How to Set Up a Clean VPS on Debian 13: Hostname, User, SSH Keys, and Port

How to Set Up a Clean VPS on Debian 13: Hostname, User, SSH Keys, and Port

You just got a fresh Debian 13 VPS and logged in as root with a password. Before installing anything else, let’s lock the server down: set a proper hostname, create a non-root user with sudo rights, switch SSH to key-only authentication, disable root login, and move SSH off the default port.

Step 1: Set the Hostname

Check the current hostname:

hostnamectl

Set a new one (replace myserver with whatever fits your naming scheme):

hostnamectl set-hostname myserver

Update /etc/hosts so the hostname resolves locally — open the file and make sure it has a line like this:

127.0.1.1   myserver

Verify the change:

hostnamectl
hostname -f

You may need to log out and back in for the new hostname to show up in your shell prompt.

Step 2: Create a New User with Sudo Rights

Working as root for everyday tasks is risky. Create a dedicated user instead:

adduser deploy

You’ll be prompted for a password and some optional info (full name, etc.) — fill in what you need, the rest can be left blank.

Install sudo if it’s not already present, and add the user to the sudo group:

apt update
apt install sudo -y
usermod -aG sudo deploy

Switch to the new user and confirm sudo works:

su - deploy
sudo whoami

sudo whoami should print root. If it does, the user is correctly set up.

Step 3: SSH Access — Keys Only, No Root Login

Generate an SSH key pair (on your local machine)

If you don’t already have one:

ssh-keygen -t ed25519 -C "deploy@myserver"

Copy the public key to the server

ssh-copy-id deploy@your_server_ip

If ssh-copy-id isn’t available, do it manually:

cat ~/.ssh/id_ed25519.pub | ssh deploy@your_server_ip \
  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Test key-based login before changing anything else

ssh deploy@your_server_ip

Make sure you can log in without a password prompt before continuing — if key auth doesn’t work yet, fix it now, not after you’ve disabled passwords.

Disable password authentication and root login

Edit the SSH daemon config:

sudo nano /etc/ssh/sshd_config

Set (or uncomment and change) these directives:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH to apply the changes:

sudo systemctl restart ssh

Before closing your current session, open a second terminal and test a fresh connection as deploy to confirm you still have access. Only close the original root session once the new one works.

Step 4: Change the SSH Port

Running SSH on the default port 22 makes it a constant target for automated scans. Moving it to a non-standard port cuts down on that noise significantly.

Open the config again:

sudo nano /etc/ssh/sshd_config

Find (or add) the Port directive and set a custom port:

Port 2222

Pick any free port in the 1024–65535 range. Restart SSH:

sudo systemctl restart ssh

If you use ufw, allow the new port before you lose access, and only then remove the old one:

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp
sudo ufw status

Test the new port from a separate terminal, keeping your current session open until it’s confirmed:

ssh -p 2222 deploy@your_server_ip

To avoid typing -p 2222 every time, add an entry to your local ~/.ssh/config:

Host myserver
    HostName your_server_ip
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Now you can just run:

ssh myserver

Summary

At this point you have a Debian 13 server with no password-based root access exposed on a predictable port — a solid baseline before installing anything else. Keep your session open until every change is verified from a second connection; that one habit prevents almost every “I locked myself out” story.