iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure an Ubuntu VPS in a deliberate order: confirm the release is supported and recovery works, patch it, create a named administrator, harden SSH, then expose only necessary ports through both the host firewall and your provider’s network controls. Keep AppArmor enabled, remove only software you know you do not need, and verify updates, logs, backups, and reboot behavior. The order matters: test alternate access before changing SSH or enabling firewall rules, so a mistake does not leave you locked out.
What should I secure first on a new Ubuntu VPS?
Start with the ability to recover the server, then patch it before adding workloads or opening application ports. A firewall or SSH change can interrupt your access; an unpatched base system can remain exposed while you configure it.
Recommended Free Tools
- Identify the Ubuntu release. Check the installed release and confirm its maintenance window. Canonical provides five years of standard maintenance for Ubuntu LTS releases; Ubuntu Pro can extend security maintenance through ESM. Do not assume that a server remains covered indefinitely just because it still boots.
- Confirm out-of-band recovery. Find your provider’s web console, rescue mode, or other recovery workflow and make sure you can use it. Check what backups or snapshots are available and how to restore one.
- Keep a working session open. Before changing SSH or firewall rules, retain your current connection and establish a second administrative login to test changes.
- Record what the server needs to serve. List required administrators, application ports, private networks, and scheduled jobs. This becomes the basis for firewall rules and for deciding what services are genuinely unused.
A cloud snapshot is useful for rollback, but it is not a substitute for a tested backup or an incident response plan. Decide how the service will be restored and who can reach the recovery console before relying on either.
Write down the current access path before changing it: the SSH port, the account you use, the source network, and any provider-level rules that permit the connection. That small inventory helps distinguish a host firewall problem from a provider firewall problem if a test connection fails. Also note who is authorized to make emergency changes and how they can reach the provider console. Recovery planning is part of hardening because a secure configuration that cannot be maintained or repaired can leave a server unavailable or unpatched.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do I patch Ubuntu and enable automatic security updates?
Update the fresh installation first, then verify that unattended security upgrades are enabled and that you can see whether they succeed. Modern Ubuntu Server installations include unattended-upgrades by default and normally apply security updates daily, but you should confirm the configuration and monitor its logs.
- Refresh package metadata and apply available upgrades:
sudo apt update && sudo apt upgrade - Check the automatic-update package:
dpkg -s unattended-upgrades
If it is absent, install it withsudo apt install unattended-upgrades. - Inspect the automatic-updates settings: Review
/etc/apt/apt.conf.d/20auto-upgradesand/etc/apt/apt.conf.d/50unattended-upgrades. Check which package origins are allowed and whether an automatic reboot is configured. - Review update activity: Inspect files under
/var/log/unattended-upgrades/and monitor disk space so that a full filesystem does not silently prevent maintenance.
Adding a third-party repository does not mean its packages are automatically covered by Ubuntu’s security-update configuration. Check which origins are permitted before assuming updates from an outside repository will be installed.
Think of updates as a lifecycle control, not a one-time installation task. Confirm that the release is still in its maintenance window, and keep track of when that window ends. LTS releases receive five years of standard maintenance; Ubuntu Pro can extend security coverage through ESM. If a server remains in service beyond its standard coverage, make an explicit maintenance decision rather than assuming that the normal update process continues to provide the same protection.
Are unattended security upgrades safe on a production VPS?
They reduce the time a server waits for covered security fixes, but they do not remove the need for monitoring and a reboot policy. Review the configured origins and logs, and decide whether automatic reboots fit the application’s availability requirements. For a service where interruptions need coordination, plan the update and restart process rather than disabling security updates without an alternative.
There is a tradeoff between patch latency and change coordination. Daily automatic security updates reduce the interval during which known vulnerabilities remain unpatched, while a production deployment may need a defined window for restarts and application checks. Choose a policy that addresses both: identify what updates are covered, decide how required reboots are handled, and verify that the application returns after a planned restart. If you rely on managed fleet tooling instead, confirm that it provides timely security updates and useful status reporting; the tool does not remove the need to check outcomes.
How should I set up administrator accounts and SSH?
Use a named account with narrowly scoped sudo privileges for routine administration, and avoid working as root. Before changing SSH settings, prove that the intended account and authentication method work in a separate session.
Free tools Windows power users keep installed
One-click scans. No signup required.
