diff --git a/blog.json b/blog.json index 02d53ba..0efe70c 100644 --- a/blog.json +++ b/blog.json @@ -220,25 +220,30 @@ "get-most-out-your-hosthatch-vps": { "title": "how to get the most out of your HostHatch VPS", "description": "Unlock the full potential of your HostHatch VPS with my friendly and easy-to-follow guide! In this blog post, I'll take you step-by-step through optimizing your NVMe and Storage VPS setups using some cool techniques like NFSv4.2, Cachefilesd, zRAM, and IPTables. Whether you're just starting out or you're a seasoned professional, you'll discover how to manage your resources more efficiently, boost performance, and keep your server environment secure. I'll also cover everything from configuring reverse DNS to setting up swap space and implementing private networking. This guide is perfect for anyone eager to maximize their VPS capabilities and make the most out of their hosting experience!", - "content": "Hi!\n\nRecently I've migrated to [HostHatch](https://hosthatch.com/)\nas my hosting provider, and while switching (even before, actually)\nI noticed that my target plan (NVME 16 GB) had only 75 GB of NVMe storage. This is why I also bought\nStorage VPS 1 TB on the side for $5 which has an HDD so it is not as expensive.\n\nThis blog post is meant to serve as a guide to how to get the most out of your HostHatch VPS\nby using NFSv4.2 (or whatever the latest is at the time you're reading this), Cachefilesd,\nzRAM, swap, and IPTables, as well as trying to follow common security practices which should be\n\"good enough\" for any average person.\n\nThis guide, of course, may be applied to other hosting providers, but not everything might be applicable\nor as easy as described here on other hosting providers. The more changes you make on your end, the more\nchanges you will need to make using this guide.\n\nAlso, if you're thinking about switching to HostHatch, consider using my affiliate link at .\nIt gives me a small commission on your first order at no cost to you :) No obligation though.\n\n## Disclaimer\n\nWhile I strive to provide accurate and helpful information in this guide, please note that any actions you take based on\nthe content provided are at your own risk. I am not liable for any damages, data loss, or other issues that may arise from\nfollowing the instructions outlined in this post. Always ensure you have proper backups and consult with a professional\nif you're unsure about any steps. Happy optimizing!\n\n## Knowledge\n\nThis guide assumes you have experience in system administration and understand what you are doing. Common issues\nwhile following this guide could be:\n\n- Compatibility issues due to a choice of a different Linux distribution. You should be proficient in the OS you choose to be able to debug these problems.\n- Network configuration issues such as mistakes in the Netplan configuration. Make sure to read everything carefully and consult other online resources if you are confused.\n- Firewall configuration (iptables) could get messed up with one command. Be careful and make sure to utilise the recovery console if something goes completely haywire.\n- Backups could be a problem if you mess something up majorly as a root user. Back your stuff up - full backups.\n- SSH configuration might be confusing for you, make sure to understand what you are doing. The recommended one is strongly based off [Mozilla standards for SSH](https://infosec.mozilla.org/guidelines/openssh).\n- Dependency management and problems, so make sure you understand your dependency problems, there might've been a mistake and I left out some dependency. Debug your problems and if you feel like it report it to me so I could fix it :)\n- General troubleshooting as system administration is a complex task and you might run into unexpected problems. This guide might serve as a helpful resource during your quest, but it does not constitute a whole experience of being a systems administrator.\n\nPlease be careful, and make sure you understand what you are doing. Online resources can help you a lot, but please don't put your bets on AI and LLMs like ChatGPT right away. They\ntend to respond with error-prone commands and code, so you might not want to play with such fire while doing complex tasks like this where sensitive data might be involved.\nDon't force yourself into a situation where you have use that backup you (hopefully) made!\n\n## Hardware\n\n- Processing VPS: NVMe 16 GB\n - 4 AMD EPYC cores (2 dedicated, 2 fair-shared)\n - 16 GB of DDR4 RAM\n - 75 GB of NVMe storage\n - 4 TB of network bandwidth\n - Location: Stockholm, Sweden. (Or whatever you want as long as the location supports Storage VPSes, if you're planning on using private networking) (a person I know has experienced performance problems using Swedish VPSes, you might want to use another location, it's been fine for me though)\n- Storage VPS: Storage 1 TB\n - 1 vCPU core\n - 1024 MB of RAM\n - 1000 GB of storage\n - Note: If you have a separate OS drive and a storage HDD, I suggest you put swap and all the OS stuff on the OS drive (NVMe hopefully), and the data on the 1 TB HDD formatted using XFS (`UUID=... /mnt/hdd xfs defaults,noatime 0 1` or something) using GPT layout. XFS should increase the performance of the HDD, especially when dealing with a lot of small files (such as in databases). This is how I set it up at least :)\n - 2500 GB of network bandwidth\n - Location: Same one as the processing VPS. (This will be useful when using private networking. You may also follow this guide even if your storage VPS is in a different location, although, there's catches described below)\n\nWe have extremely limited resources on the storage VPS, so we will try to work around that.\n\n## Operating systems & software stack\n\nThis guide should work for pretty much all Linux-based operating systems. Most commonly it is Debian Linux,\nalthough nobody is stopping you from using another distribution, such as Alpine Linux, which may even decrease\nthe resource usage.\n\nPersonally, I chose Debian Linux because it is very versatile and it has huge software repositories. It worked\nfine for me over and over again and I believe it to be a very reliable choice.\n\nIf you use anything other than Debian or Debian-based (such as Ubuntu) - adjust the procedures as needed based\non your software stack.\n\n## Reverse DNS\n\nThis is mainly a convenience feature, but you might want to change the rDNS of your\nHostHatch VPS(es). To change the rDNS of your VPS do the following steps:\n\n1. Log into HostHatch at .\n2. Go to your server's panel by clicking on its hostname.\n3. Go to the 'Network' tab.\n\nThen:\n\n- For IPv4\n 1. Click the arrow at the end of the IP row (looks like a gray `>` character at the edge of the row).\n 2. Enter your reverse DNS.\n 3. Press the confirm checkmark.