Skip to main content

Debian Server Management

Introduction

Debian is one of the most stable and secure Linux distributions, making it an excellent choice for server deployments. Effective server management involves monitoring resources, managing services, maintaining security, and performing regular maintenance. This guide will walk you through the essential aspects of Debian server management, providing you with the knowledge to maintain a healthy, secure, and efficient server environment.

Basic Server Administration

Updating Your System

Keeping your Debian server updated is crucial for security and stability. Debian uses the APT (Advanced Package Tool) package management system.

bash
# Update package lists
sudo apt update

# Upgrade installed packages
sudo apt upgrade

# Full distribution upgrade
sudo apt dist-upgrade

Output example:

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
base-files linux-image-amd64 openssl
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 8,456 kB of archives.
After this operation, 12.3 kB of additional disk space will be used.
Do you want to continue? [Y/n]

It's recommended to set up automatic security updates:

bash
# Install unattended-upgrades package
sudo apt install unattended-upgrades apt-listchanges

# Configure automatic updates
sudo dpkg-reconfigure -plow unattended-upgrades

Managing Services with systemd

Debian uses systemd to manage system services. Here are essential commands:

bash
# Check status of a service
sudo systemctl status apache2

# Start a service
sudo systemctl start apache2

# Stop a service
sudo systemctl stop apache2

# Restart a service
sudo systemctl restart apache2

# Enable a service to start at boot
sudo systemctl enable apache2

# Disable a service from starting at boot
sudo systemctl disable apache2

Service status output example:

● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2023-08-15 14:30:42 UTC; 2h 25min ago
Docs: https://httpd.apache.org/docs/2.4/
Main PID: 12345 (apache2)
Tasks: 6 (limit: 4675)
Memory: 24.2M
CGroup: /system.slice/apache2.service
├─12345 /usr/sbin/apache2 -k start
├─12346 /usr/sbin/apache2 -k start
├─12347 /usr/sbin/apache2 -k start
├─12348 /usr/sbin/apache2 -k start
├─12349 /usr/sbin/apache2 -k start
└─12350 /usr/sbin/apache2 -k start

User Management

Managing users is a fundamental administrative task:

bash
# Create a new user
sudo adduser username

# Add user to sudo group
sudo usermod -aG sudo username

# Switch to another user
su - username

# Change user password
sudo passwd username

# Delete a user
sudo deluser username

# Delete a user and their home directory
sudo deluser --remove-home username

Monitoring Server Resources

System Information and Resource Usage

Monitor system resources to ensure optimal performance:

bash
# View system information
uname -a

# Check CPU information
lscpu

# Display memory usage
free -h

# Show disk usage
df -h

# Display running processes
ps aux

# See real-time process information
top

Example output of free -h:

              total        used        free      shared  buff/cache   available
Mem: 7.7Gi 1.2Gi 4.8Gi 11Mi 1.7Gi 6.2Gi
Swap: 2.0Gi 0B 2.0Gi

Installing and Using htop

htop provides an improved interface over the standard top command:

bash
# Install htop
sudo apt install htop

# Run htop
htop

Monitoring with Netdata

Netdata is a powerful, real-time performance monitoring solution:

bash
# Install dependencies
sudo apt install zlib1g-dev uuid-dev libuv1-dev liblz4-dev libjudy-dev libssl-dev libmnl-dev gcc make git autoconf autoconf-archive autogen automake pkg-config curl

# Clone Netdata repository
git clone https://github.com/netdata/netdata.git --depth=100

# Install Netdata
cd netdata
sudo ./netdata-installer.sh

After installation, access Netdata dashboard by navigating to http://your-server-ip:19999 in your web browser.

Log Management

Understanding Debian Logs

Logs provide valuable information about system events and issues:

bash
# View system logs
sudo journalctl

# View logs for a specific service
sudo journalctl -u apache2

# View logs since a specific time
sudo journalctl --since "2023-08-15 14:00:00"

# Follow logs in real-time
sudo journalctl -f

Important log files in Debian:

  • /var/log/syslog: General system logs
  • /var/log/auth.log: Authentication logs
  • /var/log/kern.log: Kernel logs
  • /var/log/apache2/: Apache web server logs
  • /var/log/mysql/: MySQL database logs

Log Rotation with logrotate

logrotate helps manage log files to prevent them from growing too large:

bash
# Check logrotate configuration
cat /etc/logrotate.conf

# Create a custom log rotation configuration
sudo nano /etc/logrotate.d/custom-logs

Example logrotate configuration:

/var/log/custom-application/*.log {
daily
missingok
rotate 14
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
postrotate
systemctl reload custom-application
endscript
}

Backup and Recovery

Setting Up Basic Backups

Regular backups are essential for disaster recovery:

bash
# Install rsync
sudo apt install rsync

# Backup important directories
sudo rsync -av --delete /path/to/source/ /path/to/backup/

# Schedule backups with cron
sudo crontab -e

Example cron entry for daily backups at 2 AM:

