Security is an operating model.

EzeAD combines user-facing protection with server-side boundaries, strict privileged execution, diagnostics and recoverable change workflows.

Identity & sessions

TOTP multi-factor authentication
Single-use recovery codes
Session inventory and revocation
Login history and rate boundaries

Workload protection

ClamAV scan workflows
Fail-closed upload handling
Quarantine boundaries
Account and server scan scopes

Platform defenses

Firewall and Fail2Ban visibility
ModSecurity and OWASP CRS
Guarded SSH policies
Apache and service health probes

Least privilege

The web request does not become root.

EzeAD separates the panel runtime from a narrow privileged execution path. Helpers validate operation, identity and path scope before server changes are accepted.

Dedicated panel service identity
Explicitly enumerated sudo operations
Tenant-aware resource helpers
Ownership and mode validation for generated configuration
Protected secrets and audit evidence

Sign-in security in EzeAD — Authentication controls are visible and understandable to the account owner.

Layered model

Prevent, detect, contain, recover

No single control carries the entire security story.

Layer	Purpose	EzeAD controls
Prevent	Reduce unsafe states	Input validation, tenant scopes, MFA, HTTPS, safe defaults
Detect	Find drift and threats	Panel Doctor, service checks, malware scans, login history
Contain	Limit blast radius	Account isolation, scoped helpers, quarantine, feature lists
Recover	Restore a known state	Backups, versioned releases, snapshots, validation and rollback

Malware scanner interface — Queued malware scans keep long work outside the web request.

Operational safety

Security controls should remain usable.

Rather than exposing raw scanner or firewall output as the product, EzeAD presents clear state, guided actions and protected evidence.

Review the technical model

Security gallery

Controls in the product

Scope note: Security capabilities reduce operational risk but do not replace responsible server hardening, monitoring, patch management, backups or an organization’s own security program.