# Application Security
This article describes the automatic security checks EasyDCIM runs every five minutes. It lists the verified items (local SSH, free disk space, custom SSH port, cron entries, remote-agent connectivity) and explains how administrators can trigger the same checks manually after changes.
# System Security Checks
EasyDCIM performs a series of automatic background tests every five minutes to verify the system’s most critical settings. You can also run these tests manually whenever needed—for example, after updates or configuration changes.
Key checks include:
| Check | What it verifies | Recommended action |
|---|---|---|
| Local SSH Connection | Verifies local SSH availability. | Run easydcim-control app shell -- php artisan ssh:generate if needed. |
| Free Disk Space | Checks available disk space on the EasyDCIM server. If free space falls below the configured threshold, currently 10 GB, the system marks this as a critical issue. | Free disk space before updates, backups, or heavy maintenance tasks. |
| SSH Server Port | Warns if SSH uses the default port 22. | Configure a custom SSH port and update it in settings. |
| CRON Status | Ensures required scheduled task entries exist in /etc/crontab. | Restore missing cron entries if scheduled tasks are not running. |
| Remote Agents Connection | Validates communication between EasyDCIM and Remote Agents. | Check Remote Agent status, network access, and firewall rules. |
| DHCP Servers | Monitors operational status of DHCP on Remote Agents. | Check provisioning subnets, DHCP logs, and Remote Agent services. |
| Remote Agent Data Polling | Confirms polling completes within the expected time window. | If polling is slow or stale, check polling load, queues, and Remote Agent resources. |
| Backend & API IP Access | Recommends IP whitelisting to restrict unauthorized backend/API access. | Configure trusted backend/API source IP addresses. |
| Advanced Firewall (ModSecurity) | Checks whether ModSecurity is enabled and configured with proper whitelist settings. | Enable ModSecurity and whitelist trusted IPs where required. |
| Redis Status | Verifies that Redis is running. | Restart Redis or check the container/service status if unavailable. |
| SSL Configuration | Recommends SSL if the system is exposed via a public domain. | Replace the default self-signed certificate with Let's Encrypt or a paid/custom certificate. |
| PHP, Debian, and EasyDCIM Versions | Confirms that the stack uses supported EasyDCIM, PHP, and host operating system versions for Docker-based deployment. | Update unsupported components. |
| Remote Agents Version | Checks whether Remote Agents should be updated. | Update Remote Agents to the latest compatible version. |
| Two-Factor Authentication | Verifies whether 2FA is enabled for backend access. | Enable 2FA for backend users. |
# Firewall Rules
EasyDCIM and Remote Agents rely on several ports for communication, provisioning, monitoring, and console access. You can limit access to only required traffic using a firewall such as iptables, nftables, or an external network firewall.
# EasyDCIM Backend
| Source | Destination | Protocol / port | Used for |
|---|---|---|---|
| Administrators / integrations | EasyDCIM server | TCP 443 | HTTPS access to the backend, API, and web interface. |
| Administrators / integrations | EasyDCIM server | TCP 80 | HTTP access, redirects to HTTPS, or certificate validation depending on configuration. |
| Administrators | EasyDCIM server | TCP 22 or custom SSH port | Server administration and maintenance. |
| EasyDCIM support access / tooling | EasyDCIM application container | TCP 50223 | Container SSH used by EasyDCIM support access and internal maintenance workflows. |
| User browser | EasyDCIM server | TCP 6081-6200 | noVNC / Websockify console sessions. |
# Client Area
| Source | Destination | Protocol / port | Used for |
|---|---|---|---|
| Clients | Client Area server | TCP 443 | HTTPS access to the Client Area. |
| Clients | Client Area server | TCP 80 | HTTP access, redirects to HTTPS, or certificate validation depending on configuration. |
| EasyDCIM / local proxy | Local Client Area | TCP 8443, TCP 8444 | Local Client Area communication when installed on the same server as EasyDCIM. |
| Client browser | EasyDCIM backend | TCP 6081-6200 | Proxied noVNC / Websockify console sessions. |
# Remote Agents
| Source | Destination | Protocol / port | Used for |
|---|---|---|---|
| EasyDCIM server | Remote Agent | TCP 8080, TCP 8081 | Remote Agent HTTP/HTTPS endpoints. |
| Administrators / EasyDCIM tooling | Remote Agent | TCP 22 or custom SSH port | Remote Agent administration and local SSH checks. |
| EasyDCIM support access / tooling | Remote Agent container | TCP 50222 | Container SSH used by Remote Agent support access and internal maintenance workflows. |
| PXE booting server | Remote Agent | UDP 67/68 | DHCP request and response during PXE boot. |
| PXE booting server | Remote Agent | UDP 69 | TFTP bootloader download. |
| Windows installer / provisioning client | Remote Agent | TCP 139, TCP 445 | Samba/SMB access for Windows installation files. |
| User browser / console proxy | Remote Agent | TCP 5901-6000 | Docker-based console access, depending on Remote Agent configuration. |
# Outgoing Connections From EasyDCIM or Remote Agents
| Source | Destination | Protocol / port | Used for |
|---|---|---|---|
| EasyDCIM / Remote Agent | Server BMC / IPMI interface | UDP 623 | IPMI power control and IPMI status checks. |
| EasyDCIM / Remote Agent | Server BMC web interface | TCP 443, TCP 80 | Redfish, vendor BMC web access, or IPMI proxy workflows. |
| Remote Agent | Network devices / PDUs / servers | UDP 161 | SNMP polling and discovery. |
| Network devices | EasyDCIM / monitoring endpoint | UDP 162 | SNMP traps, if used. |
| Remote Agent | Network devices | TCP 22 | SSH-based automation or switch driver operations. |
| Remote Agent | Network devices | TCP 830 | NETCONF-based network device communication, if used by a driver. |
| EasyDCIM / Remote Agent | license.easydcim.com (5.161.211.169) | TCP 443 | License validation and package access. |
For a Remote Agent-focused network checklist, see Remote Agent Network Requirements.
# Additional Security Measures
EasyDCIM includes several access-control features that help reduce exposure of the backend, API, and Client Area integration.
| Area | Purpose | Where to configure |
|---|---|---|
| Two-Factor Authentication | Adds an extra verification step for backend logins. | Two-Factor Authentication extension configuration. |
| Backend IP whitelist | Limits backend access to trusted IPv4/IPv6 addresses or CIDR subnets. | Global settings, System Access tab. |
| Admin API IP whitelist | Limits Admin API access to trusted source addresses. | Global settings, API access fields. |
| Client Area connection | Controls backend parameters used by the Client Area integration. | Settings → Basic → Client Area. |
| ModSecurity | Adds an additional web application firewall layer. | Global settings and server firewall configuration. |
| SSL certificate | Protects browser and API traffic with HTTPS. | easydcim-control app ssl or SSL configuration page. |
# Two-Factor Authentication
Enable 2FA for backend users, especially administrator accounts. Learn more in the Two-Factor Authentication guide.
# IP Access Restrictions
Use IP whitelisting to restrict access to backend and API endpoints.
Examples:
192.168.56.1
192.168.56.0/24
2001:db8::/32
Available access-control fields include:
| Field | Applies to |
|---|---|
| Allowed IP Addresses | Backend access. |
| Allowed IP Addresses (Admin API) | Admin API access. |
# Client Area Access
Within Settings → Basic → Client Area, configure backend parameters related to Client Area communication and behavior.
For the full description of available backend options, see Backend Configuration Fields.