How to Manage a VPS
Last updated
Was this helpful?
Last updated
Was this helpful?
By the end of this guide you should know how to set up, configure, and secure a VPS or dedicated server. The guide is useful for launching a Watcher instance or any blockchain node. It is required to have some basic knowledge of Linux.
A VPS is the most common way to run any blockchain infrastructure. It is a very efficient way to run a Watcher because it offers guaranteed uptime, redundancy in the case of hardware failure, and a static IP address that is required to use the installed Watcher instance during integration with the OMG Network. It is also possible to if you're an individual developer.
The guide is using as an example of VPS. However, , , , and are also popular choices. It's recommended to choose a provider that supports a Docker daemon and a Postgres database.
You need to have an account to start working with . After your account is set up, you can create your first project as follows:
Digital Ocean uses Droplets to create a new server, either standalone or as part of a larger, cloud-based infrastructure. To create a new Droplet, click on the New Droplet button.
There are a few things you need to configure before creating a Droplet. Consider using the following values:
Image: Ubuntu 16.04.6 (LTS) x64 or any other image that is listed on list.
Plan: Basic with the pricing that matches .
Block storage: —
Datacenter Region: depends on your preference.
VPC Network: —
Additional options: —
Authentication: password. It is recommended to use SSH for increased security. The password option was chosen because some of the VPS providers don't provide SSH authentication out of the box. You'll learn how to set up the SSH further in the guide.
The number of Droplets: 1.
Hostname: an identifying name for your host.
Tags: any tags that will help to organize your servers, such as watcher, omg-network, etc.
To finish the process, click the Create Droplet button. The creation of a Droplet might take a few minutes. As a result, you will see your server details as follows:
To connect to VPS, use ssh command from your terminal:
By default, OpenSSH Client is an optional feature. You need to install it if you're using it the first time with the following commands:
Go to Settings > Apps, select Manage optional features.
Click the Add a feature button.
Find OpenSSH Client, click Install.
Test if the client works with the ssh command in your terminal.
When you connect to the server the first time, it will show the following message:
Type yes. This will prompt you to enter a password. Note, all Linux systems don't reveal passwords when you type them, thus complete the process and click Enter. If your credentials are correct, you will see the following message:
Some of the server providers send the default login and password of the root user to your email. You must always change this password to a strong one. To change the password, use the passwd command. This will prompt you to type and repeat a new password. If everything is correct, you will see a success message:
It's not recommended to do any changes with the system under a root user due to security concerns. However, you can create a regular user and give super user rights to allow executing commands at root access without having all of the root access to modify system files. To create a new user, use the following command:
Fill $USER with the name of the user you want to use instead of root. Then repeat a password for this user twice, and you can skip the other parts by pressing Enter:
After a new user is created, one needs to have root access rights. This is accomplished with the following command:
This will add our user to a sudo group:
To test a connection with a new user, logout from your existing session and log in with the name of the user you've just created:
Make sure to have both root and your new user passwords saved before doing any of the steps below.
To prevent brute force login attempts to the root account, it's recommended to disable root login. This is accomplished by changing configs in the sshd_config file using nano or vi text editors:
To prevent from login into root user, scroll to the #Authentication section and change the PermitRootLogin key from yes to no as follows:
Press ctrl+o (Linux/Windows) or control+o (macOS) to save and Enter to confirm the changes respectively. Then exit the file with ctrl+x or control+x.
To apply the changes, restart SSH with the following command:
Now if you try to log into your server with root via SSH, it won't work and return the Permission denied, please try again message.
Another security measure to prevent people from making different types of attacks is to make it harder to find your SSH access port. You can change it in the sshd_config file by using the method from the previous step:
Scroll to the # What ports, IPs and protocols we listen for section and change the port number from 22 to any number higher than 100 or ideally 1000. Save the changes, restart the SSH, and logout from the server. If you try to access your server with default connections, you'll receive a Connection refused error. You'll need to specify a port number each time you login into the server as follows:
As was mentioned earlier, SSH keys allow a more secure method of authenticating to your server. To establish such a method, you need to have a pair of public and private keys on your laptop. Note, you should check for existing SSH keys and make a backup if they are available but you don't want to use them for this specific server.
