Debian Server Security: A Safe Baseline for Debian 12 and 13

1. Inventory before changing policy

Confirm the release and which services are reachable. Record the current SSH port, verify your recovery console, and save a backup of the configuration you are about to edit. Do not replace an existing firewall policy without understanding its role.

cat /etc/os-release
sudo ss -lntup
sudo nft list ruleset
systemctl --failed

2. Patch from trusted repositories

sudo apt update
apt list --upgradable
sudo apt upgrade

Keep repository suites appropriate for your installed release. Mixing stable, testing, and unrelated repositories can complicate security maintenance. Review held packages and third-party software separately. Debian’s package-management reference covers package and repository administration.

3. Create and test a named sudo user

On a minimal image without sudo, install it from an existing root console first. Replace opsadmin with the administrator name you intend to use.

apt install sudo
adduser opsadmin
usermod -aG sudo opsadmin

From your workstation, install your public SSH key using ssh-copy-id -p SSH_PORT opsadmin@SERVER_IP, replacing both placeholders. Test a fresh key-based login and sudo -v before restricting root or password access.

4. Verify the effective SSH configuration

For a key-only server without keyboard-interactive MFA, the desired settings are:

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no

Place settings in the main configuration or an included snippet in the correct order. OpenSSH normally takes the first value for a directive, and Match blocks can change the result for particular connections. The Debian SSH configuration manual is the reference for these semantics.

sudo /usr/sbin/sshd -t
sudo /usr/sbin/sshd -T | grep -E "^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin) "

Only after the checks pass, reload ssh.service. Test from a new terminal, keeping the old one open. If login fails, restore the previous snippet through the console and validate again. Do not blindly remove authentication methods required by your organization.

5. Choose one firewall manager

Debian supports nftables. On a simple VPS, UFW is also an approachable front end. If nftables, Docker, a hosting panel, or another tool already manages rules, adapt that existing policy rather than adding a competing manager. The following is for a fresh host choosing UFW:

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Replace 22 with the port already used by SSH.
sudo ufw allow 22/tcp
# Add the other ports your workload needs before enabling.
sudo ufw enable
sudo ufw status verbose

For a web server, explicitly allow TCP 80 and 443. Check IPv6 as well as IPv4, and test a second SSH connection before tightening source ranges. Debian’s UFW manual documents matching and rule commands.

6. Make updates and recovery observable

sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
sudo unattended-upgrade --dry-run --debug

Inspect allowed origins in /etc/apt/apt.conf.d/50unattended-upgrades, verify that periodic updates are enabled, and review logs after a run. The Debian package documentation describes its purpose. Automatic updates are not a substitute for checking failed jobs, scheduling required reboots, and testing restoration of both database and file backups.