Who secures what
On an unmanaged server the security boundary runs straight through the middle of the machine. Knowing exactly where saves an argument at the worst possible time.
Ours
- Physical access. The racks are in carrier-grade facilities with access control and surveillance. Nobody touches your machine without a reason and a record.
- The network. Our routing, our carriers, and filtering of large attacks at backbone level — see DDoS filtering.
- Separation between customers. Switch ports are configured so that traffic claiming to be someone else's address does not pass.
- The management network. BMCs are not reachable from the internet; you reach the console through the portal. See IPMI and the BMC.
- The hardware itself, including firmware we ship and the replacement of anything that fails.
Yours
- The operating system and every package on it — automatic security updates.
- Accounts and keys. SSH configuration, who has root, what is in
authorized_keys— see users and sudo. - The firewall on the machine, in both address families — firewalling your server.
- Your application, its dependencies and its data.
- Backups. Nothing is backed up unless you arranged it — backups.
- What leaves the machine. If it starts attacking others, that is yours to stop — a compromised server.
The grey areas, settled
- A vulnerability in software we installed at delivery
- The image is a starting point; the moment you take delivery, patching is yours. We will tell you if we become aware of something serious.
- An attack that fills your port
- Ours to absorb. An attack that overwhelms your application while the port is fine is yours — see what you can do about DDoS.
- A compromised customer of yours
- Yours. If you resell or host for others, you are the one who must be able to act — starting as a reseller.
- Your BMC, on colocated hardware
- Yours, and it is the most commonly neglected thing in a rack. Change the default credentials before the machine ships.
What we do when we see something
We are not monitoring the contents of your server and we have no general obligation to. But if we see traffic that is damaging others, or receive a credible report, you get told — and for something active we may act first and tell you immediately afterwards. That is in the AUP in plain English.
If you would rather not own that half
Then an unmanaged dedicated server is the wrong product, and we would rather say so than sell it to you. See what unmanaged means and what we do not offer.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base