[{"data":1,"prerenderedAt":2581},["ShallowReactive",2],{"guides-index":3},[4,827,1062,1157,1360,1742,2049,2229,2396],{"id":5,"title":6,"body":7,"date":810,"description":811,"draft":812,"extension":813,"featured":812,"keyTakeaway":814,"meta":815,"navigation":514,"path":816,"primaryKeyword":817,"seo":818,"service":819,"stem":820,"tags":821,"__hash__":826},"guides\u002Fguides\u002Fcyber-essentials-14-day-patching-linux.md","Cyber Essentials 14-day patching rule for Linux servers",{"type":8,"value":9,"toc":790},"minimark",[10,14,18,23,26,30,41,58,61,64,68,77,88,96,99,102,106,111,150,157,190,205,209,223,230,234,263,270,288,307,311,315,362,365,381,385,401,408,430,433,464,467,471,474,477,535,546,557,561,564,637,640,662,666,672,686,692,742,745,751,755,758,775,779,786],[11,12,6],"h1",{"id":13},"cyber-essentials-14-day-patching-rule-for-linux-servers",[15,16,17],"p",{},"For small UK tech firms and agencies with a handful of Linux servers or VPSs, preparing for Cyber Essentials and wondering what the patching rule means in practice.",[19,20,22],"h2",{"id":21},"key-takeaway","Key takeaway",[15,24,25],{},"Since the April 2026 changes, missing high-risk or critical updates within 14 days of release is an automatic fail. On Linux that means: know every server you run, check security updates at least weekly, apply them automatically where you can, reboot for kernel fixes, and keep dated records that prove it.",[19,27,29],{"id":28},"what-changed-in-april-2026","What changed in April 2026",[15,31,32,33,40],{},"IASME's ",[34,35,39],"a",{"href":36,"rel":37},"https:\u002F\u002Fiasme.co.uk\u002Farticles\u002Fimportant-update-changes-to-cyber-essentials-for-april-2026\u002F",[38],"nofollow","February 2026 update on the scheme changes"," lists two security update questions that are now \"auto-fail\":",[42,43,44,52],"ul",{},[45,46,47,51],"li",{},[48,49,50],"strong",{},"A6.4:"," are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?",[45,53,54,57],{},[48,55,56],{},"A6.5:"," the same question for applications, including associated files and extensions.",[15,59,60],{},"Failing either one fails the whole assessment, however well you do elsewhere. IASME says the changes apply to assessment accounts created after 26 April 2026, alongside Requirements for IT Infrastructure v3.3 and the new Danzell question set. If your account was created before that date, you have six months to get certified using the previous version of the requirements.",[15,62,63],{},"IASME also says the \"point in time\" for the assessment is the date the certificate is issued, so your systems must be supported on that date. And the director's declaration now confirms you'll stay compliant for the whole certification period, not just on assessment day.",[19,65,67],{"id":66},"what-counts-as-high-risk-or-critical","What counts as high-risk or critical",[15,69,70,71,76],{},"The NCSC's ",[34,72,75],{"href":73,"rel":74},"https:\u002F\u002Fwww.ncsc.gov.uk\u002Ffiles\u002Fcyber-essentials-requirements-for-it-infrastructure-v3-3.pdf",[38],"Cyber Essentials: Requirements for IT Infrastructure v3.3"," says in-scope software must be licensed and supported, have automatic updates turned on where possible, and be updated within 14 days of release where:",[42,78,79,82,85],{},[45,80,81],{},"the vendor describes the vulnerabilities as \"critical\" or \"high risk\"",[45,83,84],{},"the vulnerabilities have a CVSS v3 base score of 7 or above",[45,86,87],{},"the vendor gives no details about how severe the vulnerabilities are",[15,89,90,91,95],{},"If an update fixes several issues and any one of them is critical or high risk, the whole update has to go on within 14 days. The NCSC also recommends, though it isn't mandatory, applying ",[92,93,94],"em",{},"all"," updates within 14 days.",[15,97,98],{},"On Linux, vendor terms vary. Red Hat-family distributions use Critical, Important, Moderate and Low. Ubuntu and Debian publish priorities in their security notices and trackers. If you're unsure, use the CVSS score, or treat the update as in scope. The 14 days start when the vendor releases the fix, not when your scanner first notices it.",[15,100,101],{},"The simplest approach on a server is to install every security update within 14 days, rather than sorting them one by one.",[19,103,105],{"id":104},"debian-and-ubuntu","Debian and Ubuntu",[107,108,110],"h3",{"id":109},"see-pending-updates","See pending updates",[112,113,118],"pre",{"className":114,"code":115,"language":116,"meta":117,"style":117},"language-bash shiki shiki-themes github-dark","sudo apt update\napt list --upgradable\n","bash","",[119,120,121,137],"code",{"__ignoreMap":117},[122,123,126,130,134],"span",{"class":124,"line":125},"line",1,[122,127,129],{"class":128},"svObZ","sudo",[122,131,133],{"class":132},"sU2Wk"," apt",[122,135,136],{"class":132}," update\n",[122,138,140,143,146],{"class":124,"line":139},2,[122,141,142],{"class":128},"apt",[122,144,145],{"class":132}," list",[122,147,149],{"class":148},"sDLfK"," --upgradable\n",[15,151,152,153,156],{},"On Ubuntu, security fixes come from the ",[119,154,155],{},"-security"," pocket, so you can filter for them:",[112,158,160],{"className":114,"code":159,"language":116,"meta":117,"style":117},"apt list --upgradable 2>\u002Fdev\u002Fnull | grep -- '-security'\n",[119,161,162],{"__ignoreMap":117},[122,163,164,166,168,171,175,178,181,184,187],{"class":124,"line":125},[122,165,142],{"class":128},[122,167,145],{"class":132},[122,169,170],{"class":148}," --upgradable",[122,172,174],{"class":173},"snl16"," 2>",[122,176,177],{"class":132},"\u002Fdev\u002Fnull",[122,179,180],{"class":173}," |",[122,182,183],{"class":128}," grep",[122,185,186],{"class":148}," --",[122,188,189],{"class":132}," '-security'\n",[15,191,192,193,196,197,200,201,204],{},"On Debian, security updates come from the ",[119,194,195],{},"security.debian.org"," (",[119,198,199],{},"bookworm-security",", ",[119,202,203],{},"trixie-security",") suite. Check that it's in your sources, then use the same listing.",[107,206,208],{"id":207},"apply-them","Apply them",[112,210,212],{"className":114,"code":211,"language":116,"meta":117,"style":117},"sudo apt upgrade\n",[119,213,214],{"__ignoreMap":117},[122,215,216,218,220],{"class":124,"line":125},[122,217,129],{"class":128},[122,219,133],{"class":132},[122,221,222],{"class":132}," upgrade\n",[15,224,225,226,229],{},"Use ",[119,227,228],{},"sudo apt full-upgrade"," when an update needs to add or remove packages, for example new kernel packages on some releases. Check what it plans to remove before you confirm.",[107,231,233],{"id":232},"automate-with-unattended-upgrades","Automate with unattended-upgrades",[112,235,237],{"className":114,"code":236,"language":116,"meta":117,"style":117},"sudo apt install unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n",[119,238,239,251],{"__ignoreMap":117},[122,240,241,243,245,248],{"class":124,"line":125},[122,242,129],{"class":128},[122,244,133],{"class":132},[122,246,247],{"class":132}," install",[122,249,250],{"class":132}," unattended-upgrades\n",[122,252,253,255,258,261],{"class":124,"line":139},[122,254,129],{"class":128},[122,256,257],{"class":132}," dpkg-reconfigure",[122,259,260],{"class":148}," -plow",[122,262,250],{"class":132},[15,264,265,266,269],{},"This turns on the daily periodic job in ",[119,267,268],{},"\u002Fetc\u002Fapt\u002Fapt.conf.d\u002F20auto-upgrades",". By default it installs updates from the security origin only. To check what it would do:",[112,271,273],{"className":114,"code":272,"language":116,"meta":117,"style":117},"sudo unattended-upgrade --dry-run --debug\n",[119,274,275],{"__ignoreMap":117},[122,276,277,279,282,285],{"class":124,"line":125},[122,278,129],{"class":128},[122,280,281],{"class":132}," unattended-upgrade",[122,283,284],{"class":148}," --dry-run",[122,286,287],{"class":148}," --debug\n",[15,289,290,291,294,295,298,299,302,303,306],{},"It logs to ",[119,292,293],{},"\u002Fvar\u002Flog\u002Funattended-upgrades\u002F",". If a server must reboot itself at a set time, look at ",[119,296,297],{},"Unattended-Upgrade::Automatic-Reboot"," and ",[119,300,301],{},"Automatic-Reboot-Time"," in ",[119,304,305],{},"\u002Fetc\u002Fapt\u002Fapt.conf.d\u002F50unattended-upgrades",".",[19,308,310],{"id":309},"rhel-rocky-linux-and-almalinux","RHEL, Rocky Linux and AlmaLinux",[107,312,314],{"id":313},"see-pending-security-updates","See pending security updates",[112,316,318],{"className":114,"code":317,"language":116,"meta":117,"style":117},"sudo