What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The lowest-effort safe pattern for a VPS is layered automation: let Ubuntu install approved security updates, keep failures and pending reboots visible, administer through a least-privilege SSH account, expose only required firewall ports, remove unnecessary software, and maintain a tested backup or redeployment path. Automation should reduce routine logins—not hide a failed update or restart a production service without a plan.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a low-effort, secure VPS routine actually includes
A VPS stays maintainable when routine work is automated and exceptions are explicit. For an Ubuntu Server used by a website, API, database, or game server, the practical control set is:
As an Amazon Associate I earn from qualifying purchases.
- Automatic security patching: install security fixes from repositories you have deliberately trusted.
- Normal-update policy: decide whether feature and bug-fix updates should be delayed, reviewed, or installed automatically.
- Observability: retain update logs and send alerts when a run fails, packages remain held back, or a reboot is required.
- Planned reboots: keep automatic restarts disabled for fragile production workloads unless you have tested the behavior and have a maintenance window.
- Access hardening: use a named administrator account, strong SSH authentication, and least privilege instead of routine root login.
- Reduced attack surface: permit only required network ports and remove services and packages you do not use.
- Recovery: keep restorable backups, snapshots, or a reproducible image and periodically prove that recovery works.
This is a recurring control process, not a one-time hardening script. NIST SP 800-123 (Karen Scarfone, Wayne Jansen, and Miles Tracy; 2008, updated 2021) frames server security as selecting, implementing, and maintaining controls. That framing fits a VPS: every change needs an owner, an observable result, and a recovery path.
Check the VPS before enabling automation
Confirm the release and package sources
Use a supported Ubuntu Server release. The documented default behavior for unattended security updates begins with Ubuntu 18.04, but an old release should not be treated as safe merely because the updater still runs. Check the release, enabled repositories, and any vendor-provided images or scripts before changing policy.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
lsb_release -a
cat /etc/apt/sources.list
ls -1 /etc/apt/sources.list.d/Every additional repository expands the code you trust and the update behavior you must monitor. Keep only sources required by the application. A package from a third-party repository or PPA is not covered by Ubuntu’s default archive policy unless you explicitly add that origin to the unattended-upgrades configuration and understand how that publisher handles security fixes.
Record how the service recovers
Before patching a production VPS, document how to reach the provider’s out-of-band console, how to boot a previous image or snapshot, and which command or service unit starts the workload. This preparation matters when an update succeeds but a service fails to start, a kernel change needs a reboot, or SSH is accidentally misconfigured.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Configure Ubuntu’s unattended security updates
Know the documented defaults
On supported Ubuntu Server installations, unattended-upgrades is installed by default and runs once per day by default. Ubuntu’s security documentation says that, from Ubuntu 18.04 onward, security updates are installed after 24 hours by default and normal updates after seven days. The exact timing still depends on the machine’s timers, repository availability, package state, and any local policy that overrides those defaults.
| Setting or behavior | Documented Ubuntu default | Operational implication |
|---|---|---|
| Security updates | Applied daily; the default delay is 24 hours | Reduces exposure without requiring a daily login, but does not guarantee a successful run. |
| Normal updates | Default delay is seven days | Feature and non-security changes are not necessarily immediate; decide whether that delay suits your workload. |
| Repositories | Ubuntu archive repositories, plus ESM when enabled | Third-party repositories and PPAs require an explicit trust decision. |
| Automatic reboot | Disabled | A kernel or service update can leave a reboot pending until you schedule one. |
| Run history | Detailed logs in /var/log/unattended-upgrades |
Logs provide the evidence needed to investigate failures and confirm what changed. |
Canonical explains the security trade-off this way: “Ubuntu believes that risk to be less than the risk of NOT applying a security update, which is why unattended-upgrades will apply security updates by default.” That is a reason to enable and monitor it, not a reason to stop testing or backing up.
Inspect and enable the service
- Check whether the package and timer are present:
dpkg -l unattended-upgrades systemctl status unattended-upgrades systemctl list-timers --all | grep -E 'apt|unattended' - If your image does not have it installed, install the package and accept the prompt to keep security updates current:
sudo apt update sudo apt install unattended-upgrades - Review the vendor configuration before adding local policy. Ubuntu recommends a numbered drop-in under
/etc/apt/apt.conf.d/rather than editing the vendor50unattended-upgradesfile. A local file such as/etc/apt/apt.conf.d/52unattended-upgradessurvives package replacements more cleanly. - Inspect the existing
Allowed-Originsblock. Keep the Ubuntu security origin enabled. Add a third-party origin only after verifying its signing, support, release process, and rollback plan. - Run a simulation before allowing the first production change:
sudo unattended-upgrade -v --dry-run - Read the resulting files in
/var/log/unattended-upgrades. Confirm that the proposed packages are expected and that no dependency is held back unexpectedly.
