Server Hardware/Software Setup

Basis for my dedicated server guides.
This will cover everything relating to the computer (hardware and software), network, and security.

Introduction

This guide will be an introduction to the game specific dedicated server guides.
Everything in this guide will be focusing on getting everything prepared before you begin the game dedicated server portions.

If you have already done this before, already have a server set up, or think you don't need to read this, than you can go back to the originating guide.

A major/minor thing I will mention is that I will assume that you have never done this before and will try to cover everything that needs to be mentioned (IP addresses, firewalls, operating systems, etc.) so keep that in mind if you see topics you already know about.

To begin with, all a server is is just a computer that runs 24/7.
You may also hear buzzwords like "cloud" where it means the same thing as a server.

One last thing before I begin this guide. Please read everything first before beginning/attempting!
This guide is pretty long so I may have some errors, mistakes, or mention things later that you won't find out until later.
I can be more specific about self hosting, but not so much for rented servers since each server provider will be different. So keep this in mind when there is vagueness when I give instructions for people who use rented servers.

Server Location

There are two options when it comes to setting up a server.
Hosting it yourself or renting a server.

When you host your own server you will have to ensure that the internet and electricity is stable and find a place to put your servers since you cannot allow them to heat up to dangerous temperatures (>80°C). Also because these servers will be on 24/7 and the fans are going to be loud.

When you rent a server all you have to worry about is the agreements and bills for the provider you choose.

The main benefit of hosting your own server is that no matter what goes wrong you own and manage everything. If something goes wrong with the server provider then it may or may not end well depending on how its managed. Remember they are the ones who own the servers and have access to it.


So once you decided if you want to host it yourself or rent a server you will have another thing to consider. Location.

Depending on where you live (or where your server lives if you rented it) the players in the surrounding area will have the best connection.

So if you live in Canada and rent a server where the servers reside in California, you're not going to have the best connection and 99% of your players will be from the US.

Same example again, if you live in Canada at the border and self host you will get both Canadian and US players.

Another thing to remember is that some games don't use a lobby/matchmaking system (ex. Counter-Strike) so you can have players choose your server even though they are far away from the server (unless you install plugins to disallow this).
For games that do use lobby/matchmaking (ex. Left 4 Dead) most people will land on your server because of location with the 'Best Available Dedicated' option. However, people can still can connect using the server browser, but for the most part this is how people will connect.

Another thing to keep in mind is that your connection latency will depend on multiple things, but for the most part the latency number as shown in the image should be somewhat accurate.

Server Hardware

These hardware requirements apply to both self hosted and rented servers.

The information here prior to the guide update in 2023 was quite outdated and most of it has been scrapped so you may wish to re-read this section.

CPU

The CPU should be a x86_64 CPU (also called amd64) with a minimum clock speed of 2.0Ghz.
I would recommend a CPU with a speed that is greater than 3.0GHz and contains multiple cores.

Although some games can still be ran from a x86 CPU (also called i386/i486/i586/i686), I wouldn't recommend it since most computers that have a CPU like this are going to be outdated and be a pain to deal with. But, if you are set on using old x86 computers then be my guest; just remember that you will have to adjust certain things to your situation.

If you run games with maximum amount of slots used (128 players) you will probably only be able to have one game on one server.
If you run games with reasonable amount of slots used (32 players) you will probably be able to have multiple games on one server.
Depending on your CPU speed and core count is how this estimate will be affected (games with much higher activity or lack of optimizations also play a part).

To throw some examples:
On a decent powerful CPU (forgot specifications) I could run about eight games on one server.
Since every server wasn't active I could get by with having this much with every game using about 10-20% CPU (sometimes more).
Some games have bugged out and do jump and stay at 100% CPU, but since CPU had multiple cores it didn't cause too much problems for the other games. Still not good to have though.

RAM

Bare minimum would be 4GB.
Recommended amount would be 8-16GB or more.

Games that are inactive on the server may or may not use less RAM.
Some games may cause memory leaks or require occasional restarts to keep RAM usage low.
All in all, every game is going to behave differently with RAM depending on how the game was designed.

To throw some examples:
On a machine with 8GB RAM I was fine with eight games.
All of these games were Valve based and typically used 300MB idling and 700-1024 active.
However, with the game Rust I find that it consumes a lot of RAM. 6GB idle and potentially 8GB active. I say potentially because at that point the machine ran out of memory.

