Debian's strength is its minimalism. Here's how to set up a lean, secure Debian server without unnecessary bloat.

1. Update

sudo apt update && sudo apt upgrade -y

2. Install only what you need

sudo apt install sudo curl ufw fail2ban unattended-upgrades -y

A minimal Debian install doesn't even include sudo by default, so add it and put your user in the sudo group.

3. Secure SSH

Add your SSH key, then set PermitRootLogin no and PasswordAuthentication no in /etc/ssh/sshd_config and reload SSH.

4. Firewall and auto-updates

sudo ufw allow OpenSSH && sudo ufw enable
sudo dpkg-reconfigure -plow unattended-upgrades

5. Add your stack

Install your web server, database or runtime. Because you started minimal, the server runs few services, uses less RAM, and has a smaller attack surface — exactly why admins love Debian.

OneHost offers Debian 12 and 11 on NVMe SSD + KVM, so your lean setup also runs fast.