uAdmin

System & maintenance

Security module (Fail2ban)

Complete overview of the Security module in the panel — installation, tabs (Dashboard, Jails, Banned IPs, Log, Settings), preset jails, login protection and UFW integration.

  1. What the module does

    The Security module (route /fail2ban) manages the Fail2ban service on the server: automatic IP bans after failed attempts (SSH, web auth, FTP, panel login). It appears in the sidebar for admin users after installing the Fail2ban package via Web stack. If the package is not installed, the page shows installation instructions.

  2. Installing Fail2ban

    Web stack → Install → check Fail2ban component → Install preview → confirm. The panel installs the fail2ban apt package and runs install-fail2ban.sh which creates uAdmin preset files in /etc/fail2ban/jail.d/uadmin-*.conf and the panel login filter.

    # Ručno (SSH, root) — isto kao panel:
sudo /usr/local/uadmin/bin/install-stack.sh fail2ban
sudo fail2ban-client status
    Tip

    UFW (Firewall module) is recommended — bans are then applied via UFW instead of raw iptables.

  3. Preset jails (uAdmin)

    After installation the panel automatically creates these jails (depending on installed services). Files are in /etc/fail2ban/jail.d/ with the uadmin- prefix.

    sshd                 — SSH brute-force (maxretry 4, bantime 24h)
nginx-http-auth      — Nginx HTTP auth greške (port 80/443)
apache-auth          — Apache auth greške (port 80/443)
vsftpd               — FTP neuspjeli login (maxretry 3)
uadmin-panel-login   — Panel login (port 10001, log:
                       /var/log/uadmin-panel/login-failed.log)
uadmin-cms-admin-login — Joomla /administrator, WordPress wp-login.php
                       (log: /web/logs/*/proxy-access.log, access.log)
                       maxretry 25 / 5m, bantime 2h

Globalni DEFAULT (uadmin-default.conf):
  bantime  = 1h
  findtime = 10m
  maxretry = 5
  ignoreip = 127.0.0.1/8 ::1

  4. Dashboard tab

    Shows: Fail2ban service status (active/inactive), total currently banned IPs, active jail count, ban backend in use (ufw / iptables). Cards with global thresholds (bantime, findtime, maxretry) and jail overview with ban counts. Reload button reloads configuration (fail2ban-client -t + systemctl reload).

  5. Home dashboard summary

    On the home dashboard (/) the lazy Fail2ban widget shows the same summary without opening the Security module — ban count, active jails and service status.

  6. Jails tab

    Table of all jails reported by Fail2ban. uAdmin preset jails have Edit link and Disable button. Edit opens the uadmin-*.conf file editor — you can change enabled, maxretry, findtime, bantime, port, logpath etc. Saving requires checkbox confirmation. The sshd jail is marked protected (SSH) — disabling requires extra confirmation because it removes SSH brute-force protection.

    Tip

    Jails that are not uAdmin presets (e.g. manually added in /etc/fail2ban/jail.local) appear in the table but cannot be edited through the panel.

  7. Banned IPs tab

    List of all currently banned IP addresses per jail. Each row has an Unban button to remove the ban for that IP in that jail. Below the table, per jail with active bans, Unban all in jail is available. Useful when you accidentally banned yourself or need to quickly unblock a client.

    # SSH alternativa (root):
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 203.0.113.50
sudo fail2ban-client set uadmin-panel-login unbanip 203.0.113.50
sudo fail2ban-client set uadmin-cms-admin-login unbanip 203.0.113.50

  8. Log tab

    Two sections: (1) Panel audit — recent actions admins took in the Security module (reload, jail toggle, unban, save jail or global settings). (2) Fail2ban log — recent lines from /var/log/fail2ban.log (tail).

