Web UI

Cette page n'existe qu'en anglais pour le moment.

The Shieldlist Web UI is served by the controller at / on the API listener — one page, no build, a client of the API and nothing else: everything it does is one request an operator token could make from a script, and everything it changes is a change to the configuration files.

Signing in. A name and a password; a one-time code as a second step once the account has enrolled one; an API token behind a link, as the alternative. Sessions slide with activity (twelve hours unless set — Settings → Access). Every action is recorded under the person's name in Activity.

Home. The sanctions as they land, and one search box: an address or its start, a rule, a server, a country code, a network by number or name — an exact address offers Open for its whole history across the fleet. The feed refreshes every few seconds (▶ Live / ❚❚ Paused), new rows flash; the state chips (everything, banned now, bans, detections, expired, lifted), a server, dates on demand; what only changes the display sits apart — rows, fields, Requests (the log lines behind each sanction under its row). Each sanction is a card, not a table row: the address with its flag, when, its network; then the server, the rule, the state, what was reported. Four numbers on top: servers connected, banned now, sanctions in the last hour, whether every server holds its configuration. The side panel (▤ to hide it) shows the servers — a click narrows the feed to one — and, under the current filters, the top countries, networks, rules and targets, each with its bans (blue) and hits being counted (yellow), figures compacted (688k; the exact number on hover), sorted by bans or by hits (sorted by … ⇅ — hits first is how false positives and noisy rules surface). A click filters on one (a second click clears it); ctrl-click (⌘, shift) adds it — several countries, networks, rules, usernames or targets at once, the chip says the set, and the kinds stack (a country AND a rule AND a network); all … opens the full list, where ticking boxes does the same without a keyboard. ★ pins an entry at the top of its list. Bans by hand sit under the rules as their own line, out of the ranking.

The live pill in the top bar, left of your account name, drives every page's refresh at once. Its body is play/pause — pausing holds the whole Web UI still, resuming reloads immediately. Its ▾ opens the cadence menu: how often live pages ask (1–30 s), and what happens when nobody is looking — with the window not focused (a Web UI on a second screen while you work elsewhere) refresh can stay at full speed, slow down tenfold (the default) or pause; with the tab hidden it pauses by default. Choices apply at once; each page keeps a ↻ Refresh for a manual reload while paused.

The world map on Home paints each country by what it sent under the current filters (hover for the count, click to narrow the feed on it; ✕ hides it, remembered), and moves as the servers decide: each fresh ban or hit fires a ray from its source — the city itself when the city database places it — to the very point of the server it hit, a thin trail with a bright head riding its tip (red a ban, yellow a hit); several from one source follow each other on the same trail, so a stream reads as a stream. Your own servers sit as blue dots at their city (hover names them — the first three and "& n more" — and the city); a full-screen button, and arcs beside the legend turns the rays off. Outlines from Natural Earth (public domain), in the Web UI itself — no tiles, no third party. Your account — click your name in the header: username, email, password (the current one is asked), two-factor, and Sign out. Next to it, the theme button cycles auto → dark → light, kept with your account.

What to show. Two axes, side by side above the feed. Prod / Test: two switches, both on by default — what the enforcing rules did, and what the rules in test would have done, together in one timeline. A test decision is unmistakable: its card finely striped in its colour, a hatched side stripe and a tag that says it — test · would ban 6h, test · would hit — nothing was enforced. Switch one off to see the other alone (one of the two always stays on); with Test alone the map hatches grey. Then the stages — All, Bans, Hits, Expired, Exempted — cumulative chips: light the ones you want, nothing lit is everything; All interleaves the hits being counted with the sanctions. Hits is every hit below a threshold: the ones being counted, and the ones no longer counted within the hour, greyed with why they left (convicted, cleared, expired, lifted). Expired is bans only — expired or lifted. Remembered by the browser. The map, the side panel, the chart (its Would ban and Would hit series, hatched and dashed) and Stats follow the same choice.

