A 1 GB VPS can run a small website, reverse proxy, API, monitoring agent, or personal service reliably if you configure it for low memory and secure remote access. This guide assumes a fresh Ubuntu 24.04 LTS image, a VPS provider console for recovery, and a domain or service that will connect over SSH. You will create a non-root administrator, verify key authentication before locking down SSH, enforce a default-deny firewall, enable security updates, decide whether to add swap, and verify every control before deploying applications.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a 1 GB VPS can realistically handle
One gigabyte of RAM is a constrained budget, not a performance target. The operating system, SSH service, firewall, update jobs, web server and your application all share it. A lightweight static site, small reverse proxy, low-traffic API, DNS utility or single background worker is a reasonable fit. Multiple language runtimes, a database with a large cache, container stacks, build jobs and traffic spikes can exhaust memory quickly.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Start with one service and measure before adding another. Keep a provider console or out-of-band terminal available: if a firewall rule or SSH change locks you out, the console is the recovery path.
Assumptions and distribution differences
- The commands and paths below target Ubuntu 24.04 LTS. Debian, Fedora and other distributions use different package names, service names and firewall defaults.
- You have the server’s public IP address and an account that initially has root SSH access or provider-console access.
- You have a public/private SSH key pair on your workstation. Never paste a private key onto the VPS.
- Run commands as root only during the initial account creation, or prefix them with
sudoafter the administrator account is ready.
Prepare before changing the server
Record the current state
Log in once and record the image, kernel, addresses and memory. These checks do not change anything:
lsb_release -a
uname -a
ip addr
free -h
df -hNote the provider’s default SSH port, the account you used, and whether a swap device already exists:
swapon --showIf the command prints nothing, the image has no active swap. Do not assume that a small VPS image includes one.
Apply initial package metadata
Before installing the security tools, refresh package metadata:
sudo apt updateOn a newly provisioned image, installing the available updates before hardening reduces the time spent running known-vulnerable packages. Review any provider-specific kernel or networking instructions before accepting a reboot.
Create a non-root administrator and verify key login
Do this before disabling root SSH or password authentication. Keep the original root session open until a second terminal has successfully authenticated with the new key.
Create the account and grant sudo
Replace adminuser with a name you choose:
sudo adduser adminuser
sudo usermod -aG sudo adminuserThe adduser wizard requests a password and optional profile fields. The password is still useful for local console recovery even if SSH password authentication will later be disabled.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Install your public key
From the existing root-capable session, create the SSH directory with the correct ownership and permissions, then append your workstation’s public key:
sudo install -d -m 700 -o adminuser -g adminuser /home/adminuser/.ssh
sudo sh -c 'cat /root/.ssh/authorized_keys >> /home/adminuser/.ssh/authorized_keys'
sudo chown adminuser:adminuser /home/adminuser/.ssh/authorized_keys
sudo chmod 600 /home/adminuser/.ssh/authorized_keysThe copy command is appropriate only when the key you intend to use is already in root’s authorized_keys. If your key is elsewhere, transfer its public portion and append it to /home/adminuser/.ssh/authorized_keys; the file must contain one complete public-key line per key.
Test from a second terminal
Open a new local terminal and connect as the new user:
ssh adminuser@SERVER_IPConfirm that privilege escalation works:
sudo -v
sudo idThe second command should report uid=0(root). Do not continue until this login works. A typo in the key, ownership, permissions or username becomes much harder to repair after root and password access are disabled.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Harden SSH without losing access
Ubuntu’s OpenSSH configuration loads snippets from /etc/ssh/sshd_config.d/. A dedicated drop-in is easier to audit and preserves the distribution’s main file. For most directives, the first value read wins, so use a filename that sorts late, such as 99-hardening.conf, and check the effective configuration afterward.
Set conservative authentication limits
Create the drop-in:
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
EOFPermitRootLogin noprevents direct root SSH sessions; usesudothrough the administrator account instead.PasswordAuthentication nodisables password-based SSH authentication.KbdInteractiveAuthentication noprevents keyboard-interactive prompts from becoming an alternate password path.MaxAuthTries 3limits failed authentication attempts in one connection.
Validate before restarting
Syntax-check the complete configuration:
sudo sshd -tNo output indicates a successful check. If an error appears, fix the file and run the check again. Never restart a configuration that has not passed this test.
