ECS Best Practices

Alibaba Cloud ECS is one of the most widely used cloud server products for enterprises and small-to-medium teams in China. This article summarizes hands-on experience from real projects, covering initialization, security, performance, images, networking, and operational stability to help you deploy a production ECS environment faster and more reliably.

1. Best Practices for Initial Setup

Change the SSH port immediately and disable password login
Use Alibaba Cloud “security group templates” to quickly create access rules
Install fail2ban / firewalld to improve security
Enable automatic updates or run yum update -y to apply patches
Set timezone consistently to Asia/Shanghai to avoid messy logs

2. Hardening Security for Production

Disable direct root login and create a dedicated ops account
Enable MFA (multi-factor authentication) and use RAM sub-accounts
Only open 80/443 in security groups; open other ports only when needed
Database ports (3306, 5432) should be accessible only via private network
Use Alibaba Cloud Security Center (free tier) for malware scanning

3. Performance Optimization Tips

For small ECS instances, ESSD PL0/PL1 is highly recommended for better I/O performance
Tune Nginx worker processes and connection limits to avoid 502/504 errors
Manage PHP-FPM / Node.js / Python processes with Supervisor/PM2
For frequent I/O, mount a separate data disk and partition it properly
Enable swap to reduce unexpected exits caused by OOM kills

4. Images and Bulk Deployment Techniques

Use “custom images + Cloud Assistant scripts” to replicate environments quickly
Keep separate image versions for staging and production
One-click init scripts (install nginx/mysql/git/node) are extremely practical
For cross-account migration, use “Copy image to another region/account”

5. Networking and Domain Deployment Tips

After binding an EIP, note: unused EIPs are billed; consider using SLB forwarding
HTTPS certificates: Alibaba Cloud free certs / Let’s Encrypt / ZeroSSL
CDN + OSS is the best combo for accelerating static resources
For slow cross-region access, consider DCDN (Dynamic Content Delivery Network)

6. Operations Monitoring and Stability

Use Cloud Monitor: set alerts for CPU, memory, disk, and traffic
Ensure services like Nginx/PHP-FPM auto-restart via systemd
Clean logs regularly to avoid /var/log filling up and causing outages
If the website is down, check 80/443, app logs, load, and memory first
Create monthly snapshots (automate via Alibaba Cloud) for rollback safety

7. Common ECS Issues and Quick Troubleshooting

502/504 → Nginx, backend processes, timeouts, slow database queries
SSH login fails → password disabled, IP not whitelisted, security group issues
CPU maxed out → infinite loop in app / crypto-mining intrusion
Disk full → log explosion or large files not cleaned up
Slow website → wrong region / no CDN / database bottlenecks

Summary & Recommendations

Alibaba Cloud ECS is flexible and stable. By following best practices in security, monitoring, image management, and log cleanup, you can keep long-term stability. For production workloads, strongly consider scheduled snapshots, monitoring alerts, and higher-tier ESSD storage to ensure performance and security.