HDD

At minimum I would recommend 250GB.
For everything else 500GB-1TB should be enough.

Before I get into details about amount of storage, I must first bring up hard drive types.
There is mechanical hard drives and solid state hard drives.
Mechanical hard drives are generally slower and more prone to hardware failure, but can store a huge amount of data.
Solid state drives are generally faster and less prone to hardware failure, but cannot store a huge amount of data.

So although you can easily buy a 8TB mechanical hard drive, you can't do the same for solid state hard drives.
Depending on your motherboard you may or may not be able to use NVMe chips which are even faster than solid state hard drives.

With mechanical hard drives the speed depends on the rpm and SATA revision.
With solid state hard drives the speed depends on the SATA revision.
For mechanical hard drives I would recommend using a 7200 rpm drive.
For both mechanical and solid state hard drives, a SATA revision of 2.0 (3GB/s) is sufficient.

So with that in mind, I can now go back to amount of storage.
Since the amount of storage a GNU/Linux distribution changes over time I typically recommend to use 32-64GB minimum for the system partition. 128GB-256GB as a recommended amount for the system partition.
Everything else should be used for the home partition which will hold the data for the games.

Depending on your RAM size, you will end up with a partition that will be used for swap.
So if you have 8GB of RAM you will end up with a 8GB partition used for swap.

The dedicated server software size will vary depending on the game. To check how much would be required, go to https://steamdb.info/ and enter something like "game name dedicated server".
When you find the correct page, select the depots tab; you should be able to see the size for the main depot and then the os specific depot. Add these two together and you have the required size.

If you wish to include mods, that will also take up storage.
So as you can see, things are going to add up and it isn't a real good idea to get a bare minimum size hard drive.

Ethernet

If you self host then you should use a Cat5e or Cat6 Ethernet cord plugged directly from the server to the modem/router.

Before you can begin hosting you need to know two things: internet speed and bandwidth limits.

If you rent a server you should already know these two things.
If you self host you will have to find the information from your ISP.

A decent tool you can use if you self host is speedtest.net to find your internet speed.

Then go to this site: https://ambaca.github.io/rate-calculator-2015/
Enter your upload speed into the first box and the number of players you wish to have into the second box. Click calculate and then below the image you can see the results.

So if you have 50mbps and want a 24 player slot:

You can host 118 players
* Recommended Upload Bandwidth for 24 players = 10.14 Mbps

You would need about 10Mbps.

You don't have to mess with the other input boxes unless you want to use those settings/cvars.

As with knowing how much bandwidth you need for other games you will have to do your own tests and research.

Knowing your bandwidth usage you have to make sure that it doesn't go past your bandwidth limit. Usually going past your bandwidth limit will result in extra fees or other penalties.
I don't know about any bandwidth monitoring tools for GNU/Linux so you will have to do research in this regard if you have to deal with bandwidth limits.
I do know that on Oracle Linux the ifconfig command does show amount of data processed (RX/TX) since the server has been online.
So for every month, my gaming server would use about 200GB upload and 100GB download.

IP Addresses and Ports

An ip address is a set of numbers assigned to a computer to be able to locate a computer on a network.
The most commonly used is IPv4 which looks like this: 127.0.0.1


There has been a push to use IPv6, but in order to use this you would have to have:

• Support from your ISP
  
• Support from your modem/router
  
• Support from your operating system
  
• Support by the dedicated server software

I always preferred to use IPv4 and I haven't really used IPv6 so I can't really say much about it. So if you need to use IPv6 you will have to do research and see if you can be able to use IPv6 for the rest of the guide.


Continuing forward, there are two types of ip addresses. Public and private.
Private ip addresses are a range of addresses that are reserved for private networks.
These private networks are used in homes, offices, schools, etc.

Private ip addresses will look something like this:
10.0.0.50
172.16.0.50
192.168.0.50

Public ip addresses are addresses that are available to access from any computer.
These are used in data centers and at the root of your private network.

Public ip addresses will look something like this:
74.6.231.21
184.84.152.105
142.251.33.46


So every building will have at least one public ip address that is received by the modem (aka root of your private network). But you can only use one device from the modem unless you have multiple public ip addresses.

To solve this issue you use a router. What the router does is something called NAT. The router creates a private network and assigns all devices connected to the router a private ip address. Then all requests go from your device to the router, from the router to the modem, and from the modem to the server.

