.. include:: global.rst ******************* Glossary ******************* .. glossary:: VPS Virtual Private Server. A virtualized instance running on shared physical hardware that behaves like a dedicated machine, with its own operating system, allocated CPU, RAM, and storage, isolated from other tenants on the same host. Storage-VPS A :term:`VPS` variant tuned for capacity rather than compute, offering a large pool of disk space (often on slower, cheaper storage media) for workloads such as backups, file hosting, or archival data rather than CPU-intensive applications. VDS Virtual Dedicated Server. Similar to a :term:`VPS`, but with guaranteed (rather than shared/bursting) CPU, RAM, and I/O resources, giving more predictable performance closer to that of a physical dedicated server. Object-Storage A storage architecture that manages data as discrete objects (data plus metadata plus a unique identifier) accessed over an HTTP/API interface, rather than as files in a hierarchical filesystem or blocks on a disk. Commonly used for backups, media, and large-scale unstructured data. Server A physical or virtual machine that provides resources, data, or services to other computers ("clients") over a network. Outlet-Server A server offered through an outlet or clearance tier, typically provisioned on older or refurbished hardware at a reduced price in exchange for fewer guarantees on specification or availability compared to standard server offerings. Domain DNS Zone Management The set of tools and controls used to create, edit, and delete DNS records (A, AAAA, CNAME, MX, TXT, etc.) within a domain's DNS zone, determining how that domain resolves and routes traffic. Reverse DNS Management Controls for setting and editing PTR records, which map an IP address back to a hostname. Correct reverse DNS is commonly required for mail servers to avoid being flagged as spam. Server Control The administrative interface or API used to manage a physical server's lifecycle and state, such as power on/off, reboot, console access, and hardware-level configuration. VDS Control The administrative interface or API used to manage a :term:`VDS` instance, including actions such as start, stop, reboot, resizing resources, and console access. VPS Control The administrative interface or API used to manage a :term:`VPS` instance, including actions such as start, stop, reboot, resizing resources, and console access. IP Management Tools for allocating, assigning, releasing, and configuring IPv4/IPv6 addresses on a server, VPS, or VDS, including tasks like adding additional IPs or configuring IP-based access. OS Reinstalls The ability to wipe a server, VPS, or VDS and reinstall a fresh copy of an operating system or image, typically selected from a list of supported distributions or templates. Auto Backup An automated, scheduled backup service that periodically snapshots a server, VPS, or VDS without requiring the user to manually trigger each backup. Private Networking An internal, isolated network connecting a customer's servers or instances directly to one another without routing traffic over the public internet, typically used for lower latency and added security between related systems. API Application Programming Interface. A defined set of endpoints and operations that allow external software to programmatically manage resources, such as provisioning, controlling, or monitoring servers, VPS/VDS instances, DNS, and storage. SSH Secure Shell. A network protocol that provides an encrypted channel for logging into and executing commands on a remote server or instance over an unsecured network, commonly used for remote administration. Ping A network utility that sends ICMP echo request packets to a host and measures the response, used to test whether a server is reachable and to gauge round-trip latency to it. Firewall A gatekeeper for network traffic. It checks every connection trying to come in (or go out) against a list of rules and lets it through or drops it. Think of it as a fence with only a few gates left open on purpose. Port A numbered "door" on a server that a particular kind of traffic comes in through. For example, :term:`SSH` uses port 22, web pages use port 80 (HTTP) and port 443 (HTTPS). A :term:`Firewall` works mostly by choosing which ports are open. Default Deny A firewall stance where everything is blocked unless a rule specifically allows it. It's safer than blocking only the things you know are bad, because anything you forgot about stays shut. UFW Uncomplicated Firewall. A simple command-line tool on Debian/Ubuntu for setting firewall rules (``ufw allow 22/tcp``, ``ufw enable``). It doesn't filter anything itself; it translates easy commands into :term:`netfilter` rules. netfilter The part of the Linux kernel that actually inspects network packets and decides whether to accept or drop them. Tools like :term:`UFW` and :term:`nftables` are just ways of giving it rules. nftables The modern rule language and command (``nft``) for :term:`netfilter`, replacing the older ``iptables``. :term:`UFW` writes these rules for you so you don't have to learn the syntax. Fail2ban A background :term:`Service` that watches login logs for repeated failures from the same address and then tells the :term:`Firewall` to ban that address for a while. It protects doors, like :term:`SSH`, that have to stay open. Jail In :term:`Fail2ban`, a set of rules for guarding one service: which log to watch, how many failures are allowed (``maxretry``), how long a ban lasts (``bantime``), and how to ban (``banaction``). The ``sshd`` jail guards SSH logins. jail.local The file where your own :term:`Fail2ban` settings go. It is read on top of ``jail.conf``, which you should never edit because package updates overwrite it. Brute-Force Attack Trying password after password (usually by an automated