First things you do on a new server?

Comments

• GenerallyClueless Member

  December 2025

  1. disable root login, setup pubkey auth, then disable password auth
  2. update and hardening thru ansible
     1. https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/dnf_module.html#ansible-collections-ansible-builtin-dnf-module
     2. https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/apt_module.html#ansible-collections-ansible-builtin-apt-module
     3. https://galaxy.ansible.com/ui/repo/published/devsec/hardening/content/role/os_hardening/
     4. https://galaxy.ansible.com/ui/repo/published/devsec/hardening/content/role/ssh_hardening/
  3. yabs

  Thanked by 2plumberg tentor
• ralf Member

  December 2025

  I have a setup script that I use everywhere, so it's just wget -O- https://secret.url/setup.sh | WG=11 sh for me. That sets up all my base stuff that I have on every server - locks down iptables so SSH is only from trusted IPs, sets up SSH, does apt upgrade and installs common packages, sets up wireguard (the WG parameter is the subnet) and finally sets up borg backup and zabbix.

  I then have a couple of specialisations - a virsh setup script for dedis or reasonably large VPS, and that sets up a bunch of different subnets for different protection zones, firewall rules for those zones between different wireguard hosts, and adds some more iptables rules to forward HTTP(S), DNS, internal webapp ports etc to a particular IPs on the various zone subnets. Then when I run my one line script to create each VM I want on that machine, the rules are already in place.

  For the VMs themselves, there are similar setup scripts for haproxy (also designed to work on a bare VPS too), web app setup, etc...

  I've still got a few manual tasks for each new host, like adding it to DNS, adding the borg rules to SSH auth on the various targets, manually adding to zabbix server, copying the generated wireguard block to existing host configs, adding any new haproxy VM to my certbot copying script and editing the haproxy to point to the closest web server / web apps in the default pool. But generally it only takes about 30 minutes when I get a new machine to having it functional. I would have automated more or that, but I've slowed right down in acquiring new hosts now, so might as well leave it as is.

  For me the best reason for doing it this way is that everything ends up repeatably the same and e.g. all my haproxies and webapps have the same final octets in IP (apart from the first 2 machines that are still on older manual configs), and so the wireguard IPs all differ only by the subnet ID. Also, automating the firewall rules means that I know e.g. that the web app VMs can only talk to each other and via the single opened port for haproxy.

  Over time I've added guards to the scripts, so they don't recreate configuration files that already exist (so e.g. keys and wireguard configs don't get trashed). But that also means I can ensure specific things are fully up to date by just re-running the setup script again, even on a live server. If I'm iterating on something, e.g. when I was adding zabbix to the setup, I can just restore the system zabbix file from the backup made by my script and it'll redo that entire step.

  At some point I should learn how to use ansible for some of these tasks, but I've always felt more comfortable rolling my own scripts.
• corbpie Member

  December 2025

  YABSdb

  curl -sL yabs.sh | bash -s -- -s "https://yabsdb.com/add"
• SoftShellWeb Member, Patron Provider

  December 2025

  Check if port 25 is open

  Thanked by 1jnd
• JasonM Member

  December 2025

  @barbaros said: change ssh password to test

  
• newbieshan Member

  December 2025

  Open BBR and run YABS
• 384_cz Member

  December 2025

  Check IPHM & port 25
• azhai Member

  December 2025

  yabs
• rotkari Member

  December 2025

  @CloudHopper said:
  I run an Ansible playbook that performs the following steps:

  - name: Create xxxx user
  - name: Create xxxx  SSH directory
  - name: Copy authorized_keys file with owner and permissions
  - name: Install a list of packages
  - name: Install Auditd Rules
  - name: restart auditd service and issue daemon-reload to pick up config changes
  - name: Upgrade the OS (apt-get dist-upgrade)
  - name: Copy Fail2Ban config file with owner and permissions
  - name: Copy sshd_config fille with owner and permissions
  - name: Restart SSH service and issue daemon-reload to pick up config changes
  - name: Restart Fail2Ban service and issue daemon-reload to pick up config changes
  - name: Enable Fail2Ban service and ensure it is not masked
  - name: Allow access to port XXXX for SSH
  - name: UFW - Enable and deny by default
  - name: Install Crowdsec
  - name: Install Wazuh
  - name: Install Zabbix Agent2
  - name: Copy Zabbix Agent2 config file  with owner and permissions
  - name: Restart Zabbix Agent2 and issue daemon-reload to pick up config changes
  - name: Install Tailscale
  - name: Allow access to port 10050 on Tailscale0 for Zabbix
  

  Can u share ?
  Kind regards ,
  Alex
• MagdAlmuntaser Member

  December 2025

  Setting up a new server takes me a couple of days to ensure high performance and strong security. Because my servers host news websites, they are frequent targets, so I rely on my own security setup and Cloudflare rather than the hosting provider.
  I hide the real IP using an IPv6/NAT-like setup and keep the server minimal to reduce risks and resource usage. I host only a few sites on high-spec dedicated servers, not VPSs. In 16 years, my sites have never been hacked.
  I hosted with Contabo for 9 years, then another provider for 4 years, and later BinaryRacks, where my server ran for 624 days with 100% uptime. This month, I moved to Hetzner for AMD servers.
  PS: I don’t use YAPS; I’m launching my own platform soon, which will replace it and other control panels.