Free tools Windows power users keep installed
One-click scans. No signup required.
A secure Linux VPS starts with three controls in the right order: lock down access, restrict network traffic, and keep recoverable off-server backups. Apply a full update before putting the server into service, enable automatic security patches, and verify every control from outside the VPS. The commands below target Ubuntu and Debian systems; check your distribution’s documentation before applying Ubuntu-specific steps.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use this order on a new VPS
- Update once immediately. New images can contain packages with already-known vulnerabilities.
- Create a non-root administrator and install an SSH key. Use that account with
sudofor daily work. - Disable root and password-based SSH authentication. Keep an existing SSH session open while testing the new settings.
- Set a default-deny firewall. Open only the ports your service needs, normally SSH, HTTP and HTTPS.
- Add brute-force protection. Fail2ban can ban addresses that repeatedly fail authentication.
- Enable unattended security updates. Decide how you will handle reboots and packages that cannot be updated automatically.
- Make an off-server backup and perform a restore test. A file that has never been restored is not a proven backup.
- Audit and review regularly. Use Lynis and your system logs to detect drift.
Harden SSH before exposing administration
Create a separate administrator
Log in with the temporary account supplied by your host, then create a named user and grant only the administrative privilege needed for maintenance:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo adduser adminuser
sudo usermod -aG sudo adminuserReplace adminuser with the account name you actually use. Confirm that the account can obtain a root shell through sudo before closing your original session:
su - adminuser
sudo whoamiThe second command should print root. Do not remove the original access path until this test succeeds.
Use an SSH key
Generate a key pair on your workstation, preferably with the strongest key type supported by your current SSH client, and copy the public key to the new account:
ssh-keygen
ssh-copy-id adminuser@your-server-addressTest a new connection in a second terminal. The private key stays on your workstation; only the public key belongs in the server account’s ~/.ssh/authorized_keys file. Protect the private key with a passphrase and do not paste it into tickets, shell history or chat.
Disable root and password login
Edit /etc/ssh/sshd_config with sudo and set the effective directives to:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yesYou can also restrict SSH to named accounts with AllowUsers if your operating model permits it. Validate the file before reloading the daemon:
sudo sshd -t
sudo systemctl reload sshKeep the original SSH session open, then connect in a new terminal as the non-root user. If the new session works, close the old one. If validation or login fails, use the still-open session to restore the last working configuration.
Should you change port 22?
Changing the SSH port reduces automated scan noise but does not replace key-only authentication, disabled root login or a firewall. If you choose another port, open that port in the firewall before reloading SSH, test it from a second terminal, and retain an existing session until the test succeeds. Update monitoring, backup scripts and any provider console rules that refer to port 22.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Build a default-deny firewall
UFW baseline
On Ubuntu, UFW provides a readable interface to the host firewall. Apply rules before enabling it so you do not lock yourself out:
sudo apt update
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw limit 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose
sudo ufw status numberedUse the actual SSH port if you changed it. The limit rule rate-limits repeated SSH connections; it is not a substitute for keys and disabled password authentication. Delete rules you do not need with the numbered status output, and review both IPv4 and IPv6 behavior on hosts where IPv6 is enabled.
Verify from another network
A local status screen shows intended rules, not necessarily what the Internet can reach. From a separate machine or network, scan the public address with an external tool such as nmap and confirm that only the ports required by your service answer. Check the provider’s network firewall as well: a cloud-level allow rule can expose a port even when the guest configuration appears restrictive.
Do not forget service-specific ports
Every listening daemon expands your attack surface. Inventory listeners with your distribution’s socket tools, then either remove the service, bind it to localhost, or add a narrowly scoped firewall rule. Administrative databases, caches and dashboards generally should not listen on every public interface.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDocker containers and the UFW trap
Published Docker ports can appear reachable even when UFW denies incoming traffic. Docker commonly steers published traffic through forwarding and its own chains rather than the host’s ordinary INPUT path, so ufw status alone does not prove that a container is private.
Inspect mappings, not just firewall rules
docker ps --format 'table {{.Names}}t{{.Ports}}'A mapping without an IP, such as -p 8080:80, normally binds the host port on all interfaces. If the service is intended for local access only, bind it explicitly to loopback:
docker run -p 127.0.0.1:8080:80 image-namePut a reverse proxy on ports 80 and 443 if the application needs public HTTPS while the container itself remains unreachable from the public interface.