Create and test a named administrator
Create a user for each administrator who needs access, grant only the required administrative privileges, and test a fresh login and sudo operation. Keep a tested recovery account in accordance with your organization’s access policy. Store private keys securely and rotate access when staff or systems change.
Named accounts make access easier to scope and review than routine use of a shared superuser login. Keep the number of people and systems that can administer the VPS as small as practical, and remove or rotate credentials when access is no longer needed. A recovery account should be usable when ordinary access is broken, but it should not become an excuse to skip testing the normal administrator login. Treat its credentials and any stored private keys as sensitive access material.
Harden SSH without self-lockout
- Keep the current SSH session open and confirm that provider console or rescue access is available.
- Set up the intended key or certificate for the named account, then open a second session to prove it works.
- Apply your policy for disabling password authentication and direct root login, and for limiting permitted users or groups. Ubuntu security guidance recommends disabling SSH password authentication because weak passwords are a leading cause of breaches.
- Review the installed OpenSSH configuration and any included configuration files before editing. The correct directives depend on the installed version and recovery design.
- Validate the SSH configuration with the installed platform’s syntax-test command, then reload the SSH service using the service name and method for that Ubuntu installation.
- Test a new connection again before closing the original session. If the test fails, use the still-open session or provider recovery console to undo the change.
Changing SSH to a nonstandard port can reduce routine noise in logs, but it is not a replacement for strong authentication, account controls, or a firewall. If you change the port, update the host and provider firewall rules together and confirm the new path before disconnecting.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
SSH security has several separate parts: identity, authentication, and network exposure. A key or certificate helps avoid reliance on weak passwords; account and group limits reduce who is permitted to connect; firewall rules limit where connections can come from. A port change only changes the connection endpoint and does not provide those controls by itself. The right cryptographic directives depend on the OpenSSH version in use, so avoid copying a supposedly universal configuration without checking compatibility and recovery access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do I configure UFW without locking myself out?
UFW is Ubuntu’s default firewall frontend and starts disabled. Add and verify the necessary access rules before enabling it; the correct allowlist depends on your application, administrator networks, IPv6 use, and provider firewall.
- Inventory required connections. Identify the SSH port and approved source networks, application ports that must be publicly reachable, and any private service traffic. Check provider security groups or equivalent network controls too.
- Add the management rule first. Where practical, restrict SSH to trusted administrative networks instead of allowing it from everywhere.
- Add only required application rules. A web application might need HTTP and HTTPS; a different workload may need different ports. Do not add a port simply because an example uses it.
- Review the rules before activation:
sudo ufw status numbered - Enable UFW, then inspect its state:
sudo ufw enablesudo ufw status verbose - Test from a new connection. Keep the original session open until you have confirmed both administrative access and the required application paths.
For example, this is a pattern—not a safe copy-and-paste policy for every VPS:
sudo ufw allow from ADMIN_CIDR to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status numberedReplace ADMIN_CIDR with the actual trusted network range and change the ports to match the service. Reconcile host rules with provider firewalls, private service networks, and IPv6. If IPv6 is enabled at the provider but not accounted for in your policy, the server may be reachable over a path you did not intend to expose.
The sequence is as important as the rule set. If SSH uses a different port, use that port in the management rule. If administrative addresses can change, make sure you have a provider console or another approved recovery path before narrowing the source range. After enabling UFW, check that it is active and inspect the numbered rules so you can identify and correct a mistaken entry. Do not close the session that enabled the firewall until a fresh connection confirms that the intended access still works.
What belongs on the public allowlist?
Only services that must accept connections from the relevant network. Allow management access from the smallest practical set of trusted sources, and allow public application ports only when the workload serves them. A port is unnecessarily open when it is exposed to an untrusted network without a need or belongs to a service no longer in use.
UFW also supports logging; turn it on when the resulting records will be reviewed and operationally useful. The firewall does not replace removing an unneeded listener or controlling access in the provider’s network layer.
Think of exposure control as two coordinated layers: UFW on the server and the provider’s network rules. A provider rule can block a connection allowed by UFW, and a permissive rule at either layer can make a service reachable when you did not intend it. The effective public surface is determined by the combined configuration, including IPv6 and any private service networks. Maintain a record of both policies so a later change to one layer does not accidentally reopen access.
Should I disable root SSH login?
