Free tools Windows power users keep installed
One-click scans. No signup required.
Secure a Linux VPS by reducing its exposed services, enforcing named-account and key-based access, applying security updates, filtering traffic with a default-deny firewall, protecting files and secrets, monitoring logs, and maintaining tested backups. Do the work in that order while keeping a second SSH session and your provider’s recovery console available; a firewall or authentication change can otherwise lock you out.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The commands below use Ubuntu as the reference system. Debian, RHEL-based distributions, and provider images use different package names, service units, firewall tools, and file paths, so confirm each command against the release you actually deployed.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What Linux VPS hardening actually does
Hardening is layered defense, not a single switch. Canonical describes it as reducing the attack surface and using defense in depth so that one weakness does not become a complete compromise. Patching, account controls, SSH configuration, firewall rules, service minimization, permissions, logging, backups, and recovery procedures must reinforce one another.
A hardened host can still contain an unknown vulnerability. The objective is to make exploitation harder, limit what an intruder can reach, detect suspicious activity, and restore service without guessing. Disabling root login, for example, does not compensate for an unpatched web application or an open database port.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prepare a safe change plan before you connect
Record the baseline
Write down the distribution and exact release, public and private addresses, provider console or serial-console path, required application ports, administrator usernames, backup location, and the person responsible for emergency access. Save a copy of the provider’s recovery instructions outside the VPS.
Define a rollback plan for every change. Keep the current SSH window open, establish a second session with the new administrator account, and do not close either session until the replacement login and firewall rules have been tested.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSeparate management from application traffic
Decide which network should reach SSH. A corporate VPN or fixed office address is preferable to allowing port 22 from the whole internet. If a changing address makes a narrow rule impractical, use another control such as a VPN or provider console rather than assuming an exposed SSH service is harmless.
Create a named administrator and stop routine root use
Use a personal, named account for administration. Keep privilege escalation auditable through sudo instead of sharing a root password or a generic account.
- From the initial provider account, create a user:
sudo adduser adminuser. - Grant administrative rights on Ubuntu:
sudo usermod -aG sudo adminuser. On another distribution, use its administrator group and policy. - Install the administrator’s public key. As the new user, run
mkdir -p ~/.ssh && chmod 700 ~/.ssh, place the public key in~/.ssh/authorized_keys, then runchmod 600 ~/.ssh/authorized_keysandchown -R adminuser:adminuser ~/.ssh. - Open a second terminal and verify that the new account can log in and run a harmless command such as
sudo -v. Confirm that the expected sudo policy, hostname, and application access are present. - Only after that test, plan to disable direct root login and any password method you do not need. Keep the original session and provider console available while testing.
Use least privilege: grant sudo only to people who need it, use service-specific accounts for applications, and avoid running network-facing software as root. A service account should not be able to read an administrator’s private key or unrelated application data.
Patch the operating system and define reboot handling
Apply the initial updates
On Ubuntu, update package metadata and install available upgrades:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo apt update && sudo apt upgrade
Review removals and configuration-file prompts rather than accepting them blindly. Restart affected services when the package manager does not do so automatically. Check whether a kernel or core library update requires a reboot; on Ubuntu, the presence of /var/run/reboot-required is a useful indication. Schedule the reboot, notify users, and verify the application afterward.
Use controlled automatic security updates
Ubuntu documents unattended-upgrades for automatic security fixes and enables security updates by default on supported installations. Install or verify the package with:
sudo apt install unattended-upgrades
Review the files under /etc/apt/apt.conf.d/ to confirm which origins are allowed, when updates run, and whether old packages are removed. Automatic patching reduces the window of exposure, but it does not decide when a kernel reboot is safe. Choose a maintenance window, monitor for a pending reboot, and retain console access.
For every distribution, document patch latency, who approves non-security updates, how failed upgrades are recovered, and how you will detect a machine that stopped updating. A policy that silently fails is not patch management.
Recommended Free Tools
Inventory listening sockets and remove unnecessary services
Do not write firewall rules from memory. First see what is actually listening:
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
sudo ss -tulpn
Map each listening socket to an application owner and business requirement. List enabled services with systemctl list-unit-files --type=service --state=enabled and inspect a candidate with systemctl status service-name. Remove software you do not need; otherwise disable it and prevent automatic startup with the distribution’s service manager. Uninstall unused administrative tools, sample applications, default dashboards, and development daemons from production images.