Control forwarded traffic deliberately
For a container that must be reachable only from selected networks, apply filtering in Docker’s DOCKER-USER chain or use a maintained helper such as ufw-docker. Forwarded packets have already undergone destination rewriting, so rules are matched against the container port, not necessarily the host’s published port. Docker’s official networking and packet-filtering documentation should be checked for the current syntax before deploying a production rule.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDo not assume a hand-entered rule will survive a reboot. Persist Docker-chain policy with a supported mechanism such as iptables-persistent, a systemd unit, or the helper’s documented integration. Disabling Docker’s iptables management is reported to break container networking and is not the normal fix.
Add brute-force protection with Fail2ban
Fail2ban watches authentication logs and temporarily bans addresses that repeatedly fail. Install and start it after SSH logging is working:
sudo apt update
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshdPlace local changes in a file such as /etc/fail2ban/jail.local rather than editing packaged defaults. Enable the SSH jail, choose retry and ban durations appropriate for your users, and ensure the jail watches the correct log backend for your distribution. Test from a controlled address before tightening thresholds; an overly aggressive policy can ban your own office, VPN or monitoring service. Fail2ban complements—not replaces—keys, disabled password login and firewall limits.
Patch immediately, then automate security updates
Perform the first full update
Run a complete package update before installing applications:
sudo apt update
sudo apt full-upgradeReview removals and configuration prompts instead of blindly accepting them. Reboot when the distribution or a kernel update requires it, and reconnect using the non-root account after the reboot.
Understand Ubuntu’s unattended-upgrades files
On Ubuntu, unattended-upgrades is installed by default and applies security updates automatically. Its policy is defined primarily in:
/etc/apt/apt.conf.d/50unattended-upgrades, which controls which update origins and packages are eligible./etc/apt/apt.conf.d/20auto-upgrades, which controls periodic package-list refreshes and unattended installation.
The default schedule runs once per day. Inspect the effective files rather than assuming an image has retained the distribution defaults:
cat /etc/apt/apt.conf.d/20auto-upgrades
sed -n '1,240p' /etc/apt/apt.conf.d/50unattended-upgradesUse a dry run to see what would be installed without changing packages:
sudo unattended-upgrade --dry-runReview the activity log at /var/log/unattended-upgrades/unattended-upgrades.log. A dry run does not create a backup and does not apply an update.
Set an explicit reboot and exception policy
Automatic patching reduces the time a known vulnerability remains exposed, but it can restart services or leave packages held because of dependency, configuration or maintenance constraints. Decide who reviews failed runs, which packages may be held, how kernel reboots are scheduled, and how you will confirm service health afterward. The exact reboot option has changed across releases; check the current Ubuntu unattended-upgrade manpage for the setting supported by your version instead of copying an older guide.
Manual versus automatic updates
| Approach | Strength | Risk or work required |
|---|---|---|
| Automatic security patches | Shortens exposure without waiting for an operator. | Requires a reboot policy, monitoring and handling for blocked packages. |
| Manual patching only | Lets an operator coordinate every change and restart. | Creates a longer vulnerability window when maintenance is delayed. |
| Hybrid policy | Security fixes install automatically while major upgrades and reboots are scheduled. | Needs clear ownership, alerts and periodic review of unattended-upgrade logs. |
Design backups that can actually recover the VPS
Back up off the production host
A copy on the same VPS disappears with the disk, account or host. Store backups on a separate system or provider and protect access to that destination. Keep more than one recovery point so a newly corrupted file does not overwrite the only good copy.
Include configuration as well as application data
Document and copy the items needed to rebuild the machine:
- Application data, uploads and persistent container volumes.
- Database dumps made in a transactionally consistent way for the database engine.
/etc/ssh/sshd_configand the authorized-key administration procedure.- Firewall policy, including UFW rules and any Docker or iptables chains.
- Fail2ban configuration, service unit overrides and scheduled jobs.
- Reverse-proxy, TLS and application configuration, with secrets protected separately.
- Package and deployment notes that identify the distribution release and required versions.
Do not treat a provider snapshot as your only copy. A snapshot can accelerate whole-disk recovery, while file-level archives and database dumps let you recover one application without restoring an obsolete operating-system state.
