Managed versus Non-Managed Hosting

[Pete]

Hi folks

The past few years I've been going for managed VPS solutions for my hosting. I always liked the fact that during setup of the new VPS I could send the support team a list of things I need and they would set them up for me. I also liked the relative ease of using WHM and cPanel over the command line.

My problem is with how much is usually charged for the privilege. I realise I will always pay a premium for WHM and cPanel (what hosting companies charge varies wildly) but for "managed", most UK companies hike up the costs to a ridiculous level with nothing in between "unmanaged" and "managed".

To clarify, all I want is that initial setup to be done by someone, then if I run into trouble with something I can just bounce some ideas of a support guy/gal and ask them to install something if I'm not sure. My support requests are generally in the region of 4 a year, if that sometimes. It's a shame nobody seems to do "per-incident" support with hosting.

There is a massive gulf between what US and UK companies charge. I have no trouble with my current provider, Servint, but the closest datacentre to me is in Amsterdam. The connection is quick, but it would be nice to use someone like UK2.net where the servers are closer and things load that fraction quicker. They offer WHM and cPanel for an additional fee on their VPS package and the package I would need then comes into line with the prices I'm paying with ServInt, but they won't install anything.

So I guess my question is: how hard is it to actually manage your own server from the command line? I mean things like upgrading PHP, mySQL etc, installing modules and so on? I like my safety net, and I guess as long as I had a host that could allow me to roll back to an image I would still have a safety net (with careful planning of upgrades out of normal hours) but like many people I am comfortable with an expert on-hand and fear change

EDIT: Might have found an excellent, managed option with London datacentre options and reasonable pricing: http://www.futurehosting.com/

EDIT2: For cheaper than my current package I can also have running on SSDs? Where is my wallet?! On a more serious note, I'm not going to be silly and jump in right away with anything - I've been through various hosting companies over more than a decade (feeling old now) and know not to rush in just because something looks amazing.

Edit The Third: But I'm still interested to hear people's thoughts on unmanaged and any links to required reading in that area that you guys recommend (I could Google, but that will return about a billion articles and I'm after advice from my peers ).

[pwired]

Edit: when setting up websites for clients, hosting management, redundancy and local laws

should be in compliance in the best possible way.

[Pete]

I assume that was a joke? If so, very funny

If not, then there is a huge difference between self-hosting and going with a hosting company (latency, bandwidth, hardware quality, redundant connections etc - the list goes on).

Most hosting companies operate from datacentres with massive bandwidth whereas home internet, even fibre-optic broadband just doesn't cut it. And enterprise grade drives run at £400+ per drive. And the servers they run on are a few thousand pounds. And so on and so on...

So yes, hosting with a real hosting hosting company will be better by many orders of magnitude!

[cstevensjr]

The main concern, I believe, with managed versus unmanaged ultimately revolves around adequate Security (and I mean security at many different levels).  I would never recommend that anyone put critical business-level resources on an unmanaged server.  You do get what you pay for.  In this instance, you are basically paying for peace of mind regarding the correct configuration and maintenance of the underlining server.

I host with many different providers.  I do have one dedicated server that is very unmanaged.  I've been doing networking since 1977 and I still like to get out and work with a server at it's most basic.  The only thing I have on this box of any consequence is a Subsonic music streaming installation.  The music files on this installation are backed up in multiple other locations external to this server.  If the server gets hacked, I research the cause (learning something new) and come up with a reasonable future counter-measure.  I then strip this box raw and start again from scratch.  Other than the Subsonic installation, this box is strictly for research purposes and sharpening/maintaining my reasonable Unix/Linux skills.  The web host has a hardware firewall installed and I have a variety of software based firewall and intrusion detection tools installed.  The point I'm trying to make is this ---- there are too many things you would need to first know & then implement to keep yourself reasonably safe.  The bad guys have more skills and tools than you could ever realize. 

As you should already know, even with a managed server you must do due diligence in picking a knowledgeable and competent hosting provider.  They are not all equal and once again ---- you normally get what you pay for.  Even with the best managed hosting provider, the security of your web resources can be compromised.

Most times, the biggest hosting providers are never the best, they have just gotten good at selling their services.  You have to read between the lines when buying hosting services.  I believe the most important thing is to be realistic and honest about what you really need, not want.   Security and peace of mind always come at a price.  Sometimes it's reasonable, however most times it's costly.  BTW, stick with European hosting at all costs.  I shouldn't have to explain why that is the truth.

Good luck with your research.

Best Regards,

Charles

[pwired]

Edit: when setting up websites for clients, hosting management, redundancy and local laws

should be in compliance in the best possible way.

[Beluga]

Virtualmin is a free web control panel that has helped me greatly on a non-managed server. Just have a checkbox ticked and you will get a fully working mail server. You can use the web interface to update PHP, MySQL (or MariaDB for me) and your Linux server in general. Roundcube and phpMyAdmin can be installed with a couple of clicks.

