Initial server setup checklist on Debian

A freshly provisioned Debian VPS is deliberately minimal – that’s Debian’s whole philosophy. It also means there’s a short list of things worth doing before you deploy anything on it. This checklist covers the essentials for a Debian 13 “trixie” (or 12 “bookworm”) server, in the order we’d recommend doing them.

1. Update the system

Log in as root (or whichever account your provider gave you) and bring the package lists and installed packages up to date first, before anything else:

apt update && apt upgrade -y

If you’re unfamiliar with apt, our guide to managing packages with apt covers the difference between update, upgrade, and full-upgrade in more detail.

2. Create a non-root sudo user

You shouldn’t do your day-to-day work, or leave SSH open, as root. A minimal Debian install often doesn’t have sudo installed at all, so check for it and install it first if needed:

apt install sudo

Then create a new user and add them to the sudo group:

adduser yourusername
usermod -aG sudo yourusername

Log out and back in as that user, then confirm sudo access works with sudo whoami – it should print root. We go into this in more depth, including why Debian ships this way, in Creating a new sudo user on Debian.

3. Secure SSH

Before you lock anything down, make sure you can log in as your new sudo user over SSH first – ideally with an SSH key rather than a password. Copy your public key across (from your local machine):

ssh-copy-id yourusername@your-server-ip

Once key-based login is confirmed working, edit /etc/ssh/sshd_config on the server and set:

PermitRootLogin no
PasswordAuthentication no

Then restart the SSH service:

systemctl restart ssh

Keep your current SSH session open until you’ve verified you can open a fresh connection as your sudo user – if something’s misconfigured, you don’t want to be locked out.

4. Set the hostname and timezone

A sensible hostname makes logs and prompts easier to read, especially once you’re managing more than one server:

hostnamectl set-hostname your-server-name

Set the timezone so log timestamps match what you expect – UK-based servers usually want:

timedatectl set-timezone Europe/London

Many admins prefer to leave servers on UTC to avoid daylight-saving confusion in logs – either is fine, just be consistent across your infrastructure.

5. Set up a basic firewall

Debian’s underlying firewall framework is nftables, but for a straightforward VPS, ufw (Uncomplicated Firewall) is a simpler front end for the same thing and is what we’d recommend if you just need to allow SSH, HTTP, and HTTPS. Install and enable it:

apt install ufw
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Double-check the SSH rule is in place before enabling – ufw allow OpenSSH covers the default port 22. If you’ve changed SSH to a non-standard port, allow that port number explicitly instead. Check status any time with ufw status verbose.

If you’d rather work with nftables directly – useful if you need more complex rules later – that’s a reasonable choice too, but ufw is the more approachable starting point for most setups.

6. Enable automatic security updates

An unmanaged VPS doesn’t patch itself unless you tell it to. Debian’s unattended-upgrades package applies security updates automatically in the background:

apt install unattended-upgrades apt-listchanges
dpkg-reconfigure --priority=low unattended-upgrades

Answer “yes” to the prompt, which enables the daily cron-style timer and turns on automatic installation of security updates. You can review exactly what’s covered in /etc/apt/apt.conf.d/50unattended-upgrades – by default it applies updates from the Debian security archive.

That’s the baseline

None of this is exotic – it’s the same handful of steps most sysadmins run through on any fresh Debian box. Once it’s done, you’ve got a server that’s reasonably hardened, patches its own security issues, and is ready for whatever you’re actually deploying.