---
tags:
  - Server
  - Security
---
# **Initial Server Setup with Debian-Based Distributions**

Setting up a new Debian-based server (e.g., **Debian**, **Ubuntu**, or **Linux Mint**) is the foundation of a secure and efficient system. This guide walks you through the essential steps I follow to establish a secure and functional environment, ensuring long-term stability and reliability.

---

## **Why Initial Server Setup Matters**

Properly configuring a server during its initial setup is crucial to:

- **Enhance Security**: Protect against unauthorized access.
- **Ensure Reliability**: Lay the groundwork for stable and efficient operations.
- **Save Time**: Avoid future headaches by configuring the server correctly upfront.

---

## **Logging in as Root**

Many Debian-based distributions disable direct `root` SSH access for security. If root login is allowed or you're accessing the server via the console, log in as the root user:

```bash
ssh root@<your-server-ip>
```

For cloud-based servers, you might need to log in with a default user like `ubuntu` or `debian`.

---

## **Secure Password Update**

Immediately update the root password (if root login is enabled):

```bash
passwd
```

If you’re using a default user, update its password as well:

```bash
sudo passwd
```

---

## **Creating a New User**

Using `root` for daily operations is discouraged. Create a new user for regular use:

```bash
adduser username
```

This prompts you to set a password and optional user details.

---

## **Granting Administrative Privileges**

To allow the new user to execute administrative tasks, add them to the `sudo` group:

```bash
usermod -aG sudo username
```

If `sudo` is not installed (common on Debian minimal installs):

```bash
apt install sudo
```

Test the configuration by switching to the new user:

```bash
su - username
sudo apt update
```

---

## **Configuring SSH**

### **Setting Up SSH Keys**

SSH keys offer better security than passwords. Generate an SSH key pair on your local machine:

```bash
ssh-keygen
```

Copy the public key to the server:

```bash
ssh-copy-id username@<your-server-ip>
```

Alternatively, manually upload the key to the server:

```bash
cat ~/.ssh/id_rsa.pub | ssh username@<your-server-ip> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
```

### **Secure SSH Configuration**

Edit the SSH configuration file to improve security:

```bash
sudo nano /etc/ssh/sshd_config
```

Update the following settings:

- Disable root login:
    
    ```none
    PermitRootLogin no
    ```
    
- Disable password authentication if SSH keys are configured:
    
    ```none
    PasswordAuthentication no
    ```
    
- Allow only specific users (optional):
    
    ```none
    AllowUsers username
    ```
    

Restart the SSH service:

```bash
sudo systemctl restart ssh
```

---

## **Setting Up a Firewall**

Use **UFW** (Uncomplicated Firewall) to secure your server:

1. Install UFW if it’s not already present:
    
    ```bash
    sudo apt install ufw
    ```
    
2. Allow SSH connections:
    
    ```bash
    sudo ufw allow OpenSSH
    ```
    
3. Enable the firewall:
    
    ```bash
    sudo ufw enable
    ```
    
4. Check the status:
    
    ```bash
    sudo ufw status
    ```
    

Add rules for other services as needed (e.g., HTTP/HTTPS):

```bash
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```

---

## **Regular Updates and Maintenance**

### **Keep the System Updated**

Update and upgrade the system regularly:

```bash
sudo apt update && sudo apt upgrade -y
```

### **Monitor Disk Usage**

Check disk usage to avoid running out of space:

```bash
df -h
```

### **Check Logs**

Review system logs for unusual activity:

```bash
sudo journalctl -xe
```

### **Install Monitoring Tools**

Install tools like `htop` for performance monitoring:

```bash
sudo apt install htop
htop
```

---

## **Testing the Configuration**

1. Log out of the root account:
    
    ```bash
    exit
    ```
    
2. Log back in using the new user:
    
    ```bash
    ssh username@<your-server-ip>
    ```
    

Verify that:

- You can log in using SSH keys.
- Root login is disabled.
- Password authentication is disabled (if configured).
- Firewall rules allow necessary services.

---

## **Optional Enhancements**

- **Enable Automatic Updates**:  
    Install and configure `unattended-upgrades` for automatic security updates:
    
    ```bash
    sudo apt install unattended-upgrades
    sudo dpkg-reconfigure --priority=low unattended-upgrades
    ```
    
- **Install Fail2Ban**:  
    Protect against brute-force attacks:
    
    ```bash
    sudo apt install fail2ban
    ```
    

---

## **Conclusion**

This guide ensures your Debian-based server is secure, stable, and ready for application deployment. By following these steps, you establish a solid foundation for further customization and management, whether you're running a personal project or a production service.

**Next Steps**:

- Configure and deploy specific applications.
- Set up automated backups.
- Explore monitoring and logging tools.

Happy administering!

---

Return to the [Table of Contents](https://wiki.kitpro.us/table-of-contents) for more guides and tutorials.