<p>This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there. </p>

<p>Their instructions are tilted towards Ubuntu as far as specifics, but should fit for any Linux VPS.</p>

<p>Recording the links here so we don't lose the patterns. I agree with them because they're actually the same as what I came up with personally in arranging VPS security, and they say what's needed clearly and concisely.</p>

<p><a href="https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers" rel="noreferrer">https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers</a></p>

<p>and to complete on automatic security updates, </p>

<p><a href="https://blog.mafr.de/2015/02/26/ubuntu-unattended-upgrades/" rel="noreferrer">https://blog.mafr.de/2015/02/26/ubuntu-unattended-upgrades/</a></p>

<p>IT's quite worth reading the comments also on each of these, particularly the second. I like the so-often Germanic completeness there, if would suggest that auto-reboot is not just for personal servers. </p>

<p>You can control time-of-day via the auto-cron setting, and if you need 100% uptime, this is very likely better managed (and likely only actually possible for many scenarios) by providing more than one load-balanced server, updating them in a sequence, which again the cron portion could be one way of handling.</p>

CC BY-SA 3.0
2016-11-16T11:41:22.460Z
While both of those links are very interesting, they deal specifically with setting up security manually on your VPS. Does anyone have any comments on whether those articles would work on a server managed by serverpilot? Or indeed whether Serverpilot negates the need to do some of those things?
darylknight
CC BY-SA 3.0
2016-10-31T23:35:20.873Z
2016-10-31T23:35:20.873Z
narration_sd
<p>We have the choice of engaging services like Forge and ServerPilot, or rolling our  own.</p>

<p>Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do they protect?</p>

<p>Would it be equal or better to provide our own securing when using VPS?</p>

<p>To decide, it would be good to understand an apparent baseline for server security.</p>

<server><security><deployment>
What are useful guidelines for Craft CMS security on VPS (virtual private servers)?
# What are useful guidelines for Craft CMS security on VPS (virtual private servers)?

(Asked by: username_0 on 2016-10-31)

We have the choice of engaging services like Forge and ServerPilot, or rolling our own.

Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do they protect?

Would it be equal or better to provide our own securing when using VPS?

To decide, it would be good to understand an apparent baseline for server security.

**Tags:** server, security, deployment

---

## 1 answers

### Answer by username_0 on 2016-10-31. Score: 8

This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there.

Their instructions are tilted towards Ubuntu as far as specifics, but should fit for any Linux VPS.

Recording the links here so we don't lose the patterns. I agree with them because they're actually the same as what I came up with personally in arranging VPS security, and they say what's needed clearly and concisely.

<https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers>

and to complete on automatic security updates,

<https://blog.mafr.de/2015/02/26/ubuntu-unattended-upgrades/>

IT's quite worth reading the comments also on each of these, particularly the second. I like the so-often Germanic completeness there, if would suggest that auto-reboot is not just for personal servers.

You can control time-of-day via the auto-cron setting, and if you need 100% uptime, this is very likely better managed (and likely only actually possible for many scenarios) by providing more than one load-balanced server, updating them in a sequence, which again the cron portion could be one way of handling.

> **Comments:**
> **username_1**: While both of those links are very interesting, they deal specifically with setting up security manually on your VPS. Does anyone have any comments on whether those articles would work on a server managed by serverpilot? Or indeed whether Serverpilot negates the need to do some of those things?  

---

