Running a small VPS without regrets

2026-10-12

Every few months I set up another small server for something. The setup is always the same, and I always forget one step, so this is the checklist I actually use.

1. Stop trusting the default firewall

Most images ship with ufw inactive and an iptables chain that allows everything. Turn it on before you install anything else, or you will spend an hour wondering why your database is on the public internet.

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw enable

Do this over a console session the first time, not SSH. I have locked myself out exactly once, and once was enough.

2. Key-only SSH, and turn off the noisy part

Password authentication is a brute-force target and it never stops. Keys plus a disabled root login removes the entire category.

PasswordAuthentication no
PermitRootLogin no
KbdInteractiveAuthentication no

Add fail2ban anyway. It will not stop a determined attacker, but it keeps the logs readable.

3. Unattended upgrades, carefully

Security patches should not depend on me remembering. Full upgrades should. The distinction matters on a box you cannot reboot casually:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

4. Prove the backup restores

The single most valuable thing on any server is a restore you have tested. Not a backup — a restore. I keep a script that pulls the latest snapshot into a temporary directory, opens the database, and counts rows. It runs weekly. It has caught two silently broken backup jobs.

What I stopped doing

I no longer install a control panel on small boxes. Every panel is another listening service, another login page, another thing to patch. For a handful of services, systemd units and a reverse proxy are less work overall — and far easier to reason about at 2am.