iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest method depends on what you are downloading. Install software that exists in your VPS distribution’s repositories with its native package manager: apt on Debian or Ubuntu, dnf on Fedora, RHEL, and CentOS Stream, or zypper on SUSE. Fetch a direct HTTP or HTTPS file with curl or GNU Wget. Copy a file from another computer with SSH-based scp, SFTP, or rsync.
Before executing an unfamiliar archive or binary, verify the publisher’s SHA-256 checksum and, when available, its signed checksum file. Work as an ordinary user in a directory you control; use sudo only for package installation or protected paths.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the transfer method first
| Method | Source and direction | Best fit | Dependencies and trust | Useful capabilities |
|---|---|---|---|---|
| Native package manager | Configured distribution repositories to the VPS | Software that is packaged for your distribution | Resolves dependencies and applies repository metadata and signature policy | Managed upgrades, removals, and consistent file ownership |
curl |
HTTP/HTTPS, and also SFTP or SCP URLs, to the VPS | A single release archive, data file, or API response | You must inspect the URL, certificate, and downloaded artifact | Explicit output names, redirect following, retries, SSH-key authentication for SFTP/SCP |
| GNU Wget | HTTP, HTTPS, or FTP to the VPS | Non-interactive or repeatable downloads | Certificate verification should remain enabled | File-oriented output, retries, resume with -c, response headers, recursive retrieval |
scp or SFTP |
Another computer over SSH to or from the VPS | One-off interactive or scripted transfers | Uses SSH keys or passwords and the account’s remote permissions | Alternate SSH ports, explicit identity files, interactive directory browsing with SFTP |
rsync over SSH |
Another computer over SSH, commonly a directory tree | Repeated or large synchronizations | Uses SSH authentication and destination permissions | Efficient repeat transfers, progress display, and interruption-friendly synchronization |
The table’s source direction matters: curl and Wget pull from a URL when run on the VPS, while scp, SFTP, and rsync move data between machines through SSH.
Identify the VPS and prepare a destination
-
Connect over SSH and identify the operating system:
#1 Best Overall
cat /etc/os-release uname -a/etc/os-releasereveals the distribution and release family;uname -asupplies kernel and machine details that can help explain compatibility problems. -
Confirm which account and directory should own the download:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.id -un pwd ls -ld .A non-root working directory is preferable for archives and temporary files. Create a private staging directory if needed:
mkdir -p ~/downloads -
Check capacity before a large transfer:
df -hDo not assume that free space in your home directory is the same as free space in a protected mount such as
/srvor/var. -
Confirm that the final destination already exists and that your account can write there. Use
sudoonly when installing packages or writing a path protected from your normal account.
Install software with the VPS distribution’s package manager
Repository packages are usually the least labor-intensive choice because the manager obtains metadata, resolves dependencies, and follows the distribution’s signing and upgrade policy. Use a repository package when it provides the version and features you need; do not replace it with a random archive merely because an archive is easy to download.
Debian and Ubuntu: APT
Refresh package metadata, then install the package:
sudo apt update
sudo apt install package-nameRun both commands on the VPS. The first downloads current metadata from repositories already configured on the machine; the second selects the package and its dependencies. If the package is not found, check the distribution release and enabled repositories rather than downloading an unrelated build.
Rank #2
Fedora, RHEL, and CentOS Stream: DNF
sudo dnf install package-nameDNF is the normal package client for these RPM-family systems. The DNF download plugin can download binary or source RPMs, choose a destination directory, print package URLs, and resolve dependencies when you need an artifact without installing it immediately.
SUSE: Zypper
sudo zypper install package-nameZypper is the native package client on SUSE systems. Keep repository configuration aligned with the exact SUSE release so that dependency and signature metadata match the operating system.
Recommended Free Tools
When a vendor repository is required
Some software is distributed through a vendor repository rather than the base distribution. Repository clients such as apt, dnf/yum, and zypper are supported by Microsoft’s Linux repository documentation, and repository configuration packages commonly include GPG keys for package validation. On Ubuntu, store third-party keys in a dedicated keyring and configure the repository so package signatures can be checked. Do not paste a key into a global trust location without understanding which repository it authorizes.
Download a direct HTTP or HTTPS file with curl
Run curl on the VPS when the file is available at a direct URL. Curl writes to standard output by default, so choose an output option for a file.
