Installing Java 17 on Debian 13 and Debian 12
Debian 12 ships OpenJDK 17, Debian 13 no longer does. Here is how to install Java 17 on both, either with apt or through the Adoptium repository with Eclipse Temurin.
KernelHost Tutorials
Server Tutorials and Guides
Every guide here comes out of running our own network and is tested on real hardware before it goes live. Each command in these articles was executed exactly as written.
121
Guides
10
Topics
18
Languages
Topics
Most read
These are the guides our readers open most often.
Installing Java 8 and Java 11 on Debian 13 and Debian 12
Debian ships neither Java 8 nor, from Debian 12 onwards, Java 11. Here is how to install both versions cleanly with apt anyway, using the Adoptium repository and Eclipse Temurin.
Install a LAMP stack on Ubuntu 24.04 and 22.04: Apache2, PHP 8, MySQL and phpMyAdmin
Apache2, PHP 8, MySQL or MariaDB and phpMyAdmin on Ubuntu 24.04 LTS or 22.04 LTS: the complete setup step by step, including how to secure it afterwards.
All guides
Installing a Minecraft server on Debian or Ubuntu (Paper)
How to install a Minecraft server (Paper) on Debian or Ubuntu: from the right Java version through the download to a running server under screen.
Install a LAMP stack on Debian 13 and Debian 12: Apache2, PHP 8, MariaDB and phpMyAdmin
Apache2, PHP 8, MariaDB and phpMyAdmin on Debian 13 or Debian 12: the complete setup step by step, including hardening and troubleshooting.
Back up MySQL databases daily on Debian, Ubuntu and Linux
A small script plus a cron job is all it takes to back up every MySQL and MariaDB database in compressed form each night. Including the points where Debian and Ubuntu differ and a backup fails silently.
Install a TeamSpeak 3 server on Debian or Ubuntu
How to install your own TeamSpeak 3 server on Debian or Ubuntu: with a separate user, an accepted license, a saved Privilege Key and the right ports open.
Setting up a free SSL certificate with Let's Encrypt and Certbot
A free SSL certificate for your Linux server: install Certbot on Debian and Ubuntu, issue a Let's Encrypt certificate for Apache and let it renew itself automatically.
Game server DDoS protection with real-time filtering
Specialized DDoS protection for game servers: attacks are filtered in real time instead of taking the IP offline. With real attack cases from live operations.
Installing Java 8 and Java 11 on Ubuntu 24.04 and 22.04
Java 8 and Java 11 are still part of the official package sources on Ubuntu 24.04 LTS and 22.04 LTS. Here is how to install the version you need and set it as the default.
Which payment methods does KernelHost support?
Klarna, PayPal, paysafecard, card, Apple Pay, Google Pay and cryptocurrencies: which payment options KernelHost offers and how quickly an invoice counts as paid.
Installing Java 21 on Debian 13 and Debian 12
Java 21 is the current LTS release. Install it on Debian 13 straight from apt, on Debian 12 through the Adoptium repository, or as an Oracle package.
How can I protect my server from DDoS attacks?
Firewall rules kick in too late once the line is already congested. What actually helps: filtering in the network in front of the server, permanently active and without null-routing.
apt update fails: switching an old Debian release to the archive
Once a Debian release reaches its end of life, apt update aborts with a 404 error. Here is how to switch sources.list over to archive.debian.org and make the server updatable again.
Install a Minecraft Bedrock server with Nukkit on Debian or Ubuntu
Nukkit is a lean server software for the Minecraft Bedrock Edition. This guide walks through the complete installation on Debian and Ubuntu, from the Java package to a running server.
Minecraft DDoS Protection and Nullping Protection
Nullping attacks need barely any bandwidth and still take down entire BungeeCord networks. How the attack works and how it gets filtered out in real time.
Install your own mail server with Modoboa on Debian
The Modoboa installer sets up Postfix, Dovecot, webmail and SSL in a single run. Here is how to install your own mail server on Debian and set the DNS records it needs.
