# Configure Security Settings

In `Settings-Security`, you can configure login sessions, Auto lock, Two-Factor Authentication, SSH, Firewall, User Improvement Program, and Certificate.

## Set Auto Logout

Auto logout ends the current login session after the web app has been inactive for a long time.

1. Open `Settings-Security-Security`:
   ![Security tab overview](position://apps/settings/security#security-overview)

2. Select [Auto logout the web app after].
3. Set the waiting time and select the time unit.
4. Click [Apply] to save the setting.
5. After saving, the interface prompts `"The auto logout timeout rule has been adjusted and will take effect after you sign in again"`. Sign in again for the new auto logout rule to take effect.

## Clear Login Sessions After Restart

After this option is enabled, restarting the system clears normal login sessions; sessions set to keep the user signed in are not affected.

1. Open `Settings-Security-Security`.
2. Select [Clear login sessions on system reboot].
3. Click [Apply] to save the setting. After saving succeeds, the interface prompts `"Saved successfully"`.
4. To turn it off, clear [Clear login sessions on system reboot] again and click [Apply].

## Configure Auto Lock

Auto lock limits device access from IP addresses with consecutive failed sign-in attempts. You can maintain both the allow list and the block list.

![Auto lock settings](position://apps/settings/security#auto-block-setting)

1. Open `Settings-Security-Security`.
2. Select [Auto lock].
3. Set the failed sign-in time window and number of failed attempts.
4. Select the handling method after blocking. You can choose an auto unlock time, or select [Permanent lock]. IP addresses permanently locked in the block list display `"Permanent lock"`.
5. Click [Apply] to save the setting. After saving succeeds, the interface prompts `"Saved successfully"`.
6. To manage the allow list or block list, click [Allow/Block list]:
   ![Auto lock - block and allow list management](position://apps/settings/security#auto-block-list-dialog)

7. On the `Allow list` tab, click [New Allowlist], select the IP type, and enter the IP address:
   ![Auto lock - add IP](position://apps/settings/security#auto-block-add-ip-dialog)

8. After you click [Save], the IP appearing in the list indicates that it was added successfully.
9. To delete an allow-list IP, click [Delete] in that IP row. The confirmation dialog prompts `"Confirm delete this IP?"`:
   ![Auto lock - delete allow-list confirmation](position://apps/settings/security#auto-block-delete-confirm)

10. After you click [Confirm], the IP being removed from the list indicates that the operation succeeded.
11. On the `Block list` tab, you can add a blocked IP in the same way.
12. To unblock a block-list IP, click [Unblock] in that IP row. The confirmation dialog prompts `"Confirm unblock this IP?"`:
   ![Auto lock - unblock confirmation](position://apps/settings/security#auto-block-unblock-confirm)

13. After you click [Confirm], the IP being removed from the list indicates that the operation succeeded.

## Enable Two-Factor Authentication

Two-Factor Authentication is located on the `Account and Security` tab. After it is enabled, signing in to a Zettlab device requires a second verification step (OTP) in addition to the account password.

1. Open `Settings-Security-Account and Security`:
   ![Two-Factor Authentication entry](position://apps/settings/security#two-factor-entry)

2. Check the current status in the `Two-Factor Authentication` area.
3. Click [Manage]. The system opens a separate `Account Settings` window.
4. In `Account Settings-Account and Security`, find the `Two-Factor Authentication` switch:
   ![Account Settings - Two-Factor Authentication switch](position://apps/settings/security#two-factor-account-settings)

## Configure SSH Service

The SSH service is used to sign in through Terminal and manage the system. Enabling SSH, or changing the port or auto close time, requires administrator password verification.

