Debian is a popular server OS because it’s stable, predictable and supported for years. This guide covers getting Debian onto a server and the first-hour configuration every new machine should get.

1. Installing Debian

On a VPS, you don’t run the installer yourself: choose Debian in the order form or reinstall from the control panel, and you’ll receive the IP address and root password by email. Skip to step 2.

On a physical or dedicated server with the installer:

  • Download the netinst ISO from debian.org.
  • Partitioning: for most servers, “Guided – use entire disk” with all files in one partition is fine. Use LVM if you may want to resize volumes later.
  • At Software selection, untick the desktop environment and select only SSH server and standard system utilities.
  • Set a strong root password, or leave it empty to give the first user sudo rights instead.

2. Log in and update

ssh root@YOUR_SERVER_IP
apt update && apt full-upgrade -y
apt install -y sudo curl ca-certificates vim htop unattended-upgrades

Check the version: cat /etc/debian_version.

3. Set the hostname and time zone

hostnamectl set-hostname web1.example.com
timedatectl set-timezone UTC          # UTC is simplest for servers
timedatectl                           # 'System clock synchronized: yes'

Add the hostname to /etc/hosts (127.0.1.1 web1.example.com web1).

4. Create a sudo user

adduser deploy
usermod -aG sudo deploy

More on users, groups and permissions in user and permission management on Debian.

5. Switch SSH to keys

On your computer:

ssh-keygen -t ed25519
ssh-copy-id deploy@YOUR_SERVER_IP

Test the key login in a new terminal. Then on the server, disable password and root login:

cat > /etc/ssh/sshd_config.d/10-hardening.conf <<'EOF'
PermitRootLogin no
PasswordAuthentication no
EOF
sshd -t && systemctl reload ssh

Keep your current session open until you’ve confirmed you can still log in. Full details: SSH security on Debian.

6. Enable a firewall

apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80,443/tcp        # only if this is a web server
ufw enable
ufw status verbose

See Linux firewall rules for nftables and more advanced rules.

7. Automatic security updates

dpkg-reconfigure -plow unattended-upgrades

Debian then installs security updates daily. Details and email alerts: automatic security updates.

8. Add swap (small servers)

fallocate -l 2G /swapfile && chmod 600 /swapfile
mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

9. Fail2ban for SSH

apt install -y fail2ban
systemctl enable --now fail2ban
fail2ban-client status sshd

10. Check what’s listening

ss -tulpn

Anything you don’t recognize should be disabled (systemctl disable --now service) or firewalled.

Next steps

Ready to try it? Our Debian VPS plans install Debian in seconds and include a VNC console for recovery.

  • Debian
  • Linux
  • Security