For the first time I've installed original Debian (I used to use only Ubuntu server and client editions and Arch client before) server, it was surprise for me that it has no sudo, and no ssh server installed by default, and allows root login over ssh after ssh is installed (so obviously setting up and securing SSH daemon is #1 task to be done on new installation). Any more such surprises there?
Run OpenVAS (which is the new nessus), and it will tell you the remotely exploitable vulnerabilities on the system. I know Ubuntu will automatically install security updates by default, I'm not sure if Debian can do this. I know you can use apt-cron to automatically run an
I wouldn't count on the base install being secure at all, no matter what distribution you use and no matter what you expect. Go through your basic configuration and tighten things up.
If I'm setting up an Internet server, I'd remove all possible servers except what you need, turn off as many services as possible, install OpenSSH and tighten down the configuration (you could even limit it to public keys if you like), install and activate portsentry, and other similar things.
Don't assume anything at all.
One more very important thing: do an update to make sure you have the most current releases. This alone will reduce your risk profile drastically.
Debian has a good Security Page. They post every update they do in their package system:
You should subscribe when running debian.
The Last Update of the Debian Lenny installer was published on the 26th oh June and includes all patches up to DSA-2063
Putting the two together you get 5 packages that have been fixed since... ;)
If you ad a user during install root access is deactivated...