Over time draws, per step, the bans and detections that started (bars) and, as lines — the hit lines on one shared scale, the bans in force on their own — the hits the rules scored in the step (every hit, banned or not — a flow the agents send on every sync) and the bans in force. Its boxes are its own; the feed's server, origin and date filters reach it. The step is yours (the small wheel under it — down to one second on the short windows), log switches the scale, and a click on a bar zooms the whole page into that step's dates. The first display is computed; every tick after asks for the tail alone.

Hits are the offenders the servers are counting but have not convicted — how many hits of how many, since when, one gauge per threshold, the nearest to a ban first, the requests behind them on demand — as each server last said (every sync). All carries them too, interleaved with the sanctions by time; an address's dialog shows its hits being counted above its sanctions. Every card offers the same three actions in the same place — Ban (red), Lift (green), Exempt (plain) — greyed when they do not apply. Every ban shows its duration ("6h ban") — the ladder reads at a glance. The chart's bars name their hour and counts on hover; a click narrows the feed to that hour. The report reads "reported · 100% confidence" and links to the address on AbuseIPDB.

The period. One setting for the whole page, at the right of the filters: a wheel of windows — last minute to 30 days, then Everything — turned by finger, wheel or drag, a click on a neighbour steps it; the white ring marks the choice. Custom… opens a dialog with two dates and their times, presets (Today, 7 days, This month) left open-ended — "→ now" keeps growing. The feed, the side panel, the map and the chart all read over that window. Remembered by the browser.

A server's clock. Every sync compares clocks; a machine more than thirty seconds off the controller's carries a clock off by … tag on its card and page, and Home's Servers card says so — check NTP on both; its windows, ban ends and place on the charts are off by that much.

Abuse report — X-ARF. The Abuse report… dialog of a network (or of one of its addresses, Only one address) exports what it did to the fleet as text, CSV, JSON, a bare list — or X-ARF, the machine-readable format the big abuse desks' tooling parses (DigitalOcean answers a plain-text report with a request for an X-ARF attachment). One document per address, in a zip; for one address, that document alone, the file to attach to your mail. Each carries who reports it (Settings → General → Mail: organisation, abuse contact, domain — the console's domain and the From fill the gaps), the category and type the rule's report preset implies, and the log lines that convicted the address, base64-encoded with their SHA-256.

Abuse reports — the networks' desks. Settings → General → Abuse reports holds both destinations: AbuseIPDB, and Network owners — who signs the reports (organisation, abuse contact, domain), whether the networks' abuse desks are mailed about the bans, what a network without a setting of its own gets, the format (words + X-ARF document, or words only), the daily limits, and what was mailed lately. Each network's page has an Abuse desk block: the contact as resolved (Abusix Abuse Contact DB, then RDAP) or set by hand, this network's own mailing setting and format, Mail the latest ban now, whether the desk bounces (a delivery failure read from your abuse mailbox marks it for a month — Read the mailbox under Network owners — when the registry names another address for the block, it takes over and the report goes there), and Answered: what the desk wrote back, sorted by patterns (a ticket with its reference, an acknowledgement, "we acted", "use our form", a request, a person's words), the mails a person has to read in red until Acknowledge. Lists → Networks has the same as a Response column (filters An answer to read, Desk answered, Desk refuses mail, Mailed, no answer), and Settings → Abuse reports counts what waits. Reports, beside Requests, is the whole exchange: every mail sent to a desk with its outcome and its answer — one filter (to read, no answer, answered and with what, bounced, failed, the answers themselves), the home page's period wheel and rows, pages, a search, live on the home page's cadence (the page asks for the difference only, and never redraws while a dialog is open or the search box has the keyboard); a row opens the report as a conversation over the whole screen — the mails oldest first, who wrote to whom on each, the earlier ones folded, the answer box at the bottom — with Details for the address, the ban with its log lines, every ban of that address on record and every other report about it; Acknowledge; an answer replies to the desk's last mail with its ticket kept in the subject. The To read view has Acknowledge all for the day the queue gets out of hand. The answer (Follow up while the desk has not written) shows its To and Subject, both to change, and is written in a small editor (bold, italic, underline, lists, a quote, a link; Text shows the plain text every reader gets — the mail leaves as both, no library behind it); the mail answered is quoted under the words as a mail client does, and the thread folds quoted text behind a Quoted text button; Forward on any mail of the thread sends it whole to another address under your words — a colleague's mailbox to take over from, a third party owed the proof — kept in the thread and tagged so an answer lands there. The Answers view lists the desks' mails themselves, the ones no report claims included; each opens as the exchange with its author — their mails and yours to them, oldest first, the earlier ones folded — with Acknowledge, Forward and an answer box, from there, from the queue under Settings → Abuse reports and from a network's page. What a desk attached — a forwarded mail, a screenshot, a PDF — is listed under its mail and downloads in one click. Your account keeps the signature put under what you send. The menu badge counts the answers a person has to read; owners' consoles have none of this. Under Network owners the operator also chooses the rules whose bans are mailed (the others wait for later), a sentence per rule for the desk, the mail's subject and text themselves with a preview and the list of placeholders with sample values, how often the mailbox is read and after how long the settled mail leaves it. Lists → Networks walks the origins under a window — countries, the networks inside one, the cities when the city database is loaded — each row opening its page with the same actions: ban, exempt, report, mail the desk.

