Small-server hygiene checklist

2026-06-21 · 4 min read

A short list I run through whenever I stand up a machine and then forget about it for a year. Nothing here is clever; the point is that all of it is easy to skip.

Before anything else

• Set the timezone to UTC and confirm the clock is synchronised. Log timestamps that drift are worse than no timestamps.
• Install a firewall and allow SSH before enabling it. This is the step people learn once.
• Add a second login method that does not depend on the network you are currently on.

Log rotation

The default logrotate configuration covers the usual paths. Anything writing to a custom location needs its own stanza, or the disk fills on the one week nobody is looking:

/var/log/myservice/*.log {
    weekly
    rotate 4
    compress
    missingok
    notifempty
}

Know what is listening

ss -tulpn

Run it once after setup and save the output. Six months later, this is the only reliable way to notice that something new opened a port.

Backups you have restored

An untested backup is a hypothesis. Restoring a single file once is enough to find the missing credentials, the wrong paths, and the exclude rule that quietly matched everything.