Glossary

VPS

Virtual Private Server. A virtualized instance running on shared physical hardware that behaves like a dedicated machine, with its own operating system, allocated CPU, RAM, and storage, isolated from other tenants on the same host.

Storage-VPS

A VPS variant tuned for capacity rather than compute, offering a large pool of disk space (often on slower, cheaper storage media) for workloads such as backups, file hosting, or archival data rather than CPU-intensive applications.

VDS

Virtual Dedicated Server. Similar to a VPS, but with guaranteed (rather than shared/bursting) CPU, RAM, and I/O resources, giving more predictable performance closer to that of a physical dedicated server.

Object-Storage

A storage architecture that manages data as discrete objects (data plus metadata plus a unique identifier) accessed over an HTTP/API interface, rather than as files in a hierarchical filesystem or blocks on a disk. Commonly used for backups, media, and large-scale unstructured data.

Server

A physical or virtual machine that provides resources, data, or services to other computers (“clients”) over a network.

Outlet-Server

A server offered through an outlet or clearance tier, typically provisioned on older or refurbished hardware at a reduced price in exchange for fewer guarantees on specification or availability compared to standard server offerings.

Domain DNS Zone Management

The set of tools and controls used to create, edit, and delete DNS records (A, AAAA, CNAME, MX, TXT, etc.) within a domain’s DNS zone, determining how that domain resolves and routes traffic.

Reverse DNS Management

Controls for setting and editing PTR records, which map an IP address back to a hostname. Correct reverse DNS is commonly required for mail servers to avoid being flagged as spam.

Server Control

The administrative interface or API used to manage a physical server’s lifecycle and state, such as power on/off, reboot, console access, and hardware-level configuration.

VDS Control

The administrative interface or API used to manage a VDS instance, including actions such as start, stop, reboot, resizing resources, and console access.

VPS Control

The administrative interface or API used to manage a VPS instance, including actions such as start, stop, reboot, resizing resources, and console access.

IP Management

Tools for allocating, assigning, releasing, and configuring IPv4/IPv6 addresses on a server, VPS, or VDS, including tasks like adding additional IPs or configuring IP-based access.

OS Reinstalls

The ability to wipe a server, VPS, or VDS and reinstall a fresh copy of an operating system or image, typically selected from a list of supported distributions or templates.

Auto Backup

An automated, scheduled backup service that periodically snapshots a server, VPS, or VDS without requiring the user to manually trigger each backup.

Private Networking

An internal, isolated network connecting a customer’s servers or instances directly to one another without routing traffic over the public internet, typically used for lower latency and added security between related systems.

API

Application Programming Interface. A defined set of endpoints and operations that allow external software to programmatically manage resources, such as provisioning, controlling, or monitoring servers, VPS/VDS instances, DNS, and storage.

SSH

Secure Shell. A network protocol that provides an encrypted channel for logging into and executing commands on a remote server or instance over an unsecured network, commonly used for remote administration.

Ping

A network utility that sends ICMP echo request packets to a host and measures the response, used to test whether a server is reachable and to gauge round-trip latency to it.

Firewall

A gatekeeper for network traffic. It checks every connection trying to come in (or go out) against a list of rules and lets it through or drops it. Think of it as a fence with only a few gates left open on purpose.

Port

A numbered “door” on a server that a particular kind of traffic comes in through. For example, SSH uses port 22, web pages use port 80 (HTTP) and port 443 (HTTPS). A Firewall works mostly by choosing which ports are open.

Default Deny

A firewall stance where everything is blocked unless a rule specifically allows it. It’s safer than blocking only the things you know are bad, because anything you forgot about stays shut.

UFW

Uncomplicated Firewall. A simple command-line tool on Debian/Ubuntu for setting firewall rules (ufw allow 22/tcp, ufw enable). It doesn’t filter anything itself; it translates easy commands into netfilter rules.

netfilter

The part of the Linux kernel that actually inspects network packets and decides whether to accept or drop them. Tools like UFW and nftables are just ways of giving it rules.

nftables

The modern rule language and command (nft) for netfilter, replacing the older iptables. UFW writes these rules for you so you don’t have to learn the syntax.

Fail2ban

A background Service that watches login logs for repeated failures from the same address and then tells the Firewall to ban that address for a while. It protects doors, like SSH, that have to stay open.

Jail

In Fail2ban, a set of rules for guarding one service: which log to watch, how many failures are allowed (maxretry), how long a ban lasts (bantime), and how to ban (banaction). The sshd jail guards SSH logins.

jail.local

The file where your own Fail2ban settings go. It is read on top of jail.conf, which you should never edit because package updates overwrite it.