  9. Settings tab (global DEFAULT)

    Edit the [DEFAULT] section in /etc/fail2ban/jail.d/uadmin-default.conf: bantime (ban duration, e.g. 1h, 24h), findtime (observation window, e.g. 10m), maxretry (failures before ban), ignoreip (trusted IP/CIDR addresses space-separated). Saving requires checkbox confirmation. After save the panel runs fail2ban-client -t and reloads the service.

    ignoreip = 127.0.0.1/8 ::1 203.0.113.10 198.51.100.0/24
    Tip

    Always add your fixed office/home IP to ignoreip before aggressive settings — otherwise you may ban yourself.

  10. Panel login protection (rate limit)

    Separate from Fail2ban but part of the security story: Settings → Security. Laravel rate limit restricts failed login attempts per IP (default 5 attempts in 60 seconds). When exceeded the user sees a temporary lockout message. Successful login resets the counter. Each failed login is written to /var/log/uadmin-panel/login-failed.log — that log is used by the uadmin-panel-login jail.

    # Primjer log linije:
2026-07-02 12:00:00 Login FAILED from 203.0.113.50 email=admin@localhost

# Jail uadmin-panel-login (preset):
maxretry = 10
findtime = 10m
bantime  = 24h
port     = 10001

  11. CMS admin login (Joomla, WordPress)

    Standard nginx-http-auth and apache-auth jails only catch HTTP Basic Auth (401). Joomla brute-force on /administrator/index.php returns 200/302 — they do not trigger. The uAdmin preset jail uadmin-cms-admin-login counts POST requests to /administrator and /wp-login.php in project access logs. Logpath uses glob /web/logs/*/proxy-access.log (frontend proxy) and /web/logs/*/access.log (direct backend). When a new project is created the panel reloads Fail2ban so the new log is picked up. Note: heavy legitimate admin work (many POST in a short time) could theoretically hit the threshold — add your office IP to ignoreip or raise maxretry in Security → Jails.

    # Primjer linije u proxy-access.log:
203.0.113.50 - - [02/Jul/2026:12:00:00 +0000] "POST /administrator/index.php HTTP/1.1" 200 4521

# Jail uadmin-cms-admin-login (preset):
maxretry = 25
findtime = 5m
bantime  = 2h
port     = http,https

sudo fail2ban-client status uadmin-cms-admin-login

  12. UFW and Firewall module

    When UFW is installed, install-fail2ban.sh sets banaction = ufw. Bans then appear in the Firewall module (UFW status/rules) as REJECT/DENY rules added by Fail2ban. The Security module Dashboard shows a hint if UFW is not installed (Fail2ban uses iptables). Recommended: install UFW before Fail2ban.

  13. Panel audit log

    All actions in the Security module are logged in the global panel audit log (Logs → Audit): fail2ban_reload, fail2ban_jail_toggle, fail2ban_unban, fail2ban_save_jail, fail2ban_save_settings. Useful to audit who enabled/disabled a jail or manually unbanned an IP.

  14. CLI commands (SSH)

    The panel uses scripts from /usr/local/uadmin/bin/. Manual maintenance when panel access is unavailable:

    sudo /usr/local/uadmin/bin/fail2ban-status.sh
sudo /usr/local/uadmin/bin/fail2ban-reload.sh
sudo /usr/local/uadmin/bin/install-fail2ban.sh

sudo fail2ban-client status
sudo fail2ban-client status uadmin-panel-login
sudo fail2ban-client status uadmin-cms-admin-login
sudo fail2ban-client ping
sudo systemctl status fail2ban
sudo tail -30 /var/log/fail2ban.log
sudo tail -30 /var/log/uadmin-panel/login-failed.log

  15. Troubleshooting

    Service inactive: systemctl start fail2ban and check fail2ban-client -t. Config test fails: often wrong banaction (ufw vs ufw-multiport) — run install-fail2ban.sh again. Banned yourself: SSH from another IP or hypervisor console → unban in module or fail2ban-client set <jail> unbanip. Panel login fails after many attempts: rate limit (minutes) or Fail2ban ban on port 10001 (hours) — check Banned IPs. Cannot save settings: check sudoers and that the uadmin PHP-FPM pool can run scripts.