apt install bsd-mailx\necho \"This is a test email.\" | mailx -r from-address -s hello to-address<\/pre>Check your recipient’s inbox to see if the email was indeed sent.<\/p>
2. Secure the server<\/h3> You need to set up strong security measures to safeguard your Mastodon server from unauthorized access and maintain its integrity. Here’s how:<\/p>
\nConfigure SSH keys<\/a> instead of using passwords for authentication. SSH keys provide a more secure method of accessing your VPS with a pair of cryptographic keys. Open a new terminal window without connecting to the server and type:<\/li>\n<\/ol>ssh-keygen -t rsa -b 4096<\/pre>After generating the keys, copy the public key to your server. Replace username<\/strong> and your_server_ip<\/strong> with your credentials:<\/p>ssh-copy-id username@your_server_ip<\/pre>\nSwitch back to the terminal window connected to your server. Update your system package list and upgrade installed packages to patch vulnerabilities and improve stability:<\/li>\n<\/ol>apt update && apt upgrade -y<\/pre>\nInstall Fail2ban<\/a> to protect your server from brute-force attacks. This software monitors log files and bans IP addresses showing malicious behavior.<\/li>\n<\/ol>apt install fail2ban<\/pre>Configure it by creating a local configuration file:<\/p>
nano \/etc\/fail2ban\/jail.local<\/pre>Then, add these lines inside the file:<\/p>
[DEFAULT]\ndestemail = your@email.here\nsendername = Fail2Ban\n[sshd]\nenabled = true\nport = 22\nmode = aggressive<\/pre>Restart Fail2ban to apply the changes:<\/p>
systemctl restart fail2ban<\/pre>\nInstall iptables<\/a> to allow only SSH, HTTP, and HTTPS ports:<\/li>\n<\/ol>apt install -y iptables-persistent<\/pre>During the installation, you’ll be asked to save the current IPv4 and IPv6 rules. Select No<\/strong> for both.<\/p>\n\t\t\t\n\t\t\t\t<\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\n\t\t\t\n\t\t\t\t<\/path>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure><\/div>\nCreate a new file to store IPv4 configurations:<\/li>\n<\/ol>nano \/etc\/iptables\/rules.v4<\/pre>Copy these lines into the file:<\/p>
*filter\n# Allow all loopback (lo0) traffic and drop all traffic to 127\/8 that doesn't use lo0.\n-A INPUT -i lo -j ACCEPT\n-A INPUT ! -i lo -d 127.0.0.0\/8 -j REJECT\n# Accept all established inbound connections.\n-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n# Allow all outbound traffic; you can modify this to only allow certain traffic.\n-A OUTPUT -j ACCEPT\n# Allow HTTP and HTTPS connections from anywhere, including standard ports for websites and SSL.\n-A INPUT -p tcp --dport 80 -j ACCEPT\n-A INPUT -p tcp --dport 443 -j ACCEPT\n# Allow HTTP\/3 connections from anywhere (optional).\n-A INPUT -p udp --dport 443 -j ACCEPT\n# Allow SSH connections.\n# The -dport number should be the same port number you set in sshd_config.\n-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT\n# Allow ping.\n-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT\n# Allow destination unreachable messages, especially code 4 (fragmentation required) is required or PMTUD breaks.\n-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT\n# Log iptables denied calls.\n-A INPUT -m limit --limit 5\/min -j LOG --log-prefix \"iptables denied: \" --log-level 7\n# Reject all other inbound; default deny unless explicitly allowed policy.\n-A INPUT -j REJECT\n-A FORWARD -j REJECT\nCOMMIT<\/pre>\nCreate a new IPv6 configuration file as well:<\/li>\n<\/ol>nano \/etc\/iptables\/rules.v6<\/pre>Then, add the following lines:<\/p>
