EN security root_panel_ip_allowlist

Restrict root panel login by SSH IP authorization

MagnusBilling can restrict web-panel login for the root user to IP addresses authorized from an SSH session. The allowlist is stored outside the web document root and outside MariaDB, under /etc/magnusbilling/panel-ip-access.

Activate the restriction

Connect by SSH from the same public IP used by the browser and run:

addmyip root

The command obtains the client address from the SSH connection itself. It does not accept an IP supplied on the command line. The first successful execution creates root.allow and activates the restriction. Existing installations remain unrestricted until this command is run.

Remove the current IP

From the SSH session whose address should be removed, run:

delmyip root

The restriction remains active even when the last address is removed. In that case no web-panel IP can log in as root until addmyip root is run from SSH or all restrictions are released.

Disable all IP restrictions

Run:

releaseAll

This removes all panel allowlist files and makes root unrestricted again. All three commands require root privileges.

Reverse proxies and VPNs

The web login compares Apache's trusted client address (REMOTE_ADDR) with the SSH client address. If a reverse proxy, CDN, NAT gateway, or VPN makes the two addresses different, configure Apache mod_remoteip with only the trusted proxy ranges or connect to SSH through the same egress path. Do not trust arbitrary X-Forwarded-For headers.

---

Documentation home · Documentation index · Edit this page