Firewall, users and SSH keys

Firewall#

Every server gets a default-deny firewall (nftables) during the baseline setup. Open Firewall on the server page to change it.

• SSH port and SSH allowed from: SSH is always allowed from these addresses (rate-limited), so you cannot lock yourself out. Enter addresses or CIDR ranges separated by commas; 0.0.0.0/0 and ::/0 mean everyone.
• Answer ping: whether the server replies to ping.
• Rules: each rule opens a protocol (TCP/UDP), a port or a port range (To port) to Everyone or to the addresses you list, with an optional note. Ports 80 and 443 are open for your sites.

Save and apply writes the new rules. Opening a database or cache port (MySQL, PostgreSQL, Redis/Valkey…) to everyone needs your passkey: it is almost always a mistake.

CrowdSec also runs on every server and blocks addresses that attack SSH or your sites.

Server users#

Users lists the login users Zefily created on the server.

1. Create user: a username and a shell. Creating a user is immediate.
2. Choose SSH keys from your vault for the user, and turn Sudo on if they need administrator rights.
3. SFTP only jails the user in their home directory: file transfer over SFTP, no shell, no sudo. Their files go in ~/files. Use it for designers or clients who only upload files.

Assigning SSH keys, granting sudo and deleting a user need your passkey. Sudo makes a user root-equivalent, so their terminal sessions and cron entries also need your passkey. Delete can also delete the home directory.

Each site has its own Linux user as well (shown on the site's General pane); you do not need to create those.

SSH keys#

Settings → SSH keys is your team's key vault: add a name and a public key (ssh-ed25519, ssh-rsa or ecdsa); the fingerprint is shown. Assign keys to server users on each server's Users section. Removing a key from the vault does not remove it from servers it was assigned to — update those users too.

Once root or a sudo user has an SSH key, the baseline setup turns SSH password login off. See The server page.