What is a DDoS attack? Technology, levels and defense
How a DDoS attack works in technical terms, which four finite resources it occupies, how to recognize it from your own measurements and where the defense on the server ends. With real attack cases from operations.
Install htop on AlmaLinux, Rocky Linux, RHEL and Oracle Linux
Two commands are enough on any system in the Red Hat family: enable EPEL, install htop. Why CRB and PowerTools are not needed for it, measured in real containers.
Game server DDoS protection: why only real-time filtering helps
Game servers need their own DDoS protection: UDP, freely chosen ports, sensitive latency. How permanent real-time filtering keeps the game online even while it is under attack.
Installing Node.js and npm on Debian
Node.js 10 and 12 have been out of support for years. Here is how to install the current LTS release together with npm on Debian, using NodeSource with the signing key in /etc/apt/keyrings.
Start a Minecraft server automatically: systemd service and cron job
After a server reboot your Minecraft server should come back up on its own. We show the systemd service unit as the clean way and the cron job with @reboot as the alternative.
Redirect HTTP to HTTPS with .htaccess (301 redirect)
Visitors still landing on the unencrypted page? A few lines in the .htaccess file are enough to redirect every HTTP request permanently to HTTPS with a 301 redirect.
Run programs automatically at server startup (systemd and cron)
How applications, game servers and scripts start by themselves after every reboot: with a systemd service unit as today's standard, or alternatively through a cron entry with @reboot.
Install Java 17 on Ubuntu 24.04 and Ubuntu 22.04
On Ubuntu 24.04 LTS and 22.04 LTS, OpenJDK 17 sits right in the official package sources. Here is how to install Java 17 without a PPA and set JAVA_HOME correctly.
Buy a server with Bitcoin (BTC)
Pay for your KernelHost server with Bitcoin and other cryptocurrencies: how the payment works, what to watch out for and why crypto counts as a secure payment method.
Change the RDP port on Windows without rebooting the server
A short PowerShell script changes the RDP port on Windows, creates the matching firewall rule and restarts the Remote Desktop service, with no server reboot.
Install a Hytale Server on Debian or Ubuntu
Step by step to your own Hytale server on Debian or Ubuntu: install Java 25, download the server files, create a start script and authenticate the server.
Protecting a Hytale server from DDoS attacks
Why a Hytale server needs exactly one port, what QUIC changes about the attack surface, which filter rule actually works, and from which attack size on only filtering in the network in front of the server helps.
RDP error: unlock a locked out Windows account (PowerShell)
A locked out Windows account on RDP login is usually the result of automated attacks. This PowerShell script unlocks the account, shows the source IPs and adjusts the lockout policy.
How long does a DDoS attack last? Two real cases from operations
Most DDoS attacks are over in minutes, some run for hours. This article shows both using real measurements: an attack at 745.5 Gbps and 73.1 million packets per second that ended after eight minutes, and one at 501.2 Gbps that ran for three hours and 31 minutes. Plus how to read an attack alert field by field, why packet rate often matters more than bandwidth, and why changing port or address would have helped in neither case.
Protecting Counter-Strike 1.6 and GoldSrc servers from DDoS attacks
GoldSrc is more than twenty-five years old and answers connectionless queries with no rate limit of its own. Which ports a Counter-Strike 1.6 server really needs, what the query limiter in GoldSrc is actually called, why RCON runs over UDP there, and at what attack size only filtering in the network helps.
Reporting a DDoS attack: preserve evidence, write the report, file it
The evidence for a DDoS attack exists only while it runs. What to preserve immediately, why the source address usually belongs to another victim, who to contact in which order, and what an abuse report has to contain.
Protecting your IP address while gaming: the real paths and the myths
Peer to peer lobbies, your own server list entry, old DNS records, public certificates and the headers of your own outgoing mail: the real paths through which an IP address becomes known, the myths around them, and what actually helps, sorted by effort.