On Ubuntu 24.04, SSH can be managed with socket activation. If you plan to move SSH away from the default port, inspect the active socket and apply the new port there as well; changing only sshd_config may not change the listener. Update the firewall for the new port before restarting, and keep the existing session open while testing.
Restart and test a fresh connection
sudo systemctl restart sshFrom the second terminal, disconnect and reconnect as adminuser. Once that succeeds, verify the effective values:
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|maxauthtries'You should see permitrootlogin no, passwordauthentication no, kbdinteractiveauthentication no and maxauthtries 3. If your provider requires a non-standard SSH port, test it explicitly with ssh -p PORT adminuser@SERVER_IP before closing the original session.
Build a default-deny UFW firewall
UFW (Uncomplicated Firewall) is a front end for the host firewall. The safe sequence is to set defaults, allow the management path, add only application ports you need, then enable it. If you enable UFW before allowing SSH, your current session can be cut off.
Set policies and allow required ports
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSHIf SSH uses another port, replace the profile rule with that port and protocol, for example:
sudo ufw allow 2222/tcpOpen web ports only when the VPS actually serves web traffic:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchessudo ufw allow 80/tcp
sudo ufw allow 443/tcpDo not open database, cache, admin-panel or internal service ports to the internet merely because an application uses them. Bind those services to localhost or a private network where possible.
Rate-limit SSH at the firewall
For a standard SSH profile, use:
sudo ufw delete allow OpenSSH
sudo ufw limit OpenSSHFor a custom port, use the equivalent port rule, such as sudo ufw limit 2222/tcp. UFW’s limit action is connection-rate based. Some non-primary guides describe it as blocking an address after more than six attempts in 30 seconds; treat that threshold as implementation-dependent rather than a guarantee, and inspect the rules on your image.
Enable and inspect the firewall
sudo ufw enable
sudo ufw status verboseAnswer y when prompted only after confirming that the SSH allow or limit rule is present. The status output should show default incoming denial, default outgoing allowance, SSH access and only the web ports you intentionally opened.
Enable automatic security updates
Ubuntu installs the unattended-upgrades package by default on current images, with security updates as the normal scope. Installing it explicitly makes the state clear and adds change-notification support:
sudo apt install unattended-upgrades apt-listchangesThe second command presents a configuration prompt; choose the option that enables automatic updates. Configuration is normally split between /etc/apt/apt.conf.d/50unattended-upgrades and /etc/apt/apt.conf.d/20auto-upgrades. Ubuntu's security guidance favors a separate drop-in for local policy instead of editing the vendor-managed 50unattended-upgrades file directly.
Check that updates are enabled and review logs
systemctl is-enabled unattended-upgrades
sudo unattended-upgrades --dry-run --debug
sudo tail -n 50 /var/log/unattended-upgrades/unattended-upgrades.logThe enablement check should return enabled. The dry run reports what would be installed without applying it. The log records completed unattended-upgrades activity.
Make an explicit reboot decision
Security updates can install a new kernel or libraries that require a restart. Automatic reboots may interrupt your service, so decide whether this VPS can tolerate unattended restarts. If it cannot, disable automatic reboot behavior in a local APT drop-in and schedule maintenance reboots yourself. If it can, define a maintenance window and confirm that your application starts automatically after boot. Do not assume that installing updates alone restarts every affected service.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Consider fail2ban as an optional second SSH control
UFW's limit rule reacts to connection rates at the firewall. fail2ban watches authentication logs and can temporarily ban addresses that repeatedly trigger a jail. They address different signals and can be used together, but fail2ban adds another service and configuration to maintain on a 1 GB machine.
When it is useful
- Use it when logs show persistent SSH authentication noise that you want to ban based on repeated failures.
- Keep it optional when the VPS has a tightly restricted network path, a non-public management interface, or very little administrative activity.
- Do not treat it as a substitute for key-only SSH, root-login denial and a default-deny firewall.
Check an SSH jail
If you install and configure fail2ban, a common arrangement uses UFW as its banning action and a stricter SSH jail. The exact jail syntax depends on the package version and your log backend, so review the installed example configuration rather than copying an obsolete snippet. Check the active jail with:
sudo fail2ban-client status sshdThe output should identify the jail, currently failed attempts and currently banned addresses. Test cautiously: an incorrect jail can ban your own address or fail to match Ubuntu's authentication logs.