For routine administration, use a named account with limited sudo access rather than logging in directly as root. Apply the direct-root-login setting only after verifying that the named administrator can log in and elevate privileges, and after confirming recovery access.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Disabling root SSH access is part of an account policy, not a reason to leave password authentication or weak credentials in place for other accounts. Use keys or certificates where the access model allows, restrict who can connect, and remove or rotate access that is no longer required.
Root access may still be needed for specific administrative tasks, but routine work should not depend on a direct root login. The safe transition is to establish and test the named administrator first, confirm its required sudo access, and only then apply the site’s SSH policy for direct root access. This avoids confusing a hardening change with an account-recovery failure.
Should I disable AppArmor or change its profiles?
Keep AppArmor enabled and retain production profiles in enforce mode unless you have a documented exception. AppArmor is installed and loaded by default on Ubuntu; its per-application profiles restrict what a program can do, helping limit the impact if a service is compromised.
Check its status with sudo aa-status. Complain mode can help while developing or troubleshooting a profile, but it reports policy violations rather than enforcing the profile’s restrictions. Do not treat it as an equivalent production setting. If an application is blocked, investigate its profile and the denied operation before disabling AppArmor system-wide.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →AppArmor provides confinement at the application level, complementing rather than replacing accounts, patching, and network restrictions. A firewall controls which connections can reach a service; an AppArmor profile restricts the capabilities and permissions of a program. Check the status of profiles for the services you operate and investigate unexpected changes. If troubleshooting requires complain mode, regard it as a diagnostic step and return the profile to enforce mode when the issue is understood.
What services and packages should I disable on a new server?
Do not remove services by guesswork. Inventory listening sockets and enabled services, then disable daemons and remove software only when you have confirmed they are not needed by the workload or system.
Review listeners and enabled services
Use tools such as sudo ss -lntup to inspect listening sockets and systemctl list-unit-files --type=service --state=enabled to review enabled services. Match each listener to an application, administrator need, or system function. A listening port is a reason to investigate, not proof that the service is unnecessary.
Remove software carefully
Minimizing packages can reduce the attack surface, but removing default packages or dependencies may break required functionality. Prefer a small, supported installation image where possible, and document why each exception is present. Before removing a package, inspect what else the package manager proposes to remove and retain a rollback path.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Use the inventory to distinguish “not needed by this workload” from “not immediately obvious.” A service may support a system function or scheduled task that is not apparent from its listening port. Check what depends on a package and what the package manager plans to change before confirming removal. This avoids turning a sensible reduction in attack surface into an outage or an installation that cannot be maintained. Repeat the inventory after adding applications, since new workloads can add listeners and services.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How do I verify that hardening is working?
Security changes are only useful if they remain observable and recoverable. Check access, firewall rules, update activity, confinement, logs, and restoration procedures as part of normal server operations.
- Access: Test a fresh SSH connection using the intended account and authentication method; do not rely only on an already-open session.
- Firewall: Review
sudo ufw status numberedandsudo ufw status verbose, then confirm the provider network policy agrees with the host policy. - Updates: Review
/var/log/unattended-upgrades/, confirm the intended origins and reboot policy, and watch disk space. - Confinement: Check
aa-statusand investigate unexpected profile changes or services that are not confined as intended. - Logs: Regularly review authentication, firewall, and automatic-update logs; centralize them if your operational design requires it.
- Recovery: Test that backups can be restored and document how to roll back a bad change or regain console access.
- Reboots: Define how updates that require a restart are handled and verify that the application returns after a planned reboot.
These checks cover different failure modes, so one green indicator is not proof that the VPS is secure. For example, a successful automatic-update run does not establish that packages from a third-party origin are covered, and a correct UFW status does not establish that the provider firewall agrees. A successful SSH connection from an existing session does not prove that a fresh login still works. Use separate checks for each layer and repeat them after meaningful configuration changes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsOperationally, assign responsibility for reviewing logs and responding to failed updates or unexpected access. Monitor disk space because package maintenance can fail when storage is exhausted. Centralizing logs can help when a server is unavailable, but the method should fit the deployment and retain the information needed for review. Backups and snapshots also have different roles: test restoration of the service and its data rather than assuming that the existence of a snapshot proves recovery will work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should I use Ubuntu Security Guide or Ubuntu Pro?
A baseline hardening checklist is useful for general security, but regulated or audited environments may need an explicit, repeatable compliance profile. Ubuntu Security Guide (USG) provides customizable CIS Benchmark and DISA-STIG profiles, with audit and apply workflows for supported releases.