Protecting a Minecraft proxy from DDoS attacks
Why reachable backend servers make every measure on the proxy useless, what separates BungeeCord ip_forward from Velocity modern forwarding, how to cap connections per source address, and from which attack size on only upstream filtering helps.
Protecting a Mumble Server from DDoS Attacks
The ping answer on 64738 UDP turns every Mumble server into a reflector for attacks on third parties. What allowping, bandwidth and the connection brake actually do, which configuration file applies after the rename, and where your own firewall stops.
Null routing explained: null route, RTBH and the difference from filtering
What null routing is in technical terms, how a null route travels through entire networks over BGP within seconds, why network operators set it, what it means for the customer on the receiving end and how to tell whether your own provider works this way.
Protecting RDP from DDoS attacks and brute force
Brute force, logon floods and volumetric DDoS all look alike on an RDP server and need opposite countermeasures. Tell the three apart by their signatures, lock down port 3389 properly, and know when only upstream filtering helps.
Protecting a VPN server from DDoS attacks
Why the address of a VPN server must be public and sits in every client file, what WireGuard does on its own with mac1 and the cookie reply, how tls-crypt relieves OpenVPN, and from which attack size on only filtering in the network in front of the server helps.
WordPress DDoS protection: why the plugin arrives too late
By the time a plugin sees the request, it has already passed nginx and occupied a PHP-FPM worker. The real ceiling is pm.max_children, which is why a Layer 7 attack of 2.4 Mbit/s takes a WordPress site down.
Mount a Storage Server as a network drive: Linux and Windows
How to mount your Storage Server like a local disk: on Linux as the directory /storage, on Windows as the network drive storage. Includes a permanent mount and help with error messages.
Docker Swarm Across Three Continents: High Availability Designed for 100% Uptime
One data center is a single point of failure. This article builds a Docker Swarm across three continents that can survive the loss of an entire location: manager quorum, WireGuard, one entry point per region, Geo-DNS failover, database replication and operations.
Connect an AI Agent to Your Server: How AI Deploys and Manages Your Server
An AI agent with SSH access reads logs, deploys changes, tests and documents. This field report shows the connection in seven steps, our workflow for deployments to production systems, the security rules and what the server needs to bring along.
Kubernetes Across Multiple Continents: Highly Available k3s and k8s in Data Centers Worldwide
Kubernetes across the US, Europe and Asia, built to tolerate the failure of an entire continent: why etcd cannot handle long distances, one k3s cluster per region, GitOps with Flux, GeoDNS failover, data across regions and how kubeadm differs.
Protecting an Arma 3 server from DDoS attacks
Which of the five UDP ports from 2302 to 2306 an Arma 3 server really needs, how to secure the Steam query, BattlEye RCon and the headless client, and from which packet rate on only upstream filtering helps.
Protecting a Call of Duty server from DDoS attacks
Which ports a Call of Duty server really needs, why game, query and RCON share one port, how to throttle getstatus reflection and RCON attacks, and from which attack size on only upstream filtering helps.
Protecting a Conan Exiles server from DDoS attacks
Which ports a Conan Exiles server really needs, how to secure RCON and the query port, why PvP servers get attacked inside the raid window, and from which attack size on only upstream filtering helps.
Protecting a DayZ server from DDoS attacks
Which ports a DayZ server really needs, how to secure the Steam query port, BattlEye RCon, the login queue and the startup phase after a restart, and from which attack size on only upstream filtering helps.
Protecting a Garry's Mod server from DDoS attacks
With Garry's Mod the game traffic and the server query run over the same port 27015. Which rules on the server actually work, how to secure RCON and Lua network events, and from which attack size on only upstream filtering helps.
Protecting a Left 4 Dead 2 server from DDoS attacks
Which ports a Left 4 Dead 2 server really needs, how to rate limit the A2S query on 27015/UDP without locking out your own players, what the lobby system achieves as an access filter, and at what attack size only filtering in the network in front of the server helps.
