All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Before You Deploy Anything: My 7 Step VPS Setup Checklist
iamstrangemind
Member
Whenever I spin up a fresh VPS, I try to avoid installing my application immediately. Spending a few extra minutes on the basics usually saves hours of troubleshooting later.
Here's the checklist I follow:
- Update the system
Always install the latest security patches before doing anything else.
- Create a non root user
I use a regular user with sudo privileges instead of working as root all the time.
- Set up SSH keys
SSH key authentication is much safer than relying only on passwords.
**Configure a firewall
**
Only open the ports that are actually needed (for example SSH, HTTP and HTTPS).Install Fail2Ban
It automatically blocks repeated login attempts and helps reduce brute-force attacks.
- Enable automatic security updates
Small security updates are easy to forget, so I prefer letting the server handle them automatically.
- Set up backups and basic monitoring****
A backup you don't have isn't a backup. I also like to monitor CPU, RAM and disk usage from day one.
I'm still learning, so I'm curious:
What is the one thing that's always on your VPS checklist that you think beginners often forget?
Comments
Step 1:
Remove whatever horror template you got and install your own image(by any means necessary )with encryption.
Step 2: boot into it
Step 3: do whatever you want I guess.
That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?
Step 0: Verify the VPS isn't oversold or misconfigured. If it is, request a replacement or refund before setting anything up.
Probably all three.
Mainly because I don't trust the image. I'm currently a bit occupied and on mobile to find the link but there was just recently a mention of a dedicated server image with pre-embedded authorized key from the provider for quick and easy access to your server.... Screw that 😂
And that nobody just mounts the disk and reads my data
That's actually a fair point. I'd completely forgotten about providers accidentally shipping images with leftover SSH keys. Encrypting the disk also adds another layer if someone ever gets physical or offline access to the storage. Thanks for bringing that up. 👍
Completely redundant when you setup SSH keys and remap it on a non-standard high port.
https://lowendtalk.com/discussion/218895/interserver-adding-their-own-ssh-key-to-unmanaged-dedicated-servers
There it is.
Also i love setting up tarpits on 22. Theyre on everything i have. There are some instances of insane amounts of time ive wasted for them.
Fair point. If SSH is key only, the benefit is definitely much smaller. I still install Fail2Ban because I sometimes expose other services (or temporarily enable password auth during testing), so it's a bit of extra defense for very little overhead.
I will check it out, Thanks 🙏
Doesn't fail2ban require configuration, it isn't enabled for ssh by default?
Finally, shut down the machine.
I have got a script that downloads latest debian image and asks the user to input things like ssh port, username, password, ssh pubkey, network info, LUKS password. Then you reboot and it installs debian via netboot with preseed file and install extra packages I want. It also installs clevis to unlock LUKS via tang and set up network for initramfs. You can also add whatever you want to this this script.
Yea I've also started using clevis+tang recently. It's pretty neat.
Too many steps, got my weiner stuck in the microwave now the whole place stinks.
My steps:
1) IP r a black 0.0.0.0/0
2) wipefs -fa /dev/sd*