Ask HN: VPS management for the absolute beginner

I think off-site (and inaccessible) backups are the first thing you should think when you think about 'security' - after that, it's a relative thing.

the basics (after backups) are

1. disable anything you don't need (firewalls are part of this... at the very least, the default RHEL firewall closes off almost everything. that way, if you have some poorly configured service running that you don't need, it's less of a big deal 'cause it's not accessible from the Internet.

2. use reasonable passwords. My opinion is that if you can remember it, it's not a good password, but I'm pretty paranoid. at the very least avoid dictionary words (including 'leet' dictionary words) include mixed case and punctuation. If you can use keys instead of passwords, that's even better. Personally, I always disable remote root login with a password. use a key if you must remotely login with root, but most of the time logging in as you and using sudo or su is sufficient.

3. stay on the security or announce mailing list for every bit of software you have exposed to the internet, and upgrade when there are holes.

3. is where your distro comes in. if all the software you use is provided by your distro, and you check the security mailing list every day, you are ahead of most people.

With those three basics, well, you aren't 100% covered, but you have a good start.

Know that the moment an advisory is out, the bad guys are using automated tools to scan for vulnerable hosts. Plugging known holes is the minimum standard; otherwise you will be compromised in days if not hours.

the vast majority of malicious activity is completely automated, each compromised system being used to compromise other systems. This means that there is a truly staggering number of attackers, and that you will be attacked even if you have nothing of value to take.

this is why watching the security mailing lists for your software is important; even a weekly upgrade schedule may not be enough.

The rest of the sysadmin jazz, eliminating unused programs and stuff like that are really shortcuts to reducing the number of programs who's security problems are your problems. There are holes we don't know about in everything, so the fewer programs you depend on not having holes, the better off you are.

It's good practice to sit there with 'ps' and google and figure out what every process does and how the system responds when a process is killed (especially important if you are on a linux box with an aggressive overcommit and not enough swap, and thus oom-killer issues.)