Managed vs unmanaged VPS: who patches it?

Every VPS order page makes you pick one of two words, and the cheaper one is doing a lot of quiet work.

Unmanaged does not mean basic. It means the host has told you, in writing, whose problem the server is. Hetzner’s technical and organisational measures put it in a single line for its cloud and dedicated servers: “You/the Client are completely responsible for the management, maintenance and security of the server.” OVHcloud’s getting-started guide says the same thing as a list, and the list includes “keeping the server up to date and operational” and “regularly testing your backups to ensure data recovery”.

Neither of those is hidden. People just don’t read them, because the server works on day one.

What the host still does

Quite a lot, to be fair. The physical machine, the power, the network into the rack, the hypervisor your server runs on. When a disk in their chassis dies, that is theirs.

The NCSC calls this shared responsibility, and the useful bit of its guidance is the list of things that stay with you whatever you buy. Securely configuring the services you chose is on it. So is deciding what data goes in. For a bare virtual server, the line sits very low. Everything from the operating system upwards is yours.

OVHcloud’s VPS FAQ is unusually honest about where that line sits on the first morning. The server arrives “with only the selected operating system installed”, the administrator is responsible for “applying an appropriate security configuration once the VPS is delivered”, and the host “cannot offer software configuration or administration assistance”. Nobody at the host is going to notice that your SSH accepts passwords.

What lands on you

Four jobs, and the order matters less than the fact that none of them finishes.

Updates, and the reboot after them. Installing a kernel update does nothing until the machine boots into it, and my own server once reported itself fully patched while running a kernel three versions behind. The update log looked perfect.

The front door. Anything on a public address gets tried, constantly. On my own production box I counted roughly 193,000 failed login attempts in a month, against a machine with no incident and nothing to steal that anybody knew of. Key-only SSH, a firewall that denies by default and fail2ban are the minimum, not the upgrade.

Backups. This is the one people assume the host has covered, and it is the one I’d argue about longest. OVHcloud does include a daily backup free with a VPS, and its premium option lets you go back up to a week. Hetzner’s data protection page goes the other way and says its servers are unmanaged, so you are “responsible for setting up appropriate backups yourself”. Either way, a host backup is usually an image of the whole disk, stored by the same company, reached through the same account login. If that login is what got compromised, so is your way back. And an image of a database that was halfway through a write is not something I would bet a business on without restoring it once to see.

Somebody noticing. This is the job nobody prices in. A server with no one watching it doesn’t sit still, it drifts. Certificates expire, disks fill with logs, a service dies at 2am and restarts itself into a slightly broken state. The host monitors its hardware. It does not monitor your nginx.

So is managed worth it?

Sometimes. The trouble is that “managed” is not a defined term, and hosts use it for very different things.

At one end it means the host applies operating system updates and gives you a control panel. At the other it means a named engineer who knows what your application does. Most offers sit much nearer the first. Before paying the difference, I would ask four questions and want the answers in writing.

Who installs updates, and who decides when the machine reboots? A managed plan that patches but never reboots has the same kernel problem as no plan at all.

When something breaks at 3am, what happens, and who does it? “We monitor it” and “we fix it” are different services.

Who has restored a backup of my server, and when? If the honest answer is nobody, the backup is a belief. That was the case on one of my own machines, where every job reported success every night while the largest database had never been in a backup at all.

Does it cover my application, or only the operating system under it? Nearly always the second. Your web app, your database settings and the thing your developer bolted on in 2023 usually sit outside the plan.

The third option, which is what I sell

There is a shape between the two that the order page doesn’t show: an unmanaged server, in your name, with your credentials, and one person looking after it.

That is what my infrastructure service is. One-off setup and hardening is a fixed price. Ongoing cover is monthly and priced per server, not per hour, and it covers patching, monitoring, backups tested by restoring them, and being the person who picks up when something breaks. The documentation gets written so somebody who isn’t me can take over. If you later move the work in-house or to somebody cheaper, you keep the server and the notes, and nothing needs migrating.

The server itself stays cheap, because you are still buying the unmanaged tier.

What it doesn’t buy is a team. I am one person with an alert on my phone, not a shift rota. If an outage at four in the morning costs you money by the hour, pay a host for managed hosting with staff on shift, and I’ll say so on the first call rather than after you’ve signed. I also can’t certify anybody for Cyber Essentials, and I don’t hold it myself.

When unmanaged on your own is fine

A test box. Something you can delete and rebuild in an afternoon without anybody noticing. A server run by a person who enjoys this work, has the time, and will still be there next year.

That last condition is the one that fails. The server my service page is written for was usually set up properly, by somebody competent, and then the somebody left. If you are that person, write down what runs on the box, where the backups go and how to get one back. Then restore one this week, before you need to.