So the connection will look something like this:
pc (192.168.1.11) -> router (192.168.1.1) -> modem (60.XX.XX.XX) -> server (184.84.152.105)


A common fad i've seen is people being scared about their ip being leaked.
Having your private ip address (192.168.1.11) leaked does absolutely nothing.
Also your public ip address is... public. In fact your public ip address is probably getting port scanned and sent stupid requests run by botnets to find a vulnerability.
You should only be worried if your public ip address is leaked when you have the worlds worst modem and router where security is nonexistent with username and password set to admin (well you should be worried about those issues even if your public ip wasn't leaked, but that is besides the point).

I suppose I should also mention that every time you connect to a server (or website) the server owner/operator can see your public ip address (and possibly log it depending on the service or setup). Your public ip address can/does show where you are located (city, state, and country) and what your ISP is, but it does not show your exact home address.

If you don't like the sound of that then you can look into using a VPN, proxy, or Tor.
Just remember that with using a VPN, proxy, or Tor you are transferring the trust from your ISP to the VPN provider, proxy provider, or Tor network.
Another thing to keep in mind is that if you have DHCP (which most people have) your public ip address will change after a certain amount of time anyways.


Now is the time to talk about ports.
So ip addresses is the location of the computer, but what about the services?
Every service (or program that deals with the network) run on the computer will use ports to be able to identify and separate services.

The most commonly used ports on servers are:
80 - HTTP
443 - HTTPS
22 - SSH
27015 - Source Dedicated Server

So if you run a game server you can access it from the game by running something like:
connect publicserverip:27015

If you run a website you can access it from a web browser by entering:
http://publicserverip:80/index.html
https://publicserverip:443/index.html

Depending on your setup you may also have to change the programs to listen on different ports. You can also do this anyways if you don't need to.

However I wouldn't recommend running services on other services ports; such as running a source dedicated server on port 80.

Nothing bad will happen (sometimes), but if people try to access your server from a web browser they'll be greeted with an invalid request.

However running the source dedicated server on lesser known ports like 27125 won't be an issue and will still show up in the server browser for the games.

Tools

You will need to install some tools to your computer to be able to manage your server.

Cygwin

Cygwin is a collection of utilities for Windows that can be typically found on GNU/Linux systems.
Although OpenSSH should be installed by default on newer Windows systems, I still recommend to use Cygwin anyways to have access to other utilities.

You can install Cygwin from this link:
https://cygwin.org/install.html

When you run the installer you can add the following packages to be installed:

nano openssh rsync wget

MacPorts

MacPorts is a collection of programs for macOS that can be typically found on GNU/Linux systems.
Although OpenSSH (and other utilities) should be installed by default on macOS systems, I still recommend to use MacPorts anyways to have access to other utilities.

You can install MacPorts from this link:
https://www.macports.org/install.php

Once you have MacPorts is installed you can install packages with the following commands:

$ sudo su
# /opt/local/bin/port -v selfupdate
# /opt/local/bin/port -v install nano openssh rsync wget

Just be sure to have your terminal's $PATH to be configured to something like:
PATH=/opt/local/bin/:$PATH

Rufus

If you are self hosting you will need a utility to copy the operating system iso to a usb to be able to boot up the operating system installer.

For Windows you can use Rufus to complete this task and you can download it from this link:
https://rufus.ie/en/

Although it is possible to complete this task with Cygwin's dd command I don't recommend it too much since it is more advanced.

balenaEtcher

If you are self hosting you will need a utility to copy the operating system iso to a usb to be able to boot up the operating system installer.

For macOS you can use balenaEtcher to complete this task and you can download it from this link:
https://www.balena.io/etcher/

Although it is possible to complete this task with the dd command I don't recommend it too much since it is more advanced.
As with using macOS's Disk Utility I don't recommend it since I have found it to not do the task correctly.


Some hints when using a terminal (or console):
Tab - Pressing tab can autocomplete commands and paths
Shift+Page Up - Scroll up the terminal
Shift+Page Down - Scroll down the terminal
Shift+Insert - Paste something from the clipboard to the terminal
Up and Down Arrow Keys - Move up and down the history of your commands
Left and Right Arrow Keys - Move left and right of the buffer where you enter in your command
Control+C - Cancel command or buffer
Control+D - Insert EOF (might be wrong on this one)
Control+Z - Suspend command

Server Operating System

So at this point you should have a server.
Most dedicated server software supports both GNU/Linux and Windows, but there may be some that support only Windows. This isn't that big of a problem since the programs Wine and Proton can be used to run Windows programs on GNU/Linux.