dnf updateinfo list --security\nsudo dnf updateinfo list --sec-severity=Critical\nsudo dnf updateinfo list --sec-severity=Important\n",[119,319,320,335,348],{"__ignoreMap":117},[122,321,322,324,327,330,332],{"class":124,"line":125},[122,323,129],{"class":128},[122,325,326],{"class":132}," dnf",[122,328,329],{"class":132}," updateinfo",[122,331,145],{"class":132},[122,333,334],{"class":148}," --security\n",[122,336,337,339,341,343,345],{"class":124,"line":139},[122,338,129],{"class":128},[122,340,326],{"class":132},[122,342,329],{"class":132},[122,344,145],{"class":132},[122,346,347],{"class":148}," --sec-severity=Critical\n",[122,349,351,353,355,357,359],{"class":124,"line":350},3,[122,352,129],{"class":128},[122,354,326],{"class":132},[122,356,329],{"class":132},[122,358,145],{"class":132},[122,360,361],{"class":148}," --sec-severity=Important\n",[107,363,208],{"id":364},"apply-them-1",[112,366,368],{"className":114,"code":367,"language":116,"meta":117,"style":117},"sudo dnf upgrade --security\n",[119,369,370],{"__ignoreMap":117},[122,371,372,374,376,379],{"class":124,"line":125},[122,373,129],{"class":128},[122,375,326],{"class":132},[122,377,378],{"class":132}," upgrade",[122,380,334],{"class":148},[107,382,384],{"id":383},"automate-with-dnf-automatic","Automate with dnf-automatic",[112,386,388],{"className":114,"code":387,"language":116,"meta":117,"style":117},"sudo dnf install dnf-automatic\n",[119,389,390],{"__ignoreMap":117},[122,391,392,394,396,398],{"class":124,"line":125},[122,393,129],{"class":128},[122,395,326],{"class":132},[122,397,247],{"class":132},[122,399,400],{"class":132}," dnf-automatic\n",[15,402,403,404,407],{},"In ",[119,405,406],{},"\u002Fetc\u002Fdnf\u002Fautomatic.conf",", set:",[112,409,413],{"className":410,"code":411,"language":412,"meta":117,"style":117},"language-ini shiki shiki-themes github-dark","[commands]\nupgrade_type = security\napply_updates = yes\n","ini",[119,414,415,420,425],{"__ignoreMap":117},[122,416,417],{"class":124,"line":125},[122,418,419],{},"[commands]\n",[122,421,422],{"class":124,"line":139},[122,423,424],{},"upgrade_type = security\n",[122,426,427],{"class":124,"line":350},[122,428,429],{},"apply_updates = yes\n",[15,431,432],{},"Then turn on the timer:",[112,434,436],{"className":114,"code":435,"language":116,"meta":117,"style":117},"sudo systemctl enable --now dnf-automatic.timer\nsystemctl list-timers dnf-automatic.timer\n",[119,437,438,454],{"__ignoreMap":117},[122,439,440,442,445,448,451],{"class":124,"line":125},[122,441,129],{"class":128},[122,443,444],{"class":132}," systemctl",[122,446,447],{"class":132}," enable",[122,449,450],{"class":148}," --now",[122,452,453],{"class":132}," dnf-automatic.timer\n",[122,455,456,459,462],{"class":124,"line":139},[122,457,458],{"class":128},"systemctl",[122,460,461],{"class":132}," list-timers",[122,463,453],{"class":132},[15,465,466],{},"(This is the dnf 4 setup used on RHEL 8 and 9 and their rebuilds. Newer dnf5-based releases package it differently, so check your distribution's docs.)",[19,468,470],{"id":469},"kernel-updates-reboots-and-live-patching","Kernel updates, reboots and live patching",[15,472,473],{},"A new kernel doesn't protect you until the server is running it. Installed but not booted doesn't count as patched in any useful sense.",[15,475,476],{},"Check whether a reboot is needed:",[112,478,480],{"className":114,"code":479,"language":116,"meta":117,"style":117},"# Ubuntu (and Debian where the flag is created)\nls \u002Fvar\u002Frun\u002Freboot-required 2>\u002Fdev\u002Fnull && cat \u002Fvar\u002Frun\u002Freboot-required.pkgs\n\n# RHEL family (dnf-plugins-core)\nsudo dnf needs-restarting -r\n",[119,481,482,488,510,516,522],{"__ignoreMap":117},[122,483,484],{"class":124,"line":125},[122,485,487],{"class":486},"sAwPA","# Ubuntu (and Debian where the flag is created)\n",[122,489,490,493,496,498,500,504,507],{"class":124,"line":139},[122,491,492],{"class":128},"ls",[122,494,495],{"class":132}," \u002Fvar\u002Frun\u002Freboot-required",[122,497,174],{"class":173},[122,499,177],{"class":132},[122,501,503],{"class":502},"s95oV"," && ",[122,505,506],{"class":128},"cat",[122,508,509],{"class":132}," \u002Fvar\u002Frun\u002Freboot-required.pkgs\n",[122,511,512],{"class":124,"line":350},[122,513,515],{"emptyLinePlaceholder":514},true,"\n",[122,517,519],{"class":124,"line":518},4,[122,520,521],{"class":486},"# RHEL family (dnf-plugins-core)\n",[122,523,525,527,529,532],{"class":124,"line":524},5,[122,526,129],{"class":128},[122,528,326],{"class":132},[122,530,531],{"class":132}," needs-restarting",[122,533,534],{"class":148}," -r\n",[15,536,537,538,541,542,545],{},"Compare ",[119,539,540],{},"uname -r"," with the newest kernel package installed. The ",[119,543,544],{},"needrestart"," package on Debian and Ubuntu also shows which services are still running old libraries after an update.",[15,547,548,549,552,553,556],{},"Live patching can close the gap between reboots for some kernel fixes. On Ubuntu, Canonical Livepatch comes with Ubuntu Pro (",[119,550,551],{},"sudo pro enable livepatch",", then ",[119,554,555],{},"canonical-livepatch status","). On RHEL, kpatch is available through Red Hat subscriptions. Live patches don't cover every fix, so you still need to plan reboots. A scheduled monthly reboot window, plus extra reboots for urgent kernel fixes, works for most small estates.",[19,558,560],{"id":559},"keep-evidence-of-patch-dates","Keep evidence of patch dates",[15,562,563],{},"You may need to show when updates went on. Linux already records this, so keep the records and don't let them rotate away:",[112,565,567],{"className":114,"code":566,"language":116,"meta":117,"style":117},"# Debian\u002FUbuntu: what was installed and when\nzgrep -h -E '^(Start-Date|Upgrade|Install):' \u002Fvar\u002Flog\u002Fapt\u002Fhistory.log*\n\n# RHEL family\nsudo dnf history\nsudo dnf history info \u003CID>\n",[119,568,569,574,594,598,603,612],{"__ignoreMap":117},[122,570,571],{"class":124,"line":125},[122,572,573],{"class":486},"# Debian\u002FUbuntu: what was installed and when\n",[122,575,576,579,582,585,588,591],{"class":124,"line":139},[122,577,578],{"class":128},"zgrep",[122,580,581],{"class":148}," -h",[122,583,584],{"class":148}," -E",[122,586,587],{"class":132}," '^(Start-Date|Upgrade|Install):'",[122,589,590],{"class":132}," \u002Fvar\u002Flog\u002Fapt\u002Fhistory.log",[122,592,593],{"class":148},"*\n",[122,595,596],{"class":124,"line":350},[122,597,515],{"emptyLinePlaceholder":514},[122,599,600],{"class":124,"line":518},[122,601,602],{"class":486},"# RHEL family\n",[122,604,605,607,609],{"class":124,"line":524},[122,606,129],{"class":128},[122,608,326],{"class":132},[122,610,611],{"class":132}," history\n",[122,613,615,617,619,622,625,628,631,634],{"class":124,"line":614},6,[122,616,129],{"class":128},[122,618,326],{"class":132},[122,620,621],{"class":132}," history",[122,623,624],{"class":132}," info",[122,626,627],{"class":173}," \u003C",[122,629,630],{"class":132},"I",[122,632,633],{"class":502},"D",[122,635,636],{"class":173},">\n",[15,638,639],{},"Practical habits:",[42,641,642,645,648,659],{},[45,643,644],{},"Keep a simple asset list: hostname, provider, OS and version, end-of-support date, owner.",[45,646,647],{},"Once a month, export the update history and the output of the pending-updates command for each server, and store it outside the server itself.",[45,649,650,651,654,655,658],{},"Note the date of each kernel reboot (",[119,652,653],{},"last reboot"," or ",[119,656,657],{},"uptime -s",").",[45,660,661],{},"Write down your process in a few lines: how often you check, what's automatic, who reboots, and when.",[19,663,665],{"id":664},"common-gaps","Common gaps",[15,667,668,671],{},[48,669,670],{},"Forgotten VPSs."," The staging box, the old client site, the test droplet someone made two years ago. If it's in scope, it needs patching. If it isn't needed, switch it off. Check every provider account, not just the main one.",[15,673,674,677,678,681,682,685],{},[48,675,676],{},"Unsupported OS releases."," If a release is past end of support, no security fixes arrive, so you can't meet the requirement. Check ",[119,679,680],{},"\u002Fetc\u002Fos-release"," against the vendor's lifecycle page. For Ubuntu LTS releases past standard support, Expanded Security Maintenance through Ubuntu Pro may keep them supported (",[119,683,684],{},"pro status"," shows coverage). Otherwise, plan the upgrade or migration well before your certificate date.",[15,687,688,691],{},[48,689,690],{},"Container base images."," Updating the host doesn't update the software inside your containers. Rebuild images regularly from a current, supported base and redeploy:",[112,693,695],{"className":114,"code":694,"language":116,"meta":117,"style":117},"docker build --pull --no-cache -t myapp:latest .