vServer/VPS: Getting Started

With your own vServer/VPS, you can use a variety of functions, which are explained in this article, that make it suitable for both simple and highly complex projects.

This article describes the first steps you need to take after setting up your VPS. In addition, the most important functions of the Cloud Panel are explained.

By default, your VPS is equipped with the following configuration:

Public IP:

With a Public IP, your server is accessible from the outside. This is necessary so that your customers can access your website. The server is provided by default with a public IPv4 address. If you need additional IPv4 addresses, you can create additional public IP addresses and assign them to the server.

The VPS also supports public IPv6 addresses. By default, no IPv6 address is assigned when a server is created. If necessary, you can create an public IPv6 address in the Cloud Panel  and assign it to your server.  

Additional information can be found here:

Create an additional public IPv4 or IPv6 address for your server

Assign IP address

Cloud Panel: Firewall

Due to security reasons, the server is always protected with an external hardware firewall, wich can be configured in the Cloud Panel. This firewall blocks incoming traffic for all ports except those configured in the rules.

By default, a firewall policy is configured according to the specific needs of the installed template: 

• Linux Server: allow incoming traffic for ports TCP 22, 80, 443 and 8443.

• Windows Server: allow incoming traffic for ports TCP 80, 443 and 3389.

• Plesk server: In addition to the ports enabled for your operating system, incoming traffic is allowed for TCP 8443, 8447, and TCP/UDP 53 ports.

• Cloud apps: When you create a server with a specific application like WordPress, a new firewall policy is automically configured. In this firewall policy, the same ports are shared for incoming traffic as in the linux policy. In addition, only the the specific ports, which are required by the the application, are opened in the firewall policy.

In the Firewall Policies section, you can manage the firewall policies. You can create new firewall policies and configure firewall rules for incoming traffic according to your needs. More information about firewall policies can be found here:

Firewall Policies

You can access your server directly via the public IP. However, to make your website easily accessible to your customers, you need a domain. Connect this domain to the static IP address, so that the domain points to your server. This is possible by configuring an A record (Address Resource Record) or an AAAA record.

Further information can be found here:

Order domain as IONOS customer

Configure domain in Plesk

Configuring Mail Servers with Plesk

Server monitoring

By default, your server is assigned a monitoring policy that monitors RAM, CPU, data transfer, and ping resources.

You can monitor the status of the server in the server details or in the Monitoring Center. If a limit value is exceeded, a warning is displayed in this area.

When you create a server, a default monitoring policy is automatically assigned. However, you can assign a different monitoring policy at any time. When you create a default monitoring policy, you can also specify that notifications should be sent to an email address of your choice.

Further information about monitoring policies can be found here

Monitoring

Backup your data

The protection of your server is crucial for the security of your data. This is particularly important in the event of a server failure. Therefore we strongly recommend you to create backups regularly.

Use the Backup Packages solution to create backups of your servers. This solution is is particularly useful for planned, medium and long-term backups. These backups are managed in the Backup Console, which can be opened via the Cloud Panel. To perform backups, you need to configure the backup agent on the server to be backed up and register the server in the Backup Console.Then you can create backup policies. With a backup policy, you can schedule the creation of security copies of your full server, files and folders or volumes according to your backup strategy.

Further information about the backup package can be found here:

Backup Packages

Firewall Configuration

A firewall is used to block incoming traffic. Open ports are used by hackers to attack and gain access to your infrastructure.  

By default, the firewall is configured to deny traffic for all ports. The ports that are enabled in the firewall policy are excluded. When the server is delivered, only the ports required to access the server or required by the installed application are whitelisted in the firewall.

Our recommendation is to keep all unnecessary ports closed by default in order to increase the security of your server. 

Further information about firewall policies can be found here:

Firewall Policies

Keep your operating system up to date

If you order a server from IONOS, it will always be shipped with the latest update, which is available for the operating system or distribution. Nevertheless, you should always keep the server up to date.

Operating system updates are mainly offered to implement new features or to fix bugs or vulnerabilities. If a vulnerability in the operating system of a server is not fixed, hackers can exploit the vulnerability to gain access to the server.  

We recommend that you update your operating system as security patches become available.

Security Recommendations for Linux Servers:

Public Key Authentication

The Public key authentication is a secure alternative to the well-known classic authentication with user name and password. The advantage of public key authentication is the higher security level, as SSH keys are much more complex and therefore more difficult to crack than passwords. 

This method uses a private and a public key to authenticate users. The public key must be stored in the Cloud Panel to enable public key authentication. You can then assign the public key to one or more servers during server creation. If necessary, you can also assign multiple public keys to a server. The public key is automatically entered into the file root/.ssh/authorized_keys during the creation of the server. The private key is stored locally on your own computer. After the server is created, the user can log on to the server without a login password using the public key. If necessary, enter the password with which the public key is protected.

To protect your server even more effectively, you can also disable the SSH password authentication. You can make this setting while creating a new server. If you disable the SSH password authentication, the user can only log on to the server using public-key authentication. Authentication by means of password input is only possible in this case if the user logs into the server using the KVM console or the VNC console.

If you use public-key authentication, no one can access your server without the private key. This safety measure significantly reduces the risk of being hacked.

Further information can be found here:

Generate SSH Keys

Using Public Key Authentication to Establish an SSH Connection with PuTTy

Additional Security Measures

Attackers can do considerable damage if they manage to penetrate a server to steal data, manipulate data, or disrupt the availability of the server. In order to protect a server and its services against attacks and failures, the protection of the operating system as well as the services and applications installed on it is of crucial importance. We therefore recommend the following additional security measures to increase the security level of your server: 

Use strong passwords

Strong passwords are very important for the security of your server, because they make it more difficult to potencial attackers to easily gain access to your server. The following recommendations and tips will help you create a secure password and protect your server from unauthorized access:

• Use a password that is not listed in dictionaries.

• A secure password does not contain a complete word.

• A secure password does not contain your username, real name or company name.

• Do not use data from your personal environment such as birthdays, names, etc..

• A secure password differs significantly from previous passwords you have used

A secure password contains:

• At least 8 characters

• Uppercase and lower case letters

• At least one number

• At least one special character

Use the principle of least privileges

The least privileged user account (LUA) approach is an important part of this defense strategy. e LUA approach requires that users are given only those privileges which are essential for their work. This strategy can significantly reduce malware risks and the risks associated to incorrect configurations, which are done accidentally.

Restrict access to the server

Allow only authorized users to access the server.

If your server is running but cannot be reached via SSH or Remote Desktop Connection, first check which firewall policy is assigned to the server. If port 3389 is not shared in the firewall policy, you cannot establish a remote desktop connection to the server. If port 22 is not shared in the firewall policy, you cannot establish an SSH connection to the server.

If you cannot establish a remote desktop connection (Microsoft Windows Server) or an SSH connection (Linux) despite sharing the above ports, you can use the KVM console to log into your server. The KVM console allows remote maintenance of your system just as if you were sitting right in front of it. You can track the system messages like on a "real" screen and interact with the server at any time. For example, the server can be booted with other boot options or even with an alternate image in case of startup problems. This makes the KVM console ideal for advanced troubleshooting.

If you do not have access to the server because you have forgotten your password, please follow the steps described in the following articles:

Reset Administrator Password (Microsoft Windows)

Reset Your Root Password (Linux)

If you have problems with the server, you can use the Knoppix DVD to boot from it. With Knoppix you have an operating system at your disposal with which you can check the operating system of your server and repair it if necessary. Furthermore, with Knoppix you can also save the data that is on the server, e.g. if the data structure of the file system was destroyed.