Securing the server and the panel

The security tools are in the Security group of Tools & Settings. This article covers each of them, plus two-factor authentication in your profile.

Security Policy#

Tools & Settings › Security Policy:

• Passwords: Minimum length and Must contain (an upper-case letter, a lower-case letter, a digit, a symbol). The rule applies to administrators, customers, system users, mailboxes and databases.
• Stored passwords: panel logins are kept only as bcrypt hashes; passwords the server must reuse are encrypted with Windows DPAPI. This cannot be switched off.
• FTP over TLS (FTPS): allow plain FTP and FTPS, or require FTPS.
• Panel connections: TLS versions (TLS 1.2 and 1.3, or TLS 1.3 only) and, with TLS 1.2, TLS 1.2 ciphers (forward-secret AEAD only, or also CBC for old clients). TLS 1.0 and 1.1 are never offered.

Click Save. A TLS change restarts the panel; reload the page after a few seconds.

Firewall#

Tools & Settings › Firewall manages Windows Defender Firewall. Changes take effect only after you confirm that the panel is still reachable.

The page has:

• Firewall – Windows Firewall is on (all network profiles),
• Ping (ICMP echo) – Answer pings or Ignore pings,
• Panic mode,
• Access to services – for each service (panel, Remote Desktop, websites, Website Preview, FTP, Web Deploy, SMTP, POP3, IMAP, DNS, MariaDB, SQL Server) choose Everyone, Only these addresses or Nobody (not offered for the panel),
• Own rules – click Add rule and set Name, Direction, Action, Protocol and ports and Remote addresses,
• Network interfaces and the list of Windows Firewall rules created by StackRegent.

Apply changes with automatic rollback#

1. Make your changes. The page shows "Not active yet".
2. Click Activate.
3. When the rules are active, a dialog asks Keep the new firewall settings? Click Keep these settings.

If you do not answer within 60 seconds, for example because the new rules cut you off, the previous settings come back by themselves. Discard changes throws away unsaved edits. Reset to Default switches the firewall on, answers pings, removes panic mode and every access limit, and switches own rules off (they stay in the list).

Panic mode#

For an emergency such as an attack, click Switch panic mode on and confirm. Everything except the panel and Remote Desktop is blocked: websites, mail, FTP, DNS and database connections stop until you click Switch panic mode off. Both actions go through the same confirmation and rollback.

Locked out anyway? Run stackregent firewall-reset on the server.

IP Address Banning#

Tools & Settings › IP Address Banning is the brute-force guard. It watches failed logins and blocks addresses that keep failing in Windows Firewall. It runs as the StackRegent Brute-force Guard service; if it is not running, the page links to Services Management.

Watched sources are Remote Desktop and Windows logons, the StackRegent panel, FTP, SMTP, POP3, IMAP, and password-protected website directories.

Web Application Firewall#

Tools & Settings › Web Application Firewall uses ModSecurity with the OWASP Core Rule Set. Install ModSecurity for IIS with OWASP Core Rule Set under Server Components first; it starts in detection-only mode.

• Settings tab: Mode (Off, Detection only, On – blocks with HTTP 403), Paranoia level 1–4 (1 is recommended), and switched-off rules By ID, By tag and By message.
• Websites tab: a mode per website, or the server default.
• Recent Hits tab: flagged requests; switch off next to a rule adds it to the switched-off IDs.
• Update the rule set fetches the current Core Rule Set.

The firewall checks addresses, query strings and headers, not the bodies of posted forms: ModSecurity for IIS loses form data when it reads them, so ASP.NET logins and forms would receive empty fields.

A good path: run detection only for a few days, switch off rules that hit legitimate traffic, then turn the mode On.

SSL/TLS Certificates and Let's Encrypt#

Tools & Settings › SSL/TLS Certificates holds the panel's certificate and the server pool that every website may use.

To secure the panel with Let's Encrypt:

1. Enter Panel host name (it must point at this server in DNS) and click Save.
2. Click Secure the panel with Let's Encrypt.

Or choose an existing pool certificate from Use a pool certificate….

Other parts of the page:

• Certificates of mail and FTP – the certificate SMTP, IMAP, POP3 and FTPS present (Same as the panel or a server pool certificate). It is one certificate for every mailbox and FTP account on the server, so a website's own certificate (in its subscription) cannot be chosen; the same setting shown on a website's SSL/TLS page changes it for the whole server. Give customers the server's host name for mail and FTP, or add a certificate covering the names they use to the server pool.
• Let's Encrypt – an option to use the staging CA for tests. Certificates renew 30 days before they expire.
• Server pool – Upload (PEM files or PFX), Create CSR and Self-signed; in the list, download, add the issued certificate to a CSR, switch automatic renewal, or remove.

Websites get certificates from their own SSL/TLS Certificates tool. Wildcard Let's Encrypt certificates are not available yet.

Antivirus (Microsoft Defender)#

The installer adds Microsoft Defender when the server image came without it (it becomes active after the next restart) and keeps it scanning the website folders, where uploaded web shells and infected plugins land. Database files are excluded from real-time scanning, because scanning open database files slows every query and can lock or damage them: the data and backup folders and server processes of every SQL Server instance, the customer MariaDB and the panel database. The same exclusions are added when you install MariaDB or SQL Server from Tools & Settings › Components, and you can add them again at any time with stackregent defender-exclude.

Defender's scheduled scans run at low CPU priority. Folders of large backup archives that only arrive from other servers (for example a remote-backup FTP folder) can be excluded by hand with Add-MpPreference -ExclusionPath.

Two-factor authentication#

1. Go to My Profile › Profile & Preferences.
2. Under Two-factor authentication, click Set up.
3. Scan the QR code with an authenticator app, or type the key shown.
4. Enter the 6-digit code and click Turn on.

From then on every login asks for a code. To turn it off, click Turn off and enter your password. Additional Administrator Accounts shows who uses two-factor authentication.

IP Access Restriction#

Tools & Settings › IP Access Restriction Management sets which addresses administrators may log in from: Allow every address except those in the list or Deny every address except those in the list. Enter one address, network or range per line and click Save. Websites, mail and FTP are not affected. If you lock yourself out, run stackregent ip-access-reset.

Sessions#

Prohibited domains and subzones#

Tools & Settings › Prohibited Domain Names stops customers adding well-known domains such as gmail.com. Tick Prohibit creating domains that resolve to other servers and/or Prohibit creating domains from the list below (including their subdomains), and use Add Domain Name to extend the list.

Tools & Settings › Restrict Creation of Subzones has one option: Forbid users to create DNS subzones in other users' DNS superzones, which stops, for example, shop.example.com being added when example.com belongs to someone else.

Related#

• Server settings
• Server components
• DNS and FTP