Choose the output name
Use -o when you want to set the local filename:
curl -fL -o app.tar.gz https://example.com/releases/app.tar.gzUse -O to keep the filename supplied by the URL:
curl -fLO https://example.com/releases/app.tar.gzThe combined flags mean that -f treats HTTP errors as failures instead of saving an error page, -L follows redirects, and -O uses the remote name. Add a limited retry count for transient network failures:
curl --retry 3 -fL -o app.tar.gz https://example.com/releases/app.tar.gzInspect the URL and the server certificate. Never disable TLS verification as a shortcut for a certificate error; fix the hostname, clock, CA configuration, or server-side problem instead.
Use curl with SSH-based URLs
Curl can use SFTP and SCP URLs with SSH-key authentication. This is useful when the source is another SSH-accessible machine, although scp, SFTP, or rsync is often clearer for machine-to-machine transfers.
Download with GNU Wget
Wget is designed for non-interactive retrieval and is convenient in scripts or unattended sessions:
Rank #3
wget -O app.tar.gz https://example.com/releases/app.tar.gzUse -c to continue a partial download when the server supports range requests:
wget -c -O app.tar.gz https://example.com/releases/app.tar.gzWhen diagnosing a redirect, authentication, or content-type problem, ask Wget to print response headers:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →wget --server-response -O app.tar.gz https://example.com/releases/app.tar.gzWget documents HTTP, HTTPS, FTP, recursive retrieval, retry behavior, and certificate controls. Keep certificate verification enabled. A successful transfer only means that bytes were received; it does not establish that the file is safe or that the publisher is authentic.
Copy a file from another computer with SSH
For a file that is already on your workstation, run the transfer command on that workstation. The destination account must be able to write the target directory.
One file with scp
scp ./backup.tar.gz user@vps.example:/srv/backups/For a nonstandard SSH port and a specific private key, use an uppercase -P for the port and -i for the identity file:
scp -P 2222 -i ~/.ssh/id_ed25519 ./backup.tar.gz user@vps.example:/srv/backups/SSH authenticates the account, but the remote filesystem still enforces ownership and mode bits. If the command reports permission denied, copy to a directory your account owns or have an administrator create the destination with appropriate ownership.
Interactive browsing with SFTP
SFTP is useful when you need to inspect directories and choose files interactively. Connect with the account, host, port, and key required by the VPS:
sftp -P 2222 -i ~/.ssh/id_ed25519 user@vps.exampleInside the SFTP session, use commands such as pwd and ls to inspect the remote location, lcd to change the local directory, and put to upload a file. Exit with bye when the transfer is complete.
Repeatable directory synchronization with rsync
For a site tree or repeated deployment, synchronize over SSH:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchrsync -avP -e 'ssh -p 2222' ./site/ user@vps.example:/var/www/site/The trailing slash on ./site/ means that its contents are synchronized into the destination directory. Test the destination path and account first; a typo in a remote path can create a new directory rather than update the one you intended.
Verify downloads before installation or execution
-
Obtain the checksum and signing instructions from the same publisher that supplied the artifact. Treat a checksum copied from an unrelated mirror as untrusted.
-
Calculate the local SHA-256 value:
sha256sum app.tar.gz -
Compare the output character-for-character with the publisher’s SHA-256 value. A matching hash proves that the bytes match that published value; it does not, by itself, prove that the download page or the value was authentic.
-
If the publisher supplies a signed checksum list, verify its GPG signature with the publisher’s trusted public key before relying on the hash. A typical verification command is:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.gpg --verify SHA256SUMS.sig SHA256SUMSUse the publisher’s documented key fingerprint and key-distribution method. Do not accept an unknown key merely because the command reports a mathematically valid signature.
Ubuntu’s security guidance describes this layered process: a trusted GPG signing key authenticates a signed hash list, and a SHA-256 comparison confirms that the downloaded artifact matches the signed value.
Inspect, extract, and install an archive cautiously
Do not extract an unfamiliar archive directly into a system directory. First list its contents:
tar -tf app.tar.gzLook for unexpected absolute paths, parent-directory components, or files that would overwrite configuration. Create a controlled destination and extract there:
mkdir -p ~/apps/app-version
tar -xf app.tar.gz -C ~/apps/app-versionRead the project’s installation instructions and identify the expected executable path before running anything. Prefer the package manager when the software is already packaged. If you install a standalone binary, record its source URL, version, checksum, and installation path; those details make later updates and removal possible.
