New to Bitcoin - tips on securing my server I regard myself as being a competent programmer and have good general IT knowledge; however I know very little about BTC. I just want to make sure that my setup is "generally secure" and that I'm grasping as much of the low hanging fruit as possible (from a security point of view).

So I installed bitcoin-cli on my Ubuntu 14.04 VPS (I am quite trustworthy of the company who provide the VPS):

sudo add-apt-repository ppa:bitcoin/bitcoin
sudo apt-get update
sudo apt-get install bitcoind


Here's my init script:

description "bitcoind"

start on filesystem
stop on runlevel [!2345]
oom never
expect daemon
respawn
respawn limit 10 60 # 10 times in 60 seconds

script
exec 2&gt;&gt;/var/log/bitcoind.log
set -x
user=eamorr
home=/home/$user
cmd=/usr/bin/bitcoind
pidfile=$home/.bitcoin/bitcoind.pid
# Don't change anything below here unless you know what you're doing
[[ -e $pidfile &amp;&amp; ! -d "/proc/$(cat $pidfile)" ]] &amp;&amp; rm $pidfile
[[ -e $pidfile &amp;&amp; "$(cat /proc/$(cat $pidfile)/cmdline)" != $cmd* ]] &amp;&amp; rm $pidfile
exec start-stop-daemon --start -c $user --chdir $home --pidfile $pidfile --startas $cmd -b -m
end script


Saved init script to /etc/init/bitcoind.conf

service bitcoind start

OK great.

* Now what? *

(Bearing in mind that I don't want to use a third party website)

Do I need to open port 8333 on my firewall? Is that ok?

Is there some "private key" I should store somewhere safe? Do I need to store this on my VPS?

Is there anything else I should do?

I want to buy €50 of BTC. I guess I need an address. How do I create an address? I will tell the folks at bittylicious.com to send €50 worth of BTC to my newly created address, right?

Finally, how do I create multiple BTC addresses, receive money at those and transfer into my "master" BTC address?

Here's some command outputs for your information:

&gt;&gt; bitcoin-cli getnetworkinfo 
{
    "version" : 90201,
    "protocolversion" : 70002,
    "timeoffset" : 0,
    "connections" : 8,
    "proxy" : "",
    "relayfee" : 0.00001000,
    "localaddresses" : [
        {
            "address" : "xxxxxxxxxxxxxxx - IPv4 address",
            "port" : 8333,
            "score" : 9
        },
        {
            "address" : "xxxxxxxxxxxxxxx - IPv6 address",
            "port" : 8333,
            "score" : 1
        }
    ]
}



&gt;&gt; bitcoin-cli getinfo
{
    "version" : 90201,
    "protocolversion" : 70002,
    "walletversion" : 60000,
    "balance" : 0.00000000,
    "blocks" : 172082,
    "timeoffset" : 0,
    "connections" : 10,
    "proxy" : "",
    "difficulty" : 1498294.36281651,
    "testnet" : false,
    "keypoololdest" : 1409306527,
    "keypoolsize" : 101,
    "paytxfee" : 0.00000000,
    "relayfee" : 0.00001000,
    "errors" : ""
}



&gt;&gt; bitcoin-cli listaccounts 
{
    "" : 0.00000000
}



&gt;&gt; bitcoin-cli listreceivedbyaddress 
[
]


Thanks for your help guys,



Update:

There's an init script for Debian (works on my Ubuntu 14.04) in the offical repo:

https://github.com/bitcoin/bitcoin/blob/master/contrib/init/bitcoind.conf

So, all you have to do to get bitcoin up and running headless (from a fresh install) is:

sudo apt-add-repository ppa:bitcoin/bitcoin
sudo apt-get update
sudo apt-get install bitcoind
sudo curl https://github.com/bitcoin/bitcoin/blob/master/contrib/init/bitcoind.conf &gt; /etc/init/bitcoind.conf
sudo vim /etc/init/bitcoin.conf
#Delete the line "disablewallet" (part of "exec start-stop-daemon" command) - don't delete if you don't want a wallet
adduser bitcoin
sudo mkdir /var/run/bitcoind
sudo chown bitcoin:bitcoin /var/run/bitcoind
sudo mkdir /var/lib/bitcoind
sudo chown bitcoin:bitcoin /var/lib/bitcoind
sudo mkdir /etc/bitcoin
sudo touch /etc/bitcoin/bitcoin.conf   #put your config in here: rpcuser, rpcpassword, etc.
sudo apt-get install ufw
sudo ufw allow 22
sudo ufw enable


This installation is maintainable and gives a "good" level of security.
First of all, I'd suggest to create a separate user account for this:

adduser bitcoin

And use that account to run your bitcoind from.

You can open the port 8333 on your firewall if you want to provide a "full-node" to the network, but do not open the port 8332 (that's for RPC).

For better security though, I don't recommend using the same bitcoind instance for both wallet-storage and as a public node. If you can afford two machines, set up the wallet on one of them (this will be a "private" instance) and a "border-router" instance on another. Then make sure the private one only connects to the border-router (use connect=&lt;border_IP&gt;) configuration option. Then you can feel safe to enable port 8333 on the public border-router machine and as an optimization, you can disable the wallet on it (-disablewallet).

Once you have it all set up, you can proceed to creating an address. Run:

bitcoin-cli getaccountaddress myaccount (use any account name you like)

Here you can find a nice command reference.