# Security tools

> Use the FeatherPanel security pages. FeatherZeroTrust malware scans, rate limits, banned IPs, blocked e-mail domains and the AbuseIPDB integration.

Source: https://featherpanel.com/docs/admin/security/

The Security group in the admin sidebar holds these pages. For general hardening (HTTPS, keys, proxies) see
[Security hardening](https://featherpanel.com/docs/security).

## FeatherZeroTrust

FeatherZeroTrust looks for malicious files on game servers. It reads server files through each node's
[FeatherWings](https://featherpanel.com/docs/wings) API, so nothing extra is installed on the node.

| Tab | Use |
| --- | --- |
| Scanner | Scan one server (deep scan of a directory with a max depth) or a batch of servers, with a live feed and results. |
| Suspicious Hashes | The SHA-256 hash database. Add hashes by hand, confirm or delete them in bulk, check up to 1000 hashes at once, or import recent samples from MalwareBazaar. |
| Scan History | Logs of the scheduled scans. |
| Configuration | All settings below. |

Configuration:

- **Basic settings:** System Enabled (master switch), Auto Suspend for servers with detections, scan interval in
  minutes, maximum directory depth, maximum file size, and a maximum JAR size below which JAR files count as
  suspicious.
- **Notifications:** a Discord webhook for alerts.
- **MalwareBazaar:** enable imports, optional API key, latest 100 samples or last hour, import limit (1 to 1000),
  maximum sample age, allowed file types, blocked tags, auto-confirm and require-signature options.
- **Exclusions:** ignored extensions, files and paths.
- **Threat indicators:** suspicious content patterns (one per line), malicious process names, miner and WhatsApp bot
  indicators.
- **Thresholds:** high CPU, high network and small volume size.

When System Enabled is on, the panel cron runs a scan of every server on every node at the configured interval.

## Rate limits

Rate Limits has a global switch and a table of API routes, each with its own limits per second, minute, hour and
day, a namespace, an on or off switch and a reset action. Save All writes the changes. How limits are counted and what clients receive is in
[Rate limits and errors](https://featherpanel.com/docs/api/rate-limits-and-errors).

## Banned IPs

Ban an IPv4 or IPv6 address or a CIDR range, with an optional duration (`30m`, `24h`, `7d`, `1w`, `1h30m`; empty means
permanent) and a reason. Registrations from a banned IP get the `IP_BANNED` error, and automatic account creation
through OIDC or Discord is refused. Expired bans stay in the list marked Expired.

## Blocked email domains

With Enforce blocked domains on (`email_domain_blocking_enabled`), new registrations and e-mail changes are rejected
when the domain matches the list. Subdomains match too: `sub.example.com` matches `example.com`.

Add domains one at a time or use Bulk import: the bundled disposable-domain preset, a plain-text URL (redirects are not
followed and private addresses are rejected) or pasted text, one domain per line with `#` comments.

## AbuseIPDB

Turn on `abuseipdb_enabled` and add an API key in Settings, Security. Then:

| Setting | Default | Effect |
| --- | --- | --- |
| `abuseipdb_check_on_register` | false | Check the IP of each new registration. |
| `abuseipdb_min_confidence_score` | 75 | Score (0 to 100) at which an IP counts as reported. |
| `abuseipdb_max_age_days` | 90 | Only count reports from the last N days. |
| `abuseipdb_register_action` | block | `block` refuses the sign-up, `log` only records it, `auto_ban` creates the account and bans it. |

The AbuseIPDB page scans the first and last IPs of all users and lists flagged ones, and checks a single IP. When you
ban a user you can also report their IPs to AbuseIPDB with one or more categories and a comment.

## Frequently asked questions

### What does FeatherZeroTrust scan?

Files of game servers on your Wings nodes. It hashes files and compares them with its hash database, and checks content patterns, miner and bot indicators and small JAR files.

### Does a banned IP lose access to existing accounts?

The IP ban list is checked when accounts are created, including automatic sign-up through OIDC and Discord. To lock out an existing account, ban the user.

### Can I import a list of disposable e-mail providers?

Yes. Blocked email domains has a bundled disposable-domain preset, plus import from a URL or pasted text.