Do not broaden the rule to “install everything from every configured source.” A narrowly scoped policy is easier to reason about. If normal updates need a different cadence, use a separate, reviewed maintenance process rather than silently adding every repository to the security allow-list.
Use email, monitoring, and package blacklists deliberately
Ubuntu documents email reporting and package blacklists as controls. Send reports to an address that is actually monitored, or forward the relevant log and service status to your existing monitoring system. A successful timer invocation is not the same as a successful package transaction, so alert on failed runs, repeated download errors, held packages, and a reboot-required state.
Blacklist only packages with a documented compatibility reason and an owner responsible for reviewing the exception. A blacklist that is never revisited can leave a known-vulnerable component behind indefinitely. Record why it exists and when it must be reassessed.
Handle reboots without surprising players or users
Keep automatic reboots off by default for fragile services
Ubuntu documents that automatic reboot is disabled by default and warns that reboots can be disruptive. For a production game server or any stateful service, leave it disabled unless you have a tested maintenance window, a service that starts cleanly after boot, and access to an out-of-band console if SSH does not return.
Use monitoring to detect a pending reboot, then schedule it with the people affected by the outage. Before restarting, verify that backups completed, the service has a current configuration export, and a rollback or redeployment route is available. Afterward, check the kernel, service status, listening ports, application logs, and a real client connection.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Reduce kernel reboot pressure with Livepatch, where appropriate
Ubuntu documents Livepatch as applying kernel patches for high- and critical-severity vulnerabilities while the system is running, avoiding an immediate reboot in those cases. Livepatch does not patch user-space applications, configuration errors, database migrations, or every kernel change. It therefore reduces some maintenance windows but does not remove the need for normal package updates, planned reboots, monitoring, and recovery tests.
Free tools Windows power users keep installed
One-click scans. No signup required.
Extend the support window when the release requires it
Ubuntu documents that Ubuntu Pro’s Extended Security Maintenance extends the LTS commitment for Main packages from five years to ten years and now covers Universe packages. ESM can be useful when a migration cannot happen immediately, but it is a support extension, not a substitute for upgrading the operating system, removing obsolete software, or reviewing repository trust.
Lock down SSH without locking yourself out
Create and test a named administrator account
Use a normal account for routine work and elevate only for administrative commands. On Ubuntu, an administrator can be added to the sudo group:
sudo adduser adminuser
sudo usermod -aG sudo adminuserInstall the administrator’s public key in that account’s ~/.ssh/authorized_keys, set correct ownership and permissions, and open a second SSH session to test it before changing the existing account. Keep the original session open until the new login and sudo path have worked.
Change SSH policy in a safe order
- Confirm key-based login works from a separate client and that the out-of-band console is available.
- Edit the OpenSSH server configuration and set a policy that prevents routine root administration. A common target is disabling direct root login while retaining
sudofor the named administrator. - Disable password authentication only after keys have been tested from every required administration location. Keep a documented emergency method rather than relying on a single laptop or key.
- Validate syntax before reloading:
sudo sshd -t sudo systemctl reload ssh - Open a fresh session and test both ordinary commands and an administrative command. Only then close the original session.
Ubuntu’s security guidance recommends OpenSSH, least privilege, and avoiding root except for administration. Administrators whose SSH and PAM stack supports it can add smart-card or FIDO2/U2F hardware-key authentication. Check compatibility with the installed OpenSSH, PAM modules, recovery process, and automation tools before making a hardware key mandatory.
Recommended Free Tools
Expose fewer services with a firewall
Ubuntu recommends ufw or another firewall. Start by listing what is listening and why:
sudo ss -tulpn
sudo ufw status verboseAllow SSH from an administration network where practical, then allow only the TCP or UDP ports required by the application. Enable the firewall only after an allow rule for your current administration path exists:
sudo ufw allow OpenSSH
sudo ufw enableDo not copy those commands blindly when SSH uses a nonstandard port or a provider-side firewall controls access. Test from a second session after every rule change. Remove old rules when a service is retired, and stop and disable services that are no longer needed. A package that is installed but unused still adds maintenance and attack surface.
Make failures visible instead of logging in every day
Monitor the update path
At minimum, alert on:
- a failed
unattended-upgradesrun or repeated repository errors; - disk space approaching the threshold at which downloads or package unpacking can fail;
- packages held back or a reboot-required indicator that persists beyond the maintenance window;
- the VPS becoming unreachable, an expected service not listening, or a health check failing after a reboot;
- backup jobs that did not complete or whose retention has expired.
