Secure a multi-user Linux server by giving every person an individual account, placing accounts in role-based groups, granting only narrowly defined sudo permissions, restricting SSH independently of password status, filtering network access with a host firewall, and reviewing logs and configuration continuously. Keep a tested console or second SSH session available while changing access controls so a syntax error or over-tight rule does not lock out every administrator.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The examples below use Ubuntu commands where the distribution matters. File locations such as /etc/sudoers.d/ and /etc/ssh/sshd_config are also used on many other Linux systems, but service names, firewall tools and defaults differ. On Red Hat Enterprise Linux, apply the same least-privilege design with the distribution’s documented service and firewall tooling.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What a secure multi-user server should achieve
Multi-user security is an accountability problem as much as a technical one. A shared root login makes it impossible to prove which person changed a file, restarted a service or copied data. Individual accounts preserve attribution, while sudo lets an operator elevate temporarily using that operator’s own identity. Ubuntu describes user management as a critical part of maintaining a secure system and presents sudo as the normal administrative model rather than routine root login.
Build the controls in layers:
- Identity: one named account per person, with role-based groups and stale accounts removed.
- Authorization: explicit sudo rules for specific users, groups, hosts and commands.
- Remote access: SSH keys protected on the client, an SSH allow-list on the server, and reviewed key files.
- Network exposure: a deny-by-default host firewall with only required ports reachable.
- Host controls: current patches, unnecessary services disabled and mandatory access control such as AppArmor where supported.
- Evidence: sudo and authentication logs plus repeatable security audits.
Password locking, account deletion, SSH-key removal, firewall changes and sudo changes are separate operations. Treating one as a substitute for another leaves an authentication path open.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Inventory access before changing anything
Make a written baseline while you still have reliable access. The inventory is both a security record and a recovery aid.
Record identities and privilege
- List human users, service accounts, disabled accounts and their primary and supplementary groups.
- Identify members of administrative groups and every file in
/etc/sudoers.d/. - Note which accounts have interactive shells and which are intended only for services.
- Record the owner, permissions and fingerprints of SSH public keys in each relevant
~/.ssh/authorized_keysfile.
Record exposed services
- List listening sockets and map each one to the daemon and its purpose.
- Write down the ports that must be reachable from the public internet, from an internal network and from an administration network.
- Mark software that is no longer required; removing a daemon is safer than merely hiding it behind an undocumented exception.
Prepare a recovery path
Keep the current SSH session open and establish a second, independently authenticated session or an out-of-band console before editing SSH or firewall policy. Have a tested administrator account, the server provider’s console procedure and a copy of the last known-good configuration. Ubuntu warns that an invalid sshd change can stop the daemon or prevent a remote administrator from logging in.
Create named accounts and role-based groups
Use a separate login for every operator. Never distribute a shared root password or a shared personal account. A named account means a sudo event, SSH login and subsequent file change can be associated with one person.
Example account setup on Ubuntu or Debian
sudo adduser alicecreates Alice’s named account and prompts for a password and profile information.sudo groupadd webopscreates a role group. If the group already exists, use it rather than creating a duplicate.sudo usermod -aG webops aliceadds Alice without replacing her existing supplementary groups.id aliceverifies the resulting group membership. Alice must start a new login session before all group changes are reflected.
Choose groups by job function, not by seniority: for example, a deployment group, a database-operations group and an SSH-administration group can have different access. Keep the membership list short and review it when a person changes role or leaves.
Remove stale access deliberately
First remove a former operator from administrative and SSH-allowed groups, then review keys and active sessions. Locking a local password can stop password authentication, but it does not remove a previously installed SSH public key. Delete or disable the obsolete key in authorized_keys, and terminate existing sessions according to your incident procedure. Delete an account only after preserving any files, scheduled jobs or service dependencies that must be reassigned.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Local accounts or centralized identity?
| Approach | Best fit | Security and operations trade-off |
|---|---|---|
| Local users and groups | A small number of servers with a small operator team | Simple and independent, but every account, group and departure must be changed on each host. |
| Kerberos or SSSD-backed identity | Many hosts sharing the same workforce identities | Centralizes lifecycle and policy, but adds dependency on identity services, time synchronization and careful failure planning. |
Ubuntu’s security guidance treats centralized identity such as Kerberos or SSSD as an option for larger environments, not a prerequisite for a well-managed small server.
Grant sudo without granting unrestricted root
Red Hat’s guidance is explicit: a rule such as ALL ALL=(ALL) ALL allows every user to run every command as every user on every host and creates serious risk. A safer policy names the permitted users or groups and limits the command set.