Now I used to have instructions for supporting Windows in this guide, but I will no longer be doing so. Too many games don't support Windows 7 anymore thus making Windows 7 less of a viable option and using Windows 10 (or anything made after 7) on a server is probably the worst choice you can make.
If you still wish to use Windows on a server regardless you will have to find another guide to set up the operating system.

So since Windows is not an option all that is left is GNU/Linux.
Since there is many distributions of GNU/Linux I shall be using Oracle Linux.

If you do not wish to use Oracle Linux you can find some other distribution that suits you here:
https://distrowatch.com/search.php
If you wish to use Oracle Linux you can download it from here:
https://yum.oracle.com/

One thing that should be kept in mind is that distributions may or may not support specific file systems or may package different versions. So if you use JFS on Slackware you won't be able to use it anywhere else besides on OpenSUSE. If you create an XFS partition on Oracle Linux, you can't use it on Slackware because the versions are different.
If you feel that you might be switching distributions in the future, I would recommend to stick to ext3/ext4.
If you don't feel that way, but don't know which file system to use you can read this:
https://docs.slackware.com/slackbook:working_with_filesystems#local_filesystem_types

I highly recommend avoiding btrfs and zfs since those file systems are still being worked on and were just recently imported into the kernel.

Second thing that I should mention is that Oracle Linux has a EULA mostly regarding trademark policy which you can find here:
https://www.oracle.com/downloads/licenses/oracle-linux-license.html


In my opinion, as long as the distribution is not rolling release and has stable releases then it should be fine to use.

Just be sure to know how to use the operating system well before continuing since I won't be covering that. Also be sure to install the package called: nano
You will be using this every time to edit a file.

Server Firewall

For people who rent servers, do not block all incoming connections, remove firewall rules for SSH (port 22), or change the firewall without a way back in!
If you do this you will lock yourself out.


For Slackware Linux and for distributions that use iptables you can read this:
https://www.slackbook.org/html/security-host.html

Since the SlackBook doesn't discuss IPv6 or allowing ping I will post my /etc/rc.d/rc.firewall script.
Here is how to test it before installing it to your system (the same could be followed to test your own firewall script to avoid locking yourself out):

Enter the following in /root/firewall:
(Be sure to modify the script for your system. A change could be someting like eth0 to enp4s0)

#!/bin/sh

echo "Applying iptable/ip6table rules..."
/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P FORWARD ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT
/usr/sbin/iptables -F
/usr/sbin/iptables -P INPUT DROP
/usr/sbin/iptables -P FORWARD DROP
/usr/sbin/iptables -P OUTPUT ACCEPT
/usr/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
/usr/sbin/iptables -A INPUT -p icmp --icmp-type 0 -i eth0 -j ACCEPT
/usr/sbin/iptables -A INPUT -p icmp --icmp-type 8 -i eth0 -j ACCEPT

/usr/sbin/ip6tables -P INPUT ACCEPT
/usr/sbin/ip6tables -P FORWARD ACCEPT
/usr/sbin/ip6tables -P OUTPUT ACCEPT
/usr/sbin/ip6tables -F
/usr/sbin/ip6tables -P INPUT DROP
/usr/sbin/ip6tables -P FORWARD DROP
/usr/sbin/ip6tables -P OUTPUT ACCEPT
/usr/sbin/ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/ip6tables -A INPUT -s ::1/128 -d ::/128 -i lo -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 0 -i eth0 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 8 -i eth0 -j ACCEPT

# OpenSSH
/usr/sbin/iptables -A INPUT -p tcp --dport 22 -i eth0 -j ACCEPT

# Source Dedicated Servers
/usr/sbin/iptables -A INPUT -p tcp --dport 27015:27016 -i eth0 -j DROP
/usr/sbin/iptables -A INPUT -p udp --dport 27015:27016 -i eth0 -j ACCEPT

Then enter the following in /root/nofirewall:

#!/bin/sh

echo "Removing iptable/ip6table rules..."
/usr/sbin/iptables -F
/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P FORWARD ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT
/usr/sbin/ip6tables -F
/usr/sbin/ip6tables -P INPUT ACCEPT
/usr/sbin/ip6tables -P FORWARD ACCEPT
/usr/sbin/ip6tables -P OUTPUT ACCEPT

So whenever I would run /etc/rc.d/rc.firewall to update an entry it would usually cut off my current connection, but of course ssh would still work to reconnect.
Recently I have been able to run /etc/rc.d/rc.firewall without my connection being cut. I am guessing there was an update in Slackware or something because I haven't changed anything.
Keep this in mind if you get cut off with the next command (you still are protected from being locked out which is described below).