\ndocker compose pull && docker compose up -d\n",[119,696,697,720],{"__ignoreMap":117},[122,698,699,702,705,708,711,714,717],{"class":124,"line":125},[122,700,701],{"class":128},"docker",[122,703,704],{"class":132}," build",[122,706,707],{"class":148}," --pull",[122,709,710],{"class":148}," --no-cache",[122,712,713],{"class":148}," -t",[122,715,716],{"class":132}," myapp:latest",[122,718,719],{"class":132}," .\n",[122,721,722,724,727,730,732,734,736,739],{"class":124,"line":139},[122,723,701],{"class":128},[122,725,726],{"class":132}," compose",[122,728,729],{"class":132}," pull",[122,731,503],{"class":502},[122,733,701],{"class":128},[122,735,726],{"class":132},[122,737,738],{"class":132}," up",[122,740,741],{"class":148}," -d\n",[15,743,744],{},"Pin to supported base image tags. Old tags such as an end-of-life Debian or Alpine version quietly stop getting fixes.",[15,746,747,750],{},[48,748,749],{},"Software outside the package manager."," Tarball installs, vendored binaries, language runtimes and third-party repositories sit outside the commands above. A6.5 covers applications too, so list these and track their updates.",[19,752,754],{"id":753},"where-i-can-help","Where I can help",[15,756,757],{},"I'm a Linux server support and security freelancer, and I was previously Head of Professional Services at CrowdSec. I help firms put the patching process, automation and evidence in place to meet the 14-day rule. I'm not a certification body and I don't carry out Cyber Essentials assessments.",[42,759,760,768],{},[45,761,762,763,767],{},"A ",[34,764,766],{"href":765},"\u002Flinux-server-security-review","Linux server security review"," (from £295 per server) checks update configuration, OS support status, reboot gaps, exposed services and evidence, and gives you a prioritised fix list.",[45,769,770,774],{},[34,771,773],{"href":772},"\u002Flinux-server-support#ongoing-support","Ongoing Linux server support"," (from £195\u002Fmonth) includes up to two support hours a month for checking updates, reboots and keeping records up to date. It doesn't include monitoring or 24\u002F7 cover.",[19,776,778],{"id":777},"practical-next-step","Practical next step",[15,780,781,782,306],{},"List every Linux server you run, run the pending-security-updates command on each one this week, and turn on automatic security updates where it's safe to do so. If you'd like a second pair of eyes, ",[34,783,785],{"href":784},"\u002Fcontact","book a free call",[787,788,789],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}",{"title":117,"searchDepth":139,"depth":139,"links":791},[792,793,794,795,800,805,806,807,808,809],{"id":21,"depth":139,"text":22},{"id":28,"depth":139,"text":29},{"id":66,"depth":139,"text":67},{"id":104,"depth":139,"text":105,"children":796},[797,798,799],{"id":109,"depth":350,"text":110},{"id":207,"depth":350,"text":208},{"id":232,"depth":350,"text":233},{"id":309,"depth":139,"text":310,"children":801},[802,803,804],{"id":313,"depth":350,"text":314},{"id":364,"depth":350,"text":208},{"id":383,"depth":350,"text":384},{"id":469,"depth":139,"text":470},{"id":559,"depth":139,"text":560},{"id":664,"depth":139,"text":665},{"id":753,"depth":139,"text":754},{"id":777,"depth":139,"text":778},"2026-10-12","How to meet the Cyber Essentials 14-day patching rule on Linux servers, with apt and dnf commands, automatic updates, kernel reboots and patch evidence.",false,"md",null,{},"\u002Fguides\u002Fcyber-essentials-14-day-patching-linux","cyber essentials 14 day patching linux",{"title":6,"description":811},"security-review","guides\u002Fcyber-essentials-14-day-patching-linux",[822,823,824,825],"cyber-essentials","patching","linux","security","j5ACOQC77Tn406QBIQWw1EX8nPEQYbv3V0glQCvtsG4",{"id":828,"title":829,"body":830,"date":1050,"description":1051,"draft":812,"extension":813,"featured":812,"keyTakeaway":814,"meta":1052,"navigation":514,"path":1053,"primaryKeyword":1054,"seo":1055,"service":1056,"stem":1057,"tags":1058,"__hash__":1061},"guides\u002Fguides\u002Fdocker-ufw-published-ports.md","Docker and UFW — why published ports ignore your firewall",{"type":8,"value":831,"toc":1042},[832,835,838,840,847,851,862,865,869,909,912,985,988,992,1018,1022,1030,1032,1039],[11,833,829],{"id":834},"docker-and-ufw-why-published-ports-ignore-your-firewall",[15,836,837],{},"For operators running Docker on a Linux VPS who thought UFW was blocking a port — and discovered the internet could still reach it.",[19,839,22],{"id":21},[15,841,842,843,846],{},"On Linux, Docker often inserts its own firewall rules for published ports. Traffic can reach a container ",[48,844,845],{},"before"," it hits the UFW chains you configured. Binding app ports to localhost and exposing only a reverse proxy (80\u002F443) is the practical fix for most single-host setups.",[19,848,850],{"id":849},"what-usually-goes-wrong","What usually goes wrong",[15,852,853,854,857,858,861],{},"You enable UFW, allow 22\u002F80\u002F443, and deny everything else. Then you publish a container with ",[119,855,856],{},"-p 8080:80"," or Compose ",[119,859,860],{},"ports: [\"3000:3000\"]",". From outside, port 3000 still answers.",[15,863,864],{},"That is not UFW \"failing\" in the usual sense. Docker manages related iptables\u002Fnftables rules for bridge networking and port publishing. Published container traffic can be diverted in ways that bypass the host INPUT path UFW users expect.",[19,866,868],{"id":867},"practical-pattern-for-one-vps","Practical pattern for one VPS",[870,871,872,878,888,897,903],"ol",{},[45,873,874,877],{},[48,875,876],{},"Public edge:"," reverse proxy only on 80 and 443 (nginx, Caddy, or Traefik).",[45,879,880,883,884,887],{},[48,881,882],{},"App containers:"," no public host ports — or bind to ",[119,885,886],{},"127.0.0.1"," if the proxy runs on the host.",[45,889,890,893,894,306],{},[48,891,892],{},"Databases \u002F admin UIs:"," private Docker networks only; never publish to ",[119,895,896],{},"0.0.0.0",[45,898,899,902],{},[48,900,901],{},"SSH:"," still controlled separately (keys, who can log in, ideally source limits).",[45,904,905,908],{},[48,906,907],{},"Cloud firewall:"," if your provider has one, allow only 22\u002F80\u002F443 at that layer too.",[15,910,911],{},"Example Compose idea (illustrative):",[112,913,917],{"className":914,"code":915,"language":916,"meta":117,"style":117},"language-yaml shiki shiki-themes github-dark","services:\n  app:\n    # reachable only on the Docker network \u002F localhost\n    ports:\n      - \"127.0.0.1:8080:80\"\n  proxy:\n    ports:\n      - \"80:80\"\n      - \"443:443\"\n","yaml",[119,918,919,928,935,940,947,955,962,969,977],{"__ignoreMap":117},[122,920,921,925],{"class":124,"line":125},[122,922,924],{"class":923},"s4JwU","services",[122,926,927],{"class":502},":\n",[122,929,930,933],{"class":124,"line":139},[122,931,932],{"class":923},"  app",[122,934,927],{"class":502},[122,936,937],{"class":124,"line":350},[122,938,939],{"class":486},"    # reachable only on the Docker network \u002F localhost\n",[122,941,942,945],{"class":124,"line":518},[122,943,944],{"class":923},"    ports",[122,946,927],{"class":502},[122,948,949,952],{"class":124,"line":524},[122,950,951],{"class":502},"      - ",[122,953,954],{"class":132},"\"127.0.0.1:8080:80\"\n",[122,956,957,960],{"class":124,"line":614},[122,958,959],{"class":923},"  proxy",[122,961,927],{"class":502},[122,963,965,967],{"class":124,"line":964},7,[122,966,944],{"class":923},[122,968,927],{"class":502},[122,970,972,974],{"class":124,"line":971},8,[122,973,951],{"class":502},[122,975,976],{"class":132},"\"80:80\"\n",[122,978,980,982],{"class":124,"line":979},9,[122,981,951],{"class":502},[122,983,984],{"class":132},"\"443:443\"\n",[15,986,987],{},"Exact compose depends on whether the proxy is on the host or in the same Compose file.",[19,989,991],{"id":990},"how-to-check-exposure","How to check exposure",[42,993,994,1001,1011],{},[45,995,996,997,1000],{},"From another network: ",[119,998,999],{},"nmap"," \u002F browser to unexpected high ports",[45,1002,1003,1004,1007,1008],{},"On