Server hygiene checklist for someone self-managing a handful of VPS?

[u/trueharshit]

I inherited server management duties from a coworker who left, and honestly it was held together with cron jobs and good intentions, now I'm trynna get backups, firewall rules, and basic user hygiene acc consistent across our boxes instead of tribal data. What's on your baseline checklist?

[u/CivilIntention7747]

Inherited the same kind of setup once: cron jobs, one shared root password, backups that nobody had ever restored. The checklist that actually stuck for a handful of VPS, roughly in the order I would do it:

1. Inventory first. One text file per box: what runs on it, who depends on it, where the data lives, how it gets backed up. Half the value is discovering the service nobody remembers.

2. Access: one account per human, sudo, SSH keys only, PasswordAuthentication no, PermitRootLogin no. Rotate every key the departed coworker could have had, including deploy keys in CI and cloud console access. Fail2ban is fine, but key-only auth does most of the work.

3. Firewall: default deny inbound, allow 22/80/443 and only what you need. Bind databases, redis and admin panels to 127.0.0.1 or a private interface. Docker publishing a port on 0.0.0.0 bypasses UFW rules, that one bites everyone once.

4. Patching: unattended-upgrades for security updates plus a monthly manual pass for the rest. Reboot when the kernel changes, do not let uptime become a trophy.

5. Backups: restic or borg to somewhere off the provider (B2, another provider, whatever), encrypted, with retention. Then actually restore one backup to a scratch VM and time it. A backup you have never restored is a hypothesis.

6. Monitoring that catches silence, not just errors: a dead-man switch (healthchecks-style ping from every cron job) plus disk space and cert expiry alerts. The scariest failures I have had were jobs that quietly stopped running and reported nothing for days.

7. Config in git: ansible, or even plain shell scripts you can rerun on a fresh box. The real test of a hygienic server is whether you can rebuild it in an afternoon without the person who built it.

8. Logs shipped somewhere central with 30-90 days retention, and journald size-limited so it cannot fill the disk.

Do the access and backup items this week. Everything else can be a slow burn.

[u/SpudzzSomchai]

Honestly, if they are just running services I would spin up a new VPS as needed and start from scratch.

[u/Adam_Kearn]

Get a RMM tool or patch management system and install it on every server

It will look after installing updates and also easily allow you to see any servers offline or missing security patches.

Then create scripts that will report back what ports are open and then you can use this data to check if it should be closed or left open

[u/blud_13]

I like u/CivilIntention7747 comments..

Backups first and everything else second, because you inherited this and you have no idea yet whether they have been silently failing since March. Restore one to a scratch box this week. An untested backup is a rumor.

After that, the stuff that actually bites on inherited boxes:

1. Find every account that can log in and work out which ones belong to people who left. A shared admin login with the password sitting in a doc somewhere is close to guaranteed here.
2. Get firewall rules into a file in git instead of living on the box. Same with the cron jobs. If it only exists on the server it dies with the server.
3. A patch cadence you will actually keep. Monthly and done beats weekly and abandoned in six weeks.
4. Centralize logs off the box now, before the incident, not during it.

Also, write down what each server does and who screams when it goes down. That page is worth more than any checklist item on it.

We pick up a lot of these inherited setups, ping me if you want the boring long version (or go with Civils thoughts).