Security

The Security section of a server (/servers/:id/security) is where you harden the box and keep it that way: a UFW firewall, SSH hardening, Fail2ban jails and bans, malware and integrity scans, and a live hardening score that tells you what’s still open. The core hardening tools are on all plans; the per-site managed WAF is Pro.

The page is a tabbed hub — Overview, Scan, Firewall, SSH, Fail2ban and Bans — reading its state live from the agent and writing every change back as a real job.

Raise your hardening score, step by step

1. Open Overview. The Hardening score ring shows how many of six checks pass: firewall active, SSH key-only login, root SSH login disabled, Fail2ban protecting SSH, automatic security updates, and (optional) SSH on a non-standard port.
2. Each failing check has a one-click fix inline — Enable the firewall, switch SSH to key-only, Disable root login, Enable the sshd jail, or flip on automatic security updates. The score and posture tiles update as each one applies.
3. Passing checks become links that jump you into the matching tab (Firewall, SSH, Fail2ban) to review or fine-tune the details.
4. Watch Recent login attempts at the bottom — real SSH successes and failures from the box’s journal, with a link into Logs for the full history.

What else you can do

• Firewall — UFW rules as list cards you can filter (All / Allow / Deny) and search; add or edit a rule (port, protocol, action, source IP/CIDR, comment) in a drawer, delete rules, and toggle the whole firewall on or off.
• SSH — harden sshd: key-only auth, root login on/off, the listen port, and an Allowed users (AllowUsers) allow-list that governs both SSH and SFTP.
• Fail2ban — each jail (sshd, nginx-badbots, wordpress, recidive…) is a card you can enable/disable and tune (maxretry, findtime, bantime).
• Bans — the live ban list per jail, unban an address, or add a manual ban.
• Scan — three on-demand scans: a Malware scan (ClamAV over a content root, with quarantine/delete on each finding), a WordPress integrity check (core & plugin files against wordpress.org checksums, per site), and a rogue vhost scan that flags Nginx server blocks MZPanel didn’t create and lets you disable them.
• Tools (top-right) — Export the firewall/SSH/Fail2ban config as JSON, Import a saved config, Copy settings to another server, and Re-scan the posture.

How it works

Every write dispatches a real security.* (or waf.*) job to the agent, which runs it natively — no shell-out to mz, the same engine the CLI uses. After each job the panel refetches the security inventory, which is the source of truth.

Area	Job kind	Agent runs
Firewall rule add/remove	security.fw	ufw allow/deny + reload
Firewall on/off	security.fw-toggle	ufw enable/disable
SSH hardening	security.ssh	writes /etc/ssh/sshd_config.d/99-mz-hardening.conf
SSH allow-list	security.ssh-allow	writes 60-mz-allowusers.conf
Jail enable/config	security.f2b, security.f2b-config	drop-in under /etc/fail2ban/jail.d + reload
Ban / unban	security.f2b	fail2ban-client ban/unban
Auto updates	security.auto-updates	unattended-upgrades config
Malware scan	security.scan, security.file	clamscan; quarantine to /opt/mzpanel/quarantine
WP integrity	security.wp-integrity	wp core/plugin verify-checksums
Rogue vhost	security.rogue-vhost, security.vhost-disable	reads Nginx provenance; quarantines a vhost

The read side — UFW rules, effective sshd config, Fail2ban jails and bans, auto-update status and recent login attempts — comes from the agent-pushed security inventory, so the page also renders the last-known state when the server is offline.

Quarantine, never auto-delete

A ClamAV finding is moved to quarantine (/opt/mzpanel/quarantine, outside the webroot) rather than removed. You restore or delete quarantined files yourself, so a false positive can’t break a site.

Per-site WAF (ModSecurity + OWASP CRS)

Beyond the box-level firewall, MZPanel offers a managed WAF — ModSecurity with the OWASP Core Rule Set in front of your sites, blocking SQL injection, XSS, LFI, RCE and more at Nginx. It’s a Pro feature and is managed per site (on each site’s Firewall tab), not per box — enable it where you need it and leave low-risk sites alone.

The WAF runs in one of three modes:

Mode	CLI name	Behavior
Off	off	No inspection.
Detect (learning)	learning	Matches are logged only — traffic passes.
Block	blocking	Malicious requests are rejected with 403.

Caution

False positives are the biggest WAF risk in front of WordPress/WooCommerce. Start in Detect, watch the logs, then switch to Block once you’re confident legitimate traffic — like wp-admin logins — isn’t caught.

CLI & automation

Every action here maps to an mz command on the box — the same engine the dashboard drives. SSH in and run them directly, or let an on-box AI (ClaudeCode) run them:

mz security fw enable --json                       # turn the firewall on
mz security fw add 443 tcp allow '' HTTPS --json   # allow a port
mz security ssh-set --key-only 1 --permit-root 0 --json
mz security f2b ban sshd 45.146.165.37 --json      # ban an IP in a jail
mz security scan /home --json                      # ClamAV scan a content root
mz waf mode example.com blocking                   # per-site WAF (Pro): off|learning|blocking

Pass --json for machine output. See The mz CLI and the command catalog.

Gotchas & troubleshooting

• Live, with an offline fallback. Firewall, SSH, Fail2ban and scans run real jobs while the agent is online. Offline, the page shows the last-known state from cache and writes apply once the agent reconnects.
• The Bans table is sparse on some fields. IP and jail come straight from Fail2ban; the failure count, country and ban time aren’t populated from the live inventory yet, so those columns can read blank.
• Import and Copy-to-server don’t push to the box yet. Export produces a real JSON snapshot, but Import only reloads the settings into the current view, and Copy settings to another server is a preview — neither dispatches jobs to apply the config remotely. Use them to review, not to replicate hardening across the fleet.
• “Last scanned / Re-scan” on Overview is cosmetic. It refreshes the timestamp; the real scans live under the Scan tab.
• Scheduled malware scans aren’t shipped. On-demand ClamAV scanning and quarantine work today; recurring maldet-style signature sweeps are planned but not yet available.
• Locking yourself out of SSH. Switching to key-only with no key installed, or a too-tight AllowUsers list, can end your session. The allow-list op keeps root and collapses a root-only list back to “no restriction” as a guard — but confirm your key works before you disable password auth.

Related

• Server overview — the server’s health cockpit.
• Remote database access — the per-source firewall that grants a specific IP DB access.
• Services — daemons and system services on the box.
• The mz CLI — driving the box from the command line.