Debian Server Administration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where Debian sits

Debian stable is the slow-moving distribution other projects, including Ubuntu, start from. apt is the package manager. A fresh install may not include sudo. The root account or a sudo group is a choice you make on purpose. Do not assume the Ubuntu habit is present.

Networking on Debian depends on the image. Some installs still use /etc/network/interfaces. Others use systemd-networkd. Look at the running system before you edit a file. The lab address 192.0.2.10/24 via 192.0.2.1 is only a documentation example. The tool that owns the interface is the one you configure.

Debian does not ship firewalld or SELinux as the Ubuntu-or-RHEL story. nftables or iptables may be available. Add a firewall as a decision, then allow the management prefix. Do not copy a RHEL firewall-cmd line here.

Stable means you do not casually add testing or unstable repositories to get one new package. That mix is a different distribution you will have to explain at the next upgrade.

The first hour on a lab host

Step 1 on Debian covers which Debian. Read /etc/os-release and write the version. Stable, testing, and oldstable behave differently. The ticket must name the one you have. The check is: The version in the ticket matches os-release. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Debian draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 2 on Debian covers the admin path. Decide root with su, or install sudo for a named user. Give that person a key. Assuming sudo exists will waste the first hour on a minimal image. The check is: The named admin can become root the way the ticket says, and the key works. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Debian draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 3 on Debian covers the network owner. See whether interfaces or systemd-networkd owns the NIC, then set the lab address with that tool only. Editing both leaves a reboot that uses the other file. The check is: After reboot the address matches the ticket. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Debian draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 4 on Debian covers updates. apt update, read the upgrade list, and stay on this suite's repositories. Adding testing in the same window is how stable stops being stable. The check is: No unexpected suite appears in the sources. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Debian draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 5 on Debian covers one service. Install and enable one service this host is for. A minimal Debian stays minimal until the purpose arrives. The check is: The service status is the proof, and unused services stay off. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Debian draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

# Debian lab. Review before you paste.
# Confirm interfaces vs systemd-networkd before editing.
# Lab address 192.0.2.10/24 via 192.0.2.1.
# sudo may be absent. Do not assume the Ubuntu user.
# prompt-for-this is not a password to keep.

The commands you will actually repeat

apt update and apt upgrade on stable, with the list read first, is the normal patch. The patch guide owns the ring and the reboot.

If sudo is absent, su to root for admin work and then return. Installing sudo is fine when you want Ubuntu-like workflow. Write that down so the next person knows.

systemctl manages services on current Debian. The systemd guide applies. A very old release that is past end of life is a migration, not a place for new how-tos.

Configuration you change lives in /etc. Packages will ask about config files they own. Read the prompt. Keeping the package's file or yours is a decision, not an enter key.

What Debian is not

Debian is not Ubuntu. netplan is not the default here. do-release-upgrade is not the Debian tool.

Debian stable is not testing, and it is not a place to pin one package from unstable without a plan.

It is not RHEL. dnf and firewall-cmd are the wrong commands, even when a blog shows them next to a Debian screenshot that was actually something else.

The hour you stop

Write the hostname, the role, and the clock time before you change Debian. If this host is also serving users, it is not the lab and this first hour belongs on a spare. The provisioning guide is how the spare gets built. A change without a spare is a change you can still postpone.

Keep the console or the out-of-band path open for the whole hour. Reloading a network service, a firewall, or a secure-shell daemon from the only session is how a lab becomes a drive across town. The hardware guide names that path for a physical machine. A virtual machine uses the hypervisor console. A cloud instance uses the serial console the platform gives you. Test it before the reload, not after.

The address 192.0.2.10/24 and the gateway 192.0.2.1 are documentation. They belong in the lab note and nowhere else. On a real network, use the prefix the network desk already assigned. On a cloud instance, use the address the platform assigned and do not hard-code the documentation range into user-data. If a generator filled the documentation address into a production draft, delete it.

prompt-for-this is a reminder that a secret is missing. It is not a password you set, not a token you commit, and not a string you leave in a configuration file because the service started. The real secret lives in the password store. The ticket says who can read it. A file that still contains the reminder is a file you have not finished.

One service is enough for the first hour on Debian. The purpose from the fundamentals page says which service. Every other package stays uninstalled until its own guide has a ticket. A host that enables a web server, a database, and a queue in the first hour has three changes and no proof. Finish the login, the address, and the update. Then stop.

Read the package transaction before you accept it. A count of packages is not a review. If the list contains a repository you did not add, stop. If it contains a kernel, the patch guide's reboot decision applies and the console stays open. If it contains software this role does not need, remove that line from the plan rather than installing it and disabling it later.

The previous image, the previous configuration file, or the previous package version is the rollback. Write the path down while the host still works. A rollback you invent after a failed reload is a guess. The migration guide assumes the old copy is still there. Do not delete it in the same hour to free a disk.

When the checks pass, copy the notes into the ticket and leave the host alone. The next host waits until a second person can repeat the login and the address from the notes. A fleet built from memory drifts. A fleet built from the file the provisioning guide stored stays boring, which is the point of Debian in production.

If a step on Debian fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied config produces a host nobody can rebuild. Rebuild from the image instead. The time you lose is smaller than the time you will spend explaining the hybrid.

Hand the finished lab to the guide that matches the role: web, mail, storage, backup, or hardening. Debian being installed is not the same as the role being ready. The role guide has its own proof. Do not skip it because the package manager exited without an error.

A second person reads the hostname, the address, and the rollback path aloud before you build the next host. If they cannot find those three in the ticket, the notes are not done. Silence is not agreement. The check is the sentence they repeat back.

Store the working notes next to the image version. A month from now Debian will still boot from that pair, and the chat where you remembered a flag will be gone. The file is the memory. The host is replaceable. That is the whole point of writing this hour down.

Debian checks before a second host

Confirm this before you call the change done: Debian is the OS the hostname reports, not a neighbour you copied from. The lab address 192.0.2.10/24 is gone before this host is placed on a real network. prompt-for-this is not the password that was set, and no password is in the ticket. The named admin can log in with a key. The package manager used is the one this page names. A network file from a different distribution was not pasted in. The config test or the apply command for this network tool succeeded. The previous image or install file is kept. No new third-party repository was added in the first hour. A service you do not need was not enabled to see what it does. Console or out-of-band access works before you reload SSH. A second person read the hostname and the address. The network tool was identified before any file was edited. No Ubuntu netplan file was created on Debian. Sources stay on the suite you named. And sudo's presence or absence matches the ticket. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.