Firewall and SSH

Every server has a firewall and automatic blocking from the moment it is created. You don’t need to set anything up. To see them, open the server and go to Security.

What the Security section shows

Four tiles at the top: Firewall (active or not), Automatic blocking, Banned now and Blocked in the last 24 h.

• Banned now: addresses banned automatically after repeated failures, with the reason and when the ban ends.
• Automatic protection: what the server watches for, how many addresses each rule has banned, and the known attacker networks it blocks.
• Firewall rules: what can reach the server. Web traffic (HTTP and HTTPS, ports 80 and 443) and SSH and SFTP (port 22) are listed; everything else is blocked. These rules are managed by Netkeel and marked Managed.
• Blocked addresses: your own blocks.

Unban an address

An address can get banned after several wrong passwords, even yours. If your own address is banned, a red notice at the top of the section says so.

1. Find the address under Banned now.
2. Click Unban.

It is banned again only if it keeps failing.

Block an address

Your blocks apply to the whole server: every website and SSH.

1. Under Blocked addresses, type an IP address or a range, such as 192.0.2.44 or 2001:db8:1234::/48.
2. Click Block. Add more if you need to.
3. Click Save changes. Nothing applies until you save.

To unblock, click the × next to an address and click Save changes.

You can block up to 200 entries. Private addresses, the server’s own addresses and your own current address can’t be blocked.

SFTP and SSH access

SFTP and SSH logins belong to each website, not to the server. Each website has its own login that only reaches that website. There is no root login.

To connect:

1. Open the website and go to SSH / SFTP (under Hosting).
2. Click Add key, give it a Friendly name, and paste your OpenSSH public key (or click Upload file). Click Add key.
3. Connect with any SFTP client, such as FileZilla, Cyberduck or WinSCP. Use the host, port (22) and user shown on the page, and your private key. The page also shows an sftp command you can copy.

SFTP is always available to the website’s keys. For a command-line shell, turn on the SSH access switch. The same keys then also open a shell inside the website, as the site’s own account, with tools such as git and rsync. The page shows the ssh command to copy.

To revoke access, open the key’s ⋮ menu and click Remove key.