script) until one works. Key-only login makes it pointless, and :term:`Fail2ban` makes it slow by banning the attacker. Service A program that runs in the background without anyone logged in to start it, such as ``sshd`` or ``fail2ban``. On Debian services are managed by :term:`systemd`. Also called a *daemon*. systemd The program that starts and manages :term:`Service` processes on Debian. ``systemctl enable --now fail2ban`` tells it to start Fail2ban right now and every time the server boots. sshd The SSH daemon: the :term:`Service` on the server that listens on port 22 and handles incoming :term:`SSH` logins. Its name is also the name of the :term:`Fail2ban` :term:`Jail` that protects it. VNC Console A "virtual screen and keyboard" for the server, reached through the hosting provider's control panel (Contabo) instead of over the network. It's the emergency way in if the :term:`Firewall` locks you out of :term:`SSH`. VNC stands for Virtual Network Computing. Because it isn't SSH, SSH's rules don't apply to it: you log in with your VM password, not your key. Keep it switched off when you're not using it. root The all-powerful administrator account on Linux, with :term:`UID` 0. It can read, change or delete anything, which makes it the first account attackers go after. sudo "Superuser do." A command that lets a normal account run one command with root's powers, after typing its own password. Only members of the ``sudo`` :term:`Group` may use it. ``sudo whoami`` printing ``root`` proves it works. UID User ID. The number the kernel actually uses to tell users apart; the name is just a label for people. Root is 0 and the first normal account is usually 1000. Process A program that is running right now. Every process carries the :term:`UID` of the user who started it, and the kernel checks that UID to decide what files the process may touch. Group A named set of users who share the same permissions. Adding a user to the ``sudo`` group (``usermod -aG sudo ``) is how they get :term:`sudo` rights. Groups are listed in ``/etc/group``. /etc/passwd The plain-text list of every account on the system: name, :term:`UID`, home folder and login shell. Despite the name, it no longer holds passwords; those are in :term:`/etc/shadow`. /etc/shadow The file that stores each account's :term:`Password Hash`. Only root can read it, so ordinary users can't copy the hashes and try to crack them. Password Hash A scrambled fingerprint of a password that can't be turned back into the password. At login the system hashes what you typed and compares the two fingerprints. SSH Key A matched pair of files used to log in without a password. The *private* key stays secret on your own machine, and the *public* key is copied to the server. One key pair can be used for every account and server you own. authorized_keys The file ``~/.ssh/authorized_keys`` in a user's home folder on the server. It lists the public :term:`SSH Key`\ s allowed to log in as that user. ssh-copy-id A command run from your own machine that adds your public :term:`SSH Key` to :term:`authorized_keys` on the server for you, with the right file permissions. Drop-in File A small settings file placed in a ``*.d/`` folder (such as ``/etc/ssh/sshd_config.d/``) that is read on top of the main config. Your changes stay separate and survive package updates. PermitRootLogin An :term:`sshd` setting. ``PermitRootLogin no`` refuses every SSH login as :term:`root`, even with the right key or password. PasswordAuthentication An :term:`sshd` setting. ``PasswordAuthentication no`` means SSH will only accept an :term:`SSH Key`, so password guessing (a :term:`Brute-Force Attack`) can't work at all. MFA Multi-Factor Authentication. Signing in takes something you know (a password) *plus* something you have (such as a code from your phone), so a stolen password alone isn't enough. Contabo Control Panel The hosting company's website for managing your VM: power, reinstall, and turning on the :term:`VNC Console`. Anyone who can sign in to it can get into your server, so protect it with a strong password and :term:`MFA`. Emergency Admin An extra person with access (for example to the :term:`Contabo Control Panel`) who can rescue the server if the main admin is locked out or unavailable. Worth adding once a system goes live. File Owner The one account that owns a file or folder, shown in the third column of :term:`ls -l`. The owner gets the first set of :term:`Permission Bits`, and only the owner or :term:`root` can change them. Permission Bits The nine ``r``/``w``/``x`` letters on every file and folder, in three sets: what the :term:`File Owner` may do, what members of the file's :term:`Group` may do, and what everyone else may do. ``r`` is read, ``w`` is write, ``x`` is run (or, on a folder, enter). A ``-`` means not allowed. ls -l Lists files with their details. The first column holds the :term:`Permission Bits` (its first character is ``-`` for a file or ``d`` for a folder), followed by the owner and the group. Add ``-d`` (``ls -ld ~``) to see a folder itself rather than what is inside it. Directory Permissions What the :term:`Permission Bits` mean on a folder: ``r`` lets you list what is in it, ``w`` lets you add or remove files in it, and ``x`` lets you go into it. A folder set to ``drwxr-x---`` is open to its owner, readable by its group and closed to everyone else. chmod "Change mode." Sets the :term:`Permission Bits` on a file or folder, either with letters (``chmod g+w file``) or with :term:`Octal Permissions` (``chmod 750 ~``). Octal Permissions Writing :term:`Permission Bits` as numbers, one digit each for owner, group and everyone else: ``r`` = 4, ``w`` = 2, ``x`` = 1, added up. ``750`` is ``rwx r-x ---``; ``640`` is ``rw- r-- ---``. A fourth digit in front sets special bits such as the :term:`setgid Bit`. chown "Change owner." Sets