Protecting a Lineage 2 server from DDoS attacks
Which ports a private Lineage 2 server really needs, why the login server on port 2106 is the real target, why attacks cluster around server launches, and from which attack size on only upstream filtering helps.
Protecting a Minecraft Bedrock server from DDoS attacks
Which ports a Minecraft Bedrock server really needs, why RakNet over UDP without handshake protection is so exposed, how to secure query, RCON and packet rates, and from which attack size on only upstream filtering helps.
Protecting a Mordhau server from DDoS attacks
Which four UDP ports a Mordhau server really needs, how to secure query port 27015, beacon port 15000 and RCON, and from which attack size on only upstream filtering helps.
Protecting an MTA:SA server from DDoS attacks
An MTA:SA server offers three separate services: the game on 22003 UDP, the HTTP server on 22005 TCP and the ASE query on 22126 UDP. How to secure each of them, and from which attack size only filtering in the network in front of the server still helps.
Protecting a Palworld server from DDoS attacks
Which ports a Palworld server really needs, how to secure Steam query port 27015, RCON, the REST API and the 32 slots, and from which attack size on only filtering in the network in front of the server helps.
Protecting a Project Zomboid server from DDoS attacks
Which ports a dedicated Project Zomboid server really needs, which servertest.ini directives matter, why the mod check on connect makes the server vulnerable, and from which attack size on only upstream filtering still helps.
Protecting a RedM server from DDoS attacks
Which ports a RedM server really needs, how to secure the HTTP endpoints of the FXServer, txAdmin and the 32 slots, what VORP and RSGCore do differently from ESX, and from which attack size on only upstream filtering helps.
Protecting a Terraria server from DDoS attacks
Why Terraria speaks TCP only, which ports the server really needs, how to harden serverconfig.txt, TShock and the REST API on 7878, and from which attack size on only upstream filtering helps.
Team Fortress 2: protecting a TF2 server from DDoS attacks
Which ports a Team Fortress 2 server really needs, how to limit A2S queries, split packets, RCON and rates without dropping out of the server browser, and at what attack volume only filtering in front of the server still helps.
Protecting an Unturned server from DDoS attacks
Which ports an Unturned server really needs, why 27017 has been obsolete since 2021, how to limit query floods, join floods and plugin load, and from which attack size on only upstream filtering still helps.
AI Managed Server: Securely Connecting AI Agents Like Claude Code and ChatGPT to Your Own Server
AI agents can maintain servers, analyze logs and run deployments. This article explains the difference from a traditional managed server, the three architectures, the non-negotiable security rules, typical workflows, the costs and why KernelHost servers are fully compatible.
Setting Up Claude Code and ChatGPT Codex on a Linux Server: Step by Step
From a fresh Debian or Ubuntu installation to a working AI agent: user and sudo allowlist, Node.js 22, installing and signing in to Claude Code, Codex CLI and Gemini CLI, rules files, cron jobs, first tasks and the typical errors.
Your own VPN server instead of a VPN service: when it pays off
A VPN service, a WireGuard server you set up yourself or a ready-made Dedicated Private VPN Server: what a VPN does, what it costs and which route suits whom, with a comparison table and a worked example.
Renting a Minecraft server: which plan for 10, 20, 50 or 100 players
How much RAM does a Minecraft server need for 10, 20, 50 or 100 players? Rules of thumb by server type, how to set the heap correctly, what the game panel takes care of and which KernelHost plan fits, from MC-1 to Professional VDS.
Renting a server in Germany or Austria: location, latency and GDPR
Latency, jurisdiction and connectivity: why the server location decides things that no later upgrade can change, what Frankfurt at DE-CIX means for users in Vienna or Munich, and which points to check before you order.