the host: ",[119,1005,1006],{},"ss -tulpn"," and review Compose ",[119,1009,1010],{},"ports:",[45,1012,1013,1014,1017],{},"Do not assume ",[119,1015,1016],{},"ufw status"," alone proves a Docker-published port is closed",[19,1019,1021],{"id":1020},"what-a-hardening-pass-usually-adds","What a hardening pass usually adds",[15,1023,1024,1025,1029],{},"For one Linux host this often means: agree the public surface, fix published ports, tighten SSH, document recovery, and verify after changes. That is the shape of a ",[34,1026,1028],{"href":1027},"\u002Fserver-hardening","server hardening"," engagement (from £650), not a quick firewall toggle.",[19,1031,778],{"id":777},[15,1033,1034,1035,1038],{},"If Docker and the host firewall disagree on your VPS, start with a scoped hardening pass — or ",[34,1036,1037],{"href":784},"book a free 15-minute intro call"," to check fit first.",[787,1040,1041],{},"html pre.shiki code .s4JwU, html code.shiki .s4JwU{--shiki-default:#85E89D}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":117,"searchDepth":139,"depth":139,"links":1043},[1044,1045,1046,1047,1048,1049],{"id":21,"depth":139,"text":22},{"id":849,"depth":139,"text":850},{"id":867,"depth":139,"text":868},{"id":990,"depth":139,"text":991},{"id":1020,"depth":139,"text":1021},{"id":777,"depth":139,"text":778},"2026-09-11","Why Docker-published ports can bypass UFW on Linux, how to bind containers safely behind a reverse proxy, and when a hardening project is the right fix.",{},"\u002Fguides\u002Fdocker-ufw-published-ports","docker ufw bypass",{"title":829,"description":1051},"hardening","guides\u002Fdocker-ufw-published-ports",[701,1059,1060,1056],"ufw","firewall","7EBE7N1lOv7-Nyl0f-G1dX0dO27xQdmo2H5MJooIwKg",{"id":1063,"title":1064,"body":1065,"date":1147,"description":1148,"draft":514,"extension":813,"featured":812,"keyTakeaway":814,"meta":1149,"navigation":514,"path":1150,"primaryKeyword":1151,"seo":1152,"service":819,"stem":1153,"tags":1154,"__hash__":1156},"guides\u002Fguides\u002Flinux-security-basics.md","Linux Security Basics for Small Business Servers",{"type":8,"value":1066,"toc":1137},[1067,1070,1076,1078,1081,1085,1088,1092,1096,1099,1103,1106,1117,1121,1124,1128,1131],[11,1068,1064],{"id":1069},"linux-security-basics-for-small-business-servers",[15,1071,1072,1075],{},[48,1073,1074],{},"Placeholder content"," — This article will be replaced with production content from your freelance writer.",[19,1077,22],{"id":21},[15,1079,1080],{},"Server security doesn't require a dedicated team, but it does demand attention to fundamentals: regular updates, restricted remote access, and a properly configured firewall.",[19,1082,1084],{"id":1083},"introduction","Introduction",[15,1086,1087],{},"Running a Linux server for your small business doesn't require a dedicated security team, but it does demand attention to fundamentals. This guide covers the essential security practices every server owner should understand.",[19,1089,1091],{"id":1090},"key-security-principles","Key Security Principles",[107,1093,1095],{"id":1094},"keep-your-system-updated","Keep Your System Updated",[15,1097,1098],{},"Regular updates close known vulnerabilities. Most Linux distributions make this straightforward with package managers.",[107,1100,1102],{"id":1101},"restrict-remote-access","Restrict Remote Access",[15,1104,1105],{},"SSH is powerful, but exposing it to the entire internet increases risk. Consider:",[42,1107,1108,1111,1114],{},[45,1109,1110],{},"IP whitelisting for known locations",[45,1112,1113],{},"Key-based authentication instead of passwords",[45,1115,1116],{},"Non-standard ports (security through obscurity, but helpful)",[107,1118,1120],{"id":1119},"configure-your-firewall","Configure Your Firewall",[15,1122,1123],{},"A properly configured firewall is your first line of defence. Start with denying all traffic, then explicitly allow only what your services need.",[19,1125,1127],{"id":1126},"next-steps","Next Steps",[15,1129,1130],{},"Security isn't a one-time setup. Regular reviews help you stay ahead of new threats and configuration drift.",[15,1132,1133,1134,306],{},"If you'd like expert help assessing your server's security posture, ",[34,1135,1136],{"href":765},"learn about our security review service",{"title":117,"searchDepth":139,"depth":139,"links":1138},[1139,1140,1141,1146],{"id":21,"depth":139,"text":22},{"id":1083,"depth":139,"text":1084},{"id":1090,"depth":139,"text":1091,"children":1142},[1143,1144,1145],{"id":1094,"depth":350,"text":1095},{"id":1101,"depth":350,"text":1102},{"id":1119,"depth":350,"text":1120},{"id":1126,"depth":139,"text":1127},"2026-09-10","A practical introduction to Linux server security fundamentals, covering common risks and simple hardening steps for small businesses.",{},"\u002Fguides\u002Flinux-security-basics","linux server security",{"title":1064,"description":1148},"guides\u002Flinux-security-basics",[825,1155,824],"basics","nwPpj7VzFaYgGRLjyVOgLpSsRpI3NH9T3YclArAZWak",{"id":1158,"title":1159,"body":1160,"date":1050,"description":1350,"draft":812,"extension":813,"featured":514,"keyTakeaway":814,"meta":1351,"navigation":514,"path":1352,"primaryKeyword":1353,"seo":1354,"service":819,"stem":1355,"tags":1356,"__hash__":1359},"guides\u002Fguides\u002Flinux-server-security-review.md","What a Linux server security review actually covers",{"type":8,"value":1161,"toc":1342},[1162,1165,1168,1170,1177,1181,1184,1195,1199,1206,1244,1247,1251,1254,1306,1309,1313,1327,1330,1332],[11,1163,1159],{"id":1164},"what-a-linux-server-security-review-actually-covers",[15,1166,1167],{},"For owners of one internet-facing Linux server who want a prioritised risk picture before they change production config.",[19,1169,22],{"id":21},[15,1171,1172,1173,1176],{},"A useful review is ",[48,1174,1175],{},"assessment first",": what is exposed, how you get in, what the firewall and patch state look like, and which fixes matter most. It is not a stealth penetration test, and it should not silently change your server.",[19,1178,1180],{"id":1179},"why-people-book-a-review","Why people book a review",[15,1182,1183],{},"Typical triggers:",[42,1185,1186,1189,1192],{},[45,1187,1188],{},"A VPS that \"grew\" — Docker apps, reverse proxy, SSH left open to the world",[45,1190,1191],{},"Preparing for Cyber Essentials \u002F ISO conversations without a full audit programme",[45,1193,1194],{},"Wanting a clear action list before paying for hands-on hardening",[19,1196,1198],{"id":1197},"what-a-focused-review-usually-includes","What a focused review usually includes",[15,1200,1201,1202,1205],{},"On ",[48,1203,1204],{},"one"," agreed Linux host:",[870,1207,1208,1214,1220,1226,1232,1238],{},[45,1209,1210,1213],{},[48,1211,1212],{},"Internet exposure"," — listening services, published ports, obvious unnecessary surface",[45,1215,1216,1219],{},[48,1217,1218],{},"Remote access"," — SSH configuration posture (auth methods, root, who can log in)",[45,1221,1222,1225],{},[48,1223,1224],{},"Firewall and edge"," — host firewall intent vs reality; reverse proxy as the public front door where relevant",[45,1227,1228,1231],{},[48,1229,1230],{},"Patch and package posture"," — outdated critical packages; obvious neglected updates",[45,1233,1234,1237],{},[48,1235,1236],{},"Account and privilege basics"," — weak patterns that show up quickly on a single box",[45,1239,1240,1243],{},[48,1241,1242],{},"Prioritised findings"," — what to fix first, what can wait, what needs a maintenance window",[15,1245,1246],{},"You should leave with a written plan and a short findings call — not a vague \"looks fine.