Install Debian minimal server

What you will achieve

A lean Debian server install with SSH, sudo, and only the packages you actually need — ideal for VPS-style workloads, homelab hosts, and containers-on-metal.

1) Download and verify the netinst ISO

Grab the Debian netinst image from debian.org/CD/netinst. For servers, amd64 netinst is the usual choice. Verify the checksum:

sha256sum debian-12.*-amd64-netinst.iso
# compare against SHA256SUMS from the mirror

2) Boot the installer and choose guided vs manual

1. At "Partition disks", pick Guided — use entire disk for a dedicated server, or manual if you need separate /var or RAID.
2. When asked for software selection, uncheck Desktop environment. Tick only SSH server and standard system utilities.
3. Set root password or skip root login (Debian can create a sudo user instead — preferred).

3) First boot: update and harden basics

sudo apt update && sudo apt full-upgrade -y
sudo apt install sudo curl vim-tiny ufw fail2ban
sudo ufw allow OpenSSH
sudo ufw enable

On RHEL-family systems the equivalent is a minimal @core install via Anaconda — different package manager (dnf), same principle: no GUI, enable SSH, patch immediately.

4) Optional: convert to unattended security updates

sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Verify

uname -a
systemctl is-active ssh
dpkg -l | wc -l

You should see a small package count (hundreds, not thousands), SSH active, and a current kernel after reboot if the installer pulled one.

5) Configure static networking (servers without DHCP)

If your VPS panel or hypervisor assigns a static IP, use netplan on Ubuntu-derived installs or classic /etc/network/interfaces on pure Debian:

# /etc/network/interfaces.d/eth0
auto eth0
iface eth0 inet static
    address 192.168.1.50/24
    gateway 192.168.1.1
    dns-nameservers 1.1.1.1

sudo systemctl restart networking

6) Locale, timezone, and NTP

sudo timedatectl set-timezone Europe/London
sudo timedatectl set-ntp true
sudo dpkg-reconfigure locales

Wrong timezone skews log correlation and TLS certificate validation in distributed setups.

7) SSH hardening immediately after install

sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Only disable password auth after confirming your SSH key works in a second session.

Troubleshooting installer issues

• Firmware missing for Wi‑Fi or NIC — load non-free firmware during install or use wired Ethernet for first boot, then apt install firmware-*.
• Installer cannot see disk — check SATA/NVMe mode in BIOS; RAID may need mdadm or vendor drivers.
• Mirror slow or failing — pick a geographically close Debian mirror during install or edit /etc/apt/sources.list post-install.

Related guides

• Install Fedora Workstation
• Dual-boot Linux and Windows