Brute-Force Attack

Trying password after password (usually by an automated script) until one works. Key-only login makes it pointless, and Fail2ban makes it slow by banning the attacker.

Service

A program that runs in the background without anyone logged in to start it, such as sshd or fail2ban. On Debian services are managed by systemd. Also called a daemon.

systemd

The program that starts and manages Service processes on Debian. systemctl enable --now fail2ban tells it to start Fail2ban right now and every time the server boots.

sshd

The SSH daemon: the Service on the server that listens on port 22 and handles incoming SSH logins. Its name is also the name of the Fail2ban Jail that protects it.

VNC Console

A “virtual screen and keyboard” for the server, reached through the hosting provider’s control panel (Contabo) instead of over the network. It’s the emergency way in if the Firewall locks you out of SSH. VNC stands for Virtual Network Computing. Because it isn’t SSH, SSH’s rules don’t apply to it: you log in with your VM password, not your key. Keep it switched off when you’re not using it.

root

The all-powerful administrator account on Linux, with UID 0. It can read, change or delete anything, which makes it the first account attackers go after.

sudo

“Superuser do.” A command that lets a normal account run one command with root’s powers, after typing its own password. Only members of the sudo Group may use it. sudo whoami printing root proves it works.

UID

User ID. The number the kernel actually uses to tell users apart; the name is just a label for people. Root is 0 and the first normal account is usually 1000.

Process

A program that is running right now. Every process carries the UID of the user who started it, and the kernel checks that UID to decide what files the process may touch.

Group

A named set of users who share the same permissions. Adding a user to the sudo group (usermod -aG sudo <you>) is how they get sudo rights. Groups are listed in /etc/group.

/etc/passwd

The plain-text list of every account on the system: name, UID, home folder and login shell. Despite the name, it no longer holds passwords; those are in /etc/shadow.

/etc/shadow

The file that stores each account’s Password Hash. Only root can read it, so ordinary users can’t copy the hashes and try to crack them.

Password Hash

A scrambled fingerprint of a password that can’t be turned back into the password. At login the system hashes what you typed and compares the two fingerprints.

SSH Key

A matched pair of files used to log in without a password. The private key stays secret on your own machine, and the public key is copied to the server. One key pair can be used for every account and server you own.

authorized_keys

The file ~/.ssh/authorized_keys in a user’s home folder on the server. It lists the public SSH Keys allowed to log in as that user.

ssh-copy-id

A command run from your own machine that adds your public SSH Key to authorized_keys on the server for you, with the right file permissions.

Drop-in File

A small settings file placed in a *.d/ folder (such as /etc/ssh/sshd_config.d/) that is read on top of the main config. Your changes stay separate and survive package updates.

PermitRootLogin

An sshd setting. PermitRootLogin no refuses every SSH login as root, even with the right key or password.

PasswordAuthentication

An sshd setting. PasswordAuthentication no means SSH will only accept an SSH Key, so password guessing (a Brute-Force Attack) can’t work at all.

MFA

Multi-Factor Authentication. Signing in takes something you know (a password) plus something you have (such as a code from your phone), so a stolen password alone isn’t enough.

Contabo Control Panel

The hosting company’s website for managing your VM: power, reinstall, and turning on the VNC Console. Anyone who can sign in to it can get into your server, so protect it with a strong password and MFA.

Emergency Admin

An extra person with access (for example to the Contabo Control Panel) who can rescue the server if the main admin is locked out or unavailable. Worth adding once a system goes live.

File Owner

The one account that owns a file or folder, shown in the third column of ls -l. The owner gets the first set of Permission Bits, and only the owner or root can change them.

Permission Bits

The nine r/w/x letters on every file and folder, in three sets: what the File Owner may do, what members of the file’s Group may do, and what everyone else may do. r is read, w is write, x is run (or, on a folder, enter). A - means not allowed.

ls -l

Lists files with their details. The first column holds the Permission Bits (its first character is - for a file or d for a folder), followed by the owner and the group. Add -d (ls -ld ~) to see a folder itself rather than what is inside it.

Directory Permissions

What the Permission Bits mean on a folder: r lets you list what is in it, w lets you add or remove files in it, and x lets you go into it. A folder set to drwxr-x--- is open to its owner, readable by its group and closed to everyone else.

chmod

“Change mode.” Sets the Permission Bits on a file or folder, either with letters (chmod g+w file) or with Octal Permissions (chmod 750 ~).