VPS or dedicated server: which server fits which project
Shared or exclusive hardware, from €9.99 or from €69.99 a month: this comparison uses the four KernelHost server classes to show which server fits which project, with price tables, a decision matrix and three worked examples.
Windows VPS: what it is for and what size you need
Windows VPS or Linux VPS, and if Windows, how many cores, how much RAM and NVMe? A decision guide by use case, with a sizing table, the license question, hardening in five steps and the plans that fit.
Protecting an ARK server from DDoS attacks
Ports, a rate limit on the query port, RCON and real measurements: what you can secure on an ARK cluster yourself, and at what attack size that is no longer enough.
A backup strategy for root servers that holds up when it matters
The 3-2-1 rule on a single root server, restic and Borg with examples, retention and encryption. Plus the step almost everyone skips: actually testing the restore.
Protecting CS2 and Source servers from DDoS attacks
With Counter-Strike 2 and the Source titles, game traffic and the server query run over the same port 27015. What you can secure yourself, and at what attack volume only filtering in the network in front of the server still helps.
Protecting a FiveM server from DDoS attacks
Which ports a FiveM server really needs, how to secure the query endpoints, txAdmin, rate limits and the whitelist, and from which attack size on only upstream filtering helps.
Changing the hostname permanently on Linux: hostnamectl, /etc/hosts and cloud-init
hostnamectl, /etc/hostname and /etc/hosts working together, the switch against cloud-init resetting the name, and the effects on sudo, mail servers and certificates.
journalctl: analyzing systemd logs and keeping them permanently
Time windows, unit filters, priorities and search patterns: how to cut out exactly the section that belongs to the incident, in three or four commands. Plus a journal that survives reboots, with the error messages quoted verbatim.
Updating a Linux server safely with apt
The difference between upgrade, full-upgrade and dist-upgrade, packages kept back, dpkg configuration prompts, kernel reboots with needrestart, and the release upgrade as a category of its own.
Fixing nginx 504 Gateway Time-out: find the cause instead of raising the timeout
With a 504 the backend was reachable, it only answered too slowly. How to use a timing log to pin down where the time goes, which of the many timeouts really applies, and why a higher timeout usually only postpones the outage.
Calculating pm.max_children for PHP-FPM instead of guessing
The message server reached pm.max_children does not mean you should double the value. Measure, calculate, choose the process manager mode, and then prove that the value really fits.
Protecting RAGE MP and alt:V servers from DDoS attacks
RAGE MP listens on 22005 UDP and 22006 TCP, alt:V on 7788. This guide shows step by step what you can secure yourself and from which point on only filtering in the network in front of the server still helps.
Protecting a Rust server from DDoS attacks
Rust servers are almost always attacked at wipe or in the middle of a raid. What you can secure yourself, where self-protection hits physical limits, and what has to happen upstream in the network.
Protecting SA-MP and open.mp servers from DDoS attacks
SA-MP and open.mp handle game traffic, query and RCON over one single UDP port. This guide shows what you can secure yourself, and from which attack size only the filtering in the network in front of the server still helps.
Severe DDoS attack: what to do now
Record the measurements, close ports, limit the query port and packet rates: what really helps during a sustained DDoS attack. And from which size onwards only the filtering in front of the server works.
Set up simple server monitoring with built-in tools
A check script, a systemd timer and a tested notification path are enough for a single root server. This guide shows what to monitor, how to verify every step and when the big toolbox starts to pay off.
Changing the SSH port without locking yourself out: sshd, socket activation and SELinux
Changing the SSH port almost always fails on the order of the steps. This guide keeps the server listening on both ports while you work, so the old one only goes away once the new one is proven to work.
Creating a user with sudo privileges and no longer working as root
adduser vs useradd, the sudo and wheel groups, editing sudoers safely with visudo and the test that proves you have not locked yourself out before you switch root off.
Protecting a TeamSpeak 3 server from DDoS attacks
Close the query port, tighten anti-flood, set a rate limit: what you can secure on a TeamSpeak 3 server yourself. And where those measures stop, because the line in front of it is already full.
