Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →On a new Linux VPS, keep the provider’s initial session open while you create a named administrator, install and test SSH-key access, then disable direct root and password logins. Allow the actual SSH port before enabling UFW, and keep a provider console or other recovery path available in case a firewall or SSH change cuts off your client.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What this procedure assumes
The commands below use an Ubuntu Server image and a typical VPS provider workflow. Ubuntu commonly grants administration through the sudo group and uses ufw as its default firewall configuration tool. Debian, RHEL-family distributions, and provider-customized images can use different administrative groups, service names, SSH defaults, or firewall tools. Treat the commands as a tested sequence, not as a claim that every image has identical labels.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before changing anything, write down the server’s public IP address, distribution and image, initial username, SSH port, provider console URL, and whether a provider-level (cloud) firewall is already attached. Also note whether the image uses IPv6. DigitalOcean’s production guidance, last verified on 1 October 2026, describes the target state as “SSH key authentication for a sudo non-root user, no password-based access to root, and a cloud firewall to restrict access to SSH only.” Your application will eventually need additional, deliberate ports, but the bootstrap policy should expose as little as possible.
Choose your recovery and firewall model first
You need at least one route that does not depend on the SSH rule you are about to edit. Keep the provider’s web console credentials documented, and plan to retain a second terminal session during the transition. A rescue or recovery mode is useful when the provider offers it, but it is not a substitute for checking the normal login before you close the original shell.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Layer | Where rules are managed | Typical strengths | Failure and recovery considerations |
|---|---|---|---|
| Provider cloud firewall | Provider control panel or API, outside the VPS | Can block traffic before it reaches the host; remains available if the operating system firewall is misconfigured; often supports provider-level logging | Rules may be shared by several servers; IPv4 and IPv6 behavior depends on the provider; console access is still needed if you remove your own SSH path |
| Host firewall (UFW) | Inside Ubuntu, with commands such as ufw allow |
Travels with the machine image; can express host-specific policy and show local status | A bad default policy or missing SSH rule can lock out the host; recovery normally requires a second session or provider console |
Using both layers is reasonable when ownership is explicit: for example, the cloud firewall limits which source networks may reach the server, while UFW defines which services the host accepts. Avoid copying an undocumented set of rules into both places. Record which layer owns SSH, web traffic, database access, and emergency access, and verify both IPv4 and IPv6 policies.
1. Keep the initial session open and inspect the image
Connect using the provider’s documented initial username and key or temporary credential. Do not close this root or bootstrap session while the replacement account is being tested.
ssh INITIAL_USER@SERVER_IPOnce connected, identify the operating system and current identity. These checks do not alter the server, but they prevent you from applying Ubuntu-specific instructions to another image.
whoami
cat /etc/os-release
idConfirm the SSH port before writing firewall rules. The usual port is 22, but a provider image or an existing administrator may have selected another one. A custom port can reduce accidental noise, but it is not a security control by itself; key authentication, least privilege, and a correctly configured firewall matter more. If you use a nonstandard port, document it and use that value consistently in every later command.
2. Create a named administrator instead of working as root
Use a person- or role-specific account, not a shared username. On Ubuntu, create the account with adduser and add it to the sudo group:
sudo adduser deploy
sudo usermod -aG sudo deployReplace deploy with a meaningful name for the operator or automation role. adduser asks for a password and optional profile fields. The password is useful for local recovery and for satisfying account setup, but the SSH policy later in this guide disables password authentication over the network. Do not use an easily guessed password simply because routine SSH access will use a key.
The administrative group is distribution-specific. Ubuntu commonly uses sudo; some RHEL-derived images use wheel, and provider images can define their own group. Check the image documentation or inspect existing privileged accounts before changing group membership. Grant only the group required for administration. If the VPS is intended to run an application with no human administration, a service account should not receive unrestricted sudo merely for convenience.
Group membership is evaluated when a new login session starts. Do not assume that an already-open shell has picked up the new membership. The account must also have a valid home directory and login shell; adduser normally creates both on Ubuntu.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
3. Install an SSH public key in the new account
Use an existing protected key or generate Ed25519
On the administrator’s workstation, use a key that is protected by a passphrase, or generate an Ed25519 key with OpenSSH if no suitable key exists:
ssh-keygen -t ed25519 -C "deploy@your-workstation"Accept a deliberate file location and choose a strong passphrase. The private key stays on the workstation (or an approved hardware-backed agent); it is never copied to the VPS. The file ending in .pub is the public key and is the only part that belongs in the server account’s authorization file.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCopy the public key safely
If the provider’s initial account has working key access, OpenSSH’s helper can append the key to the new account:
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@SERVER_IPWhen that helper is unavailable, use the still-open initial session and create the directory and file explicitly. The following example assumes Ubuntu and a key file available on the workstation; paste the single public-key line when prompted rather than copying the private key.
sudo install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
sudo sh -c 'cat >> /home/deploy/.ssh/authorized_keys'
# Paste the contents of id_ed25519.pub, press Enter, then press Ctrl-D
sudo chown deploy:deploy /home/deploy/.ssh/authorized_keys
sudo chmod 600 /home/deploy/.ssh/authorized_keysUbuntu’s OpenSSH documentation identifies ~/.ssh/authorized_keys as the public-key authorization location. Ownership and permissions matter: the account must own the directory and file, the directory should not be writable by other users, and the file should be readable only by the account. SELinux-enabled distributions may also require the platform’s context-restoration command after manual file creation.
