SSH only through whyctl
SSH sign-in only through the whyctl secure tunnel with WhyCloud identity, or only from allowed sources; root and password sign-in can be turned off.
Server security profilesGA
One security profile, enforced on every server
Say SSH only through whyctl, the firewall only for certain sources and Telnet off; every server inherits the profile and WhyCloud makes sure it stays that way.
- 5 min
- drift checks
- mTLS
- agent links
- Linux + Windows
- one profile
Security profilesLIVE
| Server | Profile | State |
|---|---|---|
| web-1 | Organization default | Compliant |
| db-1 | Strict | Compliant |
| win-app-01 | Windows | RDP open to internet |
Live
HOW IT WORKS
How it works
- 1
Define
Write SSH, firewall, Telnet and allowed users in one profile.
- 2
Inherit
Make it the organization default or assign it to servers.
- 3
Be sure
WhyCloud applies, checks and corrects drift.
Capabilities
Server security profiles
Firewall with inheritance
Inbound rules with nftables on Linux and Windows Firewall on Windows; validated before applying and rolled back on failure.
Telnet and insecure services
Telnet, rsh and legacy services are turned off and their ports closed.
Allowed users
Choose which system users, or only WhyCloud users, may sign in.
Ports open to the internet
Every port reachable from the whole internet, with the process behind it and its risk.
Drift and compliance
Every 5 minutes the real state is compared with the profile and drift is reported and corrected.
mTLS links
Agents talk to the control plane over mutual TLS 1.3 with a certificate per server.
Windows too
The same profile for Windows servers: RDP only from allowed sources or off, and Windows Firewall.
INHERITANCE
Inherit it like a profile
Define an organization default, a stricter profile for a group of servers, and override a single server only where needed. Each server’s effective profile is always visible, and a profile change reaches every server that uses it.
- Organization default profile
- Narrow per-server overrides
- Effective profile view
SAFE APPLY
Never lock yourself out
SSH configuration is checked with sshd -t and firewall rules with nft -c before applying. Ports WhyCloud services need stay open automatically, and a failed apply restores the previous state.
- Validated before applying
- Automatic rollback
- Service ports kept open
FAQ
Frequently asked questions
If SSH is limited to whyctl, what about emergencies?
whyctl uses the agent’s outbound connection and needs no inbound port. You can still allow an emergency source such as your office IP.
What about servers with another firewall?
WhyCloud only manages its own nftables table (inet whycloud) and leaves other rules alone.
How are open ports found?
The agent reports listening ports and WhyCloud checks from outside which are actually reachable from the internet.
Related services
Security & complianceLayered security with whycloud: Trivy CVE scanning, agent access contr…DevOps as a ServiceManaged registry, tunnels, logs and metrics with a self-service consol…Log ExplorerCollect, search and retain logs from all servers and services in one c…Monitoring & metricsLocal Prometheus and Thanos with live charts in the whycloud console; …
Turn on your own cloud today
Create an account and connect your first server in under five minutes.