Setting up automatic security updates with unattended-upgrades
How to set up unattended-upgrades so that it really runs: allowed origins, excluded packages, reboot behavior, the mail report and the proof in the log that something actually happened.
Set up the time zone and time synchronization on a Linux server
A wrong server clock never shows up as a clock problem: it shows up as a rejected certificate, as a package source apt refuses, or as a cron job at the wrong hour. How to set the time zone and the time service correctly, and how to prove that synchronization is running.
Fixing the apt error "Could not get lock"
Why apt is suddenly locked, which process is behind it and how to find it with lsof and fuser. Plus how to remove the lock file without damaging the package database.
Detecting a DDoS attack: how to tell for certain
Not every overload is an attack. Here is how to use ss, packet counters, kernel messages and web server logs to tell a DDoS attack apart from a load spike or a software bug, beyond doubt.
Fixing the Java error "Unsupported class file major version"
The number in the error tells you everything: 52 is Java 8, 55 is Java 11, 61 is Java 17, 65 is Java 21. Here is how to find out which Java is really running and how to activate the right version.
Which Java version do I need? An overview for servers
Which Java version your application really needs, which one your distribution actually offers, and how to run several versions in parallel and switch between them cleanly.
Minecraft server: fixing "java.lang.OutOfMemoryError: Java heap space"
The message java.lang.OutOfMemoryError: Java heap space does not automatically mean too little RAM. How to size Xmx and Xms correctly, find memory leaks and use swap sensibly.
Minecraft server lag: finding and fixing the causes
Is it the server or the connection? Both feel identical but have completely different causes. Measure with TPS and Spark, pregenerate chunks and find the real culprit.
Reset the MySQL and MariaDB root password
Forgot the root password? Chances are you do not need one. And if you do: here is how to open the database for exactly one minute without handing it to half the internet.
Fixing the MySQL error "Can't connect through socket"
The socket error has five realistic causes. How to work out in five minutes which one you are dealing with, and why localhost and 127.0.0.1 are not the same thing.
Installing Nextcloud on your own server
From an empty server to an overview page without warnings: web server, PHP modules, database, data directory permissions, trusted_domains, upload limits and background jobs via cron.
Setting up nginx as a reverse proxy
From proxy_pass to the WebSocket upgrade: the complete guide to nginx as a reverse proxy, including the four headers without which your application thinks every visitor is 127.0.0.1.
Install the Pterodactyl Panel for game servers
Panel and Wings are two separate programs with two separate jobs. Once you have understood that, Pterodactyl installs in half an hour. If you have not, you spend days hunting for the error.
Secure RDP: protect Windows Server against attacks
A freshly installed Windows server collects thousands of failed RDP logons within hours. This guide shows which measures actually work, what each one costs you and how not to lock yourself out.
RDP error: Network Level Authentication failed
The RDP client gives up before you ever see a sign-in screen. The five realistic causes in order, each with the check command, the fix and the way in through the console.
Fixing the SSH error "Permission denied (publickey)"
Your SSH login fails with Permission denied (publickey)? Seven causes, from file permissions and AllowUsers through to SELinux, each with the exact log line and the matching fix.
Installing a game server with SteamCMD
SteamCMD is the shared foundation of almost every game server on Steam. This guide covers the installation, anonymous login, app_update with validate, running it as a systemd service and the typical error messages.
Migrating WordPress to a new server without downtime
The order is what decides it: prepare the new server, copy the data, test under the real domain via the hosts file, issue the certificate in advance, and only then switch DNS. With a rollback path and the error messages you will actually see.
Setting up Windows Server on a VPS: the first steps
The checklist for the time right after provisioning, in the correct order: check the license, set the password, time zone, updates, firewall, harden RDP, disks and roles. Including the places where it goes wrong.