Then run:

chmod +x /root/firewall /root/nofirewall
/root/firewall && sleep 30 && /root/nofirewall &

What the last command does is that it'll apply the firewall. During this time you can open another terminal and ssh into the server to see if you can connect. If you can connect then the firewall works. If you can't connect, then the firewall isn't working properly.
After 30 seconds has passed, the firewall will be completely reset to an open state.

However, be sure to type the command correctly!
If you forget the "&" at the end then the command won't execute properly. The "&" makes the command run in the background instead of in the terminal. If you run the command in the terminal and the firewall cuts your ssh connection off, then there is no way for it to finish executing (and you end up locked out). But if you run it in the background, even if you're connection is cut off it will still execute.

Once you have verified that the firewall works completely you can install the script (for Slackware Linux) by running:

mv /root/firewall /etc/rc.d/rc.firewall
chown root:wheel /etc/rc.d/rc.firewall
chmod 755 /etc/rc.d/rc.firewall

For other distributions that use iptables you will have to lookup your distributions documentation on how firewall rules are applied (or how to run commands on boot up).

Now whenever you need to add another service all you have to do is add the following statements (once you changed them) to your /etc/rc.d/rc.firewall script:

# <service name>
/usr/sbin/iptables -A INPUT -p tcp --dport <port number> -i eth0 -j DROP
/usr/sbin/iptables -A INPUT -p udp --dport <port number> -i eth0 -j ACCEPT

For Oracle Linux and for distributions that use ufw you can read this:
https://docs.oracle.com/en/operating-systems/oracle-linux/8/firewall/

Listing current rule set

firewall-cmd --list-all

Adding and removing a service

firewall-cmd --add-service ssh
firewall-cmd --remove-service http

Adding and removing a service (with ports)

firewall-cmd --add-port 27015/udp
firewall-cmd --remove-port 27015/tcp

Saving your changes

firewall-cmd --runtime-to-permanent

If you still somehow got locked out of your rented server then you're locked out.
The way to regain access to it will depend on your server provider.
The first step is to go to your server provider's support page. You should be able to find a help page on what to do.
If you don't see a help page or anything of that sort then you will have to open up a ticket stating your problem/situation.

From there they should give you instructions on how to fix it. One of the solutions could be using VNC to connect to your server via a (most likely shared) KVM switch.
With this all you have to do is connect over VNC and login as if you had local access.

Server IP and Port Forwarding

If you rent a server you should have a static public ip address and won't have to do port forwarding (so skip this section).
If you self host you will have to set a static private ip address for your server and port forward.


1. Run:

ifconfig

This should give you the (private) ip address, subnet mask, and MAC address (physical address).

If the terminal reports that the program is not found then login as root or update your $PATH to include more entries.
On Slackware Linux the regular user's $PATH is different from the root user's $PATH.
So this means you cannot run ifconfig, but you can run /sbin/ifconfig
On newer versions of Ubuntu Linux they have dropped the ifconfig package from base so I suggest to install it or find a different way to get the same output as ifconfig

2. Run:

route

This should give you the gateway address.

3. Run:

cat /etc/resolv.conf

This should give you your DNS name server addresses.


If you don't use a router and have your server directly connected to the modem then you don't need to port forward.

If you have a router you have to port forward. What port forwarding does is that it makes a service from a private ip address available on the public ip address.
Example (srcds):
1. connection to modem with public ip address and port 60.XX.XX.XX:27015
2. connection handled by router (NAT). router sees requested port and checks if port is forwarded.
3. port is configured to be forwarded to computer 192.168.1.11 so forward connection
4. connection completed to server

Example (ssh):
1. connection to modem with public ip address and port 60.XX.XX.XX:22
2. connection handled by router (NAT). router sees requested port and checks if port is forwarded.
3. port is not configured to be forwarded.
4. connection dropped or rejected


Unfortunately I cannot be very specific here since there are many router models all with different interfaces, settings, and passwords.

