I am bumping this thread up.
@cloverme: What makes you concerned about VPS services in regards to privacy? One thing I am actually wondering about is if a cloud-based setup would be somewhat risky because the site is mirrored on servers in various countries/ jurisdictions.
Sure, so in regards to VPS and privacy, it all boils down to ownership of the virtual server. Unless you go through a lot of due diligence for encryption at rest and in transit, including configuration through a secure encrypted shell to ensure that the host isn't snooping on your sessions, then I would consider using a VPS for managing cryptocurrency to be very risky. You have to remember that most system administrators take short cuts to get their systems online as fast as possible, especially with lamp stacks, so these shortcuts may lead to openings. Known vulnerabilities or malicious ones might be hiding in the images that the VPS was deployed from, so there might be a backdoor there waiting. It may not even be on the virtual guest end but on the physical host end as well. Low end service providers offering virtual servers might be compromised through system administration weaknesses on the host provider side. As an example, host management may not be secured to specific workstations and those workstations may not be a rigorously managed as one might think. As consumers, we're often led to believe that extensive security is in place because the word "secure" and graphic of a lock is in place when you're shopping for your VPS. However, the system admin staff might be accessing the systems from their home computers or the host systems might even be running from home-built datacenter in a shed or basement. Granted, these types of situation would be with smaller niche VPS providers. The popular hosting tiers 1-3 take due diligence a little more seriously, but you should still be wary. Anything online and in someone else's building is out of your control.
That being said, you should look for the following services as a customer to help
mitigate your risk as compensating controls:
1) Two factor authentication. You should not be able to administer your VPS via web-console without providing two-factor authentication.
2) You should be able to restrict access to your VPS through a managed firewall outside of your VPS (not using the virtual guest OS as a firewall)
3) You want to make sure that no one can compromise your email account, reset your hosting password, get access to the VPS console, and steal your data. Lock down your own email account, move to a provider that offers secure encrypted email with multifactor authentication.
4) Add notes (if possible) to your VPS account telling them not to reset any passwords over the phone. Email the admins and ask them how to secure your account against identify theft to access your account. If they don't know, move to somewhere else.
If you're going to be managing large amounts of cryptocurrency on a VPS, you should consider doing the following:
1) Encrypt the entire file system of your virtual guest to a cipher that is supported under FIPS 140-2 (AES256 as an example)
2) Use SSH with a private key to access your system remotely.
3) Close all open ports inbound and outbound, only open ports to specific hosts by direct ip addresses. (for SSH restrict the local ip of your VPS to your wan ip/firewall)
3a) Don't access your system from any unknown networks like from a starbucks or your friends house.
4) Change all the passwords and don't use root/administrator for logins.
5) Turn on logging and limit unsuccessful logon attempts.
6) Qualys scan your VPS before putting any cryptocurrency on there at all, you want to patch and remediate any serious risk.
7) When taking backups, make sure your backups are encrypted as well to the FIPS 140-2 standard ciphers.
8.) Protect your own workstations, if possible, use a dedicated system that you don't use daily if you manage your VPS. Keep it updated, offline when not in use, and encrypted.
9) Protect all your strong passwords (recommend you use passphrases) and secure them in an encrypted vault that you keep offline.
While not in-expensive, the major hosts (aws, azure, etc) offer high-end cyber-security which is typically reserved for unclassified technical information using high standards to manage and monitor the infrastructure. You would use this type of infrastructure to manage large amounts of cryptocurrency to ensure the host has extra taken steps around due diligence to manage systems and access. This will be branded under ISO 27001 or NIST 800-53 and typically not available without exchanging emails or phone calls with them, it's not going to be a "next, next, buy" option.