\n- For IPv6, do the same steps, but for interface ID enter `0` the first time and then `1` the second time. This will ensure the best IPv6 rDNS compatibility: `::0` is oftentimes seen as a placeholder address, while `::1` should be your main IPv6 address. (if you enable IPv6 on HostHatch you get a whole /64 subnet)\n\n## zRAM and Swap space\n\nSwap space is an extra bit of virtual RAM so to say on your computer which your computer can fall back onto if it runs out of RAM.\nzRAM is like swap, although, it is compressed and all in-memory.\n\nzRAM might be useful for the processing VPS as it'll require CPU to compress and decompress the RAM, although, it will allow you to\nget better use out of RAM. While swap might be more useful on the storage VPS due to CPU and memory constraints.\n\nPersonally I have set up zRAM and normal swap (with a lower priority) on the processing VPS, and normal swap on the storage VPS.\n\n### zRAM\n\nFollowing the guide on zRAM on debian.org at you can easily set up zRAM as follows:\n\n apt install zram-tools\n echo -e \"ALGO=zstd\\nPERCENT=60\" | tee -a /etc/default/zramswap\n systemctl restart zramswap\n\nThis will allow zRAM to compress up to 60% of your normal RAM using the ZSTD compression algorithm which provides\nfast (de)compression with great compression ratios (around 5:1, which means for every 5 units of data it can compress\nit down to 1 unit).\n\nThis is only useful if you have spare CPU to give as the process will be using your CPU more than just using normal\nswap or just uncompressed RAM.\n\nTo mount it on boot, add this to your `/etc/fstab` file:\n\n /dev/zram0 none swap sw,pri=100 0 0\n\n### Swap\n\nThere's two main ways of setting swap up on Linux:\n\n- Swap partition: A separate partition where swap lives. This is faster than a swap file, but might be hard to achieve on a VPS due to having to modify the partition layout while the VPS is live.\n- Swap file: A normal file on your file system where swap space lives. This is more flexible as you can change the swap size at any point and you don't need to change your partition layout for it.\n\nI, personally, chose a swap file instead for both VPSes. This is how I set it up:\n\n fallocate -l 4G /swapfile # You can change the size at your accord\n chmod 600 /swapfile\n mkswap /swapfile\n\nAfter doing this, I added this to my `/etc/fstab` on my server:\n\n /swapfile none swap sw,pri=1 0 0\n\n### Finishing\n\nAfter setting swap up, you may want to reboot. Though in this case it's optional to reboot until the final reboot.\n\n## Private networking\n\nIf you were able to get both your storage VPS and processing VPS in the same location, do the following steps to enable\nand set private networking up. Do this for both of your VPSes:\n\n1. Log into HostHatch at .\n2. Go to your server's panel by clicking on its hostname.\n3. Go to the 'Network' tab.\n4. Press 'enable private networking'.\n5. Reboot the VPS.\n\nAfter enabling private networking, reboot the VPSes.\n\nAfter rebooting, log into your through ssh and follow the\n[private networking guide by HostHatch](https://docs.hosthatch.com/networking/#private-networking):\n\n1. Log in as root (either by pre-sshing as root or using the `su` command)\n2. Identify the interface name and MAC address using the command `ip -o link | grep 00:22` (the MAC address is the one that starts with `00:22:..`, and interface will usually be `enp2s0` or `eth1`)\n3. Identify the public IPv4 address of your VPS by running `curl -4 ip.me`. Remember the last number. (for example last number of `176.126.70.97` is `97`)\n4. Run `tee /etc/netplan/90-private.yaml` and paste in or type out the following text:\n\n```\nnetwork:\n version: 2\n ethernets:\n [interface name]:\n addresses:\n - 192.168.10.[last number of the current server's public IP address]/24\n match:\n macaddress: 00:22:xx:xx:xx:xx\n dhcp4: no\n mtu: 9000\n```\n\nAfter you are done: press CTRL+D, and then reboot the VPS. (this is required for private networking to take change if running `/usr/sbin/netplan apply` won't work)\n\nNote that `mtu: 9000` is optional. If it causes issues, do proceed to remove it. Although, since HostHatch claims to support jumbo frames in their docs, you should try to enable it, and by enabling it get a ~33% boost in throughput.\n\nNow you have private networking set up between the VPSes.\n\n### No private networking?\n\nNo worries - outside traffic will be blocked using IPTables, although, all the bandwidth will be taken into account while\nusing NFS and the performance might be noticeably worse, especially if the locations are far apart.\n\nIf you decide against private networking: Just use the public IP addresses (the ones you see in your HostHatch UI) rather than private ones after setting up private networking (`192.168.10.*`).\n\n## Firewall with IPTables (storage server)\n\nAfter setting private networking up, you will most likely want to isolate the storage VPS from the rest of\nthe internet to avoid leakage of data. This can be done easily using Iptables and iptables-persistent.\nThis will only cover IPv4 rules, but this can be easily translated into ip6tables as well. I would recommend not\nusing IPv6 on the storage VPS as it is pretty useless in the case of a storage server, and it'll only be more\nwork to manage everything: keep it simple.\n\nFirstly, install the required dependencies:\n\n apt install iptables iptables-persistent\n\nThen create a script called `iptables.sh` as follows:\n\n #!/bin/sh\n\n # Add /usr/sbin to PATH\n export PATH=\"$PATH:/usr/sbin\"\n\n # Flush and discard all iptables policies\n iptables -F\n iptables -X\n\n # Set default policies\n iptables -P INPUT DROP\n iptables -P FORWARD DROP\n iptables -P OUTPUT ACCEPT\n\n # Accept loopback traffic\n iptables -A INPUT -i lo -j ACCEPT\n\n # Accept established and related connections\n iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n\n # Accept SSH connections on port 22\n iptables -A INPUT -p tcp --dport 22 -j ACCEPT\n\n # Accept TCP connections on NFS ports on server IPs\n iptables -A INPUT -s 192.168.10.[last number of the storage server's public IP address] -p tcp --dport 2049 -j ACCEPT\n iptables -A INPUT -s 192.168.10.[last number of the processing server's public IP address] -p tcp --dport 2049 -j ACCEPT\n\n # Rate limiting for new SSH connections\n iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set\n\n # Drop SSH connections if more than 5 attempts occur within 60 seconds\n iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP\n\n # Drop invalid packets\n iptables -A INPUT -m state --state INVALID -j DROP\n\n # Accept loopback traffic for outgoing connections\n iptables -A OUTPUT -o lo -j ACCEPT\n\n # Save iptables rules\n iptables-save >/etc/iptables/rules.v4\n\nYou may also want to add the following rules as well to block IPv6 traffic:\n\n # Block IPv6\n ip6tables -F\n ip6tables -X\n ip6tables -P INPUT DROP\n ip6tables -P OUTPUT DROP\n ip6tables -P FORWARD DROP\n ip6tables-save >/etc/iptables/rules.v6\n\nAfter creating this script, go into your HostHatch console and do this:\n\n1. Click on your server's hostname.