Debian new server baseline

Purpose

Bring a fresh Debian server to a predictable operational baseline before exposing services.

Requirements

• Console or provider recovery access.
• A non-root administrator account.
• SSH key already tested from the operator workstation.

Commands

sudo apt update
sudo apt full-upgrade
sudo adduser matteo
sudo usermod -aG sudo matteo
sudo timedatectl set-timezone Europe/Rome

Config files

/etc/ssh/sshd_config.d/10-baseline.conf

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Checks

sudo sshd -t
ssh matteo@example-server
sudo systemctl status ssh

Rollback

Keep the original SSH session open. Remove the drop-in file, validate with sudo sshd -t, and reload SSH if key login fails.

Related notes

• Hardening SSH on Debian