A fresh Debian VPS is deliberately minimal: a stable base system and not much else. These are the ten things most Debian servers end up needing, in roughly the order you would install them, with the command for each and a note on when you can skip it. Everything here comes from Debian’s own repositories or the project’s official one, and works on Debian 12 and Debian 13.
Start Here: Update the System
sudo apt update && sudo apt full-upgrade -y1. UFW — a Simple Firewall
Your server has a public IP from the moment it boots. UFW makes “deny everything except what I allow” a three-line job.
sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw enableAllow SSH before enabling, or you lock yourself out. Guide: How to Configure UFW.
2. Fail2Ban — Block Brute-Force Attempts
Every public SSH port is probed constantly. Fail2Ban reads the logs and bans addresses that keep failing.
sudo apt install fail2ban -y
sudo systemctl enable --now fail2banGuide: How to Install and Configure Fail2Ban.
3. unattended-upgrades — Security Updates by Themselves
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgradesSecurity fixes install automatically every day. Guide: How to Enable Automatic Security Updates.
4. Everyday Admin Tools
sudo apt install htop tmux curl wget git unzip ncdu -yhtop shows what is using CPU and memory; tmux keeps long jobs running if SSH drops; ncdu finds what is filling the disk; git deploys and tracks your code.
5. Nginx — Web Server and Reverse Proxy
Fast, light, and the usual front door for everything else on the server — static sites, PHP applications, and Node.js or Python apps behind it.
sudo apt install nginx -y
sudo ufw allow 'Nginx Full'Guide: How to Install Nginx. Prefer Apache for .htaccess compatibility? sudo apt install apache2 — pick one, not both, on the same ports.
6. Certbot — Free HTTPS
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.comCertificates renew automatically. Guide: How to Install Let’s Encrypt SSL with Certbot.
7. MariaDB — the Database
Debian ships MariaDB, the drop-in MySQL replacement, rather than Oracle MySQL — apt install mysql-server will not find a package. WordPress and nearly all MySQL software run on MariaDB unchanged.
sudo apt install mariadb-server -y
sudo mariadb-secure-installationNeed PostgreSQL instead? sudo apt install postgresql. Guide: How to Install MariaDB.
8. PHP-FPM — for WordPress, Laravel and Co.
sudo apt install php-fpm php-mysql php-curl php-xml php-mbstring php-zip php-gd php-intl -yDebian 12 provides PHP 8.2 and Debian 13 PHP 8.4. Guide: How to Install PHP. Skip it if you do not run PHP software.
9. Docker Engine with the Compose Plugin
Run applications in containers, each with its own dependencies, and describe whole stacks in one compose.yaml. Install from Docker’s official repository to get current versions, including the docker compose plugin (the old separate docker-compose program is no longer needed).
Guide: How to Install Docker Engine. Note that ports Docker publishes bypass UFW — publish to 127.0.0.1 unless a service should be public. More in VPS for Docker.
10. A Backup Tool
We do not hold backups of customer servers, so this one is not optional. restic and borgbackup make encrypted, deduplicated backups to another server or to object storage.
sudo apt install restic -yGuide: How to Set Up Automated VPS Backups. Test a restore before you need one.
Which Do I Actually Need?
| Server | Install |
|---|---|
| Every server | 1, 2, 3, 4, 10 |
| WordPress or PHP site | + 5, 6, 7, 8 |
| Node.js / Python app | + 5, 6, and a database if it needs one |
| Container host | + 9, with 5 and 6 as the reverse proxy |
| VPN or mail server | 1–4, 10, plus the specific software |
FAQ
Will all of this fit on a small plan?
The security and admin tools barely register. A full web stack with MariaDB is comfortable from 2 GB of RAM; Docker stacks depend on what you run in them.
Debian 12 or 13?
Debian 13 for new servers — it is the current stable release with the longest support ahead. Support dates are on the Debian VPS page.
What should I do first?
Firewall, Fail2Ban and automatic updates, before anything else is exposed. Then harden SSH.
Continue Reading
- How to Upgrade Debian 11 to 12 (and on to 13)
- How to Fix apt Package Manager Errors
- How to Conduct a Security Audit of Your VPS
- Ubuntu vs Debian for a VPS
Browse more articles in Debian VPS Tutorials.