Requests — the public unblock page. A dual-stack visitor is usually banned twice, once per family: with two names of the console answering over one family each, or with two resolver URLs of yours that share the detect_secret and sign what they saw, the page proves both addresses and one click unblocks both; resolvers without the secret only let the visitor ask for the other one. The page can ask the visitor for an e-mail address, optional or required (Settings → General → Unblock page → Visitor's e-mail address): it is kept with every request, shown under Requests and put in the notification — to know who unblocks themselves and reach them; required, nothing is lifted or asked without one. Under Settings → General → Unblock page (off by default) the controller serves /unblock — no account: a person blocked by one of your machines opens it, sees whether their own address is banned and lifts it in one click, logged. Repeated self-unblocks offer a whitelist request; anyone may check whether an address is banned and, when you leave the switch on, ask you to unblock an address that is not theirs (someone whose customer or colleague is blocked has no other way to say so; nothing is ever lifted without you) — those wait under Requests (its own menu entry, the pending count as a badge, a notice when one arrives), where you Lift (let it in now, the rules keep watching), Exempt (never sanction it again) or Deny. A whitelist request — the visitor's own address, proven by coming from it — can instead be granted on the spot: Whitelist requests under the same settings, as a lift or as an exemption; it then shows under Requests as approved by auto and you are told by e-mail. A request for another address always waits for you. The page is yours to brand — title, footer text and link, contact line — in the visitor's language (English or French) or the one you fix; the captcha is off, built-in (an arithmetic question, no third party) or Cloudflare Turnstile; two extra names of the Web UI answering over one address family each let a dual-stack visitor unblock both their addresses.

An accepted request e-mails you, so a page embedding yours could make every visitor send one: at most thirty notifications an hour leave the controller, whatever happens. It is the mail that is dropped, never the request — it waits under Requests either way. A captcha stops the flood at the door instead, if you would rather.

The page can also be served on a name of its own, so the Web UI may be closed to the world while the page stays open: see listen.public in Configuration.

Reputation. With an AbuseIPDB key in the controller's secrets.yaml, an address's dialog shows what the provider knows — confidence of abuse, reports, last report, ISP — held from an earlier check or one click away (each check spends one of the account's daily checks; the count left is shown). Every server's card carries the provider's word on the server's own address, checked daily: a listed server is worth knowing — and so is every other address the server carries: the machines say theirs on each sync, the card shows the worst of them, the server's page lists every address with its score (Check now asks the provider at once), and a score above Alert above N % (Settings → General → AbuseIPDB, 0 by default: any report at all) is mailed to the accounts ticked under Notifications, once and again when it rises. Every ticket links to the address on AbuseIPDB.

