Introduction
Security is not a one‑time task. This article provides a maintenance checklist of recurring actions to keep your Hostxpeed VPS secure over time.
1. Daily – Check Security Alerts
Review email from fail2ban, logwatch, AIDE, and RKHunter. Look for anomalies.
2. Daily – Install Security Updates
Enable unattended upgrades for security patches. Manually review once a week.
3. Weekly – Review Authentication Logs
grep "Failed password" /var/log/auth.log – identify brute‑force patterns.
4. Weekly – Check Open Ports
sudo ss -tulpn to ensure no unexpected services are listening.
5. Weekly – List User Accounts
Check for unauthorised new users or changes to sudoers.
6. Weekly – Verify Cron Jobs
crontab -l for root and other users; look for suspicious entries.
7. Weekly – Run Lynis Quick Scan
sudo lynis audit system --quick to spot regression.
8. Weekly – Check Disk Usage
Full disks can cause service failure and are often caused by log flooding (attack).
9. Monthly – Full Lynis Audit
Run full audit and harden according to warnings.
10. Monthly – Check for OpenVAS/Nmap Vulnerabilities
Run external scan and remediate critical findings.
11. Monthly – Review User SSH Keys
Remove stale keys from authorized_keys files.
12. Monthly – Rotate Database Credentials
Change passwords for application database users where feasible.
13. Monthly – Test Backups
Perform a restore to a test VPS and verify integrity.
14. Quarterly – Full Security Audit
Include firewall rules, open ports, running processes, startup services.
15. Quarterly – Update Server Software
Apply minor version upgrades (PHP, MySQL, Nginx) that are not covered by unattended upgrades.
16. Quarterly – Re‑evaluate Hostxpeed Resources
Check if CPU/RAM usage warrants a plan upgrade to avoid resource exhaustion.
17. Semi‑Annually – Rotate SSH Host Keys
Regenerate /etc/ssh/ssh_host_*_key and distribute new fingerprints to users.
18. Semi‑Annually – SSL Certificate Audit
Check for expiring certificates, weak key lengths, and HSTS readiness.
19. Annually – Incident Response Drill
Simulate a breach, practice containment and recovery.
20. Annually – Rebuild VPS from Scratch
Provision new VPS, reinstall applications, migrate data – ensures no hidden persistence.
Conclusion
Create a calendar for these tasks. Automate where possible (updates, logwatch). Regular maintenance prevents security drift.