\n2. Go into the 'Console' tab.\n3. Log in as root.\n4. Run the script.\n5. Enable the `netfilter-persistent` service: `systemctl enable netfilter-persistent`\n\nYou should do it this way because you may experience connection issues while applying these IPTables rules.\n\nThis script will protect your VPS from brute-force attacks on the SSH port and it'll cut off the VPS from\nthe rest of the internet for the most part.\n\n### Sysctl for disabiling IPv6\n\nIf you want to truly disable IPv6, you will need to edit `/etc/sysctl.conf` and add this to it:\n\n net.ipv6.conf.all.disable_ipv6=1\n net.ipv6.conf.default.disable_ipv6=1\n\nAfter which, run this as root to apply the settings:\n\n sysctl -p\n\nNow absolutely no IPv6 traffic will be available in the storage VPS.\n\n### Firewall with IPTables (processing server)\n\nIf you want IPTables rules for your processing VPS, especially if you also allow IPv6, you are free to use\nmy `fw.sh` script located at :\n\n #!/bin/sh\n\n set -eu\n\n main() {\n for ip in iptables ip6tables; do\n echo '----------------------------------------------------------------'\n\n echo \"[$ip] Setting up iptables rules...\"\n\n echo \"[$ip] Flushing all rules...\"\n \"$ip\" -F\n \"$ip\" -X\n\n echo \"[$ip] Allowing established connections...\"\n \"$ip\" -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n echo \"[$ip] Allowing loopback interface...\"\n \"$ip\" -A INPUT -i lo -j ACCEPT\n \"$ip\" -A OUTPUT -o lo -j ACCEPT\n\n echo \"[$ip] Allowing SSH, HTTP, HTTPS, Email federation, Matrix federation, and XMPP federation on tcp...\"\n \"$ip\" -A INPUT -p tcp --dport 22 -j ACCEPT # SSH\n \"$ip\" -A INPUT -p tcp --dport 80 -j ACCEPT # HTTP\n \"$ip\" -A INPUT -p tcp --dport 443 -j ACCEPT # HTTPS\n \"$ip\" -A INPUT -p tcp -m multiport --dports 25,465,587,143,993,110,995,2525,4190 -j ACCEPT # Email federation\n \"$ip\" -A INPUT -p tcp --dport 8448 -j ACCEPT # Matrix federation\n \"$ip\" -A INPUT -p tcp -m multiport --dports 5222,5269,5223,5270,5281 -j ACCEPT # XMPP federation (without 5280 which is HTTP (not HTTPS))\n\n echo \"[$ip] Rate limiting SSH traffic on tcp...\"\n \"$ip\" -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set\n \"$ip\" -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP\n\n echo \"[$ip] Dropping invalid packets on tcp...\"\n \"$ip\" -A INPUT -p tcp -m state --state INVALID -j DROP\n\n echo \"[$ip] Dropping other traffic...\"\n \"$ip\" -P INPUT DROP\n \"$ip\" -P FORWARD DROP\n\n echo \"[$ip] Rules:\"\n \"$ip\" -vL\n\n echo '----------------------------------------------------------------'\n done\n\n echo '[ICMP] Allowing ICMP...'\n iptables -A INPUT -p icmp -j ACCEPT\n ipiptables -A OUTPUT -p icmp -j ACCEPT\n ip6tables -A INPUT -p icmpv6 -j ACCEPT\n ip6tables -A OUTPUT -p icmpv6 -j ACCEPT\n\n echo '----------------------------------------------------------------'\n\n echo '[iptables-save] Saving rules...'\n iptables-save | tee /etc/iptables/rules.v4\n\n echo '----------------------------------------------------------------'\n\n echo '[ip6tables-save] Saving rules...'\n ip6tables-save | tee /etc/iptables/rules.v6\n\n echo 'Meoww :3 done'\n }\n\n main \"$@\"\n\nMake sure no iptables or ip6tables rules are set on the server already so they don't get flushed and you experience\nnetworking problems.\n\n## NFS (storage server)\n\nIn this section, we will set up nfs-kernel-server on the _storage_ server.\n\nFirstly do the prerequisite steps:\n\n1. Make sure you are logged in as root.\n2. Install the required dependencies: `apt install nfs-kernel-server nfs-common`\n3. Create the shared exports directory, I personally chose `/share/nfs`: `mkdir -p /share/nfs`\n4. Set up the correct ownership for the directories: `chown nobody:nogroup -R /share`\n5. Set up the correct permissions for the directories: `chmod 755 -R /share`\n6. Enable the NFS service: `systemctl enable nfs-kernel-server`\n\nNow, simply export the NFS share by editing `/etc/exports`:\n\n /share/nfs 192.168.10.[last number of processing server's public IP](rw,sync,no_subtree_check,async)\n\nIf you are going to be using this share for database storage, make sure to remove the `async` flag as that may\nlead to data loss and/or corruption. I do that with PostgreSQL:\n\n /share/ 192.168.10.[last number of processing server's public IP](rw,sync,no_subtree_check)\n\nNext, simply export the filesystems:\n\n exportfs -a\n\nAnd start the NFS service:\n\n systemctl start nfs-kernel-server\n\nNow, for the next steps, verify the available NFS versions:\n\n $ cat /proc/fs/nfsd/versions\n +3 +4 +4.1 +4.2\n\nRemember the biggest number that has a `+` in front of it.\n\nYou have successfully set NFS up on the storage server! The NFS server will only be accessible by\npurely the processing server and noone else.\n\n## NFS (processing server)\n\nNow, we are going to set up NFS and Cachefilesd on the processing VPS.\n\nFirstly do the prerequisite steps:\n\n1. Open `/etc/fstab`.\n2. Edit your `/` mount to have the following mount options: `rw,discard,errors=remount-ro,x-systemd.growfs,user_xattr,acl`.\n3. Reboot the VPS.\n4. Make sure you are logged in as root.\n5. Install the required dependencies: `apt install nfs-common`\n6. Make the NFS mountpoint: `mkdir -p /mnt/nfs`\n7. Set up correct ownership: `chown nobody:nogroup /mnt/nfs`\n8. Set up the correct permissions: `chmod 755 /mnt/nfs`\n\nNow open up your `/etc/fstab` and add this:\n\n 192.168.10.[last number of the storage server's public IP]:/share/nfs /mnt/nfs nfs4 defaults,fsc,noatime,nodiratime,_netdev,x-systemd.automount,x-systemd.requires=network-online.target,timeo=600,rsize=65536,wsize=65536,hard,intr,nfsvers=[latest version of NFS available, such as 4.2],namlen=255,proto=tcp,retrans=2,sec=sys,clientaddr=192.168.10.[last number of the processing server's public IP],local_lock=none,addr=192.168.10.[last number of the storage server's public IP] 0 0\n\nFor database storage, you may want to modify these options to:\n\n 192.168.10.[same]:/share/[database path] /var/lib/[database path] nfs4 defaults,fsc,noatime,nodiratime,_netdev,x-systemd.automount,x-systemd.requires=network-online.target,timeo=600,rsize=65536,wsize=65536,hard,intr,nfsvers=[same],namlen=255,proto=tcp,retrans=2,sec=sys,clientaddr=192.168.10.[same],local_lock=none,addr=192.168.10.[same] 0 0\n\nDon't yet do anything. First, we will set Cachefilesd up (`fsc` mount option). This will give us better performance by being able to utilize the mass storage of the HDD server and the performance of the NVMe server:\n\n1. Install Cachefilesd: `apt install cachefilesd`.\n2. Edit `/etc/cachefilesd.conf` if needed. (or just use default configuration - it is okay)\n3. Edit `/etc/default/cachefilesd` and change the `RUN=no` to `RUN=yes`.\n4. Start and enable the cachefilesd service: `systemctl enable --now cachefilesd`.