The Full Opsec Checklist for an Anonymous Server — 12 Items

Twelve opsec controls for an anonymous server — alias, SSH keys, PTR, backups, XMR renewals — each under an hour, with the matching NulNet guide linked.

长文正文为英文。页头、目录与结账已翻译。

The checklist

1. Dedicated email alias for the hosting account — used nowhere else.
2. Monero payments from self-custody; never exchange-withdrawals straight to invoices.
3. SSH keys only; password auth off; named sudo user, not root.
4. Default-deny firewall: 22 (moved), 80/443, service ports only.
5. fail2ban + moved SSH port: log noise drops an order of magnitude.
6. Unattended security upgrades on the base OS.
7. 2FA on the hosting panel — the panel is attack surface too.
8. Panel over Tor/VPN when local observers figure in your threat model.
9. Neutral PTR/DNS: no names, no patterns in record labels.
10. LUKS container for data at rest (see the encryption guide).
11. Off-box encrypted backups — Restic/Borg to a Storage VPS.
12. Monthly review: canary check, DNS audit, credential rotation.

The matrix of failures

Where each item lives

On the hosting side, NulNet already supplies: no documents, crypto-only billing, editable PTR, no traffic logs (≤24 h connection metadata). The remaining eight items belong to you — each one links to a guide on this site.

The full checklist — purchase through month one

1. Dedicated privacy email; unique password; 2FA enabled.
2. Checkout through Tor or VPN when local observers matter.
3. Privacy flag (IS/CH) unless the latency model dictates otherwise.
4. Pay XMR from self-custody; exact amount; one transaction.
5. SSH keys only; passwords disabled; firewall default-deny.
6. Neutral PTR; privacy DNS or none.
7. Unattended upgrades; snapshot before risky changes.
8. Encrypted offsite backups; prove a restore.
9. Admin device habits kept apart from daily browsing.
10. Re-read the limits page; check the warrant canary monthly.

Ranger ($12.50) in Zurich is the default build with room to split services; Sentry serves when the checklist is followed ruthlessly on a single service. Ticking a list once is not opsec — schedules and renewals are where people slip.

Print the list or keep it in an encrypted note. Blog posts skimmed once will not rescue you at renewal time.

Month-two additions: verify a backup restore into a second location, rotate SSH keys if any laptop left your control, confirm 2FA recovery codes still exist offline, and re-read the limits page once comfort sets in — comfort is when leaks creep in. Ranger in Zurich at $12.50 remains the balanced default. When the checklist feels long, that is the price of private infrastructure; no shorter honest version exists.

Operational footnote: renewals and restores are where checklists die. Hold Ranger in Zurich ($12.50) as the default, XMR for payments, Tor or VPN to the panel, and a tested backup. Re-read limits whenever safety starts feeling assured. Private infrastructure is a practice, not a purchase.

Final note: checklists expire at renewal and restore time. Ranger $12.50 Zurich, XMR, Tor or VPN to the panel, tested backups, quarterly drills, the limits page reread when comfortable. Private infrastructure is practice. No shorter honest list exists.

Store 2FA recovery offline. Name servers generically inside password managers. If the alias provider itself dies, treat the panel as burned and migrate accounts. Boredom is the skill.

Checklist arrogance

High-risk nation-state models demand specialist advice beyond any VPS article. This checklist is a solid baseline for lawful private infrastructure — not a costume.

Month-two controls after the honeymoon ends

Past the first renewals: restore a snapshot into a second flag, rotate SSH keys whenever a laptop left your control, verify 2FA recovery still exists offline, and re-read the limits page while comfort persists. Ranger ($12.50) in Zurich stays the balanced default; XMR for payments; Tor or VPN to the panel. Checklists fail at renewal and restore - calendar those drills or the day-one work evaporates.

Month-two proofs, not merely day-one ticks

Once the twelve items read green, prove them again: restore a backup into a second datacenter, rotate panel 2FA, verify the canary date, and re-scan PTR for name leaks. Ranger ($12.50) in Zurich is the usual checklist home; Sentry serves a ruthless single-service operator. Schedules beat blog posts skimmed once.

Recommended setup

Plan: Ranger — 4 vCPU/8 GB with room for the LUKS container and backup tooling, $12.50/mo. Location: Zurich. Pair with the opsec guide and its honest limits.

More rankings and guides

• Anonymous VPS opsec guide
• Limits of no-KYC anonymity
• How to buy an anonymous VPS
• How to pay a VPS with Monero
• Best privacy jurisdictions 2026
• VPS for a privacy tools stack