Set up a cron job: schedule, permissions and the most common mistakes
The job runs in your shell but not in cron. This guide explains the five time fields, the difference between the user crontab and /etc/cron.d, the PATH trap and how to prove that a job really succeeded.
Installing Docker and Docker Compose on Debian and Ubuntu
Why docker.io is too old on Debian 12 but perfectly fine on Ubuntu, how to add the official repository with a keyring instead of apt-key, why Compose is a plugin now and why the docker group effectively means root.
Set up fail2ban and block brute force attacks automatically
How to configure fail2ban cleanly through jail.local, get the sshd jail running on all four current LTS distributions, verify and lift bans, and which mistakes will otherwise slow you down.
Disk full: finding and freeing up space on a Linux server
When df reports 100% and du finds nothing: the complete path from measuring to freeing up space, for Debian 12 and 13 as well as Ubuntu 22.04 and 24.04.
Let's Encrypt wildcard certificate over DNS validation
A wildcard certificate cannot be validated through the web server, it always goes through a TXT record in DNS. This guide shows the manual and the automatic route on Debian 13, Debian 12, Ubuntu 24.04 and Ubuntu 22.04, plus the errors it actually fails on.
Securing MariaDB and MySQL: the steps after installation
A database is not secure just because the package installed cleanly. This guide walks through mysql_secure_installation, settles the unix_socket question and shows how to give every application its own database user.
Fixing the MySQL error "Access denied for user"
Why "Access denied for user" usually has nothing to do with a wrong password: unix_socket, localhost versus 127.0.0.1, privileges and the safe root password reset.
Fixing nginx 502 Bad Gateway: causes and solutions
502 Bad Gateway means nginx got no valid response from the backend. The five most common causes, the matching line in the error log, and how to prove that the fix really works.
Installing and configuring nginx on Debian and Ubuntu
From the apt package to the first server block with PHP-FPM and HTTPS: which nginx version each distribution ships, what is different about the nginx.org repository, and how to get rid of the typical errors.
Setting up swap and preventing out of memory crashes
Service gone, no crash report, the log file ends mid-sentence: how to prove an OOM kill, create a swap file cleanly and tell when swap only postpones the problem.
Installing and setting up PostgreSQL on Debian and Ubuntu
Installation from the distribution package or the PGDG repo, first access through the postgres user, creating a database and a role, understanding pg_hba.conf and a backup that really holds up.
Setting up a new root server: checklist for the first 30 minutes
The first 30 minutes on a new root server decide how it will run. Nine steps in the right order, including the Debian 13 and Ubuntu 24.04 pitfalls that most guides leave out.
Securing SSH: key login, blocking root login, disabling password authentication
ed25519 on Linux, macOS and Windows, the cloud-init trap in /etc/ssh/sshd_config.d, socket activation on Ubuntu 24.04, proof through sudo sshd -T and the rescue route via the console.
Connecting to a server via SSH: Windows, macOS and Linux
The first SSH connection step by step: PuTTY and OpenSSH on Windows, Terminal on macOS and Linux, checking the fingerprint properly, transferring files and fixing the usual error messages.
Setting up a static IP address on Debian and Ubuntu
Fixed IPv4 and IPv6 addresses on Ubuntu 24.04, Ubuntu 22.04, Debian 13 and Debian 12: netplan, ifupdown and systemd-networkd compared, with a rollback strategy and extra IPs.
Create your own systemd service and run it automatically at boot
The unit file line by line: Type, User, WorkingDirectory, Restart and network-online.target. With the error messages verbatim and the proof that the service really survives a reboot.
Setting up the UFW firewall without locking yourself out
The correct order when building a UFW rule set, IPv6 rules, nftables as the backend, rate limiting with ufw limit and the way back in through the console if it does go wrong.
Set up a WireGuard VPN on your own server
From an empty server to a working WireGuard tunnel: key pairs, NAT with nftables, wg-quick as a service, a QR code for your phone and the three failure modes that really cost you time.