\n5. Check the status, and debug if needed: `systemctl status cachefilesd`.\n6. Done. You should now reboot the VPS.\n\nNFS is now successfully set up with caching. You can use the mountpoint as any mounted filesystem.\n\n## SSHD (SSH daemon) configuration\n\nOn the processing VPS you may want to use the following configuration **only after adding an unprivileged user, adding your public ssh key in ~/.ssh/authorized_keys, and testing it** for best security and access management:\n\nFirst run `rm /etc/ssh/ssh_host_* && dpkg-reconfigure openssh-server` and then edit `/etc/ssh/sshd_config`:\n\n ...\n Port 22\n AddressFamily any\n ...\n SyslogFacility AUTH\n LogLevel INFO\n ...\n PermitRootLogin no\n ...\n MaxAuthTries 3\n ...\n PubkeyAuthentication yes\n ...\n AuthorizedKeysFile .ssh/authorized_keys\n ...\n IgnoreRhosts yes\n ...\n PasswordAuthentication no\n PermitEmptyPasswords no\n ...\n KbdInteractiveAuthentication no\n ...\n UsePAM yes\n ..\n AllowAgentForwarding no\n AllowTcpForwarding no\n ...\n X11Forwarding no\n ...\n PrintMotd no\n ...\n TCPKeepAlive no\n ...\n UseDNS no\n ...\n Banner none\n ...\n AcceptEnv none\n ...\n Subsystem sftp /usr/lib/openssh/sftp-server\n ...\n ChallengeResponseAuthentication no\n\n KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256\n\n Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n\n MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\n\n AuthenticationMethods publickey\n\n HostKey /etc/ssh/ssh_host_ed25519_key\n HostKey /etc/ssh/ssh_host_rsa_key\n HostKey /etc/ssh/ssh_host_ecdsa_key\n\n AllowUsers \n\nIf you also run a git server you may want to restrict it even more:\n\n Match User git\n X11Forwarding no\n AllowTcpForwarding no\n AllowAgentForwarding no\n PermitTTY no\n AuthorizedKeysFile /home/git/.ssh/authorized_keys\n PermitTunnel no\n ClientAliveInterval 300\n ClientAliveCountMax 0\n\nWhen it comes to client configuration, you may just take one from [Mozilla SSH standards](https://infosec.mozilla.org/guidelines/openssh) pretty much:\n\n ServerAliveInterval 60\n HashKnownHosts yes\n HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256\n KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256\n MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\n Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n\nOn the storage VPS you may want to have a singular unprivileged user and only allow traffic from IPv4 (`AddressFamily inet`).\nYou may also want to specify a `Banner /etc/issue` to show a legal disclaimer by overwriting the issue and motd files in etc.\nFeel free to take this one:\n\n ********************************************************************************\n * WARNING: AUTHORIZED ACCESS ONLY *\n ********************************************************************************\n * *\n * You are accessing a private computer system owned by .......... and operated *\n * under the domain ....... This system, including all related equipment, *\n * networks, and network devices (specifically including Internet access), is *\n * provided only for authorized use. This system may be monitored for all *\n * lawful purposes, including to ensure that its use is authorized, for *\n * management of the system, to facilitate protection against unauthorized *\n * access, and to verify security procedures, survivability, and operational *\n * security. Monitoring includes active attacks by authorized entities to test *\n * or verify the security of this system. During monitoring, information may be *\n * examined, recorded, copied, and used for authorized purposes. Use of this *\n * system constitutes consent to monitoring for these purposes. *\n * *\n * Unauthorized or improper use of this system may result in civil and criminal *\n * penalties and administrative or disciplinary action, as appropriate. By *\n * continuing to use this system you indicate your awareness of and consent to *\n * these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree *\n * to the conditions stated in this warning. *\n * *\n ********************************************************************************\n\n System owned by Jane Dane - example.com\n\n## DNS servers\n\nFor best privacy, security, and generally reliable services - I recommend using [Quad9 DNS](https://quad9.net/).\nYou may use these DNS servers by editing `/etc/systemd/resolved.conf` and setting the following value as such:\n\n DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net\n\nThen either reboot or run:\n\n systemctl restart systemd-resolved\n\n## Unattended upgrades\n\nYou may want to set up unattended upgrades meaning your VPS will automatically download stable updates:\n\n dpkg-reconfigure unattended-upgrades\n\n## Security repositories\n\nAt least on Debian Linux, you may want to enable security patch repositories to stay up to date with security patches\nin various software, such as OpenSSH. The security repository allows you to have best security on your server while\nstill keeping up to date with the stability of your Linux distribution of choice.\n\nOn Debian, you can create a file such as `/etc/apt/sources.list.d/security.list` with the following content:\n\n deb http://security.debian.org/debian-security bookworm-security main contrib non-free\n deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free\n\nThis applies to Debian Linux 12 \"Bookworm\". You may change the codename of the repository depending on your Debian version.\n\n## Closing note\n\nThat's about it. Good luck and have fun with your new infrastructure!\n\n(btw that's basically the infrastructure ari.lt runs on at the moment, if I find any bottlenecks - I'll tackle them)\n\nMy storage server seems to be idling at about 100M of RAM and around 5% CPU on average, of course with spikes.\nThat play room might seem crazy, but the spikes are even crazier - keep it light and simple on the storage server!\nIt is _literally_ responsible for your storage - be careful and make sure you understand what you are doing.\n\nCya next time!", + "content": "Hi!\n\nRecently I've migrated to [HostHatch](https://hosthatch.com/)\nas my hosting provider, and while switching (even before, actually)\nI noticed that my target plan (NVME 16 GB) had only 75 GB of NVMe storage. This is why I also bought\nStorage VPS 1 TB on the side for $5 which has an HDD so it is not as expensive.\n\nThis blog post is meant to serve as a guide to how to get the most out of your HostHatch VPS\nby using NFSv4.2 (or whatever the latest is at the time you're reading this), Cachefilesd,\nzRAM, swap, and IPTables (as well as IPSet and Fail2ban), as well as trying to follow common security practices which should be\n\"good enough\" for any average person.\n\nThis guide, of course, may be applied to other hosting providers, but not everything might be applicable\nor as easy as described here on other hosting providers. The more changes you make on your end, the more\nchanges you will need to make using this guide.