Keep downloaded archives separate from executable directories until verification and inspection are complete. Avoid running installers as root unless the publisher’s instructions and the installation target genuinely require it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Set ownership and permissions after a transfer
Check the resulting file and its parent directory:
ls -l /srv/backups/backup.tar.gz
ls -ld /srv/backups/A file copied by SSH may be owned by the receiving account, while a file placed through an administrative workflow may belong to another user. Correct ownership deliberately rather than making the file world-writable. Keep private keys, credentials, backups containing secrets, and configuration files out of shared or world-readable directories.
If a service account must read the file, choose an appropriate group and directory policy instead of granting write access to everyone. Confirm access using the same account that will run the service.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot common failures
| Symptom | Likely cause | What to check or do |
|---|---|---|
| APT, DNF, or Zypper cannot find a package | The repository metadata or enabled repositories do not provide that package for this release | Recheck /etc/os-release, refresh configured metadata where appropriate, and use the distribution’s package name rather than an archive for another release |
| Curl saves an HTML error page or exits successfully despite an HTTP error | The command did not use fail-on-error handling | Use -fL, inspect the URL and redirect target, remove the invalid file, and retry |
| TLS or certificate verification fails | Wrong hostname, stale CA data, incorrect system clock, or a server certificate problem | Fix the underlying condition; do not disable certificate checks |
| Wget stops partway through | Interrupted connection or a server that does not support range requests | Retry with wget -c; if the server lacks range support, restart and verify the final checksum |
| SSH reports connection refused or timeout | Wrong host, port, firewall rule, or SSH service availability | Confirm the VPS hostname, use the configured port with -P for scp or -p inside the rsync SSH command, and test an ordinary SSH login |
scp, SFTP, or rsync reports permission denied |
The account cannot write the destination or traverse a parent directory | Transfer to a user-owned staging directory, then perform an authorized move with sudo if required |
| Checksum does not match | Incomplete transfer, wrong release, altered file, or a copied checksum from another artifact | Delete the file, download again, confirm the exact version and architecture specified by the publisher, and obtain the checksum from the publisher’s authenticated instructions |
| Extraction fails or files appear in an unexpected location | Wrong archive format, damaged download, or an archive layout different from your assumption | Run tar -tf, check the checksum, and extract into a new controlled directory |
| There is not enough space | The destination filesystem is full, even if another mount has capacity | Use df -h, remove only disposable partial files, and choose a filesystem with adequate free space |
Complete workflows
Install a repository package on Ubuntu
cat /etc/os-release
sudo apt update
sudo apt install package-nameUse this path when the package is available from repositories configured for the VPS. The package manager handles dependency selection and records the installation for future maintenance.
Fetch and stage a release archive
mkdir -p ~/downloads ~/apps/app-version
curl --retry 3 -fL -o ~/downloads/app.tar.gz https://example.com/releases/app.tar.gz
sha256sum ~/downloads/app.tar.gz
tar -tf ~/downloads/app.tar.gz
tar -xf ~/downloads/app.tar.gz -C ~/apps/app-versionCompare the displayed hash with the publisher’s value before the extraction commands. If a signed hash list exists, verify that signature first.
Upload a local backup to the VPS
scp -P 2222 -i ~/.ssh/id_ed25519 ./backup.tar.gz user@vps.example:/srv/backups/
ssh -p 2222 user@vps.example 'ls -l /srv/backups/backup.tar.gz'Run the first command locally and the second as a remote verification step. If the destination is protected, upload to a staging directory owned by user and move it with an authorized administrative command.
Quick Recap
Operational checklist
- Identify the distribution and release before selecting a package command.
- Confirm the destination filesystem has enough space and that the intended account owns the working directory.
- Prefer a native package over an arbitrary archive when the required software is packaged.
- Use
curl -fLor Wget with certificate verification enabled for direct URLs. - Use SSH keys, the correct port, and a least-privilege account for SCP, SFTP, and rsync.
- Verify SHA-256 values and signed checksum lists before executing downloaded software.
- Inspect archive contents and extract into a controlled directory.
- Record the source, version, checksum, and installation path for standalone binaries.
- Review ownership and permissions, especially for backups, credentials, and service files.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
