Free tools Windows power users keep installed
One-click scans. No signup required.
A new Ubuntu 24.04 VPS should be treated as an untrusted, internet-facing machine until you update it, create a named administrator, verify SSH access, allow the correct SSH port through the firewall, and confirm automatic security updates. Keep your provider’s recovery console available throughout. This order prevents the most common beginner failure: enabling a firewall or disabling root access before an alternative login has been tested.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Ubuntu 24.04 LTS (Noble Numbat) receives standard security maintenance through 31 May 2029. Ubuntu Pro can extend coverage beyond that date. The official Ubuntu Server image is non-graphical, so the normal administration experience is a shell session over SSH.
As an Amazon Associate I earn from qualifying purchases.
What to confirm before changing anything
Provisioning details differ between VPS companies and even between image revisions. Open the provider dashboard and record the following before running commands:
- The public IPv4 address and, if supplied, the IPv6 address.
- The provider’s recovery or serial-console path.
- The initial login name and whether it is root or a provider-created user.
- The SSH port. Do not assume it is 22.
- Whether the installed image is Ubuntu 24.04 LTS (Noble Numbat).
- Whether an SSH public key was installed during provisioning.
Do not close the provider console until a second, independent SSH session works with your new administrator account. That console is your fallback if a firewall rule or SSH edit cuts off network access.
#1 Best Overall
Expect a command-line server
Ubuntu Server’s official 24.04 image has no desktop interface. You administer it from a local terminal, an SSH client, or the provider’s web console. Commands below assume a shell prompt and a user who can run sudo. Replace example values such as 22 and admin with your actual settings.
Step 1: Update the base system
Apply available package metadata and upgrades before installing a game server, web service, database, or other application. Ubuntu’s security guidance recommends this two-command sequence:
sudo apt update
sudo apt upgradeRead the package manager’s questions rather than accepting changes blindly. If it reports that a reboot is required, schedule one when the VPS can tolerate a restart. On a production server, coordinate that restart with the service owner and confirm that the application is configured to start again automatically.
Check whether a reboot is pending
After the upgrade, inspect the standard reboot marker:
test -f /var/run/reboot-required && echo "Reboot required" || echo "No reboot marker"The marker is a useful indication, not a replacement for reading apt and needrestart output. Ubuntu 24.04 may use needrestart to restart affected services automatically after unattended upgrades; that behavior can interrupt a production process even when the VPS itself does not reboot.
Step 2: Create a named administrator
Ubuntu recommends least-privilege administration: use a personal, named account for routine work and invoke sudo only for administrative commands. A named account gives you an identifiable audit trail and avoids making every session a root shell.
Add the account and grant sudo
- Create the account. Replace
adminwith a name that identifies its owner:sudo adduser admin - Add it to Ubuntu’s administrative group:
sudo usermod -aG sudo admin - Confirm the group membership:
id admin
The new user’s password is useful for local recovery, but remote SSH should use a key whenever possible. Grant only the privilege required for the job; do not add service accounts or temporary users to sudo unless they genuinely administer the host.
Install an SSH public key
If the provider did not place your key on the new account, create its SSH directory and add the public half of your key. Perform these operations from the existing session:
sudo install -d -m 700 -o admin -g admin /home/admin/.ssh
sudo sh -c 'cat >> /home/admin/.ssh/authorized_keys'
sudo chown admin:admin /home/admin/.ssh/authorized_keys
sudo chmod 600 /home/admin/.ssh/authorized_keysAfter the second command, paste one complete public-key line and finish with Ctrl-D. Never paste the private key onto the VPS. If your provider already installed a key, copy only the public-key line into the new user’s authorized_keys file.
Step 3: Test SSH before hardening it
Open a second local terminal and connect as the named account while the original session remains open:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →ssh admin@SERVER_IPIf SSH uses a nonstandard port, include it explicitly:
ssh -p SSH_PORT admin@SERVER_IPOnce connected, verify that administrative escalation works:
sudo -v
sudo whoamiThe second command should print root. Test from a genuinely separate session, not by switching users inside the first connection. Keep the original provider login available until this test succeeds and you have confirmed that the provider console can recover the machine.
