MagnusBilling
ENPTES
Security

Restrict MagnusBilling panel access by IP authorized over SSH

Add another layer of protection to MagnusBilling by allowing each panel user to sign in only from IP addresses authorized through an SSH session.

MagnusBilling TeamUpdated: Applies to: MagnusBilling 8
ENPTES

The MagnusBilling panel now supports a per-user IP allowlist authorized directly from SSH. Once enabled for a username, the web login accepts that account only when the browser's public IP matches an address previously registered from an SSH connection.

  • The allowlist is stored outside the web document root and outside MariaDB, under /etc/magnusbilling/panel-ip-access.
  • Each panel username has an independent allowlist.
  • Existing users remain unrestricted until the feature is activated for their exact username.

Authorize your current IP

Connect to the server over SSH from the same public IP used by your browser. With root privileges, run:

  • The command reads the client address from the SSH connection itself.
  • It does not accept an IP address supplied on the command line.
  • The first successful execution creates the user's allowlist and immediately activates the restriction for that account.
addmyip root

Use it with any panel user

The feature is not limited to the root panel account. Pass the exact panel username to the command, including quotes when the name contains spaces. Each username is represented by a SHA-256 identifier in the storage directory, so special characters cannot be interpreted as filesystem paths.

addmyip administrator
addmyip "support manager"

Remove the current IP

From the SSH session whose address you want to remove, run:

  • The restriction stays active even after the last authorized address is removed.
  • With an empty allowlist, no IP can sign in to the panel as that user.
  • To restore access, run addmyip USERNAME from SSH or release all restrictions.
delmyip root

Disable all panel IP restrictions

To delete every panel allowlist and make all users unrestricted again, run the command below. The addmyip, delmyip and releaseAll commands require root privileges. Because releaseAll affects every panel user, reserve it for recovery or a deliberate rollback.

releaseAll

Reverse proxies, CDNs, NAT and VPNs

The web login compares Apache's trusted client address (REMOTE_ADDR) with the SSH client address. If a reverse proxy, CDN, NAT gateway or VPN makes those addresses different, configure Apache mod_remoteip with only the trusted proxy ranges, or connect to SSH through the same egress path.

  • Do not trust arbitrary X-Forwarded-For headers.
  • Keep at least one working SSH path before enabling the restriction.
  • Test the login in a separate browser session before ending SSH access.

Read the technical documentation

The official guide contains the operational reference for this MagnusBilling 8 security feature.

Open the panel IP allowlist documentation