Canonical’s current USG documentation lists profiles for Ubuntu 20.04, 22.04, and 24.04. Confirm that the profile version and release are eligible for your system before applying it; a profile can change system settings and should be evaluated against the application’s requirements. Ubuntu Pro is an option for extending security maintenance beyond the standard LTS period through ESM. Check current eligibility and subscription terms for your environment.
These tools address different needs: USG helps assess or apply a compliance baseline, while Ubuntu Pro extends maintenance coverage. Neither replaces an operational plan for access, firewall rules, monitoring, backups, and recovery.
Choose the assurance level to match the need. A general-purpose VPS may be served by a carefully maintained baseline and documented checks; an environment with an audit requirement may need a CIS or DISA-STIG assessment that can be repeated and evidenced. An audit workflow and an apply workflow are not the same: assess the profile’s findings and workload impact before applying changes. Check the supported release and current profile version, then plan how to validate the application after changes. Ubuntu Pro addresses lifecycle coverage beyond standard LTS maintenance; it is not itself a firewall, compliance audit, or recovery plan.
How do the main VPS hardening approaches fit together?
There is no single control that hardens every part of a VPS. Compare approaches across six practical dimensions: exposure control, identity, patch latency, confinement, assurance, and availability. Host UFW rules and provider network controls reduce exposure together. SSH keys, certificates, account scope, and any organization-required MFA address identity and authentication. Manual updates, daily unattended security upgrades, or managed fleet tooling determine how quickly covered fixes are applied. AppArmor provides per-program confinement. A baseline checklist differs from a CIS or DISA-STIG audit in the assurance it can provide. Finally, reboots, backups, rollback, and provider console access determine whether maintenance and mistakes can be handled safely.
These dimensions are complementary, not alternatives to choose one at the expense of all others. For example, a compliance profile cannot make a public listener necessary, and a strict firewall cannot patch a vulnerable package. A managed update system still needs coverage checks and operational monitoring. A narrow, reviewed policy across each dimension is more useful than optimizing one control while leaving another unexamined.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Frequently Asked Questions
Can I use UFW and my cloud provider’s firewall at the same time?
Yes. Treat them as separate layers and ensure their rules agree: a provider rule can block traffic that UFW permits, while an overly broad rule at either layer can expose a service. Keep a record of both policies so a later change does not unintentionally reopen access.
How can I tell whether an Ubuntu VPS is still receiving security updates?
Check the release and its maintenance coverage, then inspect the configured package origins and unattended-upgrades logs. A successful daily job only covers eligible origins; it does not establish that every third-party package is maintained.
Does a VPS snapshot count as a backup?
A snapshot can help roll back a change or recover a machine, but it should not be your only restoration method. Test a backup restoration and document how to bring the application and its data back into service.
Should I apply a CIS or DISA-STIG profile to every Ubuntu server?
Not automatically. Use an applicable profile when you need an auditable baseline, but review its release support and the effect of its settings on the workload before applying it. A compliance profile does not replace service-specific security and recovery controls.
Are unattended security upgrades safe on a production VPS?
They normally apply covered security updates daily on modern Ubuntu Server installations, reducing patch delay. Review allowed origins and logs, monitor available disk space, and set a reboot policy that fits the service. For planned availability windows, coordinate restarts rather than disabling updates without another timely maintenance process.
Should I change SSH to a nonstandard port to secure my VPS?
A different port may reduce routine log noise, but it is not a substitute for keys or certificates, account limits, or firewall rules. If you change it, update UFW and provider network rules together and test a fresh connection before closing your existing session.
What should I disable on a new Ubuntu server?
Do not disable services based on a generic list. Inventory listeners and enabled services, identify what each does, and remove or disable only what the workload and system do not need. Check package dependencies and the proposed removal list before proceeding.
How do I avoid locking myself out when enabling UFW?
Confirm provider recovery access, add the correct SSH rule before enabling UFW, and check that application and private-service traffic are accounted for. Keep the current session open, enable the firewall, then verify its rules and test a new login before disconnecting.
The Bottom Line
Harden in an order that preserves recovery: confirm release coverage and console access, patch the system, establish a tested named administrator, then narrow SSH and network access. Keep AppArmor enforcing, remove only verified-unused software, and routinely check update logs, firewall policies, backups, and reboot behavior. The safest policy is specific to the workload and provider, not a copied list of ports or settings.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