Disable direct root and password SSH only after the test
Ubuntu’s secure remote-access model is SSH with controlled privileges. You can harden the daemon after key login is proven. Create a small drop-in so local package updates are less likely to overwrite your choices:
sudo nano /etc/ssh/sshd_config.d/99-local-hardening.confAdd the settings appropriate to your access policy:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yesBefore reloading SSH, validate the configuration:
sudo sshd -tNo output means the syntax check passed. Reload, rather than stop, the service:
sudo systemctl reload sshKeep the second session open and start a third login test. If key authentication fails, use the still-open session or provider console to correct the key, permissions, or configuration. Do not close every working connection immediately after a reload.
Step 4: Install and configure UFW safely
ufw is Ubuntu’s default firewall configuration tool. Provider images vary, however: Ubuntu 24.04 release notes warn that Oracle Cloud Ubuntu 24.04 images may omit UFW. Check first:
command -v ufw || echo "ufw is not installed"If it is absent, install it while you still have console access:
sudo apt update
sudo apt install ufwAllow SSH before enabling the firewall
Identify the actual listening SSH port in your notes or configuration. Permit that port before turning UFW on. Port 22 is only an example:
sudo ufw allow 22/tcpIf SSH uses port 2222, the corresponding rule is:
sudo ufw allow 2222/tcpYou can inspect the daemon’s effective port with:
sudo sshd -T | grep '^port 'Do not add both ports merely out of habit. Opening an unused port expands the attack surface and can hide a configuration mistake.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Add only application ports
List the ports required by the service you intend to run, then allow those ports and protocols explicitly. A public website commonly needs HTTP and HTTPS; a game server may require a vendor-documented TCP or UDP port. Do not open a broad range “just in case.” If an application has separate administration and player ports, restrict the administration port to trusted source addresses where the application supports that arrangement.
Review, then enable
sudo ufw status verbose
sudo ufw enable
sudo ufw status numberedUFW applies a deny-by-default incoming policy when enabled unless you have changed the defaults. The important safety rule is procedural: allow the real SSH port first, review the rule list, and only then enable the firewall. If you are connected through a provider-managed network firewall as well, both layers must allow the connection.
Step 5: Verify automatic security updates
Ubuntu Server installs unattended-upgrades by default and applies security updates daily. The default policy covers official Ubuntu archive repositories; software from third-party repositories needs explicit policy and configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCheck the package and timers
dpkg -s unattended-upgrades | grep '^Status:'
systemctl status apt-daily.timer
systemctl status apt-daily-upgrade.timerIf the package is missing, install it:
sudo apt update
sudo apt install unattended-upgradesInspect the policy files when you need to know exactly what the host will do:
sudo sed -n '1,200p' /etc/apt/apt.conf.d/20auto-upgrades
sudo sed -n '1,240p' /etc/apt/apt.conf.d/50unattended-upgradesThe first file normally controls the daily update cadence. The second defines allowed origins and related behavior. Avoid copying an old tutorial’s complete file over these paths; review the existing 24.04 configuration and make narrowly scoped changes.
Read the update log
When verifying that updates actually run, inspect:
sudo ls -l /var/log/unattended-upgrades
sudo less /var/log/unattended-upgrades/unattended-upgrades.logUbuntu 24.04’s needrestart integration can automatically restart services affected by those updates. Decide whether that is acceptable for your workload. A personal test VPS may tolerate an immediate restart; a production game or web service may need a maintenance window, monitoring, and a documented recovery procedure.
Step 6: Understand Ubuntu 24.04’s APT source layout
Ubuntu 24.04 keeps the main Ubuntu archive definitions in /etc/apt/sources.list.d/ubuntu.sources, using deb822 format. Older guides often tell readers to edit only /etc/apt/sources.list; blindly following those instructions can leave you editing the wrong file or creating duplicate entries.