Use the update logs in /var/log/unattended-upgrades, systemd journal entries, and your monitoring platform’s alert history. Route alerts somewhere other than the VPS itself so a host failure does not hide the warning.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Check trends on a schedule
A weekly review should answer which updates were installed, which were deferred, whether any repository failed, and whether a reboot is pending. A monthly review should remove obsolete packages, review firewall and SSH rules, confirm backup retention, and revisit every package blacklist or third-party source. These reviews are short when daily automation is healthy; they become long and risky when ignored for months.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Backups and redeployment are the rollback plan
Updates are safer when the fastest recovery path is known. Keep provider snapshots or image backups for the operating system, separate backups for application data, and copies that cannot be destroyed by a compromised VPS. CISA’s StopRansomware guidance recommends infrastructure as code for rapid redeployment and frequent backups, including offline or cloud-to-cloud copies. Applied to a VPS, that means storing deployment templates, firewall rules, service configuration, and application versions outside the server, then testing a clean rebuild.
- Define what must be restored: database contents, uploaded files, secrets, DNS records, and service configuration.
- Record backup frequency and retention for each data class.
- Encrypt backups and protect their credentials separately from the VPS.
- Perform a restore or redeployment test periodically; a backup that has never been restored is an assumption, not evidence.
- After a major update, retain the previous image or snapshot long enough to cover the application’s rollback window.
Snapshots are not a complete backup strategy if they share the same account, region, or failure domain as the running VPS. Keep an independent copy and document who can access it during an incident.
Choose the operating model that fits your risk
| Approach | Update scope | Reboot behavior | What you still own |
|---|---|---|---|
| Manual patching | Chosen package changes, usually during a maintenance window | Operator schedules each reboot | Every login, reminder, test, log review, and recovery action |
| Unattended security updates | Approved security origins; normal updates follow their configured policy | Automatic reboot is disabled by default | Repository trust, alerting, dry runs, service checks, and planned reboots |
| Livepatch plus unattended updates | Unattended package updates plus supported high- and critical-severity kernel patches while running | Some kernel fixes avoid an immediate reboot; others still require one | Application updates, configuration review, monitoring, backups, and remaining reboots |
| Managed VPS service | Depends on the provider’s contract and maintenance policy | Depends on the provider and your approval settings | Verify scope, alert delivery, backups, access controls, rollback, and support coverage |
Unattended updates are usually the best baseline for a self-managed Ubuntu VPS because they remove repetitive security work without pretending the host is self-managing. Add Livepatch or a managed service only after confirming what each covers and what remains your responsibility. Compare total cost with the value of reduced maintenance time, not with the package-update command alone.
A practical implementation sequence
- Inventory: record the Ubuntu release, listening services, repositories, administrator accounts, data locations, and provider console method.
- Recover: create or verify a backup, snapshot, or reproducible deployment and perform a small restore test.
- Access: create a named administrator, test SSH keys and
sudoin a second session, then tighten root and password-login policy. - Network: allow only required ports with
ufwor the provider firewall, and confirm access from a separate session. - Updates: inspect
Allowed-Origins, create a numbered local drop-in if needed, and runsudo unattended-upgrade -v --dry-run. - Observe: configure email or monitoring for failed runs, pending reboots, disk pressure, service health, and backup failures.
- Schedule: keep automatic reboot disabled for fragile production workloads; define a recurring maintenance window and a post-reboot checklist.
- Review: remove unused packages and repositories, revisit exceptions, and test restoration on a regular cadence.
Troubleshooting common automation failures
The timer ran, but no packages changed
Check the log for an empty update set, held packages, repository errors, or a policy that excludes the package. Confirm the system clock, network access, disk space, and enabled origins. A “no changes” result is normal when the host is current; a failed transaction is not.
A third-party package never updates automatically
That is expected unless its origin is explicitly allowed. Verify the repository’s signing and support policy, decide whether it belongs in unattended updates, and add a narrowly scoped numbered drop-in only if you accept the risk. Otherwise, keep it in a documented manual maintenance window.
An update requires a reboot
Do not enable automatic reboot merely to clear the indicator. Check service dependencies, confirm the latest backup, notify users, reboot during the planned window, and validate SSH, listening ports, application health, and logs afterward.
SSH stopped working after hardening
Use the provider’s out-of-band console, inspect sshd -t output and authentication logs, and restore the last known-good configuration. Keep one tested session open during future changes and avoid disabling the only working authentication method at once.
A package update broke the application
Stop accepting new traffic if necessary, use the documented rollback or snapshot, and preserve logs before rebuilding. Identify whether the failure came from the package, a changed configuration, a database migration, or an unsupported third-party dependency. Add a temporary, owner-assigned exception only while a fix is prepared; do not leave a permanent blacklist without review.
The maintenance result to aim for
A well-run VPS should need attention when a decision or exception exists, not simply because a security bulletin was published. Approved security updates install automatically, logs and alerts tell you when they do not, reboots happen in a tested window, SSH and the firewall limit access, and a verified backup or redeployment path turns a bad update into a recoverable event. That combination delivers less effort without trading away visibility or control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