1. Open `Settings-Security-Terminal`:
   ![SSH settings](position://apps/settings/security#ssh-settings)

### Enable SSH Service

1. Turn on the [SSH] switch. The system displays a risk notice dialog:
   ![SSH risk notice](position://apps/settings/security#ssh-risk-dialog)

2. The risk notice prompts `"Enabling SSH may expose the device to remote login risks."` It also reminds you to enable SSH only on trusted networks, use a strong password, restrict port access, and close SSH in time when it is no longer needed.
3. Click [Continue] and enter the administrator password to finish enabling SSH:
   ![SSH password verification](position://apps/settings/security#ssh-password-dialog)

### Disable SSH Service

1. Turn off the [SSH] switch. The service is disabled immediately.

### Adjust the Port or Auto Close Time

1. Set the port in `Port`; or select the auto close time in `Auto close`. Available options include `Always on`, `After 10 min`, `After 30 min`, `After 1 hour`, and `After 2 hours`.
2. Click [Save] and enter the administrator password to save the change. After saving succeeds, the interface prompts `"Saved successfully"`.

## Manage Firewall

Firewall controls access from specific IP addresses to network ports. Changing firewall configurations may affect device access; confirm the rules before saving.

1. Open `Settings-Security-Firewall`:
   ![Firewall overview](position://apps/settings/security#firewall-overview)

2. Turn on the [Firewall] switch.
3. Click [New Configuration] to create a new firewall configuration:
   ![Firewall - new configuration](position://apps/settings/security#firewall-config-dialog)

4. Enter the firewall name and description in the configuration dialog.
5. Click [New Rule], then set the rule Permission, network interface, port strategy, protocol, and IP source:
   ![Firewall - new rule](position://apps/settings/security#firewall-rule-dialog)

6. Click [Confirm] to add the rule to the Rule list.
7. In `Default action for unmatched traffic`, select the default handling method.
8. Click [Save] to save the configuration. The list updating indicates that the save succeeded.
9. To modify a configuration, click [Edit] in the configuration row and follow the interface prompts to save.
10. To delete a configuration, click [Delete] in the configuration row and complete deletion in the confirmation dialog. The list updating indicates that the operation succeeded.

## Join or Leave the User Improvement Program

The User Improvement Program is used to share feature usage and operating status to help improve zettOS. This page provides a [Privacy Policy] link.

1. Open `Settings-Security-User Improvement Program`:
   ![User Improvement Program switch](position://apps/settings/security#user-improvement-plan)

2. Turn on the switch to join the User Improvement Program.
3. Turn off the switch to leave the User Improvement Program.
4. After turning it on or off succeeds, the interface prompts `"Set successfully"`.

## Manage Certificates

The Certificate page is used to view the current certificate, add a certificate, regenerate a certificate, or export a certificate file.

1. Open `Settings-Security-Certificate`:
   ![Certificate list](position://apps/settings/security#certificate-list)

2. To add a certificate, click [New Certificate]:
   ![Create certificate](position://apps/settings/security#certificate-create-dialog)

3. Fill in `Notes`, and paste the `Certificate`, `Private key`, and `Intermediate certificate`.
4. Certificate format requirements include: the certificate must be in `X.509 PEM` format; password-protected keys are not supported; if you upload an intermediate certificate, the certificate chain must be trusted by the system root CAs.
5. Click [Confirm] to submit the certificate.
6. To regenerate a certificate, click the more menu on the right side of the certificate card and select [Regenerate]:
   ![Regenerate certificate confirmation](position://apps/settings/security#certificate-regenerate-dialog)

7. The confirmation dialog prompts `"Replacing the certificate will restart WebDAV, FTPS, and related services, causing any active data transfers to be interrupted. Do you want to proceed?"`. Click [Confirm] to continue.
8. To export a certificate, click the more menu on the right side of the certificate card and select [Export] to download the certificate file.

## FAQ

| Question | Handling or suggestion |
| --- | --- |
| Why does enabling SSH require extra confirmation? | Because enabling SSH exposes the device to remote login ports, the product warns `"Enabling SSH may expose the device to remote login risks."` A risk notice is shown and administrator password confirmation is required. Changing the port or Auto close time also requires administrator password verification. See [Configure security settings](apps/settings/security). |
| What does “Permanent lock” mean in Auto lock? | After Permanent lock is selected, the blocked IP appears as `"Permanent lock"` in the block list and must be manually unblocked there. See [Configure security settings](apps/settings/security).|