How to Install Debian 12 on a Server

Debian 12 Bookworm is the boring-on-purpose Linux that has powered server rooms for two decades. Long support windows, conservative package versions, and a vast package archive make it our default for "we will still be running this in five years."

Prerequisites

• A server, VM, or hypervisor slot with at least 1 vCPU, 1 GiB RAM, 10 GiB disk (more if you actually run anything).
• A bootable USB or attached ISO of debian-12.x.x-amd64-netinst.iso from cdimage.debian.org.
• SHA-256 sums file from the same mirror.
• Console access (KVM, IPMI, or hypervisor remote console).

Step 1: Verify the ISO

sha256sum -c SHA256SUMS --ignore-missing
# Look for OK on the netinst line. Anything else → re-download.

Step 2: Boot the installer

Choose Graphical install (or text — same outcome). When prompted:

• Hostname: debian-host.example.sa
• Domain: leave blank if not on a domain
• Root password: leave EMPTY — Debian disables root login and creates the first user as a sudoer instead (much safer)
• Full name / username: your operator account
• User password: 32+ chars from pwgen -s 32 1

Step 3: Partitioning

Choose Guided — use entire disk and set up LVM for the safe default, or Manual for full control. Recommended layout for a 40+ GiB disk:

/boot         1 GiB ext4
/boot/efi     512 MiB FAT32 (UEFI only)
/             30 GiB ext4 (LVM)
/var          15 GiB ext4 (LVM)
/var/log      5 GiB  ext4 (LVM)
/home         10 GiB ext4 (LVM)
swap          2 GiB

Leave roughly 30% of the volume group unallocated for future growth.

Step 4: Package selection — keep it minimal

In tasksel, deselect the desktop environment, keep:

• SSH server
• Standard system utilities

That is it. Add anything else with apt after first boot — fewer packages now means fewer CVEs to patch later.

Step 5: GRUB and first boot

Install GRUB to the disk (not a partition), reboot, and log in as your user. Confirm you got sudo:

sudo apt update
sudo apt upgrade -y
sudo apt install -y curl vim htop ufw unattended-upgrades fail2ban ca-certificates
sudo systemctl enable --now unattended-upgrades fail2ban

Step 6: Lock SSH down

sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
# from your workstation:
# ssh-copy-id you@debian-host.example.sa
sudo systemctl restart ssh

Verify

hostnamectl
uname -r                       # 6.1.x or newer
lsb_release -a                 # Debian GNU/Linux 12 (bookworm)
sudo ss -tulpn                 # only sshd listening

Conclusion

You now have a minimal, hardened Debian 12 baseline — exactly the box you wanted, nothing more. Commit /etc/ssh/sshd_config.d/* and /etc/apt/sources.list to your config repo before anything else lands on it.

Next steps

• Add a non-root sudo user if you provisioned with only one operator.
• Turn on automatic security updates.
• Front public traffic with Nginx and schedule routine work with cron.