So to proceed you will need to:
1. Find your router model name.
2. Find your router model number/version.
3. Find your router login information.
4. Find your router manual. If you don't have your router manual, in your search engine look up "name modelnumber manual"

Example:

1. Netgear
2. R6400v2
3. admin/password
4. Netgear R6400v2 manual

Now you can read through the manual to understand how to do everything with the router.
Or you can look for the important topics of "Static IP" and "Port Forward".
Be aware that some manuals may call these under different terms or buzzwords.

1. So once you've read through the manual (or at least partially) open up a web browser and enter:
http://gatewayip

You should have the gateway ip address from earlier. It will (or should) be on the label of the router. Fair warning, newer routers have been doing tricks so that you must use an actual domain name. You can see this for the above example where it says "http://routerlogin.net".
G*d have mercy on your soul if you are stuck with those new routers where everything must be done from a mobile app. At that point I would suggest to just buy a better router.

2. Once done loading you should be prompted for a username and password.
On some routers you have to click login first. So enter your login information from earlier.

3. Find the section where you can set static ip addresses for clients. Here you will enter the (private) ip address of the server and the server's MAC address (also called physical address).
You should have this information from earlier.

What this does is it will always assign the same private ip address to the detected MAC address (your server).
If you don't do this then what happens is that your server's ip address will change and every port forward will break because the ip addresses are different.

On some routers it will automatically assign a static ip for the device you port forward. On other routers it won't let you port forward until you assign a static ip. On most routers it won't complain or do anything extra.

4. Now in the port forward section you will just enter the server private ip address, the port number, the protocol type (TCP/UDP/BOTH), and a name.

That is how you port forward.
You won't actually enter anything in just yet since there are no services set up.
You will be able to test the port forward later on in this guide after you setup the httpd program (web site).


If for whatever reason you are behind multiple routers, I highly suggest to just directly connect the server to the first router. Having to do multiple port forwards and other tasks will be tedious.

Services (SSH)

At this point your server should already be up and running.

Since OpenSSH is typically installed and enabled by default you won't have to worry too much about installing and setting up OpenSSH on the server.
However, you will also need to have OpenSSH on your computer to be able to connect.
You can refer to the 'Tools' section from earlier if you haven't done so and test if OpenSSH is working properly on your system by running the command:

ssh -V

To setup your SSH keys run:

ssh-keygen

You can provide a password for your SSH key file for extra security.


If you rented a server then you should be able to add this SSH key to be accepted or when you purchase the server you should be able to email or send your SSH key.

Then you should be able to log in with:

ssh yourusername@serveripaddress

You should be prompted with a message like:
The authenticity of host '60.XX.XX.XX (60.XX.XX.XX)' can't be established.
Since you cannot verify the fingerprint since the server is rented you will have to simply enter yes and blindly trust the given fingerprint.

Once you are able to log in you can skip everything else within this section.
If something goes wrong you will have to work with your server provider to fix the issue.


Now to move on setting up the SSH keys for the self hosted server.
Run the following command to begin transferring files:

sftp yourusername@privateipaddress

Then you should be prompted with a message like this:

The authenticity of host '192.168.0.101 (192.168.0.101)' can't be established.
ECDSA key fingerprint is SHA256:d35DKgNbu/61j5dQimHxWgHoh2RPyPwUEvOatEwou+c.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Log on to the self hosted server locally and run the command:

ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub

Sometimes OpenSSH will use a different cipher. If it says ED25519 instead of ECDSA, then you will have to adjust your commands to use a different keyfile.

Now compare the fingerprints to verify.
You should be able to enter the fingerprint to verify, but that doesn't work for me.

Once verified and logged in, you can enter:

put .ssh/id_rsa.pub
exit

Then run the above sftp command again except replace sftp with ssh and then run the following commands:

cat id_rsa.pub >> .ssh/authorized_keys
rm id_rsa.pub

You should now be able to log in to the server with a key file instead of a password.

Services (HTTP)

Another service you will most likely want set up is a HTTP server.
With an HTTP server you can create web pages that can be used for message of the day on supported games and add the ability to upload custom files.

Since every GNU/Linux distribution is different you will have to refer to distribution's documentation on managing the packages and managing the system services.