the :term:`File Owner` and group of a file or folder, for example ``sudo chown root:team /srv/team``. setgid Bit A special permission on a folder (the ``s`` in the group's place, as in ``drwxrws---``, or the ``2`` in ``chmod 2770``). Files made inside the folder belong to the folder's :term:`Group` rather than to the group of whoever made them, which is what makes a shared team folder work. /etc/group The plain-text list of every :term:`Group` on the system and the accounts in each. A user's new group only counts from their next login. id A command that prints who you are to the kernel: your :term:`UID`, your main group and every :term:`Group` you belong to. adduser Debian's friendly command for making a new account. It creates the user, a home folder and a group, and asks for a password. The new account has no :term:`sudo` rights unless you add it to the ``sudo`` group. gpasswd A command for managing a :term:`Group`. ``sudo gpasswd -d tester team`` takes the user ``tester`` out of the group ``team``. Package A bundle of software, plus the information needed to install it, that Debian publishes for its systems. Almost everything on the server, from :term:`sshd` to :term:`Fail2ban`, arrived as a package. apt Debian's package manager: the program that fetches each :term:`Package` from Debian's servers and installs, upgrades or removes it. Where it fetches from is listed in :term:`Package Sources`. Package Sources The list of Debian servers :term:`apt` downloads from, kept in ``/etc/apt/``. One of them is Debian's security source, where fixes for security holes are published. apt update Refreshes :term:`apt`'s list of which :term:`Package` versions are available. It installs nothing; ``apt list --upgradable`` then shows what is out of date. apt upgrade Installs the newer version of every out-of-date :term:`Package`. Plain ``upgrade`` never adds or removes a package, so it can leave some updates behind; ``apt full-upgrade`` may add or remove one when an update needs it. Security Update A new version of a :term:`Package` that fixes a security hole. Once the fix is released the hole is public, so a server that doesn't update keeps a hole everyone knows about. A :term:`Firewall` closes doors nobody should use; updates fix the locks on the doors that stay open. unattended-upgrades A tool that runs :term:`apt` automatically every day to install each :term:`Security Update` without waiting for you. It never reboots on its own, and logs what it installed in ``/var/log/unattended-upgrades/``. 20auto-upgrades The settings file ``/etc/apt/apt.conf.d/20auto-upgrades`` that turns on :term:`unattended-upgrades`. It holds two lines ending in ``"1"``: refresh the package list every day, and install every day. reboot-required The file ``/var/run/reboot-required``, which appears when an update (usually to the kernel) only takes effect after a reboot. If ``ls`` says *No such file or directory*, no reboot is needed. Check for it once a week. systemd Timer A schedule that tells :term:`systemd` to run something at set times, like a built-in alarm clock. ``apt-daily`` refreshes the package list and ``apt-daily-upgrade`` installs updates; ``systemctl list-timers`` shows when each runs next. Dry Run A trial run that shows what a command *would* do without doing it. ``sudo unattended-upgrade --dry-run --debug`` lists what would be installed and installs nothing. systemctl The command for managing every :term:`Service` through :term:`systemd`: ``status`` to look at one, ``start``/``stop`` to act now, ``enable``/``disable`` to act at the next boot, and ``enable --now`` to do both. Enabled vs. Active Two separate facts about a :term:`Service`. *Enabled* means it will be started at every boot; *active* means it is running right now. A service can be one without the other, which is why ``systemctl is-enabled`` and ``systemctl is-active`` are different checks. Unit File The file that describes a :term:`Service` to :term:`systemd`: what program to run, as which user, and what must be running first. ``systemctl status`` shows where it lives on its *Loaded* line. PID 1 Process ID 1, the first program the kernel starts when the server boots. On Debian that is :term:`systemd`, which then starts every other :term:`Service`. journald The :term:`Service` run by :term:`systemd` that collects everything every service prints into one log, called the journal. It is the log :term:`Fail2ban` reads to spot failed logins. journalctl The command for reading the log kept by :term:`journald`. ``-u ssh`` shows one service, ``-n 30`` the last 30 lines, ``-f`` follows new lines live, and ``--list-boots`` lists past boots. Persistent Journal Keeping the log on disk in ``/var/log/journal/`` so it survives a reboot. If that folder doesn't exist, :term:`journald` keeps the log only in memory and it is lost every time the server restarts. timesyncd The :term:`Service` (``systemd-timesyncd``) that keeps the server's clock right by asking time servers on the internet, using :term:`NTP`. NTP Network Time Protocol. The standard way computers ask time servers for the correct time, so clocks (and the times in logs) stay accurate. timedatectl The command that shows and sets the clock. It reports whether the clock is synchronized and whether the :term:`NTP` service is active, and ``timedatectl set-timezone America/New_York`` makes log times match your own. df "Disk free." Shows how much of each disk is used and how much is left (``df -h /`` in human-readable sizes). A full disk is the most common way a small server stops working. free Shows how much memory (RAM) is in use. In ``free -h``, the *available* column is the number that matters. systemctl --failed Lists every :term:`Service` that tried to start and failed. After a reboot it should say ``0 loaded units listed``, proving everything came back on its own.