Security settings
Set how people sign in, and what happens when somebody tries not to.
Go to Admin > Settings > Security.
A tab strip below the title shows Security and, when your license includes DDoS Mitigation, DDoS Mitigation.
Three tiles at the top of the page show the current state:
- Total Users - the number of accounts.
- 2FA Enabled - the number of accounts with two-factor authentication, and the percentage.
- Admins with 2FA - the number of administrators with two-factor authentication, out of the total.
Two-Factor authentication
| Setting | Description |
|---|---|
| Require 2FA for Administrators | Administrators must enable two-factor authentication. |
| Require 2FA for All Users | Every user must enable two-factor authentication. |
When you turn on either switch, the page shows how many people the rule affects. Each of those people must set up two-factor authentication at the next login.
Session settings
| Setting | Description |
|---|---|
| Max Sessions per User | The number of sessions that one account can hold. A value of 0 means unlimited. |
| Session Timeout | The time before a session expires. The options are from 30 minutes to 7 days. |
| Max SSH Keys per User | The number of SSH keys that one account can hold. A value of 0 means unlimited. |
Login lockout
These settings lock one account after too many failed logins.
| Setting | Description |
|---|---|
| Max Failed Attempts | The number of failed logins before a lockout. The default is 5. |
| Lockout Duration (minutes) | The time that the account stays locked. The default is 15 minutes. |
IP-Based brute force protection
These settings block an IP address that attacks many accounts.
| Setting | Description |
|---|---|
| Max IP Attempts | The number of failed logins from one IP address before a block. The default is 10. |
| IP Block Duration (minutes) | The time that the IP address stays blocked. The default is 30 minutes. |
| Tracking Window (minutes) | The period that the panel counts attempts over. The default is 15 minutes. |
| Progressive Delay | Adds a delay after each failed login, and increases the delay each time. |
| Base Delay (seconds) | The delay after the first failure. The default is 1 second. This field appears only when Progressive Delay is on. |
| Max Delay (seconds) | The largest delay. The default is 30 seconds. This field appears only when Progressive Delay is on. |
Password policy
| Setting | Description |
|---|---|
| Minimum Password Length | The smallest number of characters in a password. |
| Require uppercase (A-Z) | A password must hold a capital letter. |
| Require lowercase (a-z) | A password must hold a small letter. |
| Require number (0-9) | A password must hold a digit. |
| Require special (!@#$%) | A password must hold a special character. |
HTTPS
This card appears on a self-hosted panel only. A hosted tenant does not see it, because the platform manages certificates.
A badge in the card header shows the live state: Currently served over HTTPS or Currently served over HTTP.
WARNING
These switches record what you want, and do not turn HTTPS on by themselves. Add a certificate first.
| Setting | Description |
|---|---|
| Force HTTPS Redirect | Sends every plain request to HTTPS. Needs a certificate in place first. |
| HSTS Header | Locks browsers to HTTPS. Turn this on only with a stable HTTPS chain. |
| HSTS Max-Age (seconds) | The lifetime of the HSTS rule. The default is 31536000 (1 year). This field appears only when the HSTS Header is on. |
Saving reloads the web server, so check your certificate is in place before you turn on Force HTTPS or HSTS.
Admin IP allowlist
This list restricts admin access to specific IP addresses. An empty list permits all addresses.
- Enter an IP address or a CIDR range, for example
192.168.1.0/24. - Click the plus button, or press Enter.
Each entry becomes a chip. Click the cross on a chip to remove that entry.
WARNING
Add your own IP address before you save. An incorrect list locks you out of the admin area.
Registration rate limiting
These settings cap the number of new accounts from one IP address.
| Setting | Description |
|---|---|
| Max Registrations per Window | The number of registrations permitted in one window. The default is 3. |
| Rate Window (minutes) | The length of the window. The default is 60 minutes. The maximum is 1440 minutes. |
DDoS mitigation
The DDoS Mitigation tab appears only when your license includes that feature. The page applies host-based L3 and L4 protection to each allocation.
The Protection card holds an Enabled switch. This switch is the master control for the baseline protection.
| Setting | Description |
|---|---|
| Concurrent conns / IP | The number of open connections permitted from one IP address. A value of 0 turns the rule off. |
| New conns / sec / IP | The rate of new connections permitted from one IP address. |
| New-conn burst | The short burst that the rate limit permits. |
| SYN-flood protection | Turns on SYN flood rules. |
| SYN / sec / IP | The SYN rate permitted from one IP address. |
| SYN burst | The short SYN burst that the rate limit permits. |
| UDP packets / sec / IP | The UDP rate permitted from one IP address. A value of 0 turns the rule off, which is the recommended setting. Game traffic over UDP is bursty. |
| UDP burst | The short UDP burst that the rate limit permits. |
| Bandwidth cap / IP (kbit/s) | The bandwidth permitted from one IP address. A value of 0 turns the cap off. |
| Drop invalid / malformed packets | Discards packets that do not pass validation. |
WARNING
A NAT network shares one public IP address. A low connection limit blocks legitimate players behind that address.
Buttons on this tab:
- Create profile - starts the first profile when none exists.
- Save Profile - saves the values.
- Resync nodes - pushes the profile to every node again.
Saving
Click Save Settings at the foot of the Security tab. The panel confirms it, and says so separately when an HTTPS change made it reload.
Two-Factor authentication methods
Users choose their own methods from their account pages:
| Method | Description |
|---|---|
| Authenticator app (TOTP) | Time-based codes from an app such as Google Authenticator or Authy. |
| Security key (WebAuthn / FIDO2) | A hardware key or a platform authenticator, for example YubiKey, Touch ID, or Windows Hello. |
| Recovery codes | One-time codes that the panel generates when a user first enables two-factor authentication. |
Admin 2FA override
A user can lose the authenticator app or the security key. That user is then locked out. An administrator can remove two-factor authentication for that user from Admin > Users. Open the account, then use the security controls on the detail page. The user can then log in with the password only, and set up two-factor authentication again.