\"",[19,1248,1250],{"id":1249},"what-it-is-not","What it is not",[15,1252,1253],{},"Be wary of reviews that blur into something else:",[1255,1256,1257,1270],"table",{},[1258,1259,1260],"thead",{},[1261,1262,1263,1267],"tr",{},[1264,1265,1266],"th",{},"Not included by default",[1264,1268,1269],{},"Why",[1271,1272,1273,1282,1290,1298],"tbody",{},[1261,1274,1275,1279],{},[1276,1277,1278],"td",{},"Silent remediation",[1276,1280,1281],{},"Changes need agreed scope and a backup\u002Fwindow",[1261,1283,1284,1287],{},[1276,1285,1286],{},"Full CREST penetration test",[1276,1288,1289],{},"Different product, different depth and rules of engagement",[1261,1291,1292,1295],{},[1276,1293,1294],{},"Estate-wide SOC \u002F 24×7 monitoring",[1276,1296,1297],{},"Ongoing ops, not a one-server review",[1261,1299,1300,1303],{},[1276,1301,1302],{},"Application source-code audit",[1276,1304,1305],{},"Separate skill set unless scoped",[15,1307,1308],{},"Honest limits build trust. If something is out of scope, say so up front.",[19,1310,1312],{"id":1311},"how-it-differs-from-hardening","How it differs from hardening",[42,1314,1315,1321],{},[45,1316,1317,1320],{},[48,1318,1319],{},"Review"," — observe, prioritise, recommend (assessment only)",[45,1322,1323,1326],{},[48,1324,1325],{},"Hardening"," — agreed changes applied and verified on the host",[15,1328,1329],{},"Many clients review first, then harden the top items in a maintenance window.",[19,1331,778],{"id":777},[15,1333,1334,1335,654,1338,1341],{},"A focused server security review for one internet-facing Linux server (from £295), with a prioritised action plan and a 60-minute findings call. No changes without a separate agreed scope. Learn more at the ",[34,1336,1337],{"href":765},"security review service page",[34,1339,1340],{"href":784},"contact us"," to book an intro call.",{"title":117,"searchDepth":139,"depth":139,"links":1343},[1344,1345,1346,1347,1348,1349],{"id":21,"depth":139,"text":22},{"id":1179,"depth":139,"text":1180},{"id":1197,"depth":139,"text":1198},{"id":1249,"depth":139,"text":1250},{"id":1311,"depth":139,"text":1312},{"id":777,"depth":139,"text":778},"What a focused Linux server security review covers — exposure, SSH, firewall, patch posture — and what it deliberately omits before production changes.",{},"\u002Fguides\u002Flinux-server-security-review","linux server security review",{"title":1159,"description":1350},"guides\u002Flinux-server-security-review",[825,1357,1358],"review","assessment","Oxc8A3-YJlZbq4alQrW_sp76dlkjE8eSRTlDk-3ZBtY",{"id":1361,"title":1362,"body":1363,"date":1731,"description":1732,"draft":812,"extension":813,"featured":812,"keyTakeaway":814,"meta":1733,"navigation":514,"path":1734,"primaryKeyword":1735,"seo":1736,"service":1737,"stem":1738,"tags":1739,"__hash__":1741},"guides\u002Fguides\u002Flinux-server-troubleshooting-first-steps.md","Linux server problem? First checks before you call for help",{"type":8,"value":1364,"toc":1719},[1365,1368,1371,1373,1376,1380,1383,1394,1398,1401,1447,1451,1476,1479,1503,1507,1549,1552,1590,1594,1621,1624,1671,1675,1678,1682,1685,1699,1701,1704,1707,1709,1716],[11,1366,1362],{"id":1367},"linux-server-problem-first-checks-before-you-call-for-help",[15,1369,1370],{},"When a Linux server is down or misbehaving and nobody on the team owns it, the hard part is knowing where to start. This guide covers the checks worth running first, what to write down, and when to bring in help.",[19,1372,22],{"id":21},[15,1374,1375],{},"Most first checks take a few minutes: disk, memory, services, logs and recent changes. Write down what you find and what changed recently. That record saves time, whether you fix the problem yourself or hand it over.",[19,1377,1379],{"id":1378},"_1-note-what-changed","1. Note what changed",[15,1381,1382],{},"Before you touch anything, write down:",[42,1384,1385,1388,1391],{},[45,1386,1387],{},"what stopped working, and when you first noticed it",[45,1389,1390],{},"the exact error message, or a screenshot of it",[45,1392,1393],{},"anything that changed recently: updates, deploys, DNS, certificates or firewall rules",[19,1395,1397],{"id":1396},"_2-check-disk-space","2. Check disk space",[15,1399,1400],{},"A full disk breaks databases, logs and uploads in confusing ways.",[112,1402,1404],{"className":114,"code":1403,"language":116,"meta":117,"style":117},"df -h\ndf -i            # inodes can run out even with free space\nsudo du -xh \u002Fvar --max-depth=1 | sort -h\n",[119,1405,1406,1414,1424],{"__ignoreMap":117},[122,1407,1408,1411],{"class":124,"line":125},[122,1409,1410],{"class":128},"df",[122,1412,1413],{"class":148}," -h\n",[122,1415,1416,1418,1421],{"class":124,"line":139},[122,1417,1410],{"class":128},[122,1419,1420],{"class":148}," -i",[122,1422,1423],{"class":486},"            # inodes can run out even with free space\n",[122,1425,1426,1428,1431,1434,1437,1440,1442,1445],{"class":124,"line":350},[122,1427,129],{"class":128},[122,1429,1430],{"class":132}," du",[122,1432,1433],{"class":148}," -xh",[122,1435,1436],{"class":132}," \u002Fvar",[122,1438,1439],{"class":148}," --max-depth=1",[122,1441,180],{"class":173},[122,1443,1444],{"class":128}," sort",[122,1446,1413],{"class":148},[19,1448,1450],{"id":1449},"_3-check-memory-and-load","3. Check memory and load",[112,1452,1454],{"className":114,"code":1453,"language":116,"meta":117,"style":117},"free -h\nuptime\ntop              # press q to quit\n",[119,1455,1456,1463,1468],{"__ignoreMap":117},[122,1457,1458,1461],{"class":124,"line":125},[122,1459,1460],{"class":128},"free",[122,1462,1413],{"class":148},[122,1464,1465],{"class":124,"line":139},[122,1466,1467],{"class":128},"uptime\n",[122,1469,1470,1473],{"class":124,"line":350},[122,1471,1472],{"class":128},"top",[122,1474,1475],{"class":486},"              # press q to quit\n",[15,1477,1478],{},"Look in the kernel log to see whether the out-of-memory killer has stopped a process:",[112,1480,1482],{"className":114,"code":1481,"language":116,"meta":117,"style":117},"sudo journalctl -k | grep -i \"out of memory\"\n",[119,1483,1484],{"__ignoreMap":117},[122,1485,1486,1488,1491,1494,1496,1498,1500],{"class":124,"line":125},[122,1487,129],{"class":128},[122,1489,1490],{"class":132}," journalctl",[122,1492,1493],{"class":148}," -k",[122,1495,180],{"class":173},[122,1497,183],{"class":128},[122,1499,1420],{"class":148},[122,1501,1502],{"class":132}," \"out of memory\"\n",[19,1504,1506],{"id":1505},"_4-check-the-service","4. Check the service",[112,1508,1510],{"className":114,"code":1509,"language":116,"meta":117,"style":117},"systemctl status nginx          # swap in your service name\nsudo journalctl -u nginx --since \"1 hour ago\"\nsystemctl --failed\n",[119,1511,1512,1525,1542],{"__ignoreMap":117},[122,1513,1514,1516,1519,1522],{"class":124,"line":125},[122,1515,458],{"class":128},[122,1517,1518],{"class":132}," status",[122,1520,1521],{"class":132}," nginx",[122,1523,1524],{"class":486},"          # swap in your service name\n",[122,1526,1527,1529,1531,1534,1536,1539],{"class":124,"line":139},[122,1528,129],{"class":128},[122,1530,1490],{"class":132},[122,1532,1533],{"class":148}," -u",[122,1535,1521],{"class":132},[122,1537,1538],{"class":148}," --since",[122,1540,1541],{"class":132}," \"1 hour ago\"\n",[122,1543,1544,1546],{"class":124,"line":350},[122,1545,458],{"class":128},[122,1547,1548],{"class":148}," --failed\n",[15,1550,1551],{},"If you run Docker:",[112,1553,1555],{"className":114,"code":1554,"language":116,"meta":117,"style":117},"docker ps -a\ndocker logs --tail 100 \u003Ccontainer>\n",[119,1556,1557,1567],{"__ignoreMap":117},[122,1558,1559,1561,1564],{"class":124,"line":125},[122,1560,701],{"class":128},[122,1562,1563],{"class":132}," ps",[122,1565,1566],{"class":148}," -a\n",[122,1568,1569,1571,1574,1577,1580,1582,1585,1588],{"class":124,"line":139},[122,1570,701],{"class":128},[122,1572,1573],{"class":132}," logs",[122,1575,1576],{"class":148}," --tail",[122,1578,1579],{"class":148}," 100",[122,1581,627],{"class":173},[122,1583,1584],{"class":132},"containe",[122,1586,1587],{"class":502},"r",[122,1589,636],{"class":173},[19,1591,1593],{"id":1592},"_5-check-the-network-and-certificates","5. Check the network and certificates",[112,1595,1597],{"className":114,"code":1596,"language":116,"meta":117,"style":117},"ss -tlnp                         # what is listening, and on which port\ncurl -I https:\u002F\u002Fyour-domain.example\n",[119,1598,1599,1610],{"__ignoreMap":117},[122,1600,1601,1604,1607],{"class":124,"line":125},[122,1602,1603],{"class":128},"ss",[122,1605,1606],{"class":148}," -tlnp",[122,1608,1609],{"class":486},"                         # what is listening, and on which port\n",[122,1611,1612,1615,1618],{"class":124,"line":139},[122,1613,1614],{"class":128},"curl",[122,1616,1617],{"class":148}," -I",[122,1619,1620],{"class":132}," https:\u002F\u002Fyour-domain.example\n",[15,1622,1623],{},"An expired certificate or a firewall change often looks like \"the site is down\". Check the dates on the certificate:",[112,1625,1627],{"className":114,"code":1626,"language":116,"meta":117,"style":117},"echo | openssl s_client -connect your-domain.example:443 -servername your-domain.example 2>\u002Fdev\u002Fnull | openssl x509 -noout -dates\n",[119,1628,1629],{"__ignoreMap":117},[122,1630,1631,1634,1636,1639,1642,1645,1648,1651,1654,1656,1658,1660,1662,1665,1668],{"class":124,"line":125},[122,1632,1633],{"class":148},"echo",[122,1635,180],{"class":173},[122,1637,1638],{"class":128}," openssl",[122,1640,1641],{"class":132}," s_client",[122,1643,1644],{"class":148}," -connect",[122,1646,1647],{"class":132}," your-domain.example:443",[122,1649,1650],{"class":148}," -servername",[122,1652,1653],{"class":132}," your-domain.example",[122,1655,174],{"class":173},[122,1657,177],{"class":132},[122,1659,180],{"class":173},[122,1661,1638],{"class":128},[122,1663,1664],{"class":132}," x509",[122,1666,1667],{"class":148}," -noout",[122,1669,1670],{"class":148}," -dates\n",[19,1672,1674],{"id":1673},"_6-be-careful-with-restarts","6. Be careful with restarts",[15,1676,1677],{},"Restarting a service can bring it back, but it can also wipe out the evidence of what went wrong. Before you restart, save the output of the checks above, and avoid rebooting a production server if you're not sure it will come back up cleanly.",[19,1679,1681],{"id":1680},"when-to-get-help","When to get help",[15,1683,1684],{},"Get outside help when:",[42,1686,1687,1690,1693,1696],{},[45,1688,1689],{},"the cause isn't clear after the checks above",[45,1691,1692],{},"the fix means changing configuration you don't fully understand",[45,1694,1695],{},"the problem keeps coming back",[45,1697,1698],{},"the server holds data you can't afford to lose",[19,1700,754],{"id":753},[15,1702,1703],{},"A troubleshooting session is £150 for up to 90 minutes on one agreed problem. I investigate, make any safe fixes that fit within that time, and give you written findings and next steps. A complete fix isn't guaranteed in the session, and it isn't emergency incident response.",[15,1705,1706],{},"I also work with agencies and IT providers on their clients' servers. I can make approved changes myself, or give clear instructions to your team.",[19,1708,778],{"id":777},[15,1710,1711,1712,306],{},"Write down the problem and your notes from step 1, then ",[34,1713,1715],{"href":1714},"\u002Flinux-server-support#troubleshooting","book a troubleshooting session",[787,1717,1718],{},"html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}",{"title":117,"searchDepth":139,"depth":139,"links":1720},[1721,1722,1723,1724,1725,1726,1727,1728,1729,1730],{"id":21,"depth":139,"text":22},{"id":1378,"depth":139,"text":1379},{"id":1396,"depth":139,"text":1397},{"id":1449,"depth":139,"text":1450},{"id":1505,"depth":139,"text":1506},{"id":1592,"depth":139,"text":1593},{"id":1673,"depth":139,"text":1674},{"id":1680,"depth":139,"text":1681},{"id":753,"depth":139,"text":754},{"id":777,"depth":139,"text":778},"2026-10-20","A short checklist for small UK teams when a Linux server is down or misbehaving, from disk space and services to logs, plus when to get outside help.",{},"\u002Fguides\u002Flinux-server-troubleshooting-first-steps","linux server troubleshooting",{"title":1362,"description":1732},"troubleshooting","guides\u002Flinux-server-troubleshooting-first-steps",[824,1737,1740],"support","d83jcqvQqHFkl3vgN285Cdi7zdkH4weUCiXMMCt_NtI",{"id":1743,"title":1744,"body":1745,"date":1050,"description":2040,"draft":812,"extension":813,"featured":514,"keyTakeaway":814,"meta":2041,"navigation":514,"path":2042,"primaryKeyword":2043,"seo":2044,"service":1056,"stem":2045,"tags":2046,"__hash__":2048},"guides\u002Fguides\u002Flinux-ssh-hardening-checklist.md","SSH hardening on a Linux server — a practical checklist",{"type":8,"value":1746,"toc":2025},[1747,1750,1753,1755,1762,1766,1769,1776,1780,1800,1804,1808,1818,1834,1838,1851,1855,1870,1874,1877,1898,1902,1909,1921,1925,1973,1980,1984,1995,1997,2007,2022],[11,1748,1744],{"id":1749},"ssh-hardening-on-a-linux-server-a-practical-checklist",[15,1751,1752],{},"For operators with one or a few internet-facing Linux hosts who want fewer opportunistic attacks without a full redesign of the estate.",[19,1754,22],{"id":21},[15,1756,1757,1758,1761],{},"Most real-world SSH abuse is opportunistic: password guessing and open root login. Disabling password auth, blocking direct root, restricting who can connect, and verifying with ",[119,1759,1760],{},"sshd -T"," removes the easy wins — if you keep a recovery path open while you change config.",[19,1763,1765],{"id":1764},"why-defaults-are-not-enough","Why defaults are not enough",[15,1767,1768],{},"OpenSSH is built for compatibility. On a public VPS that often means password auth still possible, root reachable over the network, and port 22 open to the world. Attackers do not need a clever exploit; they need a weak login path.",[15,1770,1771,1772,1775],{},"This guide is a practical checklist for a ",[48,1773,1774],{},"single Linux server",", not a CIS audit of a whole fleet.",[19,1777,1779],{"id":1778},"before-you-change-anything","Before you change anything",[870,1781,1782,1785,1788,1794],{},[45,1783,1784],{},"Keep an existing SSH session open until a new login works.",[45,1786,1787],{},"Prefer console or provider recovery access (Hetzner, DigitalOcean, AWS, etc.) before you disable passwords.",[45,1789,1790,1791,1793],{},"Prefer a second admin user with a working key ",[92,1792,845],{}," you turn off password auth.",[45,1795,1796,1797,306],{},"Take a note of the current effective config: ",[119,1798,1799],{},"sudo sshd -T | less",[19,1801,1803],{"id":1802},"checklist","Checklist",[107,1805,1807],{"id":1806},"_1-prefer-key-authentication-disable-passwords","1. Prefer key authentication; disable passwords",[15,1809,403,1810,1813,1814,1817],{},[119,1811,1812],{},"\u002Fetc\u002Fssh\u002Fsshd_config"," (or a drop-in under ",[119,1815,1816],{},"\u002Fetc\u002Fssh\u002Fsshd_config.d\u002F","):",[42,1819,1820,1825,1831],{},[45,1821,1822],{},[119,1823,1824],{},"PasswordAuthentication no",[45,1826,1827,1830],{},[119,1828,1829],{},"KbdInteractiveAuthentication no"," (where supported)",[45,1832,1833],{},"Confirm your user can log in with a key first",[107,1835,1837],{"id":1836},"_2-disable-direct-root-login","2. Disable direct root login",[42,1839,1840,1845],{},[45,1841,1842],{},[119,1843,1844],{},"PermitRootLogin no",[45,1846,1847,1848,1850],{},"Use a normal user + ",[119,1849,129],{}," instead",[107,1852,1854],{"id":1853},"_3-limit-who-can-connect","3. Limit who can connect",[42,1856,1857,1867],{},[45,1858,1859,1862,1863,1866],{},[119,1860,1861],{},"AllowUsers youradmin"," (or ",[119,1864,1865],{},"AllowGroups ssh-users",")",[45,1868,1869],{},"Keep the list short; update it when staff change",[107,1871,1873],{"id":1872},"_4-tighten-session-behaviour","4. Tighten session behaviour",[15,1875,1876],{},"Useful starting points (tune to your needs):",[42,1878,1879,1884,1889],{},[45,1880,1881],{},[119,1882,1883],{},"MaxAuthTries 3",[45,1885,1886],{},[119,1887,1888],{},"LoginGraceTime 30",[45,1890,1891,298,1894,1897],{},[119,1892,1893],{},"ClientAliveInterval 300",[119,1895,1896],{},"ClientAliveCountMax 2"," for idle disconnects",[107,1899,1901],{"id":1900},"_5-restrict-network-exposure","5. Restrict network exposure",[15,1903,1904,1905,1908],{},"Hardening ",[119,1906,1907],{},"sshd"," is weaker if the whole internet can reach it forever.",[42,1910,1911,1914],{},[45,1912,1913],{},"Firewall: allow SSH only from trusted IPs or a VPN where practical",[45,1915,1916,1917,1920],{},"Changing the port reduces noisy scans; it is ",[48,1918,1919],{},"not"," a substitute for keys and access limits",[107,1922,1924],{"id":1923},"_6-validate-then-reload","6. Validate, then reload",[112,1926,1928],{"className":114,"code":1927,"language":116,"meta":117,"style":117},"sudo sshd -t\nsudo sshd -T | grep -E 'passwordauthentication|permitrootlogin|allowusers'\nsudo systemctl reload ssh   # or sshd, depending on distro\n",[119,1929,1930,1940,1958],{"__ignoreMap":117},[122,1931,1932,1934,1937],{"class":124,"line":125},[122,1933,129],{"class":128},[122,1935,1936],{"class":132}," sshd",[122,1938,1939],{"class":148}," -t\n",[122,1941,1942,1944,1946,1949,1951,1953,1955],{"class":124,"line":139},[122,1943,129],{"class":128},[122,1945,1936],{"class":132},[122,1947,1948],{"class":148}," -T",[122,1950,180],{"class":173},[122,1952,183],{"class":128},[122,1954,584],{"class":148},[122,1956,1957],{"class":132}," 'passwordauthentication|permitrootlogin|allowusers'\n",[122,1959,1960,1962,1964,1967,1970],{"class":124,"line":350},[122,1961,129],{"class":128},[122,1963,444],{"class":132},[122,1965,1966],{"class":132}," reload",[122,1968,1969],{"class":132}," ssh",[122,1971,1972],{"class":486},"   # or sshd, depending on distro\n",[15,1974,1975,1976,1979],{},"Test a ",[48,1977,1978],{},"new"," login in a second terminal before you close the safety session.",[19,1981,1983],{"id":1982},"what-this-does-not-replace","What this does not replace",[42,1985,1986,1989,1992],{},[45,1987,1988],{},"Patching and unused services still matter",[45,1990,1991],{},"Docker-published ports can bypass host firewall assumptions — that is a separate problem",[45,1993,1994],{},"A checklist is not a full server hardening project (accounts, firewall policy, proxy exposure, backups)",[19,1996,778],{"id":777},[15,1998,1999,2000,2003,2004,306],{},"If you want the changes applied and verified on one Linux server — with a change record and recovery notes — that is the shape of a Linux server hardening engagement (from £650). Prefer a short conversation first: book a free 15-minute intro call via ",[34,2001,2002],{"href":784},"contact"," or view the ",[34,2005,2006],{"href":1027},"server hardening service",[15,2008,2009,2010,200,2014,298,2018,306],{},"Available ",[34,2011,2013],{"href":2012},"\u002Fservice-areas\u002Fderby","in Derby",[34,2015,2017],{"href":2016},"\u002Fservice-areas\u002Fburton-on-trent","Burton-on-Trent",[34,2019,2021],{"href":2020},"\u002Fservice-areas","across the UK",[787,2023,2024],{},"html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":117,"searchDepth":139,"depth":139,"links":2026},[2027,2028,2029,2030,2038,2039],{"id":21,"depth":139,"text":22},{"id":1764,"depth":139,"text":1765},{"id":1778,"depth":139,"text":1779},{"id":1802,"depth":139,"text":1803,"children":2031},[2032,2033,2034,2035,2036,2037],{"id":1806,"depth":350,"text":1807},{"id":1836,"depth":350,"text":1837},{"id":1853,"depth":350,"text":1854},{"id":1872,"depth":350,"text":1873},{"id":1900,"depth":350,"text":1901},{"id":1923,"depth":350,"text":1924},{"id":1982,"depth":139,"text":1983},{"id":777,"depth":139,"text":778},"A practical checklist to harden SSH on Linux — keys not passwords, no direct root, verify the new config works — without locking yourself out.",{},"\u002Fguides\u002Flinux-ssh-hardening-checklist","ssh hardening linux",{"title":1744,"description":2040},"guides\u002Flinux-ssh-hardening-checklist",[825,2047,1056],"ssh","bzM7CB_XK9bjyOGJ4bPEsJutKVJEqi-Xz4VtpMRceMs",{"id":2050,"title":2051,"body":2052,"date":1050,"description":2222,"draft":812,"extension":813,"featured":514,"keyTakeaway":814,"meta":2223,"navigation":514,"path":2224,"primaryKeyword":1735,"seo":2225,"service":1737,"stem":2226,"tags":2227,"__hash__":2228},"guides\u002Fguides\u002Flinux-troubleshooting-session.md","When a £150 Linux troubleshooting session is enough (and when it isn't)",{"type":8,"value":2053,"toc":2214},[2054,2057,2060,2062,2069,2073,2076,2093,2096,2100,2103,2114,2120,2124,2178,2182,2196,2198,2206],[11,2055,2051],{"id":2056},"when-a-150-linux-troubleshooting-session-is-enough-and-when-it-isnt",[15,2058,2059],{},"For people with a concrete Linux, Docker or hosting problem who want a bounded first step — not an open-ended retainer.",[19,2061,22],{"id":21},[15,2063,2064,2065,2068],{},"A short troubleshooting session is enough when you have ",[48,2066,2067],{},"one agreed problem",", a reachable system, and you mainly need investigation plus safe fixes that fit the window. It is the wrong product when you need a full security programme, emergency incident response, or ongoing ownership of the estate.",[19,2070,2072],{"id":2071},"what-the-session-is-for","What the session is for",[15,2074,2075],{},"Typical fits:",[42,2077,2078,2081,2084,2087,2090],{},[45,2079,2080],{},"A service will not start after an update",[45,2082,2083],{},"Docker Compose stack is unhealthy and logs are unclear",[45,2085,2086],{},"Reverse proxy \u002F TLS \u002F DNS mismatch on a single VPS",[45,2088,2089],{},"Disk, memory, or process issues you can describe in one sentence",[45,2091,2092],{},"\"It worked last week\" with a defined change window",[15,2094,2095],{},"You get up to ~90 minutes on one agreed problem, investigation, safe fixes inside scope, and written findings with next steps.",[19,2097,2099],{"id":2098},"what-enough-looks-like","What \"enough\" looks like",[15,2101,2102],{},"The session succeeded if you leave with:",[42,2104,2105,2108,2111],{},[45,2106,2107],{},"A clearer root cause (or a short list of likely causes)",[45,2109,2110],{},"Fixes that were safe to apply in-session, or a precise next action",[45,2112,2113],{},"Notes you can hand to yourself or another engineer",[15,2115,762,2116,2119],{},[48,2117,2118],{},"complete"," fix is not guaranteed in 90 minutes. Further work is agreed separately.",[19,2121,2123],{"id":2122},"when-you-need-something-else","When you need something else",[1255,2125,2126,2136],{},[1258,2127,2128],{},[1261,2129,2130,2133],{},[1264,2131,2132],{},"Situation",[1264,2134,2135],{},"Better fit",[1271,2137,2138,2146,2154,2162,2170],{},[1261,2139,2140,2143],{},[1276,2141,2142],{},"\"Is this server actually safe on the internet?\"",[1276,2144,2145],{},"Security review (from £295)",[1261,2147,2148,2151],{},[1276,2149,2150],{},"\"Apply and verify hardening changes\"",[1276,2152,2153],{},"Server hardening (from £650)",[1261,2155,2156,2159],{},[1276,2157,2158],{},"Recurring help each month on a named environment",[1276,2160,2161],{},"Ongoing support (from £195\u002Fmo)",[1261,2163,2164,2167],{},[1276,2165,2166],{},"Active breach \u002F ransomware \u002F emergency IR",[1276,2168,2169],{},"Incident response specialist — not a troubleshooting session",[1261,2171,2172,2175],{},[1276,2173,2174],{},"Multi-host estate redesign",[1276,2176,2177],{},"Scoped project, not a single session",[19,2179,2181],{"id":2180},"how-to-prepare-so-the-hour-counts","How to prepare so the hour counts",[870,2183,2184,2187,2190,2193],{},[45,2185,2186],{},"Write the problem in one paragraph (expected vs actual)",[45,2188,2189],{},"Note recent changes (deploys, DNS, firewall, package updates)",[45,2191,2192],{},"Confirm access path (SSH user, sudo, any VPN)",[45,2194,2195],{},"Have backups or snapshots available if fixes might be risky",[19,2197,778],{"id":777},[15,2199,2200,2201,2003,2203,306],{},"If you have one clear Linux or Docker problem and want a bounded first step, start with a £150 troubleshooting session. Prefer a quick fit-check first: free 15-minute intro call via ",[34,2202,2002],{"href":784},[34,2204,2205],{"href":1714},"Linux server support service",[15,2207,2009,2208,200,2210,298,2212,306],{},[34,2209,2013],{"href":2012},[34,2211,2017],{"href":2016},[34,2213,2021],{"href":2020},{"title":117,"searchDepth":139,"depth":139,"links":2215},[2216,2217,2218,2219,2220,2221],{"id":21,"depth":139,"text":22},{"id":2071,"depth":139,"text":2072},{"id":2098,"depth":139,"text":2099},{"id":2122,"depth":139,"text":2123},{"id":2180,"depth":139,"text":2181},{"id":777,"depth":139,"text":778},"When a fixed-price Linux troubleshooting session is the right first step — and when you need a security review, hardening, or ongoing support instead.",{},"\u002Fguides\u002Flinux-troubleshooting-session",{"title":2051,"description":2222},"guides\u002Flinux-troubleshooting-session",[1737,1740,824],"EmkD1rC1ebYnYPCEDY_4sAKotz4vXXB3EkHxjrDop3A",{"id":2230,"title":2231,"body":2232,"date":1050,"description":2385,"draft":812,"extension":813,"featured":812,"keyTakeaway":814,"meta":2386,"navigation":514,"path":2387,"primaryKeyword":2388,"seo":2389,"service":1737,"stem":2390,"tags":2391,"__hash__":2395},"guides\u002Fguides\u002Fnginx-vs-traefik-vps.md","Reverse proxy on a VPS — nginx vs Traefik for one Linux host",{"type":8,"value":2233,"toc":2375},[2234,2237,2240,2242,2249,2253,2267,2271,2276,2290,2296,2300,2305,2316,2321,2325,2328,2332,2353,2357,2364,2366],[11,2235,2231],{"id":2236},"reverse-proxy-on-a-vps-nginx-vs-traefik-for-one-linux-host",[15,2238,2239],{},"For people running one Linux VPS with one or more apps who need a single public front door for HTTP(S) — and keep hitting TLS, Host header, or \"wrong upstream\" problems.",[19,2241,22],{"id":21},[15,2243,2244,2245,2248],{},"On a ",[48,2246,2247],{},"single host",", both nginx and Traefik can work well. Pick the one you can operate confidently: nginx if you want explicit config files; Traefik if Docker label-driven routing is already how you deploy. The lead goal is one clear public entry on 80\u002F443 — not collecting proxies.",[19,2250,2252],{"id":2251},"what-the-reverse-proxy-is-for","What the reverse proxy is for",[42,2254,2255,2258,2261,2264],{},[45,2256,2257],{},"Terminate TLS (Let's Encrypt or similar)",[45,2259,2260],{},"Route by hostname\u002Fpath to the right app",[45,2262,2263],{},"Keep app and database ports off the public internet",[45,2265,2266],{},"Give you one place to reason about access logs and headers",[19,2268,2270],{"id":2269},"nginx-when-it-fits","nginx — when it fits",[15,2272,2273],{},[48,2274,2275],{},"Choose nginx when:",[42,2277,2278,2281,2284,2287],{},[45,2279,2280],{},"You prefer a static config you can read end-to-end",[45,2282,2283],{},"The stack is simple (a few vhosts)",[45,2285,2286],{},"You already know certbot \u002F ACME with nginx",[45,2288,2289],{},"You want minimal moving parts",[15,2291,2292,2295],{},[48,2293,2294],{},"Watch-outs:"," config drift across files; forgetting to reload after edits; upstream still published publicly \"for testing.