Protect the backup path
Use a dedicated backup account with the minimum permissions needed to write files, encrypt data before it leaves the VPS when the destination does not provide equivalent encryption, and restrict the destination so a compromised web process cannot erase every recovery point. Keep credentials outside the application directory and rotate them on a schedule.
Test a restore on a clean system
- Provision a disposable VPS with the same distribution family and architecture.
- Install the required runtime and restore configuration and data into staging paths first.
- Verify archive checksums and database integrity before switching traffic.
- Recreate the non-root SSH account and firewall rules, then confirm that administrative access works.
- Start the application, exercise login and a representative read/write transaction, and inspect logs.
- Record how long the restore took and which steps were manual; update the runbook while the details are fresh.
Repeat the test after major operating-system, database or deployment changes. A scheduled copy that has never passed this procedure is only an assumption of recoverability.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Audit the server and review logs
Run Lynis periodically
Lynis can provide a repeatable host-hardening audit:
sudo apt update
sudo apt install lynis
sudo lynis audit systemRead each recommendation in context. Some controls are appropriate only for a particular workload, and a higher score is not proof that an application, container image or cloud account is secure.
Review authentication and update evidence
Look for unexpected SSH successes, repeated failures, privilege escalation and unattended-upgrade errors using your distribution’s journal and authentication logs. Correlate events with your deployment calendar. Investigate a sudden new listener, an unfamiliar user, a disabled timer or a package that remains pending across multiple daily runs.
Operational schedule
| When | Checks |
|---|---|
| Day one | Full update; non-root SSH key; root and password login disabled; default-deny firewall; external scan; Fail2ban; first off-server backup. |
| Daily | Review unattended-upgrades results, service alerts and unusual authentication activity. |
| After every network change | Inspect Docker mappings and listening sockets, then scan the public address from another network. |
| Weekly | Confirm backups completed, retention is intact and storage capacity is sufficient; review new firewall and SSH changes. |
| Monthly or after major changes | Run Lynis, test a representative restore, verify package exceptions and revisit exposed services. |
Troubleshooting common failures
You lost SSH access after a change
Do not repeatedly restart the daemon from a failing client. Use the provider’s console or an existing session, run sudo sshd -t, inspect the firewall’s numbered rules and confirm that the daemon is listening on the port you opened. Restore the last known-good configuration, reload SSH, and test from a second network before trying the hardening change again.
UFW says a port is closed, but a container is reachable
List published ports with docker ps. If the mapping binds all interfaces, recreate it with an explicit loopback address or enforce policy in DOCKER-USER. Reboot the host and repeat the external scan to confirm that the rule persists.
Unattended upgrades are not applying
Check both APT configuration files, run the dry run, read /var/log/unattended-upgrades/unattended-upgrades.log, and look for held packages, dependency errors or a disabled periodic schedule. Resolve the package manager error manually, then run another dry run before relying on automation.
Fail2ban bans legitimate administrators
Identify the jail and log entry with fail2ban-client status sshd, correct the log source or trusted-network settings, and use key authentication from a stable administrative address. Do not solve the problem by disabling all brute-force protection; tune the jail and document the exception.
A backup archive restores but the service does not start
Compare package versions, ownership, permissions, environment secrets, database state and systemd overrides between the source and clean host. Restore configuration in stages, read the service journal, and add the missing prerequisite to the written recovery procedure. Repeat the test until another administrator can complete it without guessing.
Quick Recap
Practical decisions at a glance
| Decision | Recommended baseline | What it does not solve |
|---|---|---|
| SSH port 22 or another port | Keep 22 unless changing it helps your operations; prioritize keys and disabled root/password login. | A different port does not stop a determined scan or exploit. |
| Firewall policy | Deny inbound by default; allow only required SSH, HTTP and HTTPS, then verify externally. | It cannot prevent an exposed Docker publish or a vulnerable allowed service by itself. |
| Patch timing | Apply a full update immediately and automate security patches with an explicit reboot policy. | Automation does not fix held packages or application vulnerabilities. |
| Container exposure | Bind internal services to 127.0.0.1 or filter forwarded traffic with current Docker-aware rules. | UFW’s ordinary input rules may not govern Docker forwarding. |
| Backup location | Keep tested copies off the VPS and include SSH and firewall configuration. | A copy that has not been restored may be unusable or incomplete. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
