mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-19 21:52:23 +03:00
9b91f0f42e
Fold the standalone 3x-ui-docs project (Next.js 16 + Fumadocs, deployed to docs.sanaei.dev) into docs/ so the panel and its documentation share a single source of truth, the way sing-box keeps its docs in-tree. The old repo becomes redundant and can be retired. - Import the full site under docs/ (app, components, content, lib, public, scripts, config). The self-contained pnpm project sits alongside the existing engineering notes with no filename collisions. - Re-point "Edit on GitHub" links from MHSanaei/3x-ui-docs to this repo's docs/content/docs path (docs/lib/shared.ts, docs/app/.../page.tsx). - Add docs-ci.yml and docs-deploy.yml under .github/workflows/, scoped to docs/** and run with working-directory: docs, since GitHub only runs workflows from the repo-root .github/. deploy-static.yml's GitHub Pages publish (CNAME docs.sanaei.dev) carries over unchanged. Follow-up (outside this commit): attach the docs.sanaei.dev custom domain to this repository's Pages (or set the Vercel project's root directory to docs), confirm the site is live from the monorepo, then delete MHSanaei/3x-ui-docs.
125 lines
3.6 KiB
Plaintext
125 lines
3.6 KiB
Plaintext
---
|
|
title: First Login
|
|
description: Find your generated 3x-ui credentials, reach the panel, enable two-factor auth, and harden it before exposing anything.
|
|
icon: KeyRound
|
|
---
|
|
|
|
After installation, your first job is to log in and **secure the panel** before
|
|
exposing anything else.
|
|
|
|
## Reach the panel
|
|
|
|
The panel is served at:
|
|
|
|
```text
|
|
http://<your-server-ip>:<port>/<web-base-path>
|
|
```
|
|
|
|
The default port is **2053** and the default base path is `/` — but a script
|
|
install **randomly generates** the username, password, **port**, and web base
|
|
path, so check your actual values.
|
|
|
|
### Find your credentials
|
|
|
|
A script install prints a credential summary when it finishes and also writes it
|
|
to a root-only file:
|
|
|
|
```bash title="/etc/x-ui/install-result.env (mode 600)"
|
|
XUI_USERNAME=...
|
|
XUI_PASSWORD=...
|
|
XUI_PANEL_PORT=...
|
|
XUI_WEB_BASE_PATH=...
|
|
XUI_ACCESS_URL=...
|
|
XUI_API_TOKEN=...
|
|
XUI_DB_TYPE=sqlite
|
|
```
|
|
|
|
If you missed them, use the management tools:
|
|
|
|
```bash
|
|
x-ui # menu → 11 (View Current Settings)
|
|
x-ui settings # or the one-shot form
|
|
```
|
|
|
|
For **Docker**, read the generated credentials from the container logs, or run
|
|
`docker exec -it <container> x-ui setting -show`.
|
|
|
|
<Callout type="warn">
|
|
If your panel still uses the default `admin` / `admin` (the panel warns when it
|
|
does), change it immediately — before creating any inbounds.
|
|
</Callout>
|
|
|
|
## Change credentials, port, and path
|
|
|
|
A non-default port and a long, random **web base path** make the panel much
|
|
harder to find. Change them from **Panel Settings** in the UI, or from the
|
|
`x-ui` menu:
|
|
|
|
- **7 — Reset Username & Password** (optionally disabling 2FA at the same time)
|
|
- **8 — Reset Web Base Path** (randomizes it)
|
|
- **10 — Change Port**
|
|
|
|
Changing your username or password **logs out all existing sessions** and, if
|
|
two-factor auth was on, disables it.
|
|
|
|
## Two-factor authentication (2FA)
|
|
|
|
3x-ui supports TOTP two-factor auth (compatible with Google Authenticator, Aegis,
|
|
etc.). Enable it in **Panel Settings** — once enabled, the login page asks for a
|
|
6-digit code in addition to your password, and turning it on forces everyone to
|
|
log in again. You can disable it from the menu's **Reset Username & Password**
|
|
step or with `x-ui setting -resetTwoFactor`.
|
|
|
|
## Built-in login protection
|
|
|
|
- **Brute-force limiter:** after **5** failed logins from the same IP/username
|
|
within 5 minutes, that combination is blocked for **15 minutes**.
|
|
- **Generic errors:** the login page reports "wrong username or password" for
|
|
both bad credentials and bad 2FA codes, so it leaks nothing.
|
|
- **Sessions** last `sessionMaxAge` minutes (default **360** = 6 hours) and are
|
|
invalidated when you change credentials.
|
|
- **LDAP** can be enabled as an auth fallback in Panel Settings.
|
|
|
|
## Essential hardening checklist
|
|
|
|
<Steps>
|
|
|
|
<Step>
|
|
### Set strong, unique credentials
|
|
|
|
Replace the generated (or `admin/admin`) username and password with strong values.
|
|
</Step>
|
|
|
|
<Step>
|
|
### Use a non-default port and random base path
|
|
|
|
Move the panel off `2053` and serve it under a long random path.
|
|
</Step>
|
|
|
|
<Step>
|
|
### Enable two-factor authentication
|
|
|
|
Turn on 2FA so a leaked password alone can't grant access.
|
|
</Step>
|
|
|
|
<Step>
|
|
### Put the panel behind TLS
|
|
|
|
Use a valid certificate (via the `x-ui` menu's SSL management, or a reverse
|
|
proxy) so the panel is only reachable over HTTPS.
|
|
</Step>
|
|
|
|
<Step>
|
|
### Restrict access with a firewall
|
|
|
|
Open only the ports you actually need, and consider limiting panel access by IP.
|
|
</Step>
|
|
|
|
</Steps>
|
|
|
|
<Callout type="info">
|
|
Want the panel on a clean domain with automatic HTTPS? See
|
|
[Reverse proxy](/docs/operations/reverse-proxy). For deeper hardening, see
|
|
[Security](/docs/operations/security).
|
|
</Callout>
|