*filter\n# Allow all loopback (lo0) traffic and drop all traffic to 127\/8 that doesn't use lo0.\n-A INPUT -i lo -j ACCEPT\n-A INPUT ! -i lo -d ::1\/128 -j REJECT\n# Accept all established inbound connections.\n-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n# Allow all outbound traffic; you can modify this to only allow certain traffic.\n-A OUTPUT -j ACCEPT\n# Allow HTTP and HTTPS connections from anywhere, including the standard ports for websites and SSL.\n-A INPUT -p tcp --dport 80 -j ACCEPT\n-A INPUT -p tcp --dport 443 -j ACCEPT\n# Allow HTTP\/3 connections from anywhere (optional).\n-A INPUT -p udp --dport 443 -j ACCEPT\n# Allow SSH connections.\n# The -dport number should be the same port number you set in sshd_config.\n-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT\n# Allow ping.\n-A INPUT -p icmpv6 -j ACCEPT\n# Log iptables denied calls.\n-A INPUT -m limit --limit 5\/min -j LOG --log-prefix \"iptables denied: \" --log-level 7\n# Reject all other inbound; default deny unless explicitly allowed policy.\n-A INPUT -j REJECT\n-A FORWARD -j REJECT\nCOMMIT<\/pre>\nManually load both configuration files during boot time:<\/li>\n<\/ol>iptables-restore < \/etc\/iptables\/rules.v4\nip6tables-restore < \/etc\/iptables\/rules.v6<\/pre>3. Prepare the system environment<\/h3> Next, set up the Mastodon server environment. This involves configuring system repositories and packages, creating a dedicated user, and installing necessary software.<\/p>
Here’s the guide:<\/p>
\nInstall essential tools and utilities:<\/li>\n<\/ol>apt install -y curl wget gnupg apt-transport-https lsb-release ca-certificates<\/pre> \ncurl<\/a> – a tool to transfer data from or to a server.<\/li>\n\n\n\nwget<\/a> – a command-line utility to download files from the web.<\/li>\n\n\n\ngnupg<\/strong> – a free implementation of the OpenPGP standard to secure communication and data storage.<\/li>\n\n\n\napt-transport-https<\/strong> – allows the package manager to retrieve packages via HTTPS.<\/li>\n\n\n\nlsb-release<\/strong> – provides Linux Standard Base (LSB) information about the installed distribution.<\/li>\n\n\n\nca-certificates<\/strong> – provides a set of trusted CA certificates.<\/li>\n<\/ul>\nAdd the Node.js repository to your VPS to ensure you have the latest version:<\/li>\n<\/ol>curl -fsSL https:\/\/deb.nodesource.com\/gpgkey\/nodesource-repo.gpg.key | gpg --dearmor -o \/etc\/apt\/keyrings\/nodesource.gpg\necho \"deb [signed-by=\/etc\/apt\/keyrings\/nodesource.gpg] https:\/\/deb.nodesource.com\/node_20.x nodistro main\" | tee \/etc\/apt\/sources.list.d\/nodesource.list<\/pre>\nSimilarly, add the PostgreSQL repository using the commands below:<\/li>\n<\/ol>wget -O \/usr\/share\/keyrings\/postgresql.asc https:\/\/www.postgresql.org\/media\/keys\/ACCC4CF8.asc\necho \"deb [signed-by=\/usr\/share\/keyrings\/postgresql.asc] http:\/\/apt.postgresql.org\/pub\/repos\/apt $(lsb_release -cs)-pgdg main\"> \/etc\/apt\/sources.list.d\/postgresql.list<\/pre>\nUpdate your package list and install the necessary packages:<\/li>\n<\/ol>apt update\napt install -y \nimagemagick ffmpeg libpq-dev libxml2-dev libxslt1-dev file git-core \ng++ libprotobuf-dev protobuf-compiler pkg-config gcc autoconf \nbison build-essential libssl-dev libyaml-dev libreadline6-dev \nzlib1g-dev libncurses5-dev libffi-dev libgdbm-dev \nnginx nodejs redis-server redis-tools postgresql postgresql-contrib \ncertbot python3-certbot-nginx libidn11-dev libicu-dev libjemalloc-dev<\/pre> \nimagemagick<\/strong> – a software suite to create, edit, compose, or convert digital images.<\/li>\n\n\n\nffmpeg<\/strong> – a tool to record, convert, and stream audio and video.<\/li>\n\n\n\nlibpq-dev<\/strong> – PostgreSQL C client library and headers.<\/li>\n\n\n\nnginx<\/strong> – a high-performance HTTP server and reverse proxy<\/a>.<\/li>\n\n\n\nnodejs<\/strong> – a JavaScript runtime built on Chrome’s V8 engine.