Put role rules in a separate file
- Find the real path of each permitted executable with
command -v; paths differ between distributions. - Create or edit a role file with
sudo visudo -f /etc/sudoers.d/webops.visudochecks syntax before installing the file. - Define only the commands the role needs. For example, a web-operations group might use a rule shaped like
%webops ALL=(root) /usr/bin/systemctl restart nginxafter verifying that exact path and service name on the host. - Test as a member of the group with
sudo -l, then run an allowed command and confirm that an unlisted command is refused.
Specify arguments when practical. Allowing a single service restart is narrower than allowing an entire service-management program, because a broad program rule may let a user start a different unit, alter its environment or invoke a shell through a helper. Avoid granting interpreters, editors, package managers or unrestricted scripts unless you have reviewed their ability to execute arbitrary code.
Separate operational roles
Give database operators database commands, deployment operators deployment commands and incident responders only the emergency actions they need. Do not add every operator to a general wheel or sudo group merely because one task requires elevation. If a command needs a controlled wrapper script, make the script root-owned, non-writable by the operator and explicit about accepted arguments.
Validate and review sudo policy
- Run
sudo visudo -cafter changes to check the complete policy. - Review both
/etc/sudoersand every file under/etc/sudoers.d/; an old broad rule can override the intent of a new narrow rule. - Document who approved each rule, why it exists and when it should be revalidated.
- Use sudo’s logs as an attribution trail. They identify the initiating account even when the command runs with root privileges.
Harden SSH without locking yourself out
SSH access is controlled by the daemon configuration, group membership, account state and individual key files. Changing one layer does not automatically close the others.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Prefer protected keys and restrict the allowed group
- Create an SSH-administration group, for example
sudo groupadd sshadmins, and add only current administrators withsudo usermod -aG sshadmins alice. - In
/etc/ssh/sshd_config, add or adjustAllowGroups sshadmins. This restricts SSH logins to members of that group, regardless of whether another user knows a password. - Use public-key authentication with a private key protected by a passphrase. On the server, check that the user’s
~/.sshdirectory andauthorized_keysfile are owned by the user and are not writable by other users; overly permissive permissions can cause the daemon to reject a valid key. - Only after a second key-authenticated session succeeds should you consider disabling password authentication with
PasswordAuthentication no. Keep a recovery path for accounts or automation that genuinely require another method, and add multi-factor authentication when your environment supports it. - Validate syntax with
sudo sshd -t. If it reports an error, fix the file before reloading. - Reload rather than terminate the daemon with
sudo systemctl reload sshon Ubuntu, then watch activity withsudo journalctl -fu ssh.service.
Test a new login in the separate session before closing the known-good connection. Verify an allowed administrator succeeds, a non-member is refused and existing automation still authenticates as intended.
Disable SSH for one user
Use all relevant controls, in this order:
- Remove the user from the group named by
AllowGroups, if group restriction is in use. - Inspect and remove that person’s public keys from
~/.ssh/authorized_keyson every account or service where they were installed. - Lock the local password with
sudo passwd -l usernameif password authentication is enabled. - Check for alternate accounts, forced commands, automation keys and already active sessions. A locked password alone does not prevent login with an existing public key.
For a temporary suspension, preserve the account and record the change. For a permanent departure, remove access, transfer required files and jobs, and then delete the account only after confirming that no service depends on it.
Use a deny-by-default host firewall
Ubuntu’s default firewall frontend is ufw. Start from a policy that denies unsolicited inbound traffic, then permit SSH and application ports deliberately. Apply firewall changes only after identifying the source networks that need each service.
Safe Ubuntu sequence
- Check the current policy with
sudo ufw status verbose. - Allow outbound traffic according to your operating requirements, for example
sudo ufw default allow outgoing. - Set inbound traffic to deny by default with
sudo ufw default deny incoming. - Permit SSH from an administration network where feasible, such as
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp. If source restriction is impossible, allow the required SSH port temporarily and tighten the rule after confirming access. - Add only application ports that the server actually provides. Do not open a port merely because a package installed it.
- Enable the firewall with
sudo ufw enable, then confirm the effective rules withsudo ufw status verbose.
The address in the example is a documentation network; replace it with your real administration range. Keep the known-good SSH session open while enabling or changing rules. RHEL systems commonly use a different firewall frontend, so translate the same deny-by-default and source-restriction policy using the release’s firewalld documentation rather than copying Ubuntu commands.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Patch the host and remove unnecessary attack surface
A firewall cannot compensate for an exposed, unpatched daemon. Keep the operating system, kernel and network-facing services updated through your normal change process. Remove packages and disable services that are not required; fewer listening programs mean fewer authentication paths and fewer vulnerabilities to monitor.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Inspect listening sockets after every service change and compare them with the inventory. Check that administrative interfaces bind only to the management network when public exposure is unnecessary. Do not assume that a service is safe because it is behind SSH tunneling; its local permissions and credentials still matter.