Check that the key is one uninterrupted line and that you appended it to /home/deploy, not to the initial account’s home directory. If the account’s home directory differs from /home/deploy, use the path reported by getent passwd deploy.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →4. Prove key login and sudo before changing SSH policy
Open a second terminal. Leave the original session untouched and connect as the named user with the intended private key:
ssh -i ~/.ssh/id_ed25519 deploy@SERVER_IPAdd -p PORT if the service uses a documented custom port. Once connected, verify identity, group membership, and sudo authorization:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
whoami
id
sudo -v
sudo -n truesudo -v may ask for the account password and refresh the sudo timestamp. The final command tests non-interactive authorization; if your sudo policy requires a password each time, it can legitimately fail even though ordinary sudo works. Run a harmless administrative check as a final proof:
sudo systemctl is-system-runningDo not proceed until a fresh key-based session can authenticate and the account can perform the administration it actually needs. DigitalOcean’s initial setup guidance specifically recommends staying logged in as root until you have verified that the new user can log in and use sudo.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems5. Harden the OpenSSH server after the new login works
Inspect the effective configuration and drop-in files
Ubuntu images can load settings from both /etc/ssh/sshd_config and files in /etc/ssh/sshd_config.d/. Inspect both locations before editing, because a later drop-in or a provider-generated file can override a line that appears correct in the main file.
sudo grep -RInE '^(Include|PermitRootLogin|PasswordAuthentication|Port|AllowUsers|AllowGroups)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/nullReview the complete effective values for the account and source you intend to use. Configuration blocks such as Match User can make a setting apply only to certain accounts, so do not rely on a single global line without reading its surrounding context.
Disable direct root and password logins
After the replacement account has passed the test, set these directives in the supported SSH configuration location:
PermitRootLogin no
PasswordAuthentication noPermitRootLogin no prevents direct SSH login as root; it does not remove root itself, and the named administrator can still obtain root privileges through sudo. PasswordAuthentication no disables password-based SSH authentication for users. Keep local console recovery and the sudo account’s local password available according to your provider and organizational policy. Some images also enable keyboard-interactive authentication or other provider-specific mechanisms; inspect those settings rather than assuming the two lines cover every method.
Free tools Windows power users keep installed
One-click scans. No signup required.
Before reloading, validate the syntax:
sudo sshd -tNo output normally indicates a successful syntax check. If it reports an error, do not reload; correct the file while the original session remains available. On Ubuntu, reload the running service without dropping established sessions:
sudo systemctl reload sshOther distributions may name the service sshd and use a different service manager command. Use the image’s documented service name. If the provider manages SSH configuration through cloud-init or a control panel, make the change in the supported layer or ensure the generated file will not undo it on reboot.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Test the hardened policy in a new terminal
Start another fresh connection as deploy using the private key. Confirm that it succeeds, then deliberately verify that direct root and password-based SSH are no longer accepted from an authorized test client. Keep the original session and provider console available until both checks are complete. Never test by closing every working connection first.
6. Configure UFW without locking yourself out
Inspect available application profiles
On Ubuntu, list the profiles supplied by installed packages:
sudo ufw app listThe profile name for OpenSSH is commonly OpenSSH, but a custom SSH port may not match that profile. You can inspect a profile with sudo ufw app info OpenSSH. If the service listens on a custom port, allow the exact TCP port instead of assuming the profile covers it.
Allow SSH before enabling the firewall
For the standard OpenSSH profile:
sudo ufw allow OpenSSHFor a documented custom port, substitute the real value:
sudo ufw allow PORT/tcpIf you know the administrator’s source network, a narrower rule can reduce exposure, but do not restrict SSH to an address range you cannot reliably reach during recovery. Ensure the cloud firewall, if present, permits the same connection path.
Recommended Free Tools
Add only services the VPS will run
Open application ports deliberately, using the package profile where one exists or an explicit protocol and port. Examples might include a web service’s HTTP and HTTPS ports, but do not open them merely because they are conventional. Database, cache, control-panel, and game-service ports should be reachable only from the networks or peers that need them. Document every rule’s owner and purpose.
Enable and inspect UFW
sudo ufw status numbered
sudo ufw enable
sudo ufw status verboseUFW warns that enabling it can interrupt existing SSH connections. That warning is why you allowed the real SSH service first and retained a second session and recovery route. Check the default incoming and outgoing policies, the listed SSH rule, and every application rule. Where IPv6 is enabled, confirm that the rules and default policies cover IPv6 as well as IPv4; a policy that protects only one address family leaves the other governed by a different path.