Add swap deliberately on a 1 GB host
Swap gives the kernel a disk-backed place to move less-active pages when RAM is tight; it is much slower than RAM and does not turn a memory-heavy workload into a suitable one. Many cloud images ship without swap. There is no primary Ubuntu recommendation in the available material that fixes a universal swap size or swappiness value for every 1 GB VPS, so treat the commonly cited values below as operational practice, not official sizing guidance.
Check first
free -h
swapon --showIf a swap device or file is already active, measure its size and leave it alone unless you have a specific reason to change it.
Create a 2 GB swap file as a common starting point
Guides commonly use a 2 GB file on a 1 GB machine, while others choose 1–2 GB. Select a size that fits your disk and workload; the figures are not a guarantee against out-of-memory kills.
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
sudo sh -c 'echo "/swapfile none swap sw 0 0" >> /etc/fstab'Locking the file to mode 600 prevents other users from reading swap contents. The /etc/fstab entry makes the file available after reboot.
Optionally set lower swappiness
A frequently suggested value for a small server is 10, but that number is not established as an official Ubuntu default for this scenario. If you choose it after observing your workload, place it in a sysctl drop-in:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo tee /etc/sysctl.d/99-vps-memory.conf >/dev/null <<'EOF'
vm.swappiness=10
EOF
sudo sysctl --systemChanging swappiness does not reserve RAM or guarantee that swapping will occur only at a particular percentage. Monitor the result and remove the drop-in if it harms latency.
Verify the file and persistence
free -h
swapon --show
cat /proc/sys/vm/swappinessThe output should show the active swap file, its size and the selected swappiness value. A swap file is a safety margin for brief pressure, not a replacement for reducing worker counts, cache sizes or application memory use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the finished baseline
Run these checks from the administrator account after all changes:
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication'
sudo ufw status verbose
systemctl is-enabled unattended-upgrades
free -h
swapon --show- SSH output must show
permitrootlogin noandpasswordauthentication no. - UFW must list only the intended SSH and application ports, with incoming traffic denied by default.
- The unattended-upgrades check should return
enabled. free -hshould show the expected RAM and available memory;swapon --showconfirms whether swap is active.
Test a new SSH connection from your workstation after this verification. Then reboot during a planned window and repeat the SSH, firewall and memory checks. A configuration that works only until the first reboot is not finished.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep a 1 GB VPS healthy after setup
Watch memory before adding services
Use free -h for a quick view and inspect the largest processes when available with tools such as top. Track whether memory pressure follows a traffic spike, an update job or a process leak. Reduce application workers and caches before increasing swap.
Keep exposed ports intentional
Whenever you install a new service, decide whether it needs public access. Add one UFW rule only after confirming the service is listening on the expected address and port. Remove rules for software you uninstall:
sudo ufw status numbered
sudo ufw delete NUMBERPlan recovery for every security change
Keep the provider console credentials, a known-good SSH key and a copy of your last working SSH configuration. Make one change at a time, validate with sshd -t or ufw status verbose, and preserve an open session until a new session succeeds. This procedure is especially important when changing SSH ports, firewall rules or automatic reboot behavior.
Common failure modes and recovery
SSH says “Permission denied (publickey)”
Use the provider console or an existing session to check the username, the public-key line, ownership and modes:
sudo ls -ld /home/adminuser/.ssh
sudo ls -l /home/adminuser/.ssh/authorized_keys
sudo chown -R adminuser:adminuser /home/adminuser/.ssh
sudo chmod 700 /home/adminuser/.ssh
sudo chmod 600 /home/adminuser/.ssh/authorized_keysConfirm that your SSH client is offering the matching private key and that you are connecting to the correct IP and port.
You are locked out after enabling UFW
Use the provider console, run sudo ufw status verbose, and add the correct SSH rule before reconnecting. If you changed ports, check both UFW and any socket-activation listener. Do not repeatedly reboot hoping a missing firewall rule will correct itself.
SSH fails after editing the drop-in
From the console, run sudo sshd -t. Remove or correct the line named in the error, then restart SSH only after the syntax check is clean. If a conflicting earlier setting wins, inspect the effective result with sudo sshd -T and adjust the drop-in ordering or remove the conflicting file.
The VPS runs out of memory
Check free -h, swapon --show and the largest processes. Stop an unnecessary service, lower worker counts, reduce caches or move a workload off the 1 GB instance. Swap can soften a short burst but sustained swapping indicates that the workload exceeds the machine's practical capacity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
