Initial hardening for move from Managed to Unmanaged VPS

Question

I know similar questions have been asked a couple of times but to keep the things short, currently I'm on a Managed hosting of Site5, which is quite good except it's quite expensive.

I want to know, is there an easy way, with almost no knowledge of SSH/Unix (commandline) skills to run an unmanaged server?

• After it has been initially hardened, can it be as easy as doing apt get/update and everything is fixed?
• What are things that would be an issue / would break easy?
• Are there VPS providers, which do this initial setup/hardening?

Answer 1

Is this an actual production website? Is it important that it's up most of the time? If so, then no, it's not possible for you to manage a production webserver with no linux experience.

At a minimum, you need the following:

• Backups
• Firewall
• Dependency software installed (MySQL/Apache/etc)
• Application software installed (Wordpress, whatever else you are running)
• Backups
• Monitoring (you need to know how loaded your box is, what kind of requests/sec you are seeing)
• Regular maintenance (Keeping up to date on security fixes, installing new software)
• Backups (no, it's not a mistake that this is listed three times)
• Knowledge of what to do if/when a security breach occurs

Simply put, a production web site is not the place for you to be learning your linux skills. I'd suggest you get a VPS and run some personal or development websites on it, in order for you to start learning about it. Don't attempt to go from a managed hosting environment to unmanaged unless you know exactly what to expect. Based on the type of question you asked, I wouldn't suggest you move to an unmanaged VPS yet.

Answer 2

It depends, when you say almost no experience I would say that yes maybe you need to just pay someone else to manage security for you. However if you are willing to learn I would suggest running a few ubuntu images and following this checklist:

http://ubuntuforums.org/showthread.php?t=1002167

Ubuntu automatically patches security updates, and that might be a low maintenance solution for you. You still need to monitor your logs, and keep your apps secure too. It's a lot of work ... in the end your managed service just might be a good value. But if you learn a bit about the process then at least you can tell if they are doing a good job.

As far as a VPS provider that provides hardened images: I am working on a startup that does just that as well as provides other security tools. Email sherman.boyd@armored.io if you are interested in beta testing.