You do have to take care of securing your Linux server yourself. Disable root login, change the ssh port, set up iptables & fail2ban and stuff like that. So it's not a walk in the park, but if you take notes, you can do it all again from scratch quite fast, if something goes wrong in the process.

[adrian]

So I guess my question is: how hard is it to actually manage your own server from the command line? I mean things like upgrading PHP, mySQL etc, installing modules and so on?

I manage my own servers and I have certainly enjoyed the learning and freedom that goes along with that. It is great to be able to compile the latest version of something yourself on the day it is released and to be able to mix and match various versions of software as needed. It can definitely have its frustrations though when dependancies are not playing nicely. Things are generally simpler if you use pre-compile packages and a package manager like aptitude or yum.

I think @cstevensjr's comments about security might be your biggest issue - there is a lot to learn on that front and it can bite hard if it's not done right. Of course I bet you could probably do better than a lot of the managed options out there on your first time anyway. When I do deal with hosted sites, I haven't had great experiences, usually because the client has been with a host for a long time and doesn't want to change. There are some horrible operators out there I need to start making sure I get to choose the provider in future!

[apeisa]

Pete, Linode is UK and has managed also.

[jacmaes]

I've also always shied away from unmanaged hosting and found the command line scary. Yet recently I've Digital Ocean after reading so many good things about this new company. It's actually not really unmanaged hosting since you can contact support at any time and they're pretty responsive, but you have to set up your own server (what they call droplets) from the command line. They have well-written guides and a vibrant community for just about any need you might have, and it's actually surprisingly easy and fun to customize everything to your needs.

So far, I'm really impressed. Believe it or not, I'm running 5 rather low-traffic sites on a $5 dollar / month SSD VPS with 512 Megs of RAM (their cheapest plan) from their Amsterdam data center, and boy do they run fast, and with no downtime whatsoever so far. You can easily find $10 coupons on Twitter and elsewhere, so you can try them out for a couple of months free.

[Pete]

Thanks all. I think if I'm honest I don't have the time to learn to play with unmanaged, so will probably stick with managed.

I do tend to read reviews and get second opinions before choosing a host, plus asking the sales teams at various hosts questions before taking the plunge, plus I don't tend to put much on new hosting the first month or so just to test it out.

BTW, stick with European hosting at all costs.  I shouldn't have to explain why that is the truth.

If you could explain though that would be great as you could be referring to several things. Latency is the obvious thing, but you could also be referring to NSA snooping, but since this article says they've been interfering with networking gear and Cisco (and other US manufacturers, this was the first to spring to mind) is in most datacentres... well... not really a lot I can do about that except hide in a basement and distribute websites via CD (didn't that used to be a thing back in the 90's? ). I know, it's a serious topic, but there's really only so far you can go in protecting data - choosing the right web host is certainly part of that.

@pwired - 50mb upload speed is not good if you have any decent number of visitors viewing your sites or have any sites with some popular downloads on you will be throttling their speeds. It might seem fast to you if you're on a network connected directly to your home server, but to everyone else out there viewing your sites over that connection it could really suck. In the UK at least you'll be routing from your house to a British Telecom exchange before it gets routed onto a big datacentre or something before it hits the fast network links that run the length of the country. If you host with a proper company at a real datacentre they have links directly to these high speed links and you're cutting out links in between. This reduces latency. Then there's 24/7 staff at datacentres, redundant power supplies in the servers, redundant power to the racks, backup generators if the power fails - lots of redundancy in place that I can't replicate myself, especially when us mere mortals sleep a third of the day on average

[cstevensjr]

If you could explain though that would be great as you could be referring to several things. Latency is the obvious thing, but you could also be referring to NSA snooping, but since this article says they've been interfering with networking gear and Cisco (and other US manufacturers, this was the first to spring to mind) is in most datacentres... well... not really a lot I can do about that except hide in a basement and distribute websites via CD (didn't that used to be a thing back in the 90's?  ). I know, it's a serious topic, but there's really only so far you can go in protecting data - choosing the right web host is certainly part of that.

Actually I was talking about the second and only due to the enforceable legal environment in the EU.  I believe that there's never a need to be paranoid about anything, people just need to be aware of any technology and it's use or possible misuse.  

I find it amusing that many people think that intrusive behavior, like what you mentioned, comes from only over here.  You mentioned one agency, yet It's a big world out there and there are many bad actors doing many bad things.  We, as humans, tend to focus on where the spotlight is directed, failing to critically think about what the bad actors in our own neighborhood are actually doing.  It would benefit everyone to realize that America is not the only place that has the talent, the resources, a desire and a will to get information they want at all costs.

