Debian 12 (Bookworm) is a popular choice for servers due to its stability, long-term support, and minimal footprint. This guide walks you through essential post-provisioning setup steps on your Data Mammoth Debian 12 server, including user creation, SSH hardening, firewall configuration, and system updates.

Prerequisites

• A newly provisioned Data Mammoth Debian 12 server.
• Root credentials or an SSH key configured during provisioning.
• An SSH client on your local machine.

Step 1 — Connect to Your Server

ssh [email protected]

Accept the fingerprint and enter your root password or use your SSH key.

Step 2 — Update the System

apt update && apt upgrade -y

This updates the package lists and installs the latest versions of all installed packages, including security patches.

Step 3 — Create a Non-Root User

adduser deploy

Follow the prompts to set a password. Then install sudo (Debian does not always include it by default) and grant the user sudo access:

apt install sudo -y
usermod -aG sudo deploy

Test the user:

su - deploy
sudo whoami

Expected output: root. Type exit to return to root.

Step 4 — Set Up SSH Key Authentication

From your local machine:

ssh-copy-id [email protected]

Or configure manually on the server:

su - deploy
mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste your public key, save, and set permissions:

chmod 600 ~/.ssh/authorized_keys
exit

Verify by logging in from your local machine:

ssh [email protected]

See Managing SSH Keys for more details.

Step 5 — Harden SSH Configuration

sudo nano /etc/ssh/sshd_config

Apply these settings:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 5
LoginGraceTime 60

Restart SSH:

sudo systemctl restart sshd

Important: Test your new user login in a separate terminal before closing the current session. Use the web console if you get locked out.

Step 6 — Configure the Firewall (UFW or nftables)

Option A: UFW (Recommended for Simplicity)

Install and configure UFW:

sudo apt install ufw -y
Allow SSH
sudo ufw allow OpenSSH
Enable the firewall
sudo ufw enable
Check status
sudo ufw status verbose

For web servers, add HTTP and HTTPS:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Option B: nftables (Advanced)

Debian 12 uses nftables as the default firewall backend. For advanced users, configure nftables directly:

sudo nano /etc/nftables.conf

A basic configuration that allows SSH, HTTP, and HTTPS:

#!/usr/sbin/nft -f
flush ruleset
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif lo accept
        tcp dport 22 accept
        tcp dport 80 accept
        tcp dport 443 accept
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Apply and enable:

sudo systemctl enable nftables
sudo systemctl restart nftables

See Server Firewall Hardening Guide for advanced rules.

Step 7 — Set the Hostname

sudo hostnamectl set-hostname web01.example.com

Update /etc/hosts:

sudo nano /etc/hosts

127.0.0.1   localhost
127.0.1.1   web01.example.com web01

Verify: hostname -f

Step 8 — Configure the Timezone

sudo timedatectl set-timezone America/New_York
timedatectl

Step 9 — Enable Automatic Security Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

Select Yes to enable automatic security updates.

Verify the configuration:

cat /etc/apt/apt.conf.d/20auto-upgrades

You should see:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Step 10 — Install Essential Tools

sudo apt install -y \
  curl \
  wget \
  git \
  htop \
  net-tools \
  vim \
  fail2ban \
  software-properties-common \
  gnupg2

Configure Fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo nano /etc/fail2ban/jail.local

Add:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

sudo systemctl restart fail2ban

Step 11 — Configure Swap (Optional)

If your server has limited RAM, adding swap space can prevent out-of-memory crashes:

# Create a 2GB swap file
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
Make it permanent
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
Adjust swappiness (lower = less swapping)
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Verify:

free -h

Step 12 — Reboot

sudo reboot

Reconnect:

ssh [email protected]

Post-Setup Verification

• [ ] System is up to date: sudo apt update && apt list --upgradable
• [ ] Non-root user has sudo: sudo whoami
• [ ] SSH key login works: ssh [email protected]
• [ ] Root SSH login is disabled
• [ ] Firewall is active: sudo ufw status or sudo nft list ruleset
• [ ] Fail2ban is running: sudo systemctl status fail2ban
• [ ] Hostname is correct: hostname -f
• [ ] Timezone is correct: timedatectl
• [ ] Unattended upgrades are enabled

What to Do Next

• Installing LAMP Stack on Your VPS — Set up a web server environment.
• Installing Docker & Docker Compose — Deploy containerized apps.
• SSH Key Best Practices — Advanced SSH security tips.
• Complete Server Security Checklist — Full security hardening guide.