at boot. If SSH or panel ports are still closed, you are asked to confirm first.
Turn off testing mode — While TESTING is on, the firewall switches itself off after TESTING_INTERVAL minutes and the login failure daemon does not run. The fix button appears only once the firewall is running, so you can confirm you can still reach the page first.
Start the firewall at boot — Checks that seclayer-firewall is enabled in systemd. Fix: Enable at boot.
Run the login failure daemon — Checks that seclayer-lfd is running. Fix: Start the daemon (not offered while testing mode is on).
Turn on DDoS protection — Checks DDOS_ENABLE. Fix: Turn on DDoS protection.
Set the alert email address — Checks LF_ALERT_TO; without it alerts go to the local root mailbox. Fix: enter an address and click Save.
Remove duplicate settings (only shown when needed) — Lists keys that appear more than once in seclayer.conf. Only the last value of a key is used, so earlier copies are silently ignored. Fix: keeps the values in use and removes the duplicates.
Stop the previous firewall (CSF) (only shown when CSF is installed) — Two firewalls on one server undo each other's rules. Done when CSF's services are not running. This step has no button; run seclayer --csfmigrate as root on the server. See Migrating from CSF.
Purchase a license — Done for an active paid license. For a trial or expired license the page shows the expiry date; once it runs out the admin panel is restricted to the License page (the firewall keeps protecting the server).

Mark as Done

If you have handled a step another way — for example SSH is deliberately closed and reachable only from an allowed IP — click Mark as done on that step. It then counts as complete, but SecLayer records who marked it and when, and keeps showing the step's real state. Click Undo to have the step checked automatically again.

Restricted UI

Fixes that change seclayer.conf (opening ports, turning off testing mode, enabling DDoS protection, setting the alert email, removing duplicates) follow RESTRICT_UI just like the Configuration page: with RESTRICT_UI = 2 none of them run from the web interface, and with RESTRICT_UI = 1 a fix that touches a restricted key is refused. Make those changes from the command line or in seclayer.conf instead.

Command Line

The same checklist is available over SSH:

seclayer --security-check

Each step is printed as [x] done, [ ] to do or [-] not applicable, with a hint on how to fix it. Over SSH, your SSH client address is used for the "Allow your own IP" step. The command exits with status 0 only when every step is done.

How to Use

Open Security Check from the left menu (or the Security Check tile on the Dashboard).
Work through the To do steps from the top down, using each step's button or field.
Use the link under a step (e.g. Allow IPs, Configuration) to adjust it in detail.
Repeat until the progress bar reaches 100%.