uAdmin

Security

Threat Security and threat feeds

Sync public threat feeds, IP/CIDR indicators, nftables sets and automatically apply auto-managed lists.

  1. What Threat Security is

    Threat Security collects public reputation lists and turns them into firewall-ready nftables sets. The focus is on network indicators such as IP addresses and CIDR ranges; URL/domain feeds are stored for reputation checks but are not directly converted into IP blocks.

  2. Feeds and auto-managed sets

    Typical feeds include Spamhaus DROP and Tor exit nodes. When a feed is marked for auto-block, sync automatically generates and applies only the relevant nftables set, without rebuilding unrelated lists.

  3. Manual set and indicator checks

    uadmin-manual is for the administrator: manually add IP/CIDR entries you want to control. Indicator search helps check whether an IP, domain or URL was seen in feeds and what its status is.

  4. CLI checks

    The same operations are available from SSH. Useful for cron, diagnostics or recovery when the web UI is not available.

    sudo -u uadmin php8.3-cli /home/uadmin/app/artisan uadmin:threat-feeds:sync
sudo -u uadmin php8.3-cli /home/uadmin/app/artisan uadmin:threat-sets:status
sudo nft list table inet uadmin
    Tip

    Auto-managed sets are applied after sync; the manual set remains under explicit administrator control.