What we do · Operations
The hardening baseline on every host
Every machine we build starts from the same security baseline, and the baseline is not up for negotiation. SELinux enforcing, a host firewall plus a perimeter firewall pair, network and country policy at the edge, SSH keys only, no swap on virtual machines. It is what makes "secure" a property of the platform rather than a promise in a contract.
What it is
A fixed set of controls applied to every Linux host and every public service we run, from the moment the machine is installed. It is built into our install templates, so a new server is hardened before anyone logs in to it, and it is checked from the outside after every change rather than trusted from the inside.
How we build it
SELinux enforcing, always. When an application and the policy disagree, we write or correct the policy, we do not switch the protection off and we do not paper over it with a generated rule that quietly weakens the whole host. When we change the enforcement mode on a remote machine, a timed safety net is armed first, so a mistake can never lock the machine away from us.
Two firewalls, not one. Every public service sits behind a high-availability firewall pair at the perimeter, built on Cisco Firepower or OPNsense, in addition to the host firewall. Perimeter changes go through the firewall's API only, standby node first, and both nodes are verified identical afterwards.
Network and country policy at the edge. Public services carry a maintained country block list and a block list of networks known for abuse. Private platforms get the opposite: an allowlist, where only named countries or named networks can connect at all. After every change, the policy is tested from several countries to prove it does what it says.
Administrative access on a separate network. Administrators reach a host through our own VPN gateways and jump hosts, on a management network that customer traffic cannot see.
No swap on virtual machines. A virtual machine's disk lives on an enterprise all-flash array. Swap would spend that array's endurance as overflow memory and turn a memory shortage into a slow, unpredictable server. A machine that needs more memory gets more memory, and the application is tuned to fit it.
The right filesystem and the right tunings. XFS everywhere, and storage tunings matched to the real disks behind the controller, so solid-state storage is treated as solid-state storage.
Patching from our own mirror. Our package mirror lives inside our own datacenter, with upstream signatures intact, reachable only from our own address ranges. A server deliberately unable to reach the internet is still a server we can fully patch.
Stateless where state is not needed. UDP services that need no connection tracking, such as DNS, are passed statelessly at the firewall, and packet processing is spread across processor cores with the control plane kept separate, so the firewall stays fast under load.
What it protects you from
- An application compromise that becomes a whole-server compromise.
- A service exposed to the world that only ever needed to answer one country.
- A memory shortage that turns into a storage problem.
- Patching held hostage by an external mirror.
In practice
Country policy, proven from outside. When we tightened the country block lists on our public firewall pairs, the change went to the standby node first, both nodes were verified identical, and the result was tested from several countries before it was considered done.
A test system that answers one country only. A customer needed a staging system reachable only from their own country. The rule set was built per customer, with explicit blocks on everything else, placed deliberately relative to the general threat rules, and proven from inside and outside that country.
Why EuroVPS
- SELinux stays enforcing. We fix policy, we do not disable protection.
- A host firewall and a high-availability perimeter pair on every public service.
- Country and network policy tested from outside after every change.
- No swap on VMs: memory problems are solved with memory.
- Our own package mirror, so patching never waits for anyone else.
FAQ
My application vendor says to disable SELinux. Will you? No. We will write the policy your application needs. In our experience that is almost always a small, precise change.
Can you restrict my service to certain countries? Yes. Allowlist or blocklist, at the perimeter, tested from outside after it is applied.
Why is there no swap on my VM? Because swap on shared enterprise flash makes a server slow and unpredictable instead of fixing the real problem. If your workload needs more memory, we size the machine for it or help you tune the application.
Can I get password logins for my team? Administrative access is key-based. We will help you set up keys for everyone who needs access.
If you want a platform hardened by default, not on request, Talk to an engineer.
Your next infrastructure partner
Let’s look at
your setup.
Tell us what you run today and what needs to improve. An engineer will review your brief and help you plan the next step.
+357 222 32280
who will look after your infrastructure.
Let’s start with your setup.
A little context helps us start the right conversation.