Keep a written inventory containing the port, protocol, process, bind address, owner, and reason it is exposed. A service bound only to 127.0.0.1 or a private interface has a smaller attack surface than one bound to every address, but it still needs authentication and patching.
Install a default-deny firewall
Use the firewall integrated with your distribution, and make IPv4 and IPv6 policy intentional. A firewall is not a substitute for fixing the service behind an allowed port.
| Option | Distribution integration | Persistence | IPv4 and IPv6 behavior | Review considerations |
|---|---|---|---|---|
| UFW | Simple Ubuntu interface for common host rules | Rules persist when enabled; verify after reboot | Supports separate v4 and v6 rules when IPv6 is enabled | Readable status output; advanced cases may require lower-level rules |
| nftables or iptables | Low-level control; exact setup varies by release | Requires an explicit save and restore mechanism | Review both families and translation layers | Powerful but easier to make opaque or inconsistent |
| firewalld or another distribution equivalent | Common on some RHEL-family images | Runtime and permanent configurations must both be checked | Review zones and rules for each address family | Zone-based review is useful when documented |
Example UFW sequence on Ubuntu
- Set conservative defaults:
sudo ufw default deny incomingandsudo ufw default allow outgoing. - Permit SSH from a management network. For example,
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcpuses a documentation address range; substitute the network you actually control. - Allow only application ports that are required, such as
sudo ufw allow 80/tcpandsudo ufw allow 443/tcpfor a public web service. Do not open databases, queues, control panels, or caches to the internet unless the design explicitly requires it. - Check the rules before activation with
sudo ufw status numbered. Confirm that an IPv6 policy exists if the VPS has IPv6. - Enable the firewall with
sudo ufw enable, then verify from a second terminal and from an external monitoring point. Record the rule numbers and purpose.
Never enable a deny policy before an allow rule for your current management path. If you lose access, use the provider console to run sudo ufw status, remove the offending rule, or temporarily run sudo ufw disable while you correct the configuration. Re-test after every provider network change.
Harden SSH without creating a lockout
Use keys and a reviewable configuration snippet
Keep local private keys on devices you control and protect them with a passphrase. On the server, store local overrides in an sshd_config.d snippet so changes are easy to review and survive package updates. For example, create /etc/ssh/sshd_config.d/10-hardening.conf with settings appropriate to your access model:
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
MaxAuthTries 3
AllowGroups sshadmins
Create the group and add the named administrators before using AllowGroups. Do not disable password or keyboard-interactive authentication until a second key-based session works. Some two-factor implementations use keyboard-interactive authentication; disabling it would disable the second factor.
Validate before reloading
- Check syntax:
sudo sshd -t. Fix every error before proceeding. - Reload rather than stopping the daemon:
sudo systemctl reload sshon Ubuntu, or the service name used by your distribution. - From a fresh terminal, connect using the intended account and key. Test sudo, file access, and the provider’s monitoring path.
- Inspect effective settings with the distribution’s SSH tools and review
journalctl -u sshfor failures.
Add network and second-factor controls
Source-network restrictions in the firewall, VPN, or SSH configuration reduce exposure but do not replace strong authentication. Where your deployment supports it, add a second factor to key-based authentication. A hardware security key can protect the second factor from password reuse and phishing, but document enrollment, spare-key custody, and the emergency recovery path before enforcing it.
Keep a console account or break-glass procedure that is protected separately and used only during recovery. Test that procedure; an untested recovery code is not a control.
Protect keys, secrets, service files, and logs
Permissions should express ownership. Private keys and credentials should be readable only by the account or service that needs them. Typical checks include:
- Administrator SSH directories: mode 700 for the directory and 600 for private or authorized-key files.
- Application secrets: owned by root or the dedicated service account, with a group-readable mode only when the service design requires it.
- Systemd unit files and configuration: writable only by root; avoid placing secrets in world-readable unit files or command lines.
- Logs: writable by the logging service, readable by authorized operators, and forwarded before local retention can be exhausted.
Search for accidental credentials in deployment scripts, shell history, repositories, backups, and world-readable environment files. Rotate a credential immediately if its exposure is suspected, then investigate how it became readable.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Enable logging, alerting, and review
At minimum, retain authentication and service logs long enough to investigate an incident. Useful Ubuntu checks include journalctl -u ssh, journalctl --since today, last, and, where enabled, lastb for failed logins. Review repeated authentication failures, unexpected privilege escalation, new listening sockets, disabled services, and changes to SSH configuration.
