Debian server
Table of Contents
1. Description
Setting up the base of a new Debian server.
2. Connect to the server (ssh)
2.1. First connection
First, make sure you can connect to the server.
ssh alan@192.168.0.127 [-p PORT]
⚠️ If the remote user is root, see #admin-user to create a new user
to login with instead of root.
2.2. Add configuration in ~/.ssh/config
Comment out the Port and IdentitiesOnly keywords for now until the
server is configured.
Host framboise User alan Hostname 192.168.0.127 # Port 13827 # IdentitiesOnly yes IdentityFile /home/alan/.ssh/framboise_id_ed25519
2.3. Generate a new key pair with ssh-keygen
ssh-keygen -f ~/.ssh/framboise_id_ed25519 -C "alan@$hostname to alan@framboise"
2.4. Copy the newly generated key pair with ssh-copy-id
This will copy the content of the file framboise_id_ed25519.pub to
~/.ssh/authorized_keys on the remote framboise.
ssh-copy-id -i ~/.ssh/framboise_id_ed25519.pub framboise
2.5. First connection with key based authentication
ssh framboise
3. Configure the OpenSSH server (sshd)
Copy and edit this configuration template to
/etc/ssh/sshd_config.d/00-framboise.conf.
Once its done, restart the service.
systemctl restart ssh
Update the Port configuration in ~/.ssh/config if needed.
Follow the logs on the server with journalctl and in another
terminal window, make sure you can still login.
journalctl -fu ssh
4. Configure the firewall (ufw)
See notes:ufw
4.1. Install the package
apt install ufw
4.2. Explicitly deny incoming traffic by default
ufw default deny incoming
4.3. Allow incoming traffic to the sshd port
ufw allow proto tcp from any to any port <SSHD_PORT>
4.4. Start the service on boot
Make sure the service will start on boot (services should be enabled by default on Debian based systems).
systemctl enable ufw
4.5. Enable the firewall
⚠️ This may drop existing ssh connections (see REMOTE_MANAGEMENT in the manpage) so it might help to have an extra terminal window connected to the server.
ufw enable
5. Configure the package manager (apt)
5.1. Periodic updates
See notes:apt#periodic-updates to configure apt for periodic
updates.
5.2. Unattended upgrades
See notes:unattended-upgrades for installing updates automatically
every n days.
6. (optional) Create a new user account with admin privileges
This might not be needed if the server has an admin user account already configured.
[navigation: Back to #connect-to-the-server]
6.1. Create user
See notes:useradd
useradd -m -G adm -s /bin/bash alan
6.2. Change user password
See notes:passwd
passwd alan
6.3. Execute commands as another user
Choose between doas and sudo to execute commands as another user,
do not install both.
6.3.1. Install and configure doas
See notes:doas for more information.
apt install doas
Add the following line in /etc/doas.conf.
permit alan as root
6.3.2. Install and configure sudo
See notes:sudo
apt install sudo
Add user to the sudo group (see notes:usermod).
usermod -aG sudo alan
7. General configuration
7.1. Check for any unwanted open ports
ss -taup
7.2. Lock the root account password
See notes:passwd and #admin-user.
passwd --lock root
7.3. Install common packages
See list of common packages.
apt install bash-completion fzf git man-db ncdu rsync tmux vim
7.4. Hostname
hostnamectl set-hostname framboise
Might need to edit /etc/hostname and /etc/hosts.
Example of /etc/hosts content:
127.0.0.1 localhost 127.0.1.1 framboise.localhost framboise
7.5. Locales
Reconfigure the locales package with dpkg-reconfigure(8) to generate
new locales.
dpkg-reconfigure locales
7.6. Timezone
timedatectl set-timezone Europe/Paris
7.7. System clock synchronization
apt install systemd-timesyncd
You can check the changes with the timedatectl command.
8. Upgrade packages and reboot
apt update apt upgrade reboot