\"",[19,2297,2299],{"id":2298},"traefik-when-it-fits","Traefik — when it fits",[15,2301,2302],{},[48,2303,2304],{},"Choose Traefik when:",[42,2306,2307,2310,2313],{},[45,2308,2309],{},"Apps are Docker Compose services and you like label-based routes",[45,2311,2312],{},"You want automatic certificate handling wired into the proxy",[45,2314,2315],{},"Services come and go and you do not want to hand-edit a big nginx file each time",[15,2317,2318,2320],{},[48,2319,2294],{}," labels become the source of truth (document them); dashboard\u002FAPI must not be public; mislabelled routers expose the wrong service.",[19,2322,2324],{"id":2323},"caddy-brief-note","Caddy — brief note",[15,2326,2327],{},"Caddy is a strong third option for automatic HTTPS with a short Caddyfile. If your team already standardised on nginx or Traefik, switching proxies mid-incident rarely helps — fix routing first, rethink later.",[19,2329,2331],{"id":2330},"common-failure-modes-any-proxy","Common failure modes (any proxy)",[42,2333,2334,2337,2340,2343,2350],{},[45,2335,2336],{},"DNS A\u002FAAAA not pointing at this VPS",[45,2338,2339],{},"App bound only to localhost but proxy pointing at the wrong port",[45,2341,2342],{},"HTTP→HTTPS redirect loops",[45,2344,2345,2346,2349],{},"Docker publishing the app port ",[92,2347,2348],{},"and"," the proxy (two public doors)",[45,2351,2352],{},"Stale certificates \u002F wrong certificate for the Host header",[19,2354,2356],{"id":2355},"when-a-150-session-is-enough","When a £150 session is enough",[15,2358,2359,2360,2363],{},"If the problem is \"one site won't route \u002F TLS won't issue \u002F wrong upstream\" on a reachable host, a bounded ",[34,2361,2362],{"href":1714},"troubleshooting session"," is often the right first step. If the public surface is a mess of published ports and SSH risk, you may need hardening after the immediate outage is clear.",[19,2365,778],{"id":777},[15,2367,2368,2369,2372,2373,306],{},"Stuck on nginx, Traefik, or TLS on one VPS? Start with a ",[34,2370,2371],{"href":1714},"£150 troubleshooting session",", or ",[34,2374,1037],{"href":784},{"title":117,"searchDepth":139,"depth":139,"links":2376},[2377,2378,2379,2380,2381,2382,2383,2384],{"id":21,"depth":139,"text":22},{"id":2251,"depth":139,"text":2252},{"id":2269,"depth":139,"text":2270},{"id":2298,"depth":139,"text":2299},{"id":2323,"depth":139,"text":2324},{"id":2330,"depth":139,"text":2331},{"id":2355,"depth":139,"text":2356},{"id":777,"depth":139,"text":778},"When to pick nginx or Traefik as the public front door on a single Linux VPS — TLS, routing, Docker fit — and when a short troubleshooting session is enough.",{},"\u002Fguides\u002Fnginx-vs-traefik-vps","nginx vs traefik vps",{"title":2231,"description":2385},"guides\u002Fnginx-vs-traefik-vps",[2392,2393,2394,701],"nginx","traefik","reverse-proxy","bPYAqHGe0ncPd13aGEp9U-TeQeHFgRxerpqyPiskJj0",{"id":2397,"title":2398,"body":2399,"date":1050,"description":2570,"draft":812,"extension":813,"featured":812,"keyTakeaway":814,"meta":2571,"navigation":514,"path":2572,"primaryKeyword":2573,"seo":2574,"service":2575,"stem":2576,"tags":2577,"__hash__":2580},"guides\u002Fguides\u002Fongoing-linux-support.md","What ongoing Linux support includes (and excludes)",{"type":8,"value":2400,"toc":2562},[2401,2404,2407,2409,2420,2424,2427,2445,2448,2452,2506,2509,2513,2524,2528,2549,2551],[11,2402,2398],{"id":2403},"what-ongoing-linux-support-includes-and-excludes",[15,2405,2406],{},"For small UK businesses and indie operators who want a named technical contact for an agreed Linux\u002Fhosting environment — without buying a full managed SOC.",[19,2408,22],{"id":21},[15,2410,2411,2412,2415,2416,2419],{},"Ongoing support works when the ",[48,2413,2414],{},"environment is named",", the ",[48,2417,2418],{},"monthly hours are bounded",", and both sides agree what is in and out of scope. It is consistent help and continuity — not unlimited firefighting or 24×7 monitoring unless that is explicitly sold.",[19,2421,2423],{"id":2422},"what-it-usually-includes","What it usually includes",[15,2425,2426],{},"Using LJ Cyber Solutions' ongoing package as a concrete example (from £195\u002Fmonth):",[42,2428,2429,2432,2439,2442],{},[45,2430,2431],{},"Up to a set number of support hours each month (two hours on the standard package)",[45,2433,2434,2435,2438],{},"Help with Linux, Docker, firewall, and reverse-proxy issues on the ",[48,2436,2437],{},"agreed"," environment",[45,2440,2441],{},"Direct email contact with the person doing the work",[45,2443,2444],{},"Extra work only after you approve it (no silent overruns)",[15,2446,2447],{},"You should expect clear notes when something material changes — same handover habit as project work.",[19,2449,2451],{"id":2450},"what-it-usually-excludes","What it usually excludes",[1255,2453,2454,2464],{},[1258,2455,2456],{},[1261,2457,2458,2461],{},[1264,2459,2460],{},"Often excluded",[1264,2462,2463],{},"Why it matters",[1271,2465,2466,2474,2482,2490,2498],{},[1261,2467,2468,2471],{},[1276,2469,2470],{},"Unused hours rolling over",[1276,2472,2473],{},"Keeps the retainer predictable",[1261,2475,2476,2479],{},[1276,2477,2478],{},"Hosting fees \u002F cloud invoices",[1276,2480,2481],{},"You still pay the provider",[1261,2483,2484,2487],{},[1276,2485,2486],{},"Continuous monitoring \u002F NOC",[1276,2488,2489],{},"Different product and staffing model",[1261,2491,2492,2495],{},[1276,2493,2494],{},"Emergency incident response cover",[1276,2496,2497],{},"IR needs separate readiness and rates",[1261,2499,2500,2503],{},[1276,2501,2502],{},"Unscoped estate growth",[1276,2504,2505],{},"New hosts\u002Fapps need an updated agreement",[15,2507,2508],{},"If you need 24×7 monitoring or guaranteed emergency cover, say so early — that is a different engagement.",[19,2510,2512],{"id":2511},"who-it-is-for","Who it is for",[42,2514,2515,2518,2521],{},[45,2516,2517],{},"One or a small number of Linux hosts you already run",[45,2519,2520],{},"You want continuity after a hardening or migration project",[45,2522,2523],{},"You prefer a fixed monthly ceiling over ad-hoc panic calls only",[19,2525,2527],{"id":2526},"who-should-start-elsewhere","Who should start elsewhere",[42,2529,2530,2536,2543],{},[45,2531,2532,2533,2535],{},"Single urgent break\u002Ffix → ",[34,2534,2362],{"href":1714}," (£150)",[45,2537,2538,2539,2542],{},"\"Is this box safe?\" with no changes yet → ",[34,2540,2541],{"href":765},"security review"," (from £295)",[45,2544,2545,2546,2548],{},"Apply agreed lockdowns → ",[34,2547,1056],{"href":1027}," (from £650)",[19,2550,778],{"id":777},[15,2552,2553,2554,2558,2559,2561],{},"If you want a consistent technical contact for a named Linux environment, look at ",[34,2555,2557],{"href":2556},"\u002Flinux-server-support","ongoing Linux support"," (from £195\u002Fmonth), or ",[34,2560,1037],{"href":784}," to confirm scope.",{"title":117,"searchDepth":139,"depth":139,"links":2563},[2564,2565,2566,2567,2568,2569],{"id":21,"depth":139,"text":22},{"id":2422,"depth":139,"text":2423},{"id":2450,"depth":139,"text":2451},{"id":2511,"depth":139,"text":2512},{"id":2526,"depth":139,"text":2527},{"id":777,"depth":139,"text":778},"What monthly Linux support from a freelance practice usually covers — hours, scope, response expectations — and what it deliberately leaves out so you are not surprised.",{},"\u002Fguides\u002Fongoing-linux-support","ongoing linux support",{"title":2398,"description":2570},"ongoing","guides\u002Fongoing-linux-support",[2578,824,2579],"ongoing-support","retainer","ETdQHsNoBkPKPfDTKJyIbCRJhLJvFCHZRAsSVD1WFDc",1792571461504]