Forward important logs to a separate system or managed log service when the environment warrants it. Alert on log-forwarding failure, disk pressure, repeated login failures, package-update errors, and changes to critical files. Restrict access to logs because they can contain usernames, addresses, request data, and operational secrets.
Back up the data and test restoration
Back up application data, databases, configuration, certificates, firewall rules, and recovery documentation to storage that an attacker cannot rewrite from the VPS. Use encryption and a retention policy suited to the data. A snapshot is useful for rapid rollback but is not the same as an independently protected backup.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Define recovery-point and recovery-time targets for each service.
- Run scheduled backups and record success or failure outside the VPS.
- Restore to an isolated host on a regular schedule. Verify database consistency, file ownership, permissions, DNS, certificates, and application startup.
- Document the exact restore commands and the credentials or keys required. Revoke temporary recovery access after the test.
A backup that has never been restored is an assumption, not an operational control.
Use release-matched compliance guidance
CIS publishes Ubuntu benchmark resources for specific releases, including Ubuntu 24.04 LTS and 22.04 LTS. Ubuntu Security Guide profiles likewise must match the release and subscription capabilities of the host. Do not apply a benchmark written for another release without reviewing every control.
| Approach | Release coverage | Audit evidence | Remediation automation | Operational overhead |
|---|---|---|---|---|
| CIS benchmark | Release-specific profiles; verify the exact edition | Structured control IDs and findings | Depends on the scanning or remediation tool | Requires exception management and evidence collection |
| Ubuntu Security Guide | Profiles tied to supported Ubuntu releases | Machine-readable assessment and profile results | Can automate selected hardening actions | Requires understanding profile impact and subscription terms |
| Manual checklist | Can cover any release if maintained carefully | Depends on administrator records and command output | Usually manual unless you build scripts | Lower tooling cost but higher drift risk |
Record accepted exceptions, their owner, compensating controls, expiration date, and evidence. A CIS or USG result demonstrates alignment with a benchmark; it does not prove that a host is invulnerable.
Choose controls by the failure you need to prevent
| Decision | What to evaluate | Practical choice |
|---|---|---|
| Firewall implementation | Distribution integration, reboot persistence, IPv4/IPv6 coverage, and reviewability | Use the native high-level tool for straightforward hosts; use lower-level rules only when you can test and document them |
| SSH protection | Key support, second-factor compatibility, source-network restrictions, recovery workflow, and automation compatibility | Use named accounts and keys first; add network restrictions and a compatible second factor after testing |
| Update policy | Patch latency, reboot coordination, rollback capability, and observability | Automate security updates, monitor failures, and schedule controlled kernel reboots |
| Compliance method | Release coverage, audit evidence, remediation automation, and operational effort | Use CIS or USG for repeatable assessment, supplemented by a local checklist for application-specific risks |
Recover from common hardening mistakes
SSH stopped accepting connections
Use the provider console. Check systemctl status ssh and journalctl -u ssh -b. Run sshd -t, restore the last known-good snippet, and reload the service. If the service is healthy, inspect the firewall rule, source address, DNS, and whether the account remains in the allowed group.
The key is rejected
Confirm that the client is offering the intended key, the server account owns ~/.ssh and authorized_keys, and permissions are not group- or world-writable. Check the authentication log for the specific rejection. Do not re-enable broad password access as a hurried workaround; use the console or a verified second administrator.
A legitimate application is unreachable
Confirm that the process is listening on the expected interface and port, then compare its requirement with the firewall rule. Check both IPv4 and IPv6 paths, cloud security groups, and any reverse proxy. Open only the required port and source range, then record why it was added.
An update causes a service failure
Read package-manager and service logs, verify configuration-file changes, and use the documented package rollback or snapshot procedure. Restore data from a tested backup if necessary. Do not leave automatic updates disabled indefinitely; correct the failure, document the exception, and resume controlled patching.
Maintain the hardening over time
Hardening decays as software, staff, addresses, and applications change. Review listening sockets and firewall rules after every deployment. Remove departed users and stale keys promptly. Check update status and pending reboots, review authentication and privilege logs, test backups, and rerun the release-matched CIS or USG assessment after major changes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep the final configuration, exceptions, recovery commands, and ownership information in version-controlled documentation. A repeatable process is more valuable than a one-time lockdown because it lets the next administrator make a safe change without guessing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
