# Securing Your Server

Your SAS Radius server holds your customers' data and controls your network. Follow these recommendations.

## Accounts

- Change the default `admin` password right after installation, and the server console passwords.
- Give each staff member and reseller their own manager account with the smallest permission group they need.
- Enable **two-factor authentication** for administrators (account menu → Profile → 2FA Setup).
- Use *Enforce Manager Password Strength*, login captcha and *Block manager login after login fails* (Settings → general settings / web).
- Give permissions marked *(Dangerous!)* only to trusted staff.

## Network

- Allow incoming traffic only where needed: RADIUS (UDP 1812/1813) from your routers, the web panel (80/443) from your offices or VPN.
- **Don't expose SSH to the internet.** If remote SSH access is needed, allow it only from known addresses and use keys instead of passwords.
- Allow outgoing traffic, at least to `license.snono.systems` and the update servers.
- Use HTTPS with a valid certificate for the panel and user portal.

## Data

- Enable daily backups to a separate disk and Google Drive, and download a copy regularly.
- Install SAS Radius updates (*Tools → System Update*).
- Review the *System Log* for unexpected logins or *security/violation* events.

<p class="callout warning">If the server shows unusual high CPU or unknown processes, it may be compromised. Contact Snono support immediately and don't reboot or delete anything before evidence is collected.</p>