For Oracle Linux you can install and enable the Apache HTTP server with the following commands:

yum install httpd
systemctl enable httpd
systemctl start httpd

Don't forget to open port 80 and additionally port forward port 80 if you need to.
Then you can create a folder on your computer that you plan to upload to this web site and store files that you wish to make public.
Once you have filled the folder with what you want you can then upload it using one of the following commands:

sftp yourusername@publicipaddress
(sftp) cd /var/www/html/
(sftp) [if on Windows] lcd /cygdrive/c/Users/YourNameHere/Desktop/website/
(sftp) [if on macOS] lcd /Users/YourNameHere/Desktop/website/
(sftp) put -r *
(sftp) exit

or

[if on Windows] rsync -av -e ssh /cygdrive/c/Users/YourNameHere/Desktop/website/* yourusername@publicipaddress:/var/www/html/
[if on macOS] rsync -av -e ssh /Users/YourNameHere/Desktop/website/* yourusername@publicipaddress:/var/www/html/

A few pointers about the commands (and process):
1. rsync or sftp?
For regular html files and other small files you can use sftp.
For mod files and other big files you can use rsync.

I prefer to use sftp all the time, but i've experienced sftp crashing when transferring big files and then have to fallback to rsync.
I also recently discovered that a command called scp exists that you can try out, but I won't be using it since I already have sftp.

2. Permission denied!
You will have to change the permission of the /var/www/html folder.
You can do so with the following commands:

$ sudo su
# chown root:yourusername /var/www/html/
# chmod 775 /var/www/html/

3. 403 Forbidden!
You will have to run the following commands to fix the permissions:

find /var/www/html/ -type d -print0 | xargs -0 chmod 755
find /var/www/html/ -type f -print0 | xargs -0 chmod 644
restorecon -R /var/www/html/

The last command will only have to be executed on GNU/Linux systems with SELinux.


Once you have uploaded the files (and fixed the permissions) you should be able to access them by opening your web browser and going to the address http://yourpublicipaddress:80/

Services (SteamCMD)

Before you can install SteamCMD you will need to make sure your distribution includes multilib support and is using glibc. If it doesn't you will have to switch distributions.

Oracle Linux has multilib support and uses glibc, but requires installing additional libraries:

yum install glibc.i686 libstdc++.i686

First prepare the groups and users:

groupadd steamds
useradd -c SteamCMD -G steamds -k /dev/null -m -s /sbin/nologin -U steam
chown steam:steamds /home/steam/
chmod 770 /home/steam/
usermod -aG steamds yourusername

Then you can now set up and run SteamCMD:

cd /home/steam/
wget https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz
tar xpvf steamcmd_linux.tar.gz
rm steamcmd_linux.tar.gz
chown -R steam:steam /home/steam/
chown steam:steamds /home/steam/
echo "/bin/su -c /home/steam/steamcmd.sh -s /bin/sh steam" >/home/steam/steamcmd-wrapper.sh
chmod +x /home/steam/steamcmd-wrapper.sh
/home/steam/steamcmd-wrapper.sh

It should now update SteamCMD. Once done you should see something like this:

Redirecting stderr to '/home/steam/Steam/logs/stderr.txt'
[  0%] Checking for available updates...
[----] Verifying installation...
Steam Console Client (c) Valve Corporation - version 1669935972
-- type 'quit' to exit --
Loading Steam API...OK

Steam>

Security

When it comes to firewalls all you have to do is not leave the firewall open all the time.
Within the firewall sections earlier I already demonstrated to drop TCP connections to the source dedicated server for security reasons.
For people who self host you may or may not experience issues with your router's firewall and security. If you do experience issues such as DDoS attacks you will have to replace your router with something more advanced such as a OpenBSD router/firewall.
Setting something like this up is out of scope of this guide.

For OpenSSH you just have to generate your SSH keys and then disallow using password authentication.
You shouldn't port forward SSH (port 22) for self hosted servers unless you need remote access.


When it comes to services running:
You typically only want services you need and that are required running.
Any extra services that you don't need and are not required should be stopped and disabled.

You will have to refer to your distribution's documentation on how to check what is running and how to disable a service.
For Oracle Linux:
https://docs.oracle.com/en/learn/use_systemd/index.html#introduction

For Oracle Linux I haven't really needed to disable any services, but for other GNU/Linux distributions i've used in the past I have disabled some.
If you don't know what services to disable for GNU/Linux then I would just recommend to skip doing this.


Having backups of your system is also good in case something goes wrong or your system is compromised.
You can use a script like below placed into your weekly cron folder (or however cron is set up on your system) for weekly backups:

SDATE=$(date +%Y-%m-%d)
mkdir /mnt/${SDATE}/
rsync -a --exclude=/dev/* --exclude=/media/* --exclude=/mnt/* --exclude=/proc/* --exclude=/sys/* --exclude=/tmp/* --exclude=/vm/* / /mnt/${SDATE}/

You may have to exclude more directories depending on your set up.
You will also have consider the (disk) performance penalty in backing up.
Just don't forget to occasionally rotate the backup drive to keep a backup drive disconnected from the server since always leaving the backup drive plugged in would defeat the purpose of backups in the case of something going wrong or system being compromised.


