Initial Server Setup for Debian 13

This guide walks you through every essential step after launching a fresh Debian 13 (Trixie) Cloud VPS — from system updates and user creation through installing a complete LEMP or LAMP web server stack. Debian is known for its rock-solid stability, minimal footprint, and extensive package repositories. Like Ubuntu, it uses apt for package management and supports UFW for firewall management. Where dedicated documentation already exists for a topic, we link directly to it so you can dive deeper without duplicated information.

1. System Updates

After your first SSH login, update the package index and upgrade all installed packages to their latest versions:

apt update && apt upgrade -y

Debian minimal images may not include common utilities. Install essential tools:

apt install curl wget gnupg2 software-properties-common apt-transport-https ca-certificates lsb-release -y

If a kernel update was installed, reboot to load it:

reboot

2. Hostname & Timezone

Setting a proper hostname and timezone is important for logging, scheduled tasks, and SSL certificates. We have a dedicated guide covering both topics in detail:

Quick reference:

# Set the hostname
hostnamectl set-hostname your-server.example.com

# Set timezone to UTC (recommended for servers)
timedatectl set-timezone UTC

# Verify
hostnamectl
timedatectl

3. Create a Sudo User

Running everything as root is a security risk. Create a regular user with sudo privileges. Note that Debian does not install sudo by default on minimal images — install it first:

# Install sudo if not present
apt install sudo -y

# Create a new user (replace 'deploy' with your preferred username)
adduser deploy

# Add the user to the sudo group
usermod -aG sudo deploy

Copy your SSH key to the new user so you can log in without a password:

# As root, copy the authorized_keys file
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

Test the new user before proceeding — open a new terminal and connect:

ssh deploy@YOUR_SERVER_IP

4. SSH Hardening

Once your sudo user is working, harden SSH by disabling root login and password authentication:

sudo nano /etc/ssh/sshd_config

Find and update these settings:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart ssh

5. Firewall Setup (UFW)

Debian does not ship with UFW pre-installed, but it's the simplest firewall frontend for iptables/nftables. Install it and allow only the ports you need:

# Install UFW
sudo apt install ufw -y

# Allow SSH (always do this first!)
sudo ufw allow OpenSSH

# Allow HTTP and HTTPS for web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Verify status
sudo ufw status verbose

6. Swap Space

Adding swap space provides a safety net when your applications temporarily exceed available RAM. This is especially useful on smaller instances.

Quick setup for a 2 GB swap file:

# Create a 2G swap file
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# Make it permanent
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# Verify
free -h

7. Automatic Security Updates

Keeping your server patched against known vulnerabilities is critical. Debian supports unattended-upgrades just like Ubuntu.

Quick-start for Debian 13:

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure -plow unattended-upgrades

8. LEMP Stack (Nginx + MariaDB + PHP)

The LEMP stack uses Nginx as the web server, MariaDB as the database (the default DB on Debian), and PHP for server-side processing. It's the most popular stack for WordPress, Laravel, and other PHP applications.

8a. Install Nginx

sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx

Verify Nginx is running by visiting http://YOUR_SERVER_IP — you should see the default Nginx welcome page.

8b. Install MariaDB

sudo apt install mariadb-server -y
sudo systemctl enable mariadb

Run the security script to set a root password and remove insecure defaults:

sudo mysql_secure_installation

Recommended answers: set a strong root password, switch to unix_socket authentication (n if you want password auth), remove anonymous users (Y), disallow remote root login (Y), remove test database (Y), and reload privilege tables (Y).

8c. Install PHP

Debian 13 ships with PHP 8.4 in its repositories. Install PHP-FPM and common extensions:

sudo apt install php-fpm php-mysql php-cli php-curl php-gd php-mbstring php-xml php-zip -y

Verify the PHP version and check that php-fpm is running:

php -v
sudo systemctl status php8.4-fpm

8d. Configure an Nginx Virtual Host

Create a server block for your domain. Replace example.com with your actual domain:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/html;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }
}

# Create the web root
sudo mkdir -p /var/www/example.com/html
sudo chown -R www-data:www-data /var/www/example.com

# Save the config above to:
sudo nano /etc/nginx/sites-available/example.com

# Enable it
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

# Test and reload
sudo nginx -t
sudo systemctl reload nginx

8e. Test PHP Processing

echo '<?php phpinfo(); ?>' | sudo tee /var/www/example.com/html/info.php

Visit http://example.com/info.php. If you see the PHP info page, your LEMP stack is working. Delete this file afterward — it exposes sensitive configuration details:

sudo rm /var/www/example.com/html/info.php

9. LAMP Stack (Apache + MariaDB + PHP)

The LAMP stack uses Apache instead of Nginx. Choose LAMP if your application relies on .htaccess files or Apache-specific modules. If you already installed Nginx in Step 8, skip this section — running both web servers on the same ports will cause conflicts.

9a. Install Apache

sudo apt install apache2 -y
sudo systemctl enable apache2
sudo systemctl start apache2

Verify Apache is running by visiting http://YOUR_SERVER_IP.

9b. Install MariaDB

The MariaDB installation is the same as in the LEMP stack above (Step 8b).

sudo apt install mariadb-server -y
sudo systemctl enable mariadb
sudo mysql_secure_installation

9c. Install PHP for Apache

Apache uses libapache2-mod-php instead of php-fpm:

sudo apt install php libapache2-mod-php php-mysql php-cli php-curl php-gd php-mbstring php-xml php-zip -y

9d. Configure an Apache Virtual Host

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com/html

    <Directory /var/www/example.com/html>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
    CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
</VirtualHost>

# Create web root
sudo mkdir -p /var/www/example.com/html
sudo chown -R www-data:www-data /var/www/example.com

# Save the config above to:
sudo nano /etc/apache2/sites-available/example.com.conf

# Enable site and mod_rewrite
sudo a2ensite example.com.conf
sudo a2enmod rewrite
sudo a2dissite 000-default.conf

# Test and reload
sudo apache2ctl configtest
sudo systemctl reload apache2

9e. Test PHP Processing

echo '<?php phpinfo(); ?>' | sudo tee /var/www/example.com/html/info.php
# Visit http://example.com/info.php, then remove:
sudo rm /var/www/example.com/html/info.php

10. SSL Certificates

Once you have a domain pointed at your server and a web server running, add free SSL/TLS certificates from Let's Encrypt using Certbot. Our dedicated guide covers everything in detail:

Quick-start:

# For Nginx
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com

# For Apache
sudo apt install certbot python3-certbot-apache -y
sudo certbot --apache -d example.com -d www.example.com

# Verify auto-renewal
sudo certbot renew --dry-run

Next Steps

Your Debian 13 server is now secured, updated, and running a full web server stack. Here are some recommended next steps depending on what you plan to deploy: