We have the choice of engaging services like Forge and ServerPilot, or rolling our own.
Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do they protect?
Would it be equal or better to provide our own securing when using VPS?
To decide, it would be good to understand an apparent baseline for server security.
This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there.
Their instructions are tilted towards Ubuntu as far as specifics, but should fit for any Linux VPS.
Recording the links here so we don't lose the patterns. I agree with them because they're actually the same as what I came up with personally in arranging VPS security, and they say what's needed clearly and concisely.
https://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers
and to complete on automatic security updates,
https://blog.mafr.de/2015/02/26/ubuntu-unattended-upgrades/
IT's quite worth reading the comments also on each of these, particularly the second. I like the so-often Germanic completeness there, if would suggest that auto-reboot is not just for personal servers.
You can control time-of-day via the auto-cron setting, and if you need 100% uptime, this is very likely better managed (and likely only actually possible for many scenarios) by providing more than one load-balanced server, updating them in a sequence, which again the cron portion could be one way of handling.
