Security

Security is about who may get in. It sits in the sidebar's Protection group and has four pages: Overview, SSH, Intrusion, and Logins. The firewall, connections, network tools, and interfaces are not Security pages; they are part of the Network section, and links from Security open them there.

Start with how the dashboard is reachedCopy Anchor Link

1. Open Security → Overview. Its first line says how this dashboard is reachable, for example through a Tailscale address, a tunnel, a private network, or a public path, and lists what that was read from: the allowed ranges, the interfaces, the tailnet address, and the address this browser arrived from. Compare that with the dashboard's allowed CIDRs.
2. Read the tiles for Firewall, SSH, Intrusion, Connections, and Logins. Each shows one figure, such as the firewall backend and inbound default, bans in force, connections from the internet, or open sessions, and opens its page. Firewall and Connections open in the Network section.
3. Check Ways in, a picture of the paths onto the machine, and Access boundary, the boundaries every firewall and SSH change is checked against.

The overview reports what it observes and does not grade the host or suggest fixes; the automatic posture findings were removed in 0.7.5. A reading that could not be taken says so rather than showing as clean.

The dashboard is root-equivalent for an authenticated administrator. Its intended access path is a VPN or SSH tunnel. Keep the machine's existing recovery path in mind when changing a firewall rule, an SSH port, or authentication. Before such a change is applied, the dashboard compares it with the access boundary and refuses a change that would cut the way this browser came in, or warns when it crosses the boundary. A correct rule can still lock out someone whose path was overlooked.

SSHCopy Anchor Link

The SSH page needs an administrator. It reads the effective sshd settings, including whether a systemd socket such as ssh.socket owns the listening port, draws the ways in that the settings being edited allow, and lists accounts with an authorized key, a Jump host section, and the Auth log. Stage changes, then press Test and apply to apply them together. The dashboard tests the new configuration with sshd -t before it reloads, restores it on failure, and refuses certain lockouts, such as turning passwords off when no account has a key, or moving SSH to a port the default-deny firewall has no rule for. Turn on Restore unless confirmed (90 s) to have the host put the old settings back unless you reconnect and confirm in time. When a systemd socket owns the listener, a port change also updates and restarts that socket.

Settings that apply only to particular users or addresses (Match blocks) are shown but cannot be edited from this page.

Intrusion and loginsCopy Anchor Link

Intrusion shows the addresses blocked across engines, then fail2ban's jails, bans, repeat offenders, and activity log. Never ban my address adds the address this browser is using to a jail's allowlist before you tune it. Where they are installed, CrowdSec's decisions, alerts, and bouncers and Suricata's alerts and top signatures appear beside fail2ban; Suricata needs an administrator.

Logins shows interactive sessions and sign-ins where the host records them. Failed attempts and the Attackers list are shown only to administrators, because login records can include sensitive text typed at a prompt. From an address in these lists you can block it at the firewall, see who owns it, run a reverse lookup, or trace the route to it. A missing host tool or log appears as unavailable, not as a clean verdict.