Banning by hand. Ban on a hit, Ban… in an address's dialog, or type any address in the search box and press Ban… — on record here or not. Given from a detection, the dialog arrives set as the rule would have done — its policy's duration, its report preset, the server that saw it — and the report carries the detection's own facts; everything stays changeable. Otherwise the defaults are the considered ones: thirty days, reported. A choice of where (one server, or the fleet — machines enrolled later get it too), how long, a reason (kept as the ban's evidence, never sent out), and the report preset. Each server applies it at its next sync, within seconds, through the same checks as any sanction — an exempted address stays exempt. The standing bans by hand are listed under Lists → Banned by hand, one row per address. A range is never banned this way: the dialog turns it into a list — the firewall's job, a set on the machines, no sanction.

Narrowing. Every narrowing beyond the state chips — a server, one or several countries or networks, a username, a target, a search — shows as a chip with its ✕ next to them, whatever set it (the side panel, a flag, a network name, the map); clear all when several. A list a filter was chosen from keeps showing the others (with their true counts), so a second and a third can join the selection. Heavy views — panel counts, map, chart — refresh at once on a filter change, then on a cadence the window can afford (seconds on a live hour, slower on a week); they dim only while the question changes, never on a routine tick.

Settings: five tabs, each a page of panels. General is what a fresh install sets up, in the order it is done: your own address (exempt it in one click), the geo databases (their editions, the refresh, the city switch), mail (the SMTP relay, this console's address, a test), notifications (your e-mail, who is told what), AbuseIPDB (the key first — without one nothing is reported, whatever the switch says — the daily limit, the day's two counts: what this controller sent, and what the provider says is left on the whole account), the unblock page (its switches, and a listener of its own — listen.public, bound on save, no restart), the exemptions (the published allow lists that are on, the addresses by hand), and the servers (a new machine starts in test). Fleet: what a machine does by default, and how far an IPv6 ban follows an offender. Access: the users — one flat list, an Edit… dialog each (e-mail, password, two-factor, a client's servers and permissions) — the session length, and the API tokens (the revoked and the expired hidden until asked for, and deletable for good from there). Maintenance: the store's size and counts, retention, flush and compact; the configuration files (validate, reload); the controller's vitals (what it handles a second and what one costs); the activity trail (who did what — a page at a time, narrowed by action, actor, text and period, sorted by any column). About: versions, latest releases, credits. The old tab names still land where they meant to (/settings#geo, #tokens, #activity…).

Your account (click your name): password, e-mail, two-factor — and the display preferences: time zone, theme, ban colour, the home feed's cadence and rows, the side panel. They are kept with the account and follow you across browsers; the topbar button (next to your name) cycles the theme auto → dark → light too. Signed in with an API token, the same preferences are this browser's only.

An address opens as a dialog wherever it appears — the feed, a server's bans, the fleet's bans, the lookup. Banned where, its reverse name, the provider's reputation on demand, its hits being counted, every sanction on record with the lines that convicted it, and Its network — the address, its prefix and the whole network side by side, each with what it did and its own ban. The actions: Ban… (set as the rule would have done when opened from a detection), Lift (the address is let back in now; the reason is optional) and Exempt (the red one — never sanctioned again, on any server, by any rule, while the exemption lasts; permanent or for a while, with a note; it can lift the bans in force at the same time). Lift and Exempt can also withdraw the AbuseIPDB report when something was reported.

