# Firewall, users and SSH keys

> Firewall rules, SSH access, server users with sudo or SFTP-only access, and your team's SSH key vault.

## Firewall

Every server gets a default-deny firewall (nftables) during the baseline setup. Open **Firewall** on the server page to change it.

- **SSH port** and **SSH allowed from**: SSH is always allowed from these addresses (rate-limited), so you cannot lock yourself out. Enter addresses or CIDR ranges separated by commas; `0.0.0.0/0` and `::/0` mean everyone.
- **Answer ping**: whether the server replies to ping.
- **Rules**: each rule opens a protocol (TCP/UDP), a port or a port range (**To port**) to **Everyone** or to the addresses you list, with an optional note. Ports 80 and 443 are open for your sites.

**Save and apply** writes the new rules. Opening a database or cache port (MySQL, PostgreSQL, Redis/Valkey…) to everyone needs your passkey: it is almost always a mistake.

CrowdSec also runs on every server and blocks addresses that attack SSH or your sites.

## Server users

**Users** lists the login users Zefily created on the server.

1. **Create user**: a username and a shell. Creating a user is immediate.
2. Choose **SSH keys** from your vault for the user, and turn **Sudo** on if they need administrator rights.
3. **SFTP only** jails the user in their home directory: file transfer over SFTP, no shell, no sudo. Their files go in `~/files`. Use it for designers or clients who only upload files.

Assigning SSH keys, granting sudo and deleting a user need your passkey. Sudo makes a user root-equivalent, so their terminal sessions and cron entries also need your passkey. **Delete** can also delete the home directory.

Each site has its own Linux user as well (shown on the site's **General** pane); you do not need to create those.

## SSH keys

**Settings → SSH keys** is your team's key vault: add a name and a public key (`ssh-ed25519`, `ssh-rsa` or `ecdsa`); the fingerprint is shown. Assign keys to server users on each server's **Users** section. Removing a key from the vault does not remove it from servers it was assigned to — update those users too.

Once root or a sudo user has an SSH key, the baseline setup turns SSH password login off. See [The server page](/docs/server-overview#ssh-password-login).

---
Source: https://zefily.com/docs/firewall-and-users