Recommended Free Tools
Audit the active definitions before adding a repository:
sudo sed -n '1,240p' /etc/apt/sources.list.d/ubuntu.sources
ls -la /etc/apt/sources.list.d/After any repository change, run sudo apt update and read warnings carefully. Keep third-party sources to the minimum your application needs, and understand that automatic-update coverage for them is not implied by Ubuntu’s default official-archive policy.
Step 7: Run a baseline health and exposure check
Before installing a network-facing service, capture a small baseline. Repeat the relevant checks after each service is added.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
- Identity and time:
hostnamectl timedatectl - Storage and memory headroom:
df -h free -h - Listening sockets:
sudo ss -tulpn - Firewall rules:
sudo ufw status verbose - Pending package work:
apt list --upgradable - Remote-login test: start a new SSH session as the named account and confirm
sudoworks. - Recovery test: verify that the provider console opens and that you know how to reach it without relying on the SSH connection you are testing.
Save the hostname, public addresses, SSH port, account name, firewall rules, update policy, and the date of the baseline in your operations notes. Do not store private keys or passwords in those notes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choosing a VPS or operating policy
Two servers with the same Ubuntu release can have very different operational risk. Compare the platform and its policy, not just CPU and memory.
| Decision area | Questions to answer | Why it matters |
|---|---|---|
| Image contents | Is Ubuntu 24.04 LTS installed? Is UFW present? Which initial user and SSH defaults are supplied? | Provider images can omit packages or impose access assumptions, as with images that do not include UFW. |
| Recovery access | Is there a web console, serial console, rescue mode, or snapshot restore? | A recovery path limits the damage from an incorrect SSH or firewall change. |
| Network addressing | Are IPv4 and IPv6 supplied? Are provider-level firewall rules separate from UFW? | Every address family and filtering layer must be included in your access plan. |
| Updates and restarts | Are security updates automatic? When are services restarted? Where are logs? | Daily updates improve exposure time, while unexpected service restarts can affect production traffic. |
| Resilience | Are backups, snapshots, monitoring, and alerting included or self-managed? | A firewall is not a backup, and an update log is not service monitoring. |
Common mistakes and recovery paths
SSH stops working after enabling UFW
Use the provider console, check the actual daemon port with sudo sshd -T | grep '^port ', and inspect sudo ufw status numbered. Add the missing TCP rule, then retry from a new terminal. If the provider has a separate network firewall, confirm that it allows the same port.
The new user gets “Permission denied”
Check that the public key is complete and on one line, then verify ownership and modes:
sudo ls -ld /home/admin /home/admin/.ssh
sudo ls -l /home/admin/.ssh/authorized_keysThe directory should be private to the user, and authorized_keys should not be writable by other users. Confirm that you are connecting with the matching private key and the correct account name.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSSH configuration validation fails
Run sudo sshd -t again and read the reported file and line. Correct the drop-in, validate once more, and only then reload ssh. If you have lost network access, edit the file through the provider console.
APT reports a lock or a pending restart
Another daily APT job may be running. Check systemctl status apt-daily.service apt-daily-upgrade.service and wait for it to finish rather than deleting lock files. If needrestart requests a reboot, schedule it deliberately and verify the application afterward.
Automatic updates appear inactive
Check the package status, both APT timers, the two policy files, and the files under /var/log/unattended-upgrades. A third-party repository will not necessarily receive updates under the official Ubuntu archive policy; configure and monitor it separately.
Quick Recap
A practical completion checklist
- Ubuntu 24.04 LTS image and access details recorded.
- Initial packages updated with
sudo apt updateandsudo apt upgrade. - Named administrator created with only the required sudo access.
- Public-key login tested from a separate SSH session.
- Root login and password SSH changed only after that test, with
sshd -tpassing. - Provider console or another recovery route confirmed.
- UFW installed if necessary, the real SSH port allowed first, and only application ports added.
- UFW rules reviewed after enabling.
unattended-upgrades, its timers, policy files, and logs checked.- Service-restart behavior from
needrestartconsidered for the workload. ubuntu.sourcesreviewed before repository changes.- Hostname, clock, disk, memory, sockets, firewall, pending updates, and a fresh login checked.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