Add mandatory access control
Ubuntu’s layered security guidance includes AppArmor where supported. Keep profiles enabled for services that have suitable profiles, review denials before changing them and avoid weakening a profile simply to make an application start. Mandatory access control limits what a compromised process can read or execute even when the process has a valid service account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Audit who changed what
Auditing combines identity, authorization and system evidence. Sudo records the initiating user for elevated commands, while SSH and authentication logs show login attempts and session events. Review these records centrally when possible and protect them from alteration by ordinary server users.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePerform a repeatable baseline audit
Ubuntu Security Guide (USG) can run a CIS Level 1 server assessment with:
sudo usg audit cis_level1_server
USG emits HTML and XML reports. Treat the CIS profile as a baseline, not proof that the host is secure: inspect each finding, document accepted exceptions and tailor controls to the server’s role. A database host, build host and public web host will not have identical requirements.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Review evidence on a schedule
- After each sudo, SSH or firewall change, verify the effective configuration rather than trusting the edited file.
- At regular intervals, reconcile current users and group membership with the staff or service inventory.
- Review new SSH keys, failed and successful logins, sudo invocations and unexpected listening ports.
- Run the CIS-oriented audit after major operating-system changes and track exceptions to closure.
- Test that logs identify the initiating named account, not only a shared service or root identity.
Choose controls according to the environment
| Decision | Looser option | Tighter option | When the tighter option is justified |
|---|---|---|---|
| Account source | Local accounts on each host | Kerberos or SSSD central identity | Many hosts, frequent personnel changes or a need for centralized lifecycle control. |
| SSH authentication | Password login | Protected keys, optionally with multi-factor authentication | Internet-facing administration, high-value data or a policy requiring resistance to password guessing. |
| Sudo authorization | Broad administrative group | Command- and argument-scoped rules | Different operator roles, regulated systems or a need for precise attribution. |
| Security review | Manual checklist | USG CIS Level 1 report plus manual review | Repeatable evidence is needed across hosts; exceptions still require human judgment. |
Common failure modes and recovery
The SSH daemon will not reload
Keep the existing session open, run sudo sshd -t to identify syntax errors and restore the last known-good file if necessary. Do not repeatedly restart a daemon whose configuration has not passed validation. Use the console when the service is stopped or the network path is unavailable.
An administrator is suddenly denied
Check group membership, the exact spelling and capitalization of AllowGroups, account shell state and key-file ownership and permissions. Confirm that the client is using the intended private key. A password lock does not explain a key-authentication failure; inspect authorized_keys separately.
Free tools Windows power users keep installed
One-click scans. No signup required.
The firewall blocks legitimate administration
Use the console or the still-open trusted session to inspect sudo ufw status verbose. Restore a narrowly scoped SSH rule for the administration network, verify a second session, then remove any temporary broad rule. Record the final policy so the emergency exception does not become permanent.
A sudo rule is broader than intended
Run sudo -l as the affected user and inspect every file under /etc/sudoers.d/ with sudo visudo -c. Remove duplicate or obsolete entries, then test both an allowed command and a command that must fail. Pay particular attention to rules that invoke shells, editors, interpreters or scripts writable by the operator.
Operational checklist
- Every human has an individual account; shared root logins are not used for routine work.
- Groups express roles, and membership is reviewed when duties change.
- Sudo files are edited with
visudo, stored under/etc/sudoers.d/where appropriate and limited to required commands and arguments. - SSH is restricted with
AllowGroups; key files are reviewed, and private keys are protected on clients. - Password locking, key removal, group removal and account deletion are handled as separate decisions.
- SSH syntax is tested with
sshd -t, changes are reloaded safely and a second session or console is available. - The host firewall denies unsolicited inbound traffic and allows only required ports from required networks.
- The operating system and exposed daemons are patched; unnecessary services are removed or disabled.
- AppArmor or another supported mandatory access-control system is enabled and maintained.
- Sudo, SSH and authentication events are retained, reviewed and attributable to named users.
sudo usg audit cis_level1_serveris run when a repeatable CIS-oriented baseline is useful, with findings tailored to the server’s role.
A multi-user Linux server is secure when access is explicit, temporary elevation is narrow, remote entry points are independently controlled and every important action leaves evidence tied to a named identity. Build those layers incrementally, verify each effective setting from a second access path and keep the configuration under regular review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