Lastly, keeping your system up to date.
Once again you will have to refer to your distribution's documentation on updating (not upgrading).

For Oracle Linux you can use this command:

yum update

If a service was updated such as httpd you can restart the service to apply the updates.
If the kernel was updated you will have to reboot the system to apply the updates, however, I generally don't since I do not run important stuff on my GNU/Linux systems.

You generally shouldn't do upgrades all the time and only need to do them when it's necessary.
Such a necessary situation would be when your distribution version has reached end of life.
Mostly because with upgrades your server will have to go down for a reboot to finish upgrading.

Domain Name

One of the last things you may be wanting is a domain name for your server.
Domain names are names for your server(s) so you and others don't have to memorize your public ip address.

How it works is that you purchase a name from a domain name provider and you own the title to that name. Provided that you purchased it in "good faith" and keep paying the yearly fees.
Then you can create a [A] type DNS record that points the name to your public ip address.

So you may recall earlier how I mentioned how computers connect to each other.
Well for domain names it is a different type of deal since your computer must obtain the ip address associated with a domain name.

Example (connect with ip address):
1. pc attempts to access website steampowered.com via direct ip address
2. pc establishes connection to server with direct ip address

Example (connect with domain name):
1. pc attempts to access website steampowered.com via domain name
2. pc doesn't know ip address of domain name so it sends a query to dns server
3. dns server looks up information about domain name and sends it back to pc
4. pc now knows ip address from dns record and then establishes connection with this ip address


So now knowing how this works you will have to go find a domain name provider.
Be very sure that the when you do find a domain name provider that you:
1. Make sure they provide whois privacy protection
2. Make sure that the information you give isn't too revealing

Because:
1. Without whois privacy protection any person can easily grab your information and use it for whatever purpose.
2. Even with whois privacy protection most domain name providers policies state that they can disable this for your account if they feel they need to.

You can see which websites use which domain name provider and the owner information easily since most domain name providers provide an online whois service such as:
https://www.whois.com/whois/


At this point you should have purchased a domain name from a domain name provider.
All that you have to do now is go into the control panel and create the following DNS records:

Record Type	Hostname	IP Address	Time-To-Live
A	@	60.XX.XX.XX	900
A	www	60.XX.XX.XX	900

There are multiple types of records, but the one you need to deal with the most are [A] type records.

Hostname is the name you wish to have an ip address binded to. The "@" hostname means root.
So "@" would mean example.com while "www" would mean www.example.com

Time-To-Live (TTL) is how long this record will live for. What this means is that after the set amount of time the record will expire and update. So if you expect public ip address changes or plan to change records and expect changes fast you might want to keep this a lower value.
TTL should be time in seconds, but some domain name providers may provide values in minutes for convenience.

So with this example you could then SSH by using [e-mail] and access the website at www.example.com.


Now a question may be pondered.
Is it necessary to use www and what other uses could be used for hostnames?

To answer the first question, no it is not necessary to use www
You could actually run the website on root (@) and it still will work fine.
The question of whether or not to keep it or remove it will depend on what you plan to do with your server so I can't answer this question.

As for the second question you can use it to separate websites or services.
Such as using www.example.com for the main site and forum.example.com for a forum.

You could also use it to keep track of other server locations if you own or rent servers in multiple locations.
Such an example could be usa01.example.com and mex01.example.com

Conclusion

Well hopefully I didn't forget to mention anything important within this long guide.

Now I know I may have been brief on certain subjects, but I mostly intended this to be a guide and not a textbook on creating your own server so more than likely you will still have to do your own research for topics relating to your goals and desires.

I do plan on doing a fast paced video demonstrating the process and will link it here when it is complete now:

In any case hope you have learned something from this guide or that it has been somewhat helpful.

=

Guide Revisions
2021 - Originally written
2022 - Fixed misspellings
2023 - Improved guide with some sections rewritten or added

[TERRYBERRY3000]

Awesome, I was looking into hosting my own gaming servers for more than one game, this puts me on the right path.
Much appreciated.

[carex53]

Underrated guide