Servers. Every enrolled machine with a pulse that says who is connected: agent version, when last seen, from which address and where the geo databases place it (its city with the city database), whether it holds the configuration it should, its level, state, how it takes part in the fleet, active bans. A server has five tabs:

Overview — active bans, state and level, its part in the fleet, the agent's uptime and counters, its address and place, its latest bans, what differs from the fleet's defaults; Ask for its full history again makes the machine send everything it holds, requests included (a machine enrolled again does so on its own).
Bans — the same feed, for this server only.
Rules — its level and its packs (each on or test, at the server's level or its own), then every rule it runs with the threshold it crosses on there and why. Override… opens a dialog (a level of the rule, thresholds of your own, state, policy — each field inherits unless set); Reset returns to the default.
Logs — where its logs are, of which kind, on which ports (see below).
Settings — level, state, whether it shares its bans with the fleet and enforces the fleet's, who may lift its bans, who reports its sanctions, a description. Saving writes agents/<hostname>.yaml, reloads and pushes; a refused edit is reverted and says why.

Rules. The rule language, editable in place — every edit is a file written on the controller, reloaded whole and pushed to the servers that run it, or refused with the loader's message and reverted. Five tabs:

Rules — the library, filed by category. New rule… and Edit… open the rule in its five blocks: what it recognises (parsers from the library — type to search — or a regex written here, with Try it on lines…), from how much (one threshold, or adaptive: several), what it does (a ban policy, and/or notify), what it says (a report preset), and More (state, count per address or network, share, distinct). Preview changes shows the file's diff before Save and push; Edit as file opens the YAML itself, checked by the real loader.
Packs — one row per pack; Servers… is a searchable list of the fleet: tick the servers that run it, apply. Edit… names the rules a pack lists. A rule has the same Servers… (on its row, in its dialog, in its editor): a server that runs it through a pack is ticked and greyed — take the pack back instead — one that runs it on its own can be unticked, and one ticked here is added in test unless Prod is chosen.
Parsers — the library by source, with a tester (paste lines, see what matches and what is captured); regexes written inside rules are listed with their rule.
Ban policies — how long, on which ports, how long the machine remembers, tighten on repeat, longer on reputation.
Reports — what a ban says to AbuseIPDB and when; the built-in default is editable (writes reports/default.yaml).

A server's Rules tab: its level; its packs, each on or test, at the server's level or its own; rules added on their own, each with Remove; then everything it runs with the threshold it crosses on there and why, and Override… per rule. Its Logs tab: where its logs are, of which kind, on which ports — with layouts (Plesk, Debian nginx, Apache, sshd, mail) to start from — pushed to the agent when set.

Stats. Every row, not a top: countries, networks, rules, servers, usernames tried and targets over the window of your choosing (the wheel, or free dates), bans and — beside them — the hits being counted, prod or test. Counted from the sanctions themselves, so any range is exact; the fleet's copies and the lists' blocks are left out, and bans by hand sit in the header as their own count. Each table filters as you type, all … unfolds it whole, and CSV exports what is shown. A click opens the country, the network, the rule or the server.

Cities. Settings → General → Geo data, the city edition’s also fetch it: with the DB-IP source, the city and region appear under every address — sanctions and hits alike — the search box finds them, the map's rays leave from the city itself and your servers sit at theirs; the cost is written beside the box. The sanctions keep the origin they had when they were decided; the live views resolve with the databases of the moment.

Sessions. A person's session lasts console_session (12 hours unless set — Settings → Access, Sessions end after…) after their last activity: every request pushes it out, so nobody at work is signed out; 30 days after sign-in at the very most. When the controller is updated under an open Web UI, a notice appears bottom right with a Reload button; the page keeps working meanwhile.

Exemptions live under Lists → Exempted (below).

