# System and security

Your VPS Ultra is a whole virtual machine: you administer its system and its kernel, you install the software of your choice and you decide the schedule of its updates. Simafri operates the platform that carries it: the hardware, the network, anti-DDoS protection, backups and monitoring.

## Your system

Your server is delivered with the system chosen when ordering: the Linux distribution of your choice, or Windows Server. To find out the installed version on Linux:

```
cat /etc/os-release

uname -r     # your kernel version
```

## Your kernel

The kernel of your VPS Ultra belongs to it alone: you load the modules your project needs (WireGuard, file systems, network tools), you tune its parameters with `sysctl`, and you choose its version with your distribution's packages.

```
modprobe wireguard

sysctl -w net.ipv4.ip_forward=1

echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-routing.conf   # keep the setting after a reboot
```

After a kernel update, reboot your server at a time that suits you (`reboot`) for it to take effect.

## Updates

On Ubuntu or Debian:

```
apt update && apt upgrade
```

To have security fixes install themselves every day, enable **unattended-upgrades**:

```
apt install unattended-upgrades

dpkg-reconfigure -plow unattended-upgrades
```

On Rocky Linux or AlmaLinux, `dnf upgrade`, and `dnf-automatic` for automatic fixes. On Windows Server, **Windows Update**.

Our monitoring flags the security updates that deserve your attention; you decide whether to apply them and when. Before a major update, request a **snapshot** from support: it lets you roll back in a few minutes (see [Backups and snapshots](/en/vps-ultra/sauvegardes.md)).

## Good practice

* **One SSH key per person**, and password access closed (`PasswordAuthentication no` in `/etc/ssh/sshd_config`).
* **A firewall** that opens only your public services (see [Network and sending email](/en/vps-ultra/reseau-et-e-mails.md)).
* **fail2ban**, which shuts out addresses that make repeated connection attempts: `apt install fail2ban`.
* **One user per application**, without administrative rights, to run each service.
* **Your secrets outside the code**: passwords and API keys in a file readable only by the application (`chmod 600`).

## The time zone

Your Linux server is set to Coordinated Universal Time (UTC), the convention for servers. To display it in your time zone:

```
timedatectl set-timezone Europe/London
```

## Monitoring your server

| Command              | What it shows                                     |
| -------------------- | ------------------------------------------------- |
| `htop`               | the processes, the processor and the memory, live |
| `free -h`            | used and available memory                         |
| `df -h`              | used and available disk space                     |
| `ncdu /`             | what takes up your disk, folder by folder         |
| `systemctl --failed` | the services stopped on an error                  |

Our monitoring continuously tracks your server's availability, its load and its disk space, and alerts you when one of these indicators calls for it.

## What Simafri does

| Simafri operates                                     | You administer                                         |
| ---------------------------------------------------- | ------------------------------------------------------ |
| the hardware and its mirrored disks                  | the system, its kernel, its software and their updates |
| the network, your addresses and anti-DDoS protection | your firewall and your services                        |
| the nightly backup                                   | your data and your database exports                    |
| continuous monitoring                                | your applications and their configuration              |

And between the two, **Full-Stack Assistance**: for a question about the system, the database or your code, we diagnose it and tell you what to do (see [Full-Stack Assistance and hands-on intervention](/en/vps-ultra/assistance.md)).