Is a VPS with DDOS protection sufficient security for a Tezos bakery?

Question

I was thinking about using Virmach $5.00 Windows server 2012 plan with the following specs:

for example SSD1G 1GB DEDICATED RAM // 1 vCORE // 25GB+ SSD (HW RAID 10) // DDoS Protection Available // 1TB BANDWIDTH// 1GBPS - 10GBPS

Then using bakechain to run a bakery and connect to public nodes until I can set up my own private trusted node(if I find it is worth my time and money).

Is this enough security? If not, how can I beef up the security or what is a recommended vps service?

Thanks in advance,

Mack

Answer 1

Short answer is no it is not.

DDOS is actually a secondary security concern when baking. First and foremost you should be securing access to your baking server and your private keys. If someone gains access to your server and your keys they can steal your Tezos which is a lot worse than simply loosing your rewards which is the consequence of a DDOS attack.

There is no single answer to hardening a server but general best practice is to only allow traffic on the ports/protocol you know are needed, regular patching, monitoring and specifically for crypo currencies securing your keys with a hardware security module like a Ledger.

Answer 2

Highly recommend learning how to bake without bake chain. Running a bakery requires certain skills, like being able to work with the tezos client. If that is too daunting, then frankly, you do not inspire much confidence. Also, using VPS makes using Ledger Nano difficult, which is highly recommended to be used for security purposes. Good luck.