Lists. Two tabs. Blocked: your lists that ban preventively — a network (AS), a country, prefixes written down — where they block (the fleet or chosen servers) and how many prefixes they resolve to — pushed to the machines as one firewall set each, loaded in seconds whatever the size, the machine's own exemptions carved out first; the feed leaves the list-driven blocks out. The table sorts by any column (date added first, to the minute). Exempted, three sections: Exemptions — one table of everything exempted by hand, whatever file holds it (the fleet's exemptions-cli.yaml, a server's own declaration, a one-entry list under lists/), sortable, with where each applies, until when, its note, the file it is written in, Change… for a list and Remove for all; Published allow lists (search engines, CDNs, monitoring probes, payment webhooks — on/off, where, refresh, your own); Files — the hand-kept exemptions.yaml and exemptions.d/*.yaml, one folded section each with its entries, Edit file… (checked by the loader before it is written) and New file…. One filter box reaches the table and the folded files alike and unfolds the ones that match. The offer to exempt the address you are reading from appears only while that address is not exempt — and covers both families when the controller can learn the other one: with the per-family names of the console or the detection endpoints set under Settings → General → Unblock page, the console asks each once a session, and Exempt your addresses (this bar, the warning under the header, Settings → General → Your address) lists both, a box each, the IPv6 one widened to its /64 or its /56 at will — a residential line moves inside its allocation, so the one address of today exempts nothing tomorrow. The same three buttons head both tabs: Check addresses…, Add a published list (URL)…, and the tab's own action — Block… or Exempt…. Block… opens the list dialog: type a network's name or AS number, or a country's name or code, and pick from what matches — the dialog resolves it (prefixes, addresses) before anything is written; a list may block on some servers and exempt on others. Exempt… asks what — an address or a range, a network, a country (the same pickers) — then where, for how long, and whether to lift the bans in force. A scope is the fleet, a group of servers (the groups below it included — a machine moved into the group follows, one moved out is let go), the servers running a pack (the web pack's hosts, never the DNS servers — the ones given the pack later too), or named servers — the picker shows the box of the chosen kind only, each with its own filter and scroll, so the whole fleet lists nothing; the published allow lists have the same choice in their Where column, and so does Exempt…: the fleet writes exemptions-cli.yaml, one server its own declaration, a group, a pack's servers or several servers a one-entry list (lists/exempt-<what>.yaml, permanent like every list — a network or a country there is resolved by the controller, as a block would be). At the top of the Blocked tab, Published blocklists: the blocklists that ship (Romain Marcoux's aggregate of fifteen sources, 40 000 addresses, or the whole 550 000; AWS Ireland unsolicited scanners, the AS16509 prefixes from which unsolicited security scans reach servers running Shieldlist, rebuilt daily at https://lists.shieldlist.eu/ from what those servers convicted), one click to turn on — where — and off; Add a published list (URL)… makes one of your own (URL, format, cadence, Fetch & check before anything is written); on the Exempted tab the same button adds an allow list of your own, fetched with the published ones. A network's own dialog (from the rail or a ticket) shows the whole network at the top — IPv4 addresses, IPv6 /64 networks, how much of it is banned now — Ban this network…, Exempt this network…, Abuse report… — everything the network did over a window (the last 24 or 48 hours, 7 or 30 days, one day, or between two moments) with the log lines that convicted each address, as text (one block per address, for an abuse desk), CSV (one row per log line) or JSON, times in UTC — and its activity, prefix by prefix: two readings of the same table, Bans (the addresses the rules convicted over a window of your choosing, share in addresses) and Hits (the addresses being counted right now and not banned — where slow probing spread across a big network shows), each prefix with Ban this prefix… — so you ban one prefix when one prefix carries it, and the network only when the network does. An address's dialog answers the same in three rows — the address, its prefix, the whole network — with the ban of each. Below the lists, Banned by hand: the standing manual bans, one row per address ("the fleet" or the servers named), sortable, each row opening the address with its evidence. The geo databases behind all this live under Settings → General → Geo data; a list naming a network or a country follows them (re-resolved after every update and every ten minutes — prefixes that left are lifted, prefixes that joined are blocked). The ⓘ marks explain in place; the pages stay quiet. Views: the whole filter of the Home feed — what to show, the server, the country, one or several networks, the search, the period — saved under a name with your account (Views ▾ → Save the current filters as a view…), listed first in the panel and applied in one click: the French addresses of the four big ISPs, say, to review false positives. The panel's ★ pins a country, a network, a target or a rule at the top of its list (this browser). The search box on Home also finds sanctions by target — the site or domain the convicting lines named.