\n\nAlso, if you're thinking about switching to HostHatch, consider using my affiliate link at .\nIt gives me a small commission on your first order at no cost to you :) No obligation though.\n\n## Disclaimer\n\nWhile I strive to provide accurate and helpful information in this guide, please note that any actions you take based on\nthe content provided are at your own risk. I am not liable for any damages, data loss, or other issues that may arise from\nfollowing the instructions outlined in this post. Always ensure you have proper backups and consult with a professional\nif you're unsure about any steps. Happy optimizing!\n\n## Knowledge\n\nThis guide assumes you have experience in system administration and understand what you are doing. Common issues\nwhile following this guide could be:\n\n- Compatibility issues due to a choice of a different Linux distribution. You should be proficient in the OS you choose to be able to debug these problems.\n- Network configuration issues such as mistakes in the Netplan configuration. Make sure to read everything carefully and consult other online resources if you are confused.\n- Firewall configuration (iptables) could get messed up with one command. Be careful and make sure to utilise the recovery console if something goes completely haywire.\n- Backups could be a problem if you mess something up majorly as a root user. Back your stuff up - full backups.\n- SSH configuration might be confusing for you, make sure to understand what you are doing. The recommended one is strongly based off [Mozilla standards for SSH](https://infosec.mozilla.org/guidelines/openssh).\n- Dependency management and problems, so make sure you understand your dependency problems, there might've been a mistake and I left out some dependency. Debug your problems and if you feel like it report it to me so I could fix it :)\n- General troubleshooting as system administration is a complex task and you might run into unexpected problems. This guide might serve as a helpful resource during your quest, but it does not constitute a whole experience of being a systems administrator.\n\nPlease be careful, and make sure you understand what you are doing. Online resources can help you a lot, but please don't put your bets on AI and LLMs like ChatGPT right away. They\ntend to respond with error-prone commands and code, so you might not want to play with such fire while doing complex tasks like this where sensitive data might be involved.\nDon't force yourself into a situation where you have use that backup you (hopefully) made!\n\n## Hardware\n\n- Processing VPS: NVMe 16 GB\n - 4 AMD EPYC cores (2 dedicated, 2 fair-shared)\n - 16 GB of DDR4 RAM\n - 75 GB of NVMe storage\n - 4 TB of network bandwidth\n - Location: Stockholm, Sweden. (Or whatever you want as long as the location supports Storage VPSes, if you're planning on using private networking) (a person I know has experienced performance problems using Swedish VPSes, you might want to use another location, it's been fine for me though)\n- Storage VPS: Storage 1 TB\n - 1 vCPU core\n - 1024 MB of RAM\n - 1000 GB of storage\n - Note: If you have a separate OS drive and a storage HDD, I suggest you put swap and all the OS stuff on the OS drive (NVMe hopefully), and the data on the 1 TB HDD formatted using XFS (`UUID=... /mnt/hdd xfs defaults,noatime 0 1` or something) using GPT layout. XFS should increase the performance of the HDD, especially when dealing with a lot of small files (such as in databases). This is how I set it up at least :)\n - 2500 GB of network bandwidth\n - Location: Same one as the processing VPS. (This will be useful when using private networking. You may also follow this guide even if your storage VPS is in a different location, although, there's catches described below)\n\nWe have extremely limited resources on the storage VPS, so we will try to work around that.\n\n## Operating systems & software stack\n\nThis guide should work for pretty much all Linux-based operating systems. Most commonly it is Debian Linux,\nalthough nobody is stopping you from using another distribution, such as Alpine Linux, which may even decrease\nthe resource usage.\n\nPersonally, I chose Debian Linux because it is very versatile and it has huge software repositories. It worked\nfine for me over and over again and I believe it to be a very reliable choice.\n\nIf you use anything other than Debian or Debian-based (such as Ubuntu) - adjust the procedures as needed based\non your software stack.\n\n## Reverse DNS\n\nThis is mainly a convenience feature, but you might want to change the rDNS of your\nHostHatch VPS(es). To change the rDNS of your VPS do the following steps:\n\n1. Log into HostHatch at .\n2. Go to your server's panel by clicking on its hostname.\n3. Go to the 'Network' tab.\n\nThen:\n\n- For IPv4\n 1. Click the arrow at the end of the IP row (looks like a gray `>` character at the edge of the row).\n 2. Enter your reverse DNS.\n 3. Press the confirm checkmark.\n- For IPv6, do the same steps, but for interface ID enter `0` the first time and then `1` the second time. This will ensure the best IPv6 rDNS compatibility: `::0` is oftentimes seen as a placeholder address, while `::1` should be your main IPv6 address. (if you enable IPv6 on HostHatch you get a whole /64 subnet)\n\n## zRAM and Swap space\n\nSwap space is an extra bit of virtual RAM so to say on your computer which your computer can fall back onto if it runs out of RAM.\nzRAM is like swap, although, it is compressed and all in-memory.\n\nzRAM might be useful for the processing VPS as it'll require CPU to compress and decompress the RAM, although, it will allow you to\nget better use out of RAM. While swap might be more useful on the storage VPS due to CPU and memory constraints.\n\nPersonally I have set up zRAM and normal swap (with a lower priority) on the processing VPS, and normal swap on the storage VPS.\n\n### zRAM\n\nFollowing the guide on zRAM on debian.org at you can easily set up zRAM as follows:\n\n apt install zram-tools\n echo -e \"ALGO=zstd\\nPERCENT=60\" | tee -a /etc/default/zramswap\n systemctl restart zramswap\n\nThis will allow zRAM to compress up to 60% of your normal RAM using the ZSTD compression algorithm which provides\nfast (de)compression with great compression ratios (around 5:1, which means for every 5 units of data it can compress\nit down to 1 unit).\n\nThis is only useful if you have spare CPU to give as the process will be using your CPU more than just using normal\nswap or just uncompressed RAM.\n\nTo mount it on boot, add this to your `/etc/fstab` file:\n\n /dev/zram0 none swap sw,pri=100 0 0\n\n### Swap\n\nThere's two main ways of setting swap up on Linux:\n\n- Swap partition: A separate partition where swap lives. This is faster than a swap file, but might be hard to achieve on a VPS due to having to modify the partition layout while the VPS is live.\n- Swap file: A normal file on your file system where swap space lives. This is more flexible as you can change the swap size at any point and you don't need to change your partition layout for it.\n\nI, personally, chose a swap file instead for both VPSes. This is how I set it up:\n\n fallocate -l 4G /swapfile # You can change the size at your accord\n chmod 600 /swapfile\n mkswap /swapfile\n\nAfter doing this, I added this to my `/etc/fstab` on my server:\n\n /swapfile none swap sw,pri=1 0 0\n\n### Finishing\n\nAfter setting swap up, you may want to reboot. Though in this case it's optional to reboot until the final reboot.\n\n## Private networking\n\nIf you were able to get both your storage VPS and processing VPS in the same location, do the following steps to enable\nand set private networking up. Do this for both of your VPSes:\n\n1. Log into HostHatch at .\n2. Go to your server's panel by clicking on its hostname.\n3. Go to the 'Network' tab.\n4. Press 'enable private networking'.\n5. Reboot the VPS.\n\nAfter enabling private networking, reboot the VPSes.\n\nAfter rebooting, log into your through ssh and follow the\n[private networking guide by HostHatch](https://docs.hosthatch.com/networking/#private-networking):\n\n1. Log in as root (either by pre-sshing as root or using the `su` command)\n2. Identify the interface name and MAC address using the command `ip -o link | grep 00:22` (the MAC address is the one that starts with `00:22:..`, and interface will usually be `enp2s0` or `eth1`)\n3. Identify the public IPv4 address of your VPS by running `curl -4 ip.me`. Remember the last number. (for example last number of `176.126.70.97` is `97`)\n4. Run `tee /etc/netplan/90-private.yaml` and paste in or type out the following text:\n\n```\nnetwork:\n version: 2\n ethernets:\n [interface name]:\n addresses:\n - 192.168.10.[last number of the current server's public IP address]/24\n match:\n macaddress: 00:22:xx:xx:xx:xx\n dhcp4: no\n mtu: 9000\n```\n\nAfter you are done: press CTRL+D, and then reboot the VPS. (this is required for private networking to take change if running `/usr/sbin/netplan apply` won't work)\n\nNote that `mtu: 9000` is optional. If it causes issues, do proceed to remove it. Although, since HostHatch claims to support jumbo frames in their docs, you should try to enable it, and by enabling it get a ~33% boost in throughput.\n\nNow you have private networking set up between the VPSes.\n\n### No private networking?\n\nNo worries - outside traffic will be blocked using IPTables, although, all the bandwidth will be taken into account while\nusing NFS and the performance might be noticeably worse, especially if the locations are far apart.\n\nIf you decide against private networking: Just use the public IP addresses (the ones you see in your HostHatch UI) rather than private ones after setting up private networking (`192.168.10.*`).\n\n## Firewall with IPTables (storage server)\n\nAfter setting private networking up, you will most likely want to isolate the storage VPS from the rest of\nthe internet to avoid leakage of data. This can be done easily using Iptables and iptables-persistent.\nThis will only cover IPv4 rules, but this can be easily translated into ip6tables as well. I would recommend not\nusing IPv6 on the storage VPS as it is pretty useless in the case of a storage server, and it'll only be more\nwork to manage everything: keep it simple.\n\nFirstly, install the required dependencies:\n\n apt install iptables iptables-persistent\n\nThen create a script called `iptables.sh` as follows:\n\n #!/bin/sh\n\n # Add /usr/sbin to PATH\n export PATH=\"$PATH:/usr/sbin\"\n\n # Flush and discard all iptables policies\n iptables -F\n iptables -X\n\n # Set default policies\n iptables -P INPUT DROP\n iptables -P FORWARD DROP\n iptables -P OUTPUT ACCEPT\n\n # Accept loopback traffic\n iptables -A INPUT -i lo -j ACCEPT\n\n # Accept established and related connections\n iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n\n # Accept SSH connections on port 22\n iptables -A INPUT -p tcp --dport 22 -j ACCEPT\n\n # Accept TCP connections on NFS ports on server IPs\n iptables -A INPUT -s 192.168.10.[last number of the storage server's public IP address] -p tcp --dport 2049 -j ACCEPT\n iptables -A INPUT -s 192.168.10.[last number of the processing server's public IP address] -p tcp --dport 2049 -j ACCEPT\n\n # Rate limiting for new SSH connections\n iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set\n\n # Drop SSH connections if more than 5 attempts occur within 60 seconds\n iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP\n\n # Drop invalid packets\n iptables -A INPUT -m state --state INVALID -j DROP\n\n # Accept loopback traffic for outgoing connections\n iptables -A OUTPUT -o lo -j ACCEPT\n\n # Save iptables rules\n iptables-save >/etc/iptables/rules.v4\n\nYou may also want to add the following rules as well to block IPv6 traffic:\n\n # Block IPv6\n ip6tables -F\n ip6tables -X\n ip6tables -P INPUT DROP\n ip6tables -P OUTPUT DROP\n ip6tables -P FORWARD DROP\n ip6tables-save >/etc/iptables/rules.v6\n\nAfter creating this script, go into your HostHatch console and do this:\n\n1. Click on your server's hostname.\n2. Go into the 'Console' tab.\n3. Log in as root.\n4. Run the script.\n5. Enable the `netfilter-persistent` service: `systemctl enable netfilter-persistent`\n\nYou should do it this way because you may experience connection issues while applying these IPTables rules.\n\nThis script will protect your VPS from brute-force attacks on the SSH port and it'll cut off the VPS from\nthe rest of the internet for the most part.\n\n### Sysctl for disabiling IPv6\n\nIf you want to truly disable IPv6, you will need to edit `/etc/sysctl.conf` and add this to it:\n\n net.ipv6.conf.all.disable_ipv6=1\n net.ipv6.conf.default.disable_ipv6=1\n\nAfter which, run this as root to apply the settings:\n\n sysctl -p\n\nNow absolutely no IPv6 traffic will be available in the storage VPS.\n\n### Firewall with IPTables (processing server)\n\nIf you want IPTables rules for your processing VPS, especially if you also allow IPv6, you are free to use\nmy `fw.sh` script located at :\n\n #!/bin/sh\n\n set -eu\n\n main() {\n for ip in iptables ip6tables; do\n echo '----------------------------------------------------------------'\n\n echo \"[$ip] Setting up iptables rules...\"\n\n echo \"[$ip] Flushing all rules...\"\n \"$ip\" -F\n \"$ip\" -X\n\n echo \"[$ip] Allowing established connections...\"\n \"$ip\" -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n echo \"[$ip] Allowing loopback interface...\"\n \"$ip\" -A INPUT -i lo -j ACCEPT\n \"$ip\" -A OUTPUT -o lo -j ACCEPT\n\n echo \"[$ip] Allowing SSH, HTTP, HTTPS, Email federation, Matrix federation, and XMPP federation on tcp...\"\n \"$ip\" -A INPUT -p tcp --dport 22 -j ACCEPT # SSH\n \"$ip\" -A INPUT -p tcp --dport 80 -j ACCEPT # HTTP\n \"$ip\" -A INPUT -p tcp --dport 443 -j ACCEPT # HTTPS\n \"$ip\" -A INPUT -p tcp -m multiport --dports 25,465,587,143,993,110,995,2525,4190 -j ACCEPT # Email federation\n \"$ip\" -A INPUT -p tcp --dport 8448 -j ACCEPT # Matrix federation\n \"$ip\" -A INPUT -p tcp -m multiport --dports 5222,5269,5223,5270,5281 -j ACCEPT # XMPP federation (without 5280 which is HTTP (not HTTPS))\n\n echo \"[$ip] Rate limiting SSH traffic on tcp...\"\n \"$ip\" -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set\n \"$ip\" -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP\n\n echo \"[$ip] Dropping invalid packets on tcp...\"\n \"$ip\" -A INPUT -p tcp -m state --state INVALID -j DROP\n\n echo \"[$ip] Dropping other traffic...\"\n \"$ip\" -P INPUT DROP\n \"$ip\" -P FORWARD DROP\n\n echo \"[$ip] Rules:\"\n \"$ip\" -vL\n\n echo '----------------------------------------------------------------'\n done\n\n echo '[ICMP] Allowing ICMP...'\n iptables -A INPUT -p icmp -j ACCEPT\n ipiptables -A OUTPUT -p icmp -j ACCEPT\n ip6tables -A INPUT -p icmpv6 -j ACCEPT\n ip6tables -A OUTPUT -p icmpv6 -j ACCEPT\n\n echo '----------------------------------------------------------------'\n\n echo '[iptables-save] Saving rules...'\n iptables-save | tee /etc/iptables/rules.v4\n\n echo '----------------------------------------------------------------'\n\n echo '[ip6tables-save] Saving rules...'\n ip6tables-save | tee /etc/iptables/rules.v6\n\n echo 'Meoww :3 done'\n }\n\n main \"$@\"\n\nMake sure no iptables or ip6tables rules are set on the server already so they don't get flushed and you experience\nnetworking problems.\n\n### IPSet\n\nFor blocking IPs, such as very spammy ones, you may want to use the [ipset utility](https://manpages.debian.org/buster/ipset/ipset.8.en.html) which is used for managing IPSets. To set it up you will have to do the following:\n\n apt install ipset ipset-persistent\n\n # IPv4\n ipset create blacklist hash:ip\n ipset add blacklist \n ...\n iptables -I INPUT -m set --match-set blacklist src -j DROP\n\n # IPv6\n ipset create blacklist6 hash:net hashsize 4096 family inet6\n ipset add blacklist6 \n ...\n ip6tables -I INPUT -m set --match-set blacklist6 src -j DROP\n\n # Save IPSets\n ipset save >/etc/iptables/ipsets\n systemctl enable netfilter-persistent\n\nAt the end, don't forget to either save your IPTables and IP6Tables rules or add the rules to `rules.v*` as follows:\n\nFor v4:\n\n *filter\n :INPUT DROP [0:0]\n :FORWARD DROP [0:0]\n :OUTPUT ACCEPT [0:0]\n -A INPUT -m set --match-set blacklist src -j DROP\n\nFor v6:\n\n *filter\n :INPUT DROP [0:0]\n :FORWARD DROP [0:0]\n :OUTPUT ACCEPT [0:0]\n -A INPUT -m set --match-set blacklist6 src -j DROP\n\nIgnore the first 4 lines, what I am trying to show is that it must be before all other rules to effectively drop all traffic from blocked IPs.\n\nNow, you can proceed to monitor abusive IPs, for instance like using [fail2ban](https://github.com/fail2ban/fail2ban) or monitoring various things like `/var/log/btmp`, for example, to see the IPs that tried to brute force your SSH, you can try to run the following command:\n\n lastb -a | awk '{print $10}' | grep -v ^192 | sed '/^$/d' | sort | uniq -c | sort -nr | head -n 32\n\nThis will print the top 32 IPs which have tried to brute force SSH to try to get in. I, personally, blocked the most abusive ones (with the most brute force attempts) after collecting data over 3 or so months.\n\nYou may also try to integrate things like [IPAbuseDB](https://www.abuseipdb.com/) or something, which is another can of worms I probably won't get into for now. You can read an article like to integrate it yourself based off the official documentation :)\n\n## NFS (storage server)\n\nIn this section, we will set up nfs-kernel-server on the _storage_ server.\n\nFirstly do the prerequisite steps:\n\n1. Make sure you are logged in as root.\n2. Install the required dependencies: `apt install nfs-kernel-server nfs-common`\n3. Create the shared exports directory, I personally chose `/share/nfs`: `mkdir -p /share/nfs`\n4. Set up the correct ownership for the directories: `chown nobody:nogroup -R /share`\n5. Set up the correct permissions for the directories: `chmod 755 -R /share`\n6. Enable the NFS service: `systemctl enable nfs-kernel-server`\n\nNow, simply export the NFS share by editing `/etc/exports`:\n\n /share/nfs 192.168.10.[last number of processing server's public IP](rw,sync,no_subtree_check,async)\n\nIf you are going to be using this share for database storage, make sure to remove the `async` flag as that may\nlead to data loss and/or corruption. I do that with PostgreSQL:\n\n /share/ 192.168.10.[last number of processing server's public IP](rw,sync,no_subtree_check)\n\nNext, simply export the filesystems:\n\n exportfs -a\n\nAnd start the NFS service:\n\n systemctl start nfs-kernel-server\n\nNow, for the next steps, verify the available NFS versions:\n\n $ cat /proc/fs/nfsd/versions\n +3 +4 +4.1 +4.2\n\nRemember the biggest number that has a `+` in front of it.\n\nYou have successfully set NFS up on the storage server! The NFS server will only be accessible by\npurely the processing server and noone else.\n\n## NFS (processing server)\n\nNow, we are going to set up NFS and Cachefilesd on the processing VPS.\n\nFirstly do the prerequisite steps:\n\n1. Open `/etc/fstab`.\n2. Edit your `/` mount to have the following mount options: `rw,discard,errors=remount-ro,x-systemd.growfs,user_xattr,acl`.\n3. Reboot the VPS.\n4. Make sure you are logged in as root.\n5. Install the required dependencies: `apt install nfs-common`\n6. Make the NFS mountpoint: `mkdir -p /mnt/nfs`\n7. Set up correct ownership: `chown nobody:nogroup /mnt/nfs`\n8. Set up the correct permissions: `chmod 755 /mnt/nfs`\n\nNow open up your `/etc/fstab` and add this:\n\n 192.168.10.[last number of the storage server's public IP]:/share/nfs /mnt/nfs nfs4 defaults,fsc,noatime,nodiratime,_netdev,x-systemd.automount,x-systemd.requires=network-online.target,timeo=600,rsize=65536,wsize=65536,hard,intr,nfsvers=[latest version of NFS available, such as 4.2],namlen=255,proto=tcp,retrans=2,sec=sys,clientaddr=192.168.10.[last number of the processing server's public IP],local_lock=none,addr=192.168.10.[last number of the storage server's public IP] 0 0\n\nFor database storage, you may want to modify these options to:\n\n 192.168.10.[same]:/share/[database path] /var/lib/[database path] nfs4 defaults,fsc,noatime,nodiratime,_netdev,x-systemd.automount,x-systemd.requires=network-online.target,timeo=600,rsize=65536,wsize=65536,hard,intr,nfsvers=[same],namlen=255,proto=tcp,retrans=2,sec=sys,clientaddr=192.168.10.[same],local_lock=none,addr=192.168.10.[same] 0 0\n\nDon't yet do anything. First, we will set Cachefilesd up (`fsc` mount option). This will give us better performance by being able to utilize the mass storage of the HDD server and the performance of the NVMe server:\n\n1. Install Cachefilesd: `apt install cachefilesd`.