A minimal Debian server checklist

debian 13 / published / guide #41 / ≈ 3 min read

You just installed Debian on a VPS or a home server. There's no desktop, no graphical anything — just a login prompt. This is the end-to-end checklist for getting from "boots" to "production-ready" without anything fancy. Every step links back to a more thorough guide if you want depth; here, we're aiming for the right thing, fast.

The five things every Debian server should have

  1. A non-root user with sudo.
  2. SSH login by key only, not password.
  3. Automatic security updates.
  4. A firewall blocking everything you didn't explicitly open.
  5. A working clock (NTP) and a sensible hostname.

If you've done those five, you're ahead of most servers on the internet.

Step 1: create a user

You're probably logged in as root over SSH. Make a normal user:

adduser alice
usermod -aG sudo alice

adduser walks you through setting a password and filling in optional details (just press Enter to skip). The -aG sudo adds the user to the sudo group.

Step 2: switch SSH from password to key

From your laptop (not the server), if you don't already have a key:

ssh-keygen -t ed25519

Copy it up:

ssh-copy-id alice@your-server-ip

Test it works:

ssh alice@your-server-ip

Should let you in without asking for a password. Don't close this session. Open a second SSH session in another terminal as a safety net.

Back on the server, edit sshd config:

sudo nano /etc/ssh/sshd_config

Set or change these lines:

PasswordAuthentication no
PermitRootLogin no

Reload SSH (this doesn't drop existing connections):

sudo systemctl reload sshd

Try opening a third SSH session from your laptop. If it works, password auth is officially off and you're still in. If it doesn't, you have two existing sessions to fix the config from.

Step 3: enable automatic security updates

sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Answer Yes to enable. (Full details in the unattended-upgrades properly guide.)

Step 4: a firewall, minimally

The friendliest firewall on Debian is ufw (Uncomplicated Firewall) — a wrapper around the same nftables underneath:

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH                # short for "tcp port 22"
sudo ufw enable

That last command will warn that SSH may disconnect. Type y. Open SSH stays open (you're using it); only new rules apply.

For a web server, also:

sudo ufw allow http     # port 80
sudo ufw allow https    # port 443

Check what's open:

sudo ufw status verbose

Step 5: clock and hostname

sudo timedatectl set-timezone Europe/Oslo
timedatectl                              # confirm
sudo hostnamectl set-hostname caribou
sudo nano /etc/hosts                     # ensure 127.0.0.1 line includes "caribou"

NTP (network time) is on by default via systemd-timesyncd. Confirm with timedatectl — look for NTP service: active.

The "you might want this too" list

sudo apt install fail2ban           # auto-bans IPs that hammer ssh
sudo apt install tmux git rsync htop  # daily comforts
sudo apt install logwatch           # daily email summary of what happened
sudo apt install needrestart        # warns when a service should be restarted after upgrades

fail2ban in particular is worth its install size — it watches /var/log/auth.log, and after a few failed SSH attempts from an IP it adds a temporary firewall block. Defaults are sensible. Just install and it works.

The "what about backups" question

If you remember nothing else: set up something that copies your important data off this machine. A VPS that fails and a backup you never made is the worst feeling. Even a nightly rsync to a different VPS is better than nothing.

See the rsync without losing data guide. A typical cron line:

30 3 * * * rsync -a --delete /home/alice/ backupuser@backuphost:/backups/caribou/home/alice/

The done check

Run these and read the output:

id                          # confirm you're in the sudo group
ssh -o PasswordAuthentication=yes alice@your-server-ip      # should NOT let you in
sudo ufw status                                              # rules look right?
systemctl status unattended-upgrades
systemctl --failed                                            # nothing in red?

If all five look good, this server is ready for whatever you're going to put on it.

← back to index