UniqueSoft/openpanel
2
0
Fork 0
mirror of https://github.com/stefanpejcic/openpanel synced 2025-06-26 18:28:26 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Update 000_intro.md

Browse Source
This commit is contained in:
Stefan Pejcic 2024-04-18 00:30:37 +02:00 committed by GitHub
parent 26dfdbe977
commit 0467344309
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 23 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
documentation/docs/admin/000_intro.md
View File

@ -173,14 +173,26 @@ opencli update
OpenPanel has been built from the ground up with security in mind. Internet history is littered with painful security incidents, so we traded old software compatibility and insecure authentication methods for features that meet today's for features that meet modern security requirements. OpenPanel has been built from the ground up with security in mind. Internet history is littered with painful security incidents, so we traded old software compatibility and insecure authentication methods for features that meet today's for features that meet modern security requirements.
Security features: OpenPanel Security features:
- disable admin panel - 2FA can be enabled by users
- basicauth for admin panel - User panel port can be changed from the default 2083
- 2fa for user panel - All files and services for users are isolated, preventing resource problems
- change panel ports - Auto-login for phpMyAdmin and WebTerminal using one-time tokens
- bruteforce protection for panels - Users public services (ssh, mysql) are available via non-standard ports
- modsecurity waf for domains - Bruteforce protection and rate limiting for all panel pages
- isolated user accounts and services - User panel is isolated from admin oanel and websites
- private services - All user requests on panel are processed in the backend
- no outgoing email spam
- random ports for services
OpenAdmin Security features:
- Admin panel can be completelly disabled while all functionality remains
- HTTP BasicAuth can be enabled for admin panel
- bruteforce protection for admin panel
- all passwords are by default stored as salted SHA512 hash (5000 rounds)
- admin panel is isolated from user panel and websites
Websites:
- ModSecurity WAF can be enabled for domains, with OWASP core ruleset
- no outgoing email spam, period.
- All passwords are by default stored as salted SHA512 hash (5000 rounds)
- TLS