\n2. Edit `/etc/cachefilesd.conf` if needed. (or just use default configuration - it is okay)\n3. Edit `/etc/default/cachefilesd` and change the `RUN=no` to `RUN=yes`.\n4. Start and enable the cachefilesd service: `systemctl enable --now cachefilesd`.\n5. Check the status, and debug if needed: `systemctl status cachefilesd`.\n6. Done. You should now reboot the VPS.\n\nNFS is now successfully set up with caching. You can use the mountpoint as any mounted filesystem.\n\n## SSHD (SSH daemon) configuration\n\nOn the processing VPS you may want to use the following configuration **only after adding an unprivileged user, adding your public ssh key in ~/.ssh/authorized_keys, and testing it** for best security and access management:\n\nFirst run `rm /etc/ssh/ssh_host_* && dpkg-reconfigure openssh-server` and then edit `/etc/ssh/sshd_config`:\n\n ...\n Port 22\n AddressFamily any\n ...\n SyslogFacility AUTH\n LogLevel INFO\n ...\n PermitRootLogin no\n ...\n MaxAuthTries 3\n ...\n PubkeyAuthentication yes\n ...\n AuthorizedKeysFile .ssh/authorized_keys\n ...\n IgnoreRhosts yes\n ...\n PasswordAuthentication no\n PermitEmptyPasswords no\n ...\n KbdInteractiveAuthentication no\n ...\n UsePAM yes\n ..\n AllowAgentForwarding no\n AllowTcpForwarding no\n ...\n X11Forwarding no\n ...\n PrintMotd no\n ...\n TCPKeepAlive no\n ...\n UseDNS no\n ...\n Banner none\n ...\n AcceptEnv none\n ...\n Subsystem sftp /usr/lib/openssh/sftp-server\n ...\n ChallengeResponseAuthentication no\n\n KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256\n\n Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n\n MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\n\n AuthenticationMethods publickey\n\n HostKey /etc/ssh/ssh_host_ed25519_key\n HostKey /etc/ssh/ssh_host_rsa_key\n HostKey /etc/ssh/ssh_host_ecdsa_key\n\n AllowUsers \n\nIf you also run a git server you may want to restrict it even more:\n\n Match User git\n X11Forwarding no\n AllowTcpForwarding no\n AllowAgentForwarding no\n PermitTTY no\n AuthorizedKeysFile /home/git/.ssh/authorized_keys\n PermitTunnel no\n ClientAliveInterval 300\n ClientAliveCountMax 0\n\nWhen it comes to client configuration, you may just take one from [Mozilla SSH standards](https://infosec.mozilla.org/guidelines/openssh) pretty much:\n\n ServerAliveInterval 60\n HashKnownHosts yes\n HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256\n KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256\n MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com\n Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n\nOn the storage VPS you may want to have a singular unprivileged user and only allow traffic from IPv4 (`AddressFamily inet`).\nYou may also want to specify a `Banner /etc/issue` to show a legal disclaimer by overwriting the issue and motd files in etc.\nFeel free to take this one:\n\n ********************************************************************************\n * WARNING: AUTHORIZED ACCESS ONLY *\n ********************************************************************************\n * *\n * You are accessing a private computer system owned by .......... and operated *\n * under the domain ....... This system, including all related equipment, *\n * networks, and network devices (specifically including Internet access), is *\n * provided only for authorized use. This system may be monitored for all *\n * lawful purposes, including to ensure that its use is authorized, for *\n * management of the system, to facilitate protection against unauthorized *\n * access, and to verify security procedures, survivability, and operational *\n * security. Monitoring includes active attacks by authorized entities to test *\n * or verify the security of this system. During monitoring, information may be *\n * examined, recorded, copied, and used for authorized purposes. Use of this *\n * system constitutes consent to monitoring for these purposes. *\n * *\n * Unauthorized or improper use of this system may result in civil and criminal *\n * penalties and administrative or disciplinary action, as appropriate. By *\n * continuing to use this system you indicate your awareness of and consent to *\n * these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree *\n * to the conditions stated in this warning. *\n * *\n ********************************************************************************\n\n System owned by Jane Dane - example.com\n\n## DNS servers\n\nFor best privacy, security, and generally reliable services - I recommend using [Quad9 DNS](https://quad9.net/).\nYou may use these DNS servers by editing `/etc/systemd/resolved.conf` and setting the following value as such:\n\n DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net\n\nThen either reboot or run:\n\n systemctl restart systemd-resolved\n\n## Unattended upgrades\n\nYou may want to set up unattended upgrades meaning your VPS will automatically download stable updates:\n\n dpkg-reconfigure unattended-upgrades\n\n## Security repositories\n\nAt least on Debian Linux, you may want to enable security patch repositories to stay up to date with security patches\nin various software, such as OpenSSH. The security repository allows you to have best security on your server while\nstill keeping up to date with the stability of your Linux distribution of choice.\n\nOn Debian, you can create a file such as `/etc/apt/sources.list.d/security.list` with the following content:\n\n deb http://security.debian.org/debian-security bookworm-security main contrib non-free\n deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free\n\nThis applies to Debian Linux 12 \"Bookworm\". You may change the codename of the repository depending on your Debian version.\n\n## Closing note\n\nThat's about it. Good luck and have fun with your new infrastructure!\n\n(btw that's basically the infrastructure ari.lt runs on at the moment, if I find any bottlenecks - I'll tackle them)\n\nMy storage server seems to be idling at about 100M of RAM and around 5% CPU on average, of course with spikes.\nThat play room might seem crazy, but the spikes are even crazier - keep it light and simple on the storage server!\nIt is _literally_ responsible for your storage - be careful and make sure you understand what you are doing.\n\nCya next time!", "keywords": [ - "reverse dns configuration", - "iptables", - "resource management", - "cachefilesd", - "nfsv4.2", + "vps setup guide", "swap space management", "server security", - "debian linux", - "cloud hosting", - "hosthatch", - "vps optimization", - "linux server", - "sysadmin", - "security", - "zram", + "nfsv4.2", "private networking", - "vps setup guide" + "security", + "sysadmin", + "ipv4", + "ipv6", + "debian linux", + "linux server", + "reverse dns configuration", + "cloud hosting", + "zram", + "cachefilesd", + "hosthatch", + "resource management", + "abuseipdb", + "vps optimization", + "fail2ban", + "ipset", + "iptables" ], "created": 1724229703.894 },