If you made a mistake, remove a rule by its current number or by its exact specification, then add the corrected rule. For example:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo ufw status numbered
sudo ufw delete NUMBER
sudo ufw allow PORT/tcpDo not use a blanket reset on a production machine without first recording the intended rules and confirming that your recovery path works. A reset can remove access required by monitoring, application traffic, or your provider’s management agent.
7. Verify the finished server from the outside
Perform the final checks from a fresh workstation terminal, not only from the shell that made the changes.
- Connect as the named administrator with the intended private key and documented port.
- Run
sudo -vand a harmless sudo command to confirm authorization after a new login. - Confirm that direct root SSH is refused and that password-only SSH is refused, while key login still works.
- Run
sudo ufw status verboseand compare it with the provider cloud-firewall policy. - List listening services with
sudo ss -tulpnand close or restrict anything you did not intend to expose. - Test the public services from an appropriate external network, including IPv6 when the VPS has an IPv6 address.
- Record the account name, key owner, SSH port, firewall rule owner, provider console path, and emergency recovery steps in your operational documentation.
The goal is not merely a green firewall status. It is a server whose reachable services, administrative identities, authentication methods, and recovery routes are all known.
Root, sudo user, password, and key: practical trade-offs
| Choice | Advantages | Risks or costs | Recommended use |
|---|---|---|---|
| Direct root SSH | Immediate access during bootstrap or emergency recovery | Every mistake has maximum blast radius; actions are harder to attribute among operators; automated attacks target the account name | Temporary bootstrap only, then disable direct login |
| Named user with sudo | Per-person or per-role audit trail; privilege is requested per command; root access remains available when justified | Requires correct group membership and a working sudo policy; a damaged account still needs the provider console | Routine administration |
| Password-based SSH | Can be recovered when a key is unavailable; simple for a one-off console setup | Passwords can be guessed or reused; rotation and safe sharing are operational burdens | Local or provider-console recovery where policy permits, not routine network SSH after key verification |
| Key-based SSH | Strong authentication without sending a password; keys can be scoped, rotated, and managed by an agent | Loss of the private key or passphrase can remove access unless another administrator or console path exists | Baseline for normal SSH access |
Common failures and recovery paths
“Permission denied (publickey)”
- Confirm that you used the matching private key and the correct username.
- Check that the public key is a single line in the target account’s
authorized_keys. - Verify ownership and modes on the home directory,
.ssh, andauthorized_keys. - Read the server’s SSH authentication log through the original session or provider console; it usually identifies a wrong path, ownership problem, or rejected authentication method.
- On systems with SELinux or another mandatory access-control layer, restore the expected security context after manual file changes.
“sudo: command not found” or authorization failure
The image may not have the sudo package installed, or the administrative group may not be sudo. Use the provider’s root or console route to install the distribution’s supported sudo package and grant the documented administrative group. Start a new login after changing group membership.
SSH worked, then stopped after the firewall change
Use the second still-open session or provider console. Run sudo ufw status numbered, add the actual SSH port, and check whether the cloud firewall blocks the same path. If no session remains, use the provider’s console or recovery mode rather than repeatedly guessing from the client.
The configuration test fails or SSH will not reload
Run sudo sshd -t and inspect the exact file and line reported. Look for misspelled directives, invalid values, misplaced Match blocks, and drop-in files that conflict with the main configuration. Correct the syntax, test again, and reload only after the test is clean.
IPv4 works but IPv6 is unexpectedly exposed or blocked
Check the VPS address configuration, UFW’s IPv6 setting, cloud-firewall rules for both families, and the listening address shown by ss. Apply the same intentional service policy to each enabled address family instead of assuming an IPv4 rule automatically governs IPv6.
A repeatable bootstrap checklist
- Record image, provider, public addresses, initial account, SSH port, console path, and existing cloud-firewall rules.
- Connect through the initial account and keep that session open.
- Create a named user and grant only the distribution’s required administrative group.
- Generate or select a passphrase-protected Ed25519 key on the workstation.
- Install only the public key in the new account’s
authorized_keys, with correct ownership and permissions. - Prove a new key-based session and sudo access before editing SSH or firewall policy.
- Inspect both the main sshd configuration and drop-in files.
- Set
PermitRootLogin noandPasswordAuthentication nowhere supported, test withsshd -t, and reload safely. - Allow the real SSH profile or custom port before enabling UFW.
- Add only required application ports, with explicit IPv4/IPv6 and cloud-versus-host ownership.
- Enable UFW, inspect verbose status, and compare it with the provider firewall.
- Reconnect from a fresh terminal, inspect listening services, and document recovery.
This sequence leaves routine work on an attributable sudo account, keeps SSH authentication key-based, limits network exposure to declared services, and preserves a way back in when a configuration change is wrong.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