0 2 * * * rsync -av --delete /var/www/ /mnt/backup/www/

Using Timeshift for System Snapshots

Timeshift creates system snapshots for easy recovery:

bash
# Install Timeshift
sudo apt install timeshift

# Create a snapshot
sudo timeshift --create --comments "Before major update"

# List available snapshots
sudo timeshift --list

# Restore a snapshot
sudo timeshift --restore --snapshot '2023-08-15_02-00-01'

Security Management

Configuring the Firewall with UFW

Uncomplicated Firewall (UFW) simplifies firewall management:

bash
# Install UFW
sudo apt install ufw

# Check UFW status
sudo ufw status

# Enable UFW
sudo ufw enable

# Allow SSH connections
sudo ufw allow ssh

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Deny a specific IP address
sudo ufw deny from 192.168.1.100

# Delete a rule
sudo ufw delete allow 80/tcp

Fail2Ban for Intrusion Prevention

Fail2Ban protects against brute force attacks:

bash
# Install Fail2Ban
sudo apt install fail2ban

# Create a local configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Example Fail2Ban configuration for SSH:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

After configuration:

bash
# Restart Fail2Ban
sudo systemctl restart fail2ban

# Check Fail2Ban status
sudo fail2ban-client status

# Check specific jail status
sudo fail2ban-client status sshd

Keeping Your System Secure

Security best practices:

bash
# Check for rootkits
sudo apt install rkhunter
sudo rkhunter --check

# Scan for vulnerabilities
sudo apt install lynis
sudo lynis audit system

Advanced Server Management

Setting Up Cron Jobs

Cron allows you to schedule tasks:

bash
# Edit crontab for current user
crontab -e

# Edit crontab for another user
sudo crontab -u username -e

Cron format: minute hour day-of-month month day-of-week command

Example crontab entries:

# Run a script every day at 3:30 AM
30 3 * * * /path/to/script.sh

# Run a command every Monday at 2:00 PM
0 14 * * 1 /path/to/command

# Run a backup every 6 hours
0 */6 * * * rsync -av /source/ /backup/

Remote Server Management with SSH

Secure Shell (SSH) is essential for remote administration:

bash
# Connect to a remote server
ssh username@server_ip

# Use a specific identity file
ssh -i /path/to/private_key username@server_ip

# Create SSH key pair
ssh-keygen -t ed25519 -C "[email protected]"

# Copy SSH key to remote server
ssh-copy-id username@server_ip

For improved SSH security, edit /etc/ssh/sshd_config:

# Disable password authentication
PasswordAuthentication no

# Disable root login
PermitRootLogin no

# Use a non-standard port
Port 2222

After making changes:

bash
# Restart SSH service
sudo systemctl restart ssh

Server Performance Tuning

Optimize your server for better performance:

bash
# Check current I/O scheduler
cat /sys/block/sda/queue/scheduler

# Set I/O scheduler
echo 'deadline' | sudo tee /sys/block/sda/queue/scheduler

# Adjust swappiness (lower values prefer RAM over swap)
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf

# Apply sysctl changes
sudo sysctl -p

Automation with Ansible

Ansible allows for infrastructure as code and automation:

bash
# Install Ansible
sudo apt install ansible

# Create inventory file
sudo nano /etc/ansible/hosts

Example inventory file:

[webservers]
web1 ansible_host=192.168.1.101
web2 ansible_host=192.168.1.102

[dbservers]
db1 ansible_host=192.168.1.201

Create a simple playbook:

yaml
# update_servers.yml
---
- hosts: all
become: yes
tasks:
- name: Update apt cache
apt:
update_cache: yes

- name: Upgrade all packages
apt:
upgrade: dist

Run the playbook:

bash
ansible-playbook update_servers.yml

Container Management with Docker

Docker simplifies application deployment:

bash
# Install Docker
sudo apt install docker.io

# Start and enable Docker
sudo systemctl start docker
sudo systemctl enable docker

# Add current user to docker group
sudo usermod -aG docker $USER

# Pull a Docker image
docker pull nginx

# Run a container
docker run -d -p 80:80 --name webserver nginx

# List running containers
docker ps

# Stop a container
docker stop webserver

# Remove a container
docker rm webserver

Server Workflow Visualization

Here's a typical server management workflow:

Summary

Effective Debian server management requires a combination of regular maintenance, security practices, monitoring, and automation. By following the guidelines in this guide, you'll be able to:

  • Keep your server updated and secure
  • Monitor resources effectively
  • Manage services efficiently
  • Set up proper backup and recovery procedures
  • Implement security best practices
  • Automate repetitive tasks

These skills form the foundation of professional server administration and will help ensure your Debian servers run reliably and securely.

Additional Resources

To continue learning about Debian server management, consider exploring:

Exercises

  1. Set up a basic LAMP (Linux, Apache, MySQL, PHP) stack on a Debian server.
  2. Configure a regular backup system using rsync and cron.
  3. Create a firewall configuration that allows only necessary services.
  4. Set up fail2ban to protect SSH and other services.
  5. Create a simple monitoring dashboard using Netdata.
  6. Write an Ansible playbook to automate the setup of a new Debian web server.


If you spot any mistakes on this website, please let me know at [email protected]. I’d greatly appreciate your feedback! :)