Debian 12 Server Setup: Essential Post-Installation Steps

Welcome to our detailed guide on what to do after installing Debian 12 server. If you've just set up a new Debian server, you're probably wondering what steps to take next. This guide will teach you essential post installation steps for a minimal Debian 12 server installation, ensuring your server is secure, up-to-date, and ready for use.

From configuring software repositories to hardening SSH and setting up firewalls, we'll cover everything you need to get your Debian 12 server running smoothly.

Table of Contents

• 1. Configure Software Repositories
• 2. Upgrade Existing Packages
• 3. Install sudo
• 4. Create a New User and Add to sudo Group
• 5. Set Up SSH Keys (Optional)
• 6. Secure SSH
• 7. Install Essential Packages
• 8. Configure Time Synchronization
  • 8.1. Using systemd-timesyncd:
  • 8.2. Using ntp:
• 9. Set Up a Firewall
  • 9.1. Using ufw (Uncomplicated Firewall):
• 10. Enable Automatic Security Updates
• 11. Set Up Fail2Ban (Optional)
• 12. Additional Configuration
• 13. Reboot the System

1. Configure Software Repositories

If this is a new minimal Debian installation, you should configure the software repositories.

Edit the /etc/apt/sources.list file:

nano /etc/apt/sources.list

Replace the contents with the following (or ensure they are present):

deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware

deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware

deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

Save and close the file.

Update the package list to ensure you have the latest information about available packages.

apt update

2. Upgrade Existing Packages

Upgrade the existing packages to their latest versions.

apt upgrade -y
apt full-upgrade -y

3. Install sudo

sudo is not installed in the minimal Debian installation. Since you don't have sudo access, you'll need to install it as the root user.

apt install sudo -y

4. Create a New User and Add to sudo Group

Create a new user and add them to the sudo group.

adduser ostechnix
usermod -aG sudo ostechnix

Replace ostechnix with your actual username.

Once a new user is created, switch to the new user account.

su - ostechnix

Again, replace the username with your own.

Test that the new user has sudo access by running a command with sudo.

sudo -v

For more details, check the following guide:

• How To Add, Delete, And Grant Sudo Privileges To Users In Debian 12

5. Set Up SSH Keys (Optional)

If you want to use SSH keys for authentication, follow these steps.

On your local machine, generate an SSH key pair:

ssh-keygen

Copy the public key to your Debian server:

ssh-copy-id newusername@server_ip

Replace the username and IP address with actual values in the above command.

6. Secure SSH

Edit the SSH configuration to enhance security.

sudo nano /etc/ssh/sshd_config

Make the following changes:

• Set PermitRootLogin to no
• Set PasswordAuthentication to no (if you plan to use SSH keys)
• Set AllowUsers to specify allowed users
• Set Port to a non-default port (optional but recommended)

PermitRootLogin no
PasswordAuthentication no
AllowUsers newusername
Port 2222  # Example non-default port

Replace the username and port number with your own. Save and close the file.

Restart the SSH service:

sudo systemctl restart ssh

7. Install Essential Packages

Install some essential packages for system management and monitoring. I intend to keep a minimal Debian setup for myself, so I installed the following:

sudo apt install -y vim htop net-tools curl wget git

8. Configure Time Synchronization

Set up time synchronization using systemd-timesyncd or ntp.

8.1. Using systemd-timesyncd:

sudo apt install systemd-timesyncd
sudo timedatectl set-ntp true

Verify if the time synchronization is setup correctly by running timedatectl command:

$ timedatectl                Local time: Tue 2024-08-27 18:54:21 IST           Universal time: Tue 2024-08-27 13:24:21 UTC                 RTC time: Tue 2024-08-27 13:24:21                Time zone: Asia/Kolkata (IST,  0530)<strong>System clock synchronized: yes</strong>             <strong> NTP service: active</strong>          RTC in local TZ: no

8.2. Using ntp:

You can also configure time synchronization using ntp. To do so, run the following commands:

sudo apt install ntp -y
sudo systemctl enable ntp
sudo systemctl start ntp

9. Set Up a Firewall

This step is highly recommended if you connect your server to Internet. You should configure a firewall to restrict incoming and outgoing traffic.

9.1. Using ufw (Uncomplicated Firewall):

UFW is a command line front-end to manage iptables. It provides a framework for managing and manipulating netfilter firewall.

Run the following commands one by one to quickly setup ufw firewall, deny all incoming connections and allow only ssh connection.

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

For detailed usage about ufw, I recommend you to refer the following guide:

• How To Setup Firewall With UFW On Linux

10. Enable Automatic Security Updates

Enable automatic security updates to keep your system secure.

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

For more details, check the following guide:

• Enable Automatic Security Updates In Debian 12

11. Set Up Fail2Ban (Optional)

Install and configure monitoring like Fail2ban to prevent your servers from SSH Brute-force attacks.

sudo apt install -y fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

This is just enough for basic monitoring. For more detailed configuration, check our Fail2ban guide:

• A Comprehensive Guide to Install and Configure Fail2ban in Linux for Improved Security.

NOTE:It is usually not necessary to use Fail2Ban with sshd if only public key authentication is enabled. If you have already configured SSH key-based authentication, fail2ban is not required.

12. Additional Configuration

You should have set these during the installation. If you want to set up different values, you can do so.

• Network Configuration:Review and configure network settings if necessary.
• Hostname:Set a meaningful hostname.
• DNS:Configure DNS settings in/etc/resolv.conf.

13. Reboot the System

Finally, reboot your system to apply all changes.

sudo reboot

By following these steps, you will have configured your software repositories, installed sudo, created a new user with sudo access, and set up your system with essential security and management tools.

Did I miss any steps in Debian 12 server post installation? Please share your inputs via the comment section below. I will test them and update the guide accordingly.

Related Read:

• DebPostInstall: Debian And Ubuntu Server Post Install Script

The above is the detailed content of Debian 12 Server Setup: Essential Post-Installation Steps. For more information, please follow other related articles on the PHP Chinese website!