Open a terminal and run the following command:
If you see No such file or directory, you don't have any SSH keys on your local computer. If you have a .shh folder but you're not sure if you have any existing keys, use this command:
If you have existing SSH keys but you don't want to use them, you can make a backup with the cp command:
If you don't have any keys, create a new pair from your terminal:
Open a command prompt and run the following command:
If you see No such file or directory, you don't have any SSH keys on your local computer. If you have a .shh folder but you're not sure if you have any existing keys, follow this command:
If you have existing SSH keys, but you don't want to use them, you can make a backup with the copy command:
If you don't have any keys, create a new pair from your command prompt:
You will be asked to choose the path to save the keys and a passphrase that will be used during login to the server. You can press Enter for both of the options to have a default path and no passphrase accordingly. If you're concerned that your SSH keys can be hacked or compromised, you might consider setting a password. The entire process will look as follows:
After you've generated the SSH keys, you need to copy the public key to your server. You can do that with the ssh-copy-id command:
Some of the versions of macOS may not support ssh-copy-id out of the box, so you need to install it first with brew or other alternatives:
Then you can copy the public key:
Windows currently doesn't support ssh-copy-id but you can use an alternative approach to achieve the same result. Run the following command from the Powershell as administrator:
If the keys were added successfully, you will be prompt to log in a passphrase you set up during SSH keys generation:
Otherwise, you will be logged in without a passphrase.
Disabling password logins is the last step of basic security measures for your server. Make sure to verify one more time that authentication with SSH keys works before disabling password logins. You can accomplish that with the following command:
You can disable password logins by changing the sshd_config file on your server as follows:
Scroll to # Change to no to disable tunneled clear text passwords section and change PasswordAuthentication from yes to no as follows:
Save the changes, close the file, and restart the SSH service:
By default, Linux servers are configured to listen on IPv6 ports in addition to the standard IPv4 ports. It's a common practice to disable IPv6 because it's not widely used yet and can cause certain issues with SSH. To remove IPv6 listening, run the following command:
Save the changes, close the file, and restart the SSH service. If you ever need IPv6 SSH back, remove the AddressFamily inet line.
A firewall is the last point of contact before anyone on the internet can get into your server. Getting a firewall up is crucial before deploying a server online. The example below demonstrates iptables as a way to set up Firewall rules. However, you may choose another software you're more comfortable with, such as ufw, firewalld, etc.
On Ubuntu, the easiest way to save iptables rules without a server reboot is to use the iptables-persistent package. You can install it with the following command:
During the installation, you will be prompt to save the current iptables rules. You can save them to be able to make a backup of the current configs in case something goes wrong.
Make sure to have two active SSH connections to your server (two terminals) before following the rest of the guide. This will help to change configs back without rebooting the server.
Open iptables file:
Add the following values:
If the file is not empty, replace it with the content above. Press ctrl+o (Linux/Windows) or control+o (macOS) to save and Enter to confirm the changes respectively. Then exit the file with ctrl+x or control+x.
iptables-restore is used to restore IP Tables from data specified on STDIN or in a file. The command should be used as follows:
If you are using Docker or any other virtualization software, you may need to restart their services after doing an iptables-restore:
To check if you set up everything properly, use nmap or netcat tools as follows:
Example output (for your server's port):
Example output (for the arbitrary port):
To install the dependencies, use the apt-get command as follows:
sendmailis an optional dependency used to send emails when new IP bans happen.
When the dependencies are installed correctly, Fail2Ban status should indicate active (running). You can verify this with the following command:
To define Fail2Ban rules, you need to create a configurations file:
Then, open the file in nano or vi text editor, paste the following values, and save the result:
After the changes are saved, restart the Fail2Ban service as follows:
Now, if anyone makes 3 failed attempts to log in to your server with the wrong SSH passphrase within 600 seconds, the corresponding IP will be banned for 3600 seconds.
After the Fail2Ban is configured, you can check its status with the following command:
Example output:
You can also poll the detailed status of individual jails, such as sshd:
Example output:
The SSH Client is available starting from version. For earlier versions, please use or other alternatives to connect to a remote server:
Note, $PORT is a port you're using to connect to the server via SSH. The default value is 22 but if you follow this guide, it should be different by now. See for reference.
Alternatively, you can use to achieve the same result.
scans log files and bans IPs that show malicious signs, such as too many password failures, seeking for exploits, etc. Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.
For setting up custom configurations, refer to .