Securing Debian Servers: A Practical Checklist

Securing Debian Servers: A Practical Checklist

Securing a Debian server is one of the most important responsibilities for any developer or system administrator. Whether you are deploying a small web application or managing a fleet of production servers, a hardened Debian installation reduces your attack surface and protects sensitive data from unauthorized access. This tutorial walks you through a practical, step-by-step checklist to secure a Debian server from the ground up.

Why Server Security Matters

Every server connected to the internet is a potential target. Automated bots continuously scan public IP addresses for common vulnerabilities such as weak SSH credentials, open ports, and outdated software. A single compromised server can lead to data breaches, service downtime, ransomware infections, and even use of your infrastructure to attack others. By following a consistent hardening checklist, you dramatically reduce the likelihood of successful attacks and make your systems easier to audit and maintain.

1. Update and Upgrade the System

The first step in securing any Debian server is ensuring all installed packages are up to date. Security patches are released regularly by the Debian security team, and applying them closes known vulnerabilities.

sudo apt update
sudo apt upgrade -y
sudo apt full-upgrade -y
sudo apt autoremove -y

To enable automatic security updates, install the unattended-upgrades package:

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure -plow unattended-upgrades

Verify the configuration file at /etc/apt/apt.conf.d/50unattended-upgrades to ensure the security origin is enabled:

Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

2. Create a Non-Root User

Running services and performing daily tasks as the root user is dangerous because any command executed has full system privileges. Instead, create a dedicated user with sudo access.

sudo adduser deployuser
sudo usermod -aG sudo deployuser

Switch to the new user and verify sudo access:

su - deployuser
sudo whoami

3. Secure SSH Access

SSH is the primary entry point to most servers, making it a common target for brute-force attacks. Harden your SSH configuration by editing /etc/ssh/sshd_config.

sudo nano /etc/ssh/sshd_config

Apply the following settings:

# Disable root login
PermitRootLogin no

# Disable password authentication
PasswordAuthentication no

# Limit to specific users
AllowUsers deployuser

# Change the default port (optional but recommended)
Port 2222

# Disable empty passwords
PermitEmptyPasswords no

# Limit authentication attempts
MaxAuthTries 3

# Disable X11 forwarding if not needed
X11Forwarding no

Before restarting SSH, set up key-based authentication for your new user:

# On your local machine
ssh-keygen -t ed25519 -C "deployuser@server"
ssh-copy-id -p 2222 deployuser@your_server_ip

Test the new connection in a separate terminal before closing your current session, then restart SSH:

sudo systemctl restart ssh

4. Configure a Firewall

A firewall controls incoming and outgoing network traffic based on rules. Debian includes nftables by default, but UFW (Uncomplicated Firewall) provides a simpler interface.

sudo apt install ufw -y

Configure default policies and allow only necessary services:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw enable
sudo ufw status verbose

Always allow your custom SSH port before enabling the firewall, otherwise you will lock yourself out.

5. Install Fail2Ban

Fail2Ban monitors log files and temporarily bans IP addresses that show malicious behavior, such as repeated failed SSH login attempts.

sudo apt install fail2ban -y

Create a local configuration file to override defaults:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Configure the SSH jail to match your custom port:

[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
findtime = 600

Restart and verify the service:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban
sudo fail2ban-client status sshd

6. Disable Unnecessary Services

Every running service is a potential attack vector. List all listening services and disable anything you do not need.

sudo ss -tulpn

Disable unwanted services, for example:

sudo systemctl disable avahi-daemon
sudo systemctl stop avahi-daemon
sudo apt purge avahi-daemon -y

7. Secure Shared Memory

The /dev/shm partition allows shared memory access and can be exploited in certain attacks. Restrict it by editing /etc/fstab:

sudo nano /etc/fstab

Add the following line:

tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0

Remount immediately:

sudo mount -o remount /dev/shm

8. Enable AppArmor

AppArmor is a mandatory access control system that confines individual programs to a set of listed capabilities. Debian enables it by default, but you should verify:

sudo apparmor_status

If it is not running, enable and start it:

sudo systemctl enable apparmor
sudo systemctl start apparmor

Install additional profiles for common services:

sudo apt install apparmor-profiles apparmor-utils -y

9. Configure Automatic Security Audits

Install lynis, a popular open-source security auditing tool, to regularly assess your server configuration:

sudo apt install lynis -y
sudo lynis audit system

Review the report at /var/log/lynis.log and address any warnings or suggestions. You can schedule audits via cron:

sudo crontab -e

Add a weekly audit:

0 3 * * 0 /usr/sbin/lynis audit system --quiet

10. Enable Process and Login Accounting

Tracking who logs in and what commands they run is essential for incident response. Install accounting utilities:

sudo apt install acct auditd -y
sudo systemctl enable auditd
sudo systemctl start auditd

View recent logins:

last
lastb

Auditd logs security-relevant events to /var/log/audit/audit.log.

11. Harden Kernel Parameters

Adjust kernel parameters via sysctl to improve network security and mitigate certain attack classes. Create a custom configuration file:

sudo nano /etc/sysctl.d/99-security.conf

Add the following settings:

# Disable IP forwarding
net.ipv4.ip_forward = 0

# Enable reverse path filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP redirect acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0

# Enable TCP SYN cookies
net.ipv4.tcp_syncookies = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable IPv6 if not needed
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Apply the changes:

sudo sysctl --system

12. Set Up Log Monitoring

Centralized and proactive log monitoring helps you detect intrusions early. Install logwatch for daily email summaries:

sudo apt install logwatch -y

Test it manually:

sudo logwatch --output stdout --detail high

For more advanced monitoring, consider tools like prometheus-node-exporter with alerting rules, or a SIEM solution like Wazuh.

Best Practices

• Principle of least privilege: Grant users and services only the permissions they absolutely need.
• Regular backups: Maintain encrypted, off-site backups and test restoration procedures periodically.
• Monitor for changes: Use file integrity monitoring tools like AIDE to detect unauthorized file modifications.
• Keep documentation: Document every configuration change so your team can reproduce or roll back settings.
• Use strong, unique passwords: Even with key-based SSH, enforce strong passwords for sudo and service accounts.
• Segment your network: Place databases and internal services on private subnets, accessible only through bastion hosts or VPNs.
• Patch promptly: Subscribe to Debian security advisories and apply critical patches within 24 hours.
• Review open ports monthly: Run ss -tulpn regularly and remove services that are no longer required.

Conclusion

Securing a Debian server is not a one-time task but an ongoing process that requires vigilance, regular audits, and prompt response to new threats. By following this practical checklist, you have established a strong baseline that covers system updates, access control, network filtering, intrusion prevention, kernel hardening, and continuous monitoring. Remember that security is layered: no single measure is sufficient on its own, but together these steps form a robust defense that will make your server significantly harder to compromise. Continue to review your configuration periodically, stay informed about new vulnerabilities, and adapt your hardening strategy as your infrastructure evolves.