System and security
Your VPS Ultra is a whole virtual machine: you administer its system and its kernel, you install the software of your choice and you decide the schedule of its updates. Simafri operates the platform that carries it: the hardware, the network, anti-DDoS protection, backups and monitoring.
Your system
Your server is delivered with the system chosen when ordering: the Linux distribution of your choice, or Windows Server. To find out the installed version on Linux:
cat /etc/os-release
uname -r # your kernel version
Your kernel
The kernel of your VPS Ultra belongs to it alone: you load the modules your project needs (WireGuard, file systems, network tools), you tune its parameters with sysctl, and you choose its version with your distribution's packages.
modprobe wireguard
sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-routing.conf # keep the setting after a reboot
After a kernel update, reboot your server at a time that suits you (reboot) for it to take effect.
Updates
On Ubuntu or Debian:
apt update && apt upgrade
To have security fixes install themselves every day, enable unattended-upgrades:
apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
On Rocky Linux or AlmaLinux, dnf upgrade, and dnf-automatic for automatic fixes. On Windows Server, Windows Update.
Our monitoring flags the security updates that deserve your attention; you decide whether to apply them and when. Before a major update, request a snapshot from support: it lets you roll back in a few minutes (see Backups and snapshots).
Good practice
- One SSH key per person, and password access closed (
PasswordAuthentication noin/etc/ssh/sshd_config). - A firewall that opens only your public services (see Network and sending email).
- fail2ban, which shuts out addresses that make repeated connection attempts:
apt install fail2ban. - One user per application, without administrative rights, to run each service.
- Your secrets outside the code: passwords and API keys in a file readable only by the application (
chmod 600).
The time zone
Your Linux server is set to Coordinated Universal Time (UTC), the convention for servers. To display it in your time zone:
timedatectl set-timezone Europe/London
Monitoring your server
| Command | What it shows |
|---|---|
htop | the processes, the processor and the memory, live |
free -h | used and available memory |
df -h | used and available disk space |
ncdu / | what takes up your disk, folder by folder |
systemctl --failed | the services stopped on an error |
Our monitoring continuously tracks your server's availability, its load and its disk space, and alerts you when one of these indicators calls for it.
What Simafri does
| Simafri operates | You administer |
|---|---|
| the hardware and its mirrored disks | the system, its kernel, its software and their updates |
| the network, your addresses and anti-DDoS protection | your firewall and your services |
| the nightly backup | your data and your database exports |
| continuous monitoring | your applications and their configuration |
And between the two, Full-Stack Assistance: for a question about the system, the database or your code, we diagnose it and tell you what to do (see Full-Stack Assistance and hands-on intervention).