Skip to content

Deployment

File Browser allows you to enable user self-registration (signup). This can be enabled via Settings → Global Settings, or with filebrowser config set --signup. Self-registered users inherit the configured user defaults, including the scope.

[!WARNING]

By default, the user scope is the server’s root, so a self-registered user could read, modify, and delete every file File Browser serves. To prevent this, either:

a. Enable createUserDir so each user gets their own directory; or b. If users are meant to share files, set the default scope to something other than the root.

Brute Force Protection & Fail2ban¶

File Browser Next includes native brute-force rate limiting out of the box: POST /api/login and protected public share requests automatically block clients after 10 failed attempts within a 5-minute window (HTTP 429 Too Many Requests), with reverse-proxy-aware client IP detection (Cloudflare, Caddy, Nginx).

If you additionally require kernel-level IP dropping via iptables before requests reach the application, you can optionally configure Fail2ban to monitor File Browser Next’s access logs.

Filter Configuration¶

An example filter configuration targeted at matching File Browser’s logs.

[INCLUDES]
before = common.conf

[Definition]
datepattern = `^%%Y\/%%m\/%%d %%H:%%M:%%S`
failregex   = `\/api\/login: 403 <HOST> *`

Jail Configuration¶

An example jail configuration. You should fill it with the path of the logs of File Browser, as well as the port where it is running at.

[filebrowser]

enabled = true
port = [your_port]
filter = filebrowser
logpath = [your_log_path]
maxretry = 10
bantime = 10m
findtime = 10m
banaction = iptables-allports
banaction_allports = iptables-allports