An Unmanaged Server Nobody Updates

The move that looked like an upgrade

Shared hosting got slow, or the host complained about resources, and someone suggested a virtual private server: a slice of a powerful machine with its own memory and its own operating system.

It was faster, and often cheaper than expected. The site moved, everything worked, and the monthly charge became one more line in the accounts.

What nobody mentioned, or nobody remembers, is the word unmanaged on the order.

It means the host supplies the machine. Everything running inside it, from the operating system up, is the customer's to keep current.

What unmanaged leaves to you

The host keeps the power, the network and the hardware working. The rest is a list most owners have never seen.

• The operating system, and its regular security updates.
• The web server that answers every request for a page.
• PHP and the database, including moves to supported versions.
• The control panel, if one was installed, and its updates.
• The firewall and mail software, including what the server sends out.
• Backups, unless they were bought and tested separately.

The first is the one that quietly stops. Operating system updates are routine, a short job each month, and on an unmanaged server nobody is reminded to do them.

Why nobody does it

The server was usually set up by a developer hired for the move. Setting it up was the job; looking after it was never in the quote.

The owner assumes the host looks after it, because the host is who gets paid every month.

The host assumes the customer does, because that is what the plan says.

Each assumption is reasonable. Between them, the server can go years without an update.

Small is not invisible

It is tempting to think a small business server is too obscure to attract attention. That is not how attacks work.

Automated tools scan every address on the internet for software with known flaws, around the clock, without knowing or caring whose server it is.

When a flaw in common server software is published, those scans start looking for it within days. A server months behind on its updates answers them.

What a managed plan adds

A managed plan costs more because someone at the host works through that list: updating the operating system and server software, watching for failures and keeping backups.

Plans vary, so read what is included rather than trusting the word. Some manage the operating system but not the control panel; some keep backups on the same machine they are meant to protect.

Almost none manage the website itself. WordPress, its plugins and the site's own code stay with whoever maintains the site.

When PHP 5.5 reached its end last month, a managed customer at least had someone whose job it was to notice. On an unmanaged server, nobody did.

One page of who does what

Managed or not, the useful document is one page with three columns: the item, who is responsible, and how often.

Operating system updates: the host or a named person, monthly. PHP version: the developer, reviewed each quarter. Backups: daily, with one restored each year to prove they work.

Add the domain and certificate renewals, since they expire on their own schedule.

Give a copy to the host, the developer and whoever pays the bills. The point is that every line has a name beside it.

A worked example

A genealogist who researches family histories for clients also runs a searchable index of cemetery and parish records, transcribed by volunteers over many years.

Searches made the site slow on shared hosting, so three years ago a developer moved it to an unmanaged virtual server and set it up carefully.

The developer moved on to other work. The genealogist assumed the host handled updates, since the invoice arrived every month.

Then the host wrote to say the server had been sending spam and its outgoing mail was blocked. Messages from the site's enquiry form stopped arriving.

A look inside found no operating system updates since the month of the move, a control panel two years behind and PHP still at 5.4.

The host had acted on complaints from outside, which is how the problem surfaced. It had never looked inside the server, because on that plan nobody asked it to.

The fix was not a different server but a named owner for it: a maintenance agreement covering monthly updates and checks, with the PHP upgrade tested first on a copy of the site.

Checking the update history

You do not need to read server logs yourself. Ask whoever holds the administrator login for four answers in writing.

The date of the last operating system update, and the date the server last restarted, since some updates only take effect after a restart.

The versions of the operating system, PHP and the database, and whether each version still receives security fixes.

If nobody can answer, that is the answer.

Version numbers can mislead

One complication is worth knowing. Some server operating systems keep an older PHP version and patch it themselves, so an old number is not always unsafe on its own.

Those patches arrive only when someone installs updates. On a server nobody touches, the old number and the missing patches go together.

Someone who knows the system can tell which situation you are in within a few minutes, which beats a guess from the number.

The counter-case

Unmanaged servers are not wrong in themselves. A business with a developer or IT person who already maintains servers can run one well and save money doing it.

And a small brochure site may not need a server of its own at all. A good shared or managed plan would serve it with far less to look after.

What does not work is an unmanaged server with nobody's name next to it. Name the person who updates it, or pay the host to be that person.

Who looks after it

1. Find the word managed or unmanaged on your plan.
2. Ask who holds the administrator login.
3. Get the date of the last system update.
4. Check each version still receives security fixes.
5. Write down who does what, and how often.
6. Test the backups by restoring one.
7. Review the page whenever someone leaves.

Step two matters most, because a server whose login nobody can find is a server nobody can update, whatever the plan says.

What moving to a newer PHP involves is covered in PHP 5.5 reaches its end today.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.