Kingsfordweg 151, 1043GR Amsterdam, The Netherlands ● 24/7 support — support@novogara.com
Novogara BV
Knowledge base

Your first week

The first hour gets the machine running. This is the list for the rest of the week, in the order that costs least to do.

Day one: the machine

  1. An account of your own with sudo, SSH keys, and root password login disabled — verified from a second terminal before you close the first. See users and sudo.
  2. The firewall, default deny inbound, only what you need open, in both IPv4 and IPv6 — see firewalling and running IPv6-only for why both.
  3. Automatic security updates — automatic security updates.
  4. Check the clock, and set the timezone to UTC — keeping the clock right.

Day two: prove the hardware

  1. Benchmark it while it is empty and write the numbers down. When somebody says it got slower in six months, that record settles it — benchmarking a new server.
  2. Check SMART and the array, so you know it started healthy — disk health.
  3. Try the console. Open remote KVM once, on a working machine, so you know it works before you need it.

Day three: make it recoverable

  1. Backups, to somewhere else, with alerting when a run fails or comes back too small — backups.
  2. Restore one. An untested backup is a hope — testing a restore.
  3. Monitoring: disk space, memory, load, certificate expiry, and whether the service actually answers — monitoring your server.

Day four: the account side

  1. Set up authorised contacts so a colleague can act when you are away — who may act on your account. And make sure our notifications go to a mailbox someone reads.
  2. Set reverse DNS on your addresses, especially if the machine will ever send mail — reverse DNS.

Before you put real traffic on it

  • Services bound to the right interfaces, nothing listening on a public address that should not be — ss -ltnp
  • Certificates working, and the renewal tested with certbot renew --dry-run
  • If it sends mail, SPF, DKIM, DMARC and PTR all in place — sending mail from your server
  • Write down what you configured, or better, put it in configuration management so the next machine takes ten minutes

And then

Put a recurring reminder in the calendar: test a restore quarterly, review authorised contacts twice a year, check for pending reboots monthly. None of it takes long, and all of it is the difference between a machine you run and a machine that runs you.

Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base