I only talked about European hosts as a better choice because its been proven that existing European laws and ethical behaviors are geared more towards privacy.  The fact is that US based hosting can be cheaper, however you have to live with the legal rules that they operate under. That's an important and big difference.

Whenever you're making a decision about something like hosting, you need to be aware of and be smart about many things.  Having all of the details and not just a few facts, results in you making a better decision.  I believe that whether you host with a US provider or someone under EU regulations is an important decision to make (if you live in Europe).  Here in the US, we're stuck.  I mentioned the subject mainly because you are somewhere where you actually have a choice to make regarding privacy.

So, once again there's no reason to be hiding or fearing anything. Everything else about that agency and those discussions aren't even worth talking about, especially on this forum. 

Latency has always been an issue based on where you're at, the capabilities of your physical hardware and the communications/computer technology involved in getting the information from Point A to Point B.

Edited May 24, 2014 by cstevensjr

[horst]

...

I find it amusing that many people think that intrusive behavior, like what you mentioned, comes from only over here. 

...

We, as humans, tend to focus on where the spotlight is directed, failing to critically think about what the bad actors in our own neighborhood are actually doing.

...

[bwakad]

Not sure if this is going to help you, but in the netherlands we have a hosting provider which have received 'best hosting' for several years.

Look up antagonist.nl if you interested. I am sure it will be no problem since you not far away.

I always use it, no errors, quick response, low costs, and fast servers, etc

[pwired]

yet It's a big world out there and there are many bad actors doing many bad things.

the us, overthrowing and destabilizing foreign governments to save their virtual petrodollar,

the fed's Debt ceiling money-printing absurdity, monsanto, 911, patriot-act, nsa, anyone ?

europe and the navo are only 10 years behind the us and same things will happen here too.

the sad thing is that we the people think we are safe behind our computers, playstations, tv's

at least in thailand and vietnam people stand up and fight against government enslavement.

[horst]

Reminder: This is not a political forum, it is dev-talk. It is fairly ok I think if there is some (little) drift sometimes, but the focus should be on LITTLE.

[Pete]

Charles - sorry, I did only link to one article as it was the most recent one to hand on Google, but if I'd mentioned every country that's not playing fair then I may as well just link to Google Earth It's obviously clear now you were referring to data prviacy laws and not intending to bring up national security scandals.

In an attempt to add some balance, in the UK we have GCHQ who like to work with the NSA on interesting projects (apparently we like to perv at webcam images) as well as everything else GCHQ is "monitoring" so we're certainly no better. To think that other countries aren't doing the same is certainly naive, but when it happens in countries like the US and the UK who both purport to hold freedom so dearly, it's clear why these incidents make such an impact in the news headlines.

Bear in mind we're supposed to be protected by those same European privacy laws you mention and our own spying agency is clearly part of the problem and you can begin to see why I think the whole idea of privacy is a little laughable in the face of these incidents - it's not the ones where they make the official requests to access your data that are the truly scary ones is my point. It's certainly a global problem with no solution in sight and is certainly a discussion for another topic (probably on another forum) and it's one that I don't know enough about to discuss at any great length so we should probably just leave it there now I've balanced it out a little

You do raise a very valid point about choosing a country where the law is more on your side if you were ever asked to turn over data through official channels. You don't want a webhost where they won't let you mount any legal defense before handing over data for example. It's clear now that this was the point you were trying to make in the first place so hopefully the rest of my reply has balanced things out a little.

I agree with horst though - let's get back to the topic

[diogo]

I understand all concerns around security of unmanaged VPS and am aware of how limited my knowledge in this area is comparing to other people, but what else do you have to do concerning security that is not on this Linode guide? https://library.linode.com/securing-your-server

If what is on that guide is enough for starting, then I would say that there's no really overhead on having an unmanaged VPS and can highly recommend Linode. They have a datacenter in the UK, their guides are very interesting and easy to follow and the prices are just great.

edit:

Why not subscribe for a 100/50 Mb glassfibre internet connection

and use a fanless zero maintenance computer as a server and

then have home managed service with remote access.

I know it has been said before, but c'mon pwired, this is not something you should be telling people to do. Someone less knowledgeable might just go for it... 

[bwakad]

I worked many years in data-centers. I'd prefer a data-center anytime. Why? because the risk of entrance, fire, water, electric failure, and much more are taken care of by people on location. Battery rooms are always there as backup, just as generator rooms.

And for electricity companies, those data-centers are well taken care of. You can't simply have all of these things in your house...Imagine a block where you live have electricity failure : not so important to electricity company. But a data-center does, it holds hundreds of companies on servers and they can all claim loss at the data-center, which in terms claims at the electricity company.

I know, because I worked at those and I have seen the contracts.

[pwired]

I know it has been said before, but c'mon pwired, this is not something you should be telling people to do. Someone less knowledgeable might just go for it...

re-edited my 2 posts about that.