<\/li>\n\n\n\nredis-server<\/a> – an in-memory key-value store used as a database, cache, and message broker.<\/li>\n\n\n\ncertbot<\/strong> – a tool to automatically use Let’s Encrypt certificates.<\/li>\n<\/ul>\nEnable Corepack and set the Yarn<\/a> package manager version:<\/li>\n<\/ol>corepack enable\nyarn set version classic<\/pre>\nCreate a new user named mastodon<\/strong> or a name of your choice to run Mastodon:<\/li>\n<\/ol>adduser --disabled-login mastodon<\/pre>Switch to the mastodon<\/strong> user:<\/p>su - mastodon<\/pre>\nSet up rbenv<\/strong> to manage Ruby versions:<\/li>\n<\/ol>git clone https:\/\/github.com\/rbenv\/rbenv.git ~\/.rbenv\necho 'export PATH=\"$HOME\/.rbenv\/bin:$PATH\"' >> ~\/.bashrc\necho 'eval \"$(rbenv init -)\"' >> ~\/.bashrc\nexec bash\ngit clone https:\/\/github.com\/rbenv\/ruby-build.git \"$(rbenv root)\"\/plugins\/ruby-build<\/pre>Once done, install Ruby and set it as the global version:<\/p>
RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install 3.2.3\nrbenv global 3.2.3<\/pre>\nInstall Bundler, a Ruby gem dependency manager:<\/li>\n<\/ol>gem install bundler --no-document<\/pre>4. Set up the database<\/h3> A crucial part of hosting a dedicated Mastodon server is creating a PostgreSQL database<\/a>, which stores your instance’s essential data. Follow the instructions below:<\/p>\nReturn to the root<\/strong> user to configure the database with the necessary privileges:<\/li>\n<\/ol>exit<\/pre>\nEnter the PostgreSQL interactive terminal:<\/li>\n<\/ol>sudo -u postgres -i psql<\/pre>\nCreate a database for Mastodon:<\/li>\n<\/ol>CREATE DATABASE mastodon;<\/pre>\nCreate a dedicated PostgreSQL user for your Mastodon instance and assign a strong password. Replace your_preferred_password<\/strong> with a unique password of your choice:<\/li>\n<\/ol>CREATE USER mastodon;\nALTER USER mastodon WITH ENCRYPTED PASSWORD 'your_preferred_password';<\/pre>\nMake sure the user has the correct permissions to manage the database:<\/li>\n<\/ol>ALTER USER mastodon createdb;\nALTER DATABASE mastodon OWNER TO mastodon;<\/pre>\nQuit the PostgreSQL terminal by typing:<\/li>\n<\/ol>q<\/pre>5. Install Mastodon<\/h3> It’s time to download the installer, set up necessary Mastodon dependencies, and run the setup wizard to configure your instance. Here are the steps to complete the Mastodon installation:<\/p>
\nSwitch back to the mastodon<\/strong> user to ensure all Mastodon-related files and processes are isolated from the rest of the system:<\/li>\n<\/ol>su - mastodon<\/pre>\nUse these Git commands<\/a> to download the Mastodon installer from the official repository:<\/li>\n<\/ol>git clone https:\/\/github.com\/mastodon\/mastodon.git live && cd live\ngit checkout $(git tag -l | grep '^v[0-9.]*$' | sort -V | tail -n 1)<\/pre>\nInstall additional Ruby and JavaScript dependencies:<\/li>\n<\/ol>bundle config deployment 'true'\nbundle config without 'development test'\nbundle install -j$(getconf _NPROCESSORS_ONLN)\nyarn install --pure-lockfile<\/pre>\nRun the Mastodon setup wizard:<\/li>\n<\/ol>RAILS_ENV=production bundle exec rake mastodon:setup<\/pre>The wizard will ask you a series of questions:<\/p>
\nDomain name<\/strong> – enter the domain name that is connected to your VPS.<\/li>\n\n\n\nDo you want to enable single-user mode?<\/strong> – answer n<\/strong> to let users register on your server.<\/li>\n\n\n\nAre you using Docker to run Mastodon?<\/strong> – answer n.<\/strong><\/li>\n\n\n\nPostgreSQL host<\/strong> – enter 127.0.0.1<\/strong>.<\/li>\n\n\n\nPostgreSQL port<\/strong> – enter 5432<\/strong>.<\/li>\n\n\n\n
![\"\"](\"https:\/\/www.hostinger.com\/tutorials\/wp-content\/uploads\/sites\/2\/2023\/02\/VPS-hosting-banner-1024x300.png\")
<\/a><\/figure>