Skip to main content

Security Tab

Member Security

Tab: Security.

Use the Security tab to check and manage host-level firewall and SSH access for one server in a hosting pool. It is for server access control, not website, database, or cPanel account security.

Member-Security.png

What you can do

Area What it is for
Firewall status See whether a supported firewall backend is detected, which backend is in use, whether it is enabled, and when the rule list was last refreshed.
Security actions Refresh firewall rules, enable or disable the firewall, manage SSH access, back up firewall rules, and add firewall rules.
Firewall rules Review the latest stored rule snapshot and delete rules when needed.

Supported firewall views are based on what the member reports, commonly UFW or firewalld.

Free and Pro

Feature Community Pro
View firewall status from the latest member report Included Included
View SSH status from the latest member report Included Included
View stored firewall rule snapshots Included Included
Refresh firewall rules Upgrade required Included
Enable or disable firewall Upgrade required Included
Add firewall rules Upgrade required Included
Delete firewall rules Upgrade required Included
Enable or disable SSH service Upgrade required Included
Back up firewall rules Upgrade required Included

Community gives visibility. Pro gives controlled action: rule changes, firewall state changes, SSH access control, and firewall backups before risky changes.

Firewall status

Open Pool, choose the member, then select Security.

The firewall status area shows:

  • Whether a supported firewall was detected.
  • The firewall backend, such as UFW or firewalld.
  • Whether the firewall is enabled or disabled.
  • When the rule snapshot was last refreshed.

If the firewall is not detected, the member may not have a supported firewall installed or the agent may not have enough information yet. Refresh rules after fixing the host.

Refreshing rules

Use Refresh rules to pull a fresh firewall rule list from the host.

Refresh is useful after:

  • You changed firewall rules outside ServersCTL.
  • A backup or restore changed host security files.
  • The rules table is empty or stale.
  • You want to confirm the current live state before editing.

The rules table updates after the job completes. Check Cron & Jobs if the refresh does not appear to finish.

Managing the firewall

Use Firewall to enable or disable the detected firewall backend.

Before enabling the firewall:

  • Make sure SSH is allowed from your access IP or management network.
  • Make sure required web, database, control panel, and monitoring ports are allowed.
  • Refresh the rule list so you can see what will apply.

Before disabling the firewall:

  • Understand that inbound filtering is reduced or stopped until it is enabled again.
  • Use this only for controlled troubleshooting or planned maintenance.

Existing rules are preserved. Refresh rules after the job completes so the table reflects the new state.

Adding rules

Use Add rule to allow, deny, or reject traffic by protocol, port, and source.

The form asks for:

Field Meaning
Action Allow, deny, or reject matching traffic.
Protocol TCP or UDP.
Port A single port or a valid range.
Source any or an IPv4 CIDR range.
Comment Optional note to make the rule easier to identify later.

Use narrow sources where possible. For example, allow SSH from your office or VPN range instead of allowing it from anywhere.

Deleting rules

Use Delete from the firewall rules table when a rule is no longer needed.

Deleting a rule can immediately change live traffic. Check the action, port, protocol, source, and comment before confirming.

SSH access

Use SSH access to enable or disable the SSH service on the host.

Disabling SSH may close current sessions and block new SSH logins. The balctl agent should continue running, so you can turn SSH back on from the Security tab when the member is still checking in.

Use this carefully. If the agent stops checking in and SSH is disabled, you may need console access from your server provider.

Firewall backup

Use Firewall backup before large firewall changes, migrations, or security cleanups.

Firewall backups are stored with the member's backups so they can be found from the backup and restore areas. Keep a backup before removing broad rules or changing access to production services.

What this tab does not manage

The Security tab is host-level only.

Not managed here Where to manage it
cPanel users, packages, and account access cPanel tab or WHM
AutoSSL and website certificates cPanel or OpenLiteSpeed tools, depending on the server
Database users and grants MariaDB / MySQL tab or database tools
DNS provider security Managed DNS or provider settings
Back to top