admin

Security center

Checks of this installation, sign-in rules, and every active session and API token.

Audit trail
12 / 14
Checks passed
1
Need fixing
1
Active sessions
0
Active API tokens

Checks

  • Two-factor sign-in for admins
    Without 2FA: admin. Turn on "Require 2FA for administrators" below.
    Open
  • Configuration backup
    No backup of FleetPilot's own data exists yet.
    Open
  • HTTPS
    Sign-in cookies are only sent over HTTPS.
  • Initial password file
    The first-run password file has been removed.
  • Secret key file
    Permissions 0o600.
  • CSRF protection
    Forms are protected against cross-site request forgery.
  • Debug mode
    Debug mode is off.
  • Idle sign-out
    Sessions end after 120 minutes without activity.
  • Failed sign-ins (24 h)
    0 failed sign-ins, 0 lockouts.
  • API tokens
    0 active tokens, all with an expiry date.
  • Audit trail integrity
    0 chained events verified; none were changed or removed.
  • Session lifetime
    Sessions end after at most 12 hours.
  • Account lockout
    Accounts lock for 10 minutes after 10 failed sign-ins.
  • Internet access
    Offline mode: no update checks or online plugin catalogue.
  • Network allowlist
    Any address that can reach the server can open the sign-in page.
  • Sign-in notice
    No notice before sign-in. Government and corporate policies often require one (NIST AC-8).
  • SSH host keys
    Host keys are trusted on first connection and checked afterwards. Strict sites pre-load known_hosts and set FLEETPILOT_SSH_STRICT_HOST_KEYS=true.
  • FIPS mode
    Passwords use scrypt. Set FLEETPILOT_FIPS=true on FIPS-enabled systems.
  • Security alerts
    Lockouts and other security events are only visible in the audit trail. Add a notification channel.
    Open
  • Vulnerability scan
    The servers have not been checked for known vulnerabilities (CVEs) yet.
    Open

Sign-in rules

Administrators without 2FA are sent to the 2FA page after signing in and cannot use anything else until they set it up.
0 = never.
For user management, backups and these settings.
0 allows tokens that never expire.
Sign in again after this, even when active. NIST: 12.
DISA STIG: 3.
One address or network per line. Leave empty to allow every address. This server itself is always allowed, and so is the public status page. Your address is 127.0.0.1; a list that leaves it out is refused. Behind a reverse proxy, make sure FleetPilot sees real client addresses (FLEETPILOT_TRUST_PROXY).

Active sessions

UserDeviceAddressSigned inLast active
admin Unknown browser You — 2026-10-14 01:13 2026-10-14 01:13

API tokens

No API tokens. Users create them under Sign-in & security.

Recent failed sign-ins

Show all
When (UTC)Account triedEventAddress
No failed sign-ins recorded.