Octal Permissions

Writing Permission Bits as numbers, one digit each for owner, group and everyone else: r = 4, w = 2, x = 1, added up. 750 is rwx r-x ---; 640 is rw- r-- ---. A fourth digit in front sets special bits such as the setgid Bit.

chown

“Change owner.” Sets the File Owner and group of a file or folder, for example sudo chown root:team /srv/team.

setgid Bit

A special permission on a folder (the s in the group’s place, as in drwxrws---, or the 2 in chmod 2770). Files made inside the folder belong to the folder’s Group rather than to the group of whoever made them, which is what makes a shared team folder work.

/etc/group

The plain-text list of every Group on the system and the accounts in each. A user’s new group only counts from their next login.

id

A command that prints who you are to the kernel: your UID, your main group and every Group you belong to.

adduser

Debian’s friendly command for making a new account. It creates the user, a home folder and a group, and asks for a password. The new account has no sudo rights unless you add it to the sudo group.

gpasswd

A command for managing a Group. sudo gpasswd -d tester team takes the user tester out of the group team.

Package

A bundle of software, plus the information needed to install it, that Debian publishes for its systems. Almost everything on the server, from sshd to Fail2ban, arrived as a package.

apt

Debian’s package manager: the program that fetches each Package from Debian’s servers and installs, upgrades or removes it. Where it fetches from is listed in Package Sources.

Package Sources

The list of Debian servers apt downloads from, kept in /etc/apt/. One of them is Debian’s security source, where fixes for security holes are published.

apt update

Refreshes apt’s list of which Package versions are available. It installs nothing; apt list --upgradable then shows what is out of date.

apt upgrade

Installs the newer version of every out-of-date Package. Plain upgrade never adds or removes a package, so it can leave some updates behind; apt full-upgrade may add or remove one when an update needs it.

Security Update

A new version of a Package that fixes a security hole. Once the fix is released the hole is public, so a server that doesn’t update keeps a hole everyone knows about. A Firewall closes doors nobody should use; updates fix the locks on the doors that stay open.

unattended-upgrades

A tool that runs apt automatically every day to install each Security Update without waiting for you. It never reboots on its own, and logs what it installed in /var/log/unattended-upgrades/.

20auto-upgrades

The settings file /etc/apt/apt.conf.d/20auto-upgrades that turns on unattended-upgrades. It holds two lines ending in "1": refresh the package list every day, and install every day.

reboot-required

The file /var/run/reboot-required, which appears when an update (usually to the kernel) only takes effect after a reboot. If ls says No such file or directory, no reboot is needed. Check for it once a week.

systemd Timer

A schedule that tells systemd to run something at set times, like a built-in alarm clock. apt-daily refreshes the package list and apt-daily-upgrade installs updates; systemctl list-timers shows when each runs next.

Dry Run

A trial run that shows what a command would do without doing it. sudo unattended-upgrade --dry-run --debug lists what would be installed and installs nothing.

systemctl

The command for managing every Service through systemd: status to look at one, start/stop to act now, enable/disable to act at the next boot, and enable --now to do both.

Enabled vs. Active

Two separate facts about a Service. Enabled means it will be started at every boot; active means it is running right now. A service can be one without the other, which is why systemctl is-enabled and systemctl is-active are different checks.

Unit File

The file that describes a Service to systemd: what program to run, as which user, and what must be running first. systemctl status shows where it lives on its Loaded line.

PID 1

Process ID 1, the first program the kernel starts when the server boots. On Debian that is systemd, which then starts every other Service.

journald

The Service run by systemd that collects everything every service prints into one log, called the journal. It is the log Fail2ban reads to spot failed logins.

journalctl

The command for reading the log kept by journald. -u ssh shows one service, -n 30 the last 30 lines, -f follows new lines live, and --list-boots lists past boots.

Persistent Journal

Keeping the log on disk in /var/log/journal/ so it survives a reboot. If that folder doesn’t exist, journald keeps the log only in memory and it is lost every time the server restarts.

timesyncd

The Service (systemd-timesyncd) that keeps the server’s clock right by asking time servers on the internet, using NTP.

NTP

Network Time Protocol. The standard way computers ask time servers for the correct time, so clocks (and the times in logs) stay accurate.

timedatectl

The command that shows and sets the clock. It reports whether the clock is synchronized and whether the NTP service is active, and timedatectl set-timezone America/New_York makes log times match your own.

df

“Disk free.” Shows how much of each disk is used and how much is left (df -h / in human-readable sizes). A full disk is the most common way a small server stops working.

free

Shows how much memory (RAM) is in use. In free -h, the available column is the number that matters.

systemctl –failed

Lists every Service that tried to start and failed. After a reboot it should say 0 loaded units listed, proving everything came back on its own.