Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the first time I've installed original Debian (I used to use only Ubuntu server and client editions and Arch client before) server, it was surprise for me that it has no sudo, and no ssh server installed by default, and allows root login over ssh after ssh is installed (so obviously setting up and securing SSH daemon is #1 task to be done on new installation). Any more such surprises there?

share|improve this question
It's right whit I've said - SSH indeed was not there, and no sudo as well. And that's a vulnerability (because obviously the first command to issue on a new installation is "apt-get install openssh-server", and the ssh daemon installed allows root login by default). – Ivan Jul 11 '10 at 21:08
Ah, right. Need to clean my glasses or something because I thought you said the opposite. – Zoredache Jul 11 '10 at 21:48
Actually, that's rather common I think: sudo and openssh seem to be secondary to most installs. – Mei Jul 11 '10 at 22:21

I wouldn't count on the base install being secure at all, no matter what distribution you use and no matter what you expect. Go through your basic configuration and tighten things up.

If I'm setting up an Internet server, I'd remove all possible servers except what you need, turn off as many services as possible, install OpenSSH and tighten down the configuration (you could even limit it to public keys if you like), install and activate portsentry, and other similar things.

Don't assume anything at all.

One more very important thing: do an update to make sure you have the most current releases. This alone will reduce your risk profile drastically.

share|improve this answer
Pretty list format: After install, 1) Start firewall (ufw, FireHOL, shorewall, ferm, <insert iptables front-end here>) 2) Make sure all services are shut off except those you need. That usually isn't an issue; Ubuntu for example has very few (if any) network services installed by default. 3) Update the system. – Luke has no name Jul 12 '10 at 14:13

Run OpenVAS (which is the new nessus), and it will tell you the remotely exploitable vulnerabilities on the system. I know Ubuntu will automatically install security updates by default, I'm not sure if Debian can do this. I know you can use apt-cron to automatically run an apt-get update && apt-get upgrade.

share|improve this answer
When exactly did Ian Murdock work for Canonical? Besides, what does the talk about Ubuntu and Canoical even has to do with the original question? – andol Jul 11 '10 at 21:04

Debian has a good Security Page. They post every update they do in their package system:

You should subscribe when running debian.

The Last Update of the Debian Lenny installer was published on the 26th oh June and includes all patches up to DSA-2063

Putting the two together you get 5 packages that have been fixed since... ;)

If you ad a user during install root access is deactivated...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.