A dedicated chassis arrives with root and a public IP—useful power, also a scanner magnet until you harden it. The first 24 hours after EuroVDC delivery in Sofia (EU) should shrink the attack surface before DNS, panels or customer data land on the box. This checklist is operational, not theatrical.
Order capacity on dedicated server. Put admin paths behind Private VPN so SSH and panels are not world-open forever.
Hour 0–2: inventory and access
- Confirm IPMI/console credentials work before you change anything network-side.
- Record hostname, IPs, RAID state and OS image in your runbook.
- Create a named admin user; keep root for break-glass only.
- Install keys; disable password SSH as soon as key login works.
Hour 2–8: network and OS baseline
- Firewall default-deny: allow only what you need (22 temporarily, then VPN-only; 80/443 when the site is ready).
- Close unused services; uninstall default junk from the image if present.
- Apply security updates; reboot if the kernel demands it—better now than mid-campaign.
- Enable automatic security updates or a calendar reminder you will actually honour.
- Set timezone/NTP; wrong clocks break logs and TLS debugging.
- Configure fail2ban or equivalent on anything that must stay public.
Hour 8–16: admin path and secrets
- Stand up Private VPN (OpenVPN AS on a private VPS) and enrol only admin devices.
- Re-lock SSH/panel ports to the VPN subnet or dedicated VPN IP; drop the rest.
- Rotate any temporary passwords from delivery mail; store secrets in a vault, not chat.
- Document break-glass: provider console if the VPN host or firewall misconfiguration locks you out.
Hour 16–24: backups and proof
- Define what must be restored (OS config, DB, media) and where snapshots/off-box copies live.
- Run one restore smoke-test—even a tiny file—before calling the machine “production ready.”
- Turn on monitoring (disk, load, auth failures); alert someone who answers at night.
- Only then point DNS or move traffic.
Sofia placement keeps the metal in an EU context next to your other EuroVDC workloads. Hardening on day one beats rewriting incident notes on day three.
Frequently asked questions
Can I delay hardening until the app is installed?
No. Scanners find fresh IPs quickly. Baseline firewall and SSH first; apps second.
Is a non-default SSH port enough?
No—defence-in-depth only. Prefer VPN-only SSH plus keys, not obscurity alone.
Do I need Private VPN on day one?
Strongly recommended for admin access. EuroVDC Private VPN gives a dedicated OpenVPN AS exit you can allow-list.
What if I lock myself out?
Use IPMI/provider console as break-glass. Document that path before you tighten firewall rules.
Where does the server run?
EuroVDC dedicated servers are delivered in Sofia (EU).
How do I start?
Take delivery on dedicated server, complete this checklist, then add Private VPN before opening admin ports to the team.
