Dear all,
I am currently in a situation where I need to evaluate and negotiate webserver hosting / housing for our company. I have administred apache on Linux not on a regular basis, but sometimes in the past lets say 12? years? Can't really remember I fiddled around with it, but never in a really productive environment where it is essential that the server is up and running 24/7 and hosting a webshop and some other tools for the employees on the go and customers.
My question about this is, as I haven't found a comprehensive guide anywhere I looked for, what do I need to take into consideration?
I really do not want to run the server on my own, as it is too hard if you want it done right, so some other company will most likely run it for me and do all the needed stuff, but what is reallly essential to negotiate?
I know I want a working firewall, fail2ban configuration, constant security patch management, negotiated response time on incidents but they need to monitor the server on their own. I need elasticsearch for one of the software components running on the system, php, mysql. And ofcourse there needs to be some flexibility on the server specs as I currently have no clue how much ressources are needed to run the show properly in terms of badwith, ram, cpu. I suppose I want something like logstash? Is there a tool that aggregates logfiles and marks the hard errors or warnings I should take care of?
Are there any directly recommended distros that are "by design" better than others, for example preferrably a system without systemd or should I look for any of the *BSDs? Would you even recommend nginx or lighttpd over apache?
Is there any good guide out there what to look for in this situation? I think probably many other IT admins or companies are in the same situation like myself.
In 2 weeks time I will attend a meeting with professional service firm on these topics, but I want to be prepared and do not want them to sell me crap or make a fool out of me

Thanks folks!

A web search for linux how to evaluate hosting providers will turn up a number of useful articles.

Is the hosting going to be shared, a VPS (virtual private server--basically a virtual machine), or a dedicated server (your own physical machine at their data center)? Generally, small websites, like mine, are on shares. Larger websites are on VPS's. Only the largest sites tend to be on dedis. This article from Inmotion Hosting gives a pretty good introduction to the differences.

(I did some work for Inmotion several years ago. They are oriented towards business hosting; I found them a reputable outfit. They also have an excellent help site that is open to the public, unless something has changed.)

Generally, with shared hosting, the hosting provider will have a favored web server application, will be responsible for security, and the like, and you will have to take what you will get, so it comes down with being clear about your requirements; some of the access and control you desire might not be available with shared hosting. You also will not be able to have root access, as that would give you root access to the machine and to all the shares running on it.

If it's a VPS or a dedi, providers often expect that the customers will administer the machines. There may be an extra fee if you want them to do day-to-day administration. If you want to pick your own OS, you will need a VPS or a dedi.

You could pretty much use any distro you wanted--your programs you need will run on any Linux. For a web server, though, I think stable is the most important criteria. CentOS, Slackware, and Debian would all be excellent choices. That's just my opinion and certainly reflects my biases.

My own website is on GoDaddy; I have no complaints whatsoever and have had good experience with their tech support the three or four times I've had to call them. I also once managed a site on A Small Orange and they seem quite capable, but they do not provide domain registration services.

I hope this helps you get started on your research and preparation.

1 members found this post helpful.

Thanks for your direction.

Since we are currently hosting all our apps on 3 servers at Amazon AWS with Ubuntu Servers (...this is not my preferred situation), I am a little unsure about the real performance needed for everything we host.

do you know of some sort of scripts to collect the data (like for example in SAN environments there are scripts to collect current IOPS data)?

We would go for 5 servers in the upcoming situation, since we need 2 high available and these should be mirrored and load balanced. 1 is for minor (more or less) static webpages.
A part of the software running on these servers is custom software for our company.

I am currently thinking I shouldn't or we shouldn't run these servers on our own (like in server housing were we put our hardware), since I would guess it can be a task for one alone to administer 5 webservers on the day to day business - and we do not have this manpower currently.

We will negotiate with the major german webhosters on this, hosting in America is not that easy for a german company, since there are regulations in place preventing the move from european data to the us, and in Amazon AWS we currently cannot tell where our data is physically stored.

Devuan is quite usable in any situation where you might have been using Debian (or Ubuntu). It's Debian minus the systemd. Right now it lays over the Debian repositories and non-systemd stuff pass through and systemd stuff is substituted with unencumbered Devuan versions. So it may be closest match. FreeBSD is improving by leaps and bounds, and is all-around good, but you must read the user manual to get started. It's got a long support cycle if you get on the right version. However, OpenBSD is much cleaner and simpler, yet easy to add it what you need if it's in Ports / Packages. The downside to OpenBSD is that you do have to upgrade twice a year, more if you follow -current, or once a year at bare minimum. There are binary patches available from M:Tier for OpenBSD so re-compiling is not necessary, though M:Tier has a subscription fee if you don't keep up with the latest.

None of the three are infected with systemd.