Debian Droplet Setup Guide 2026 — Getting Started

คู่มือนี้พาไล่ทีละขั้นตอนตั้งแต่สร้าง Debian Droplet บน DigitalOcean ไปจนถึงตั้งค่าความปลอดภัยพื้นฐาน

This guide walks through step-by-step from creating a Debian Droplet on DigitalOcean to setting up basic security, with emphasis on key differences between Debian and Ubuntu — namely that sudo and ufw are not pre-installed, and there is no snap ecosystem. Ideal for users seeking a stable server with fine-grained package control over a longer deployment lifecycle.

Why Choose Debian Over Ubuntu

Debian is the upstream Linux distribution that Ubuntu builds upon. The key differences worth knowing before deciding are release cycles and package maintenance philosophy. Debian releases a new stable version roughly every 2 years (currently Debian 12, codenamed Bookworm), and packages in the stable branch are thoroughly tested before release and kept at the same version throughout the branch's lifetime. Ubuntu, by contrast, has LTS releases every 2 years as well, but tends to push newer packages into backports and PPAs on an ongoing basis. As a result, Debian suits workloads requiring maximum version stability — like long-running database servers that cannot tolerate frequent breaking changes — while Ubuntu excels at providing fresher packages and an ecosystem like snap that many software vendors favor as a distribution channel. A stark difference on DigitalOcean Droplets is that Debian comes without snapd pre-installed and lacks the sudo package by default, much like Ubuntu, but this is a detail beginners often miss: when they type sudo apt update right after boot, they hit "command not found" on the very first line. Debian is also notable for carrying no commercial obligations; the project is maintained by volunteer community members with no subscription requirements or telemetry bundled into the OS like some Ubuntu Pro features. For users already familiar with Debian in other environments — such as Raspberry Pi OS or legacy office servers — choosing Debian on Droplets lets existing workflows and automation scripts apply immediately without translation. None of this means Debian is technically superior or inferior to Ubuntu, but rather represents a trade-off between package freshness and version stability — a distinction this guide focuses on: which initial setup steps genuinely differ between Debian and Ubuntu, not just command renames.

1. Debian stable releases every ~2 years and maintains package versions throughout the branch lifetime
2. Debian Droplet lacks snapd and neither sudo nor ufw are pre-installed, unlike Ubuntu
3. No commercial obligations or telemetry bundled with the OS
4. Suited for workloads requiring version stability, such as long-lived database servers

Create a Debian Droplet

Worth highlighting here — begin by logging into the DigitalOcean Control Panel and clicking Create > Droplets. Select the Debian tab under Choose an image to see the latest stable version DigitalOcean offers (currently Debian 12). Next, choose a Region as close as possible to your actual end users. For users in Thailand, sgp1 (Singapore) is nearest, with blr1 (Bangalore) as a secondary option. For Droplet size, choose based on your workload. For testing or small websites, the Basic Shared CPU plan starting at $6/month (1 GiB RAM, 1 vCPU, 25 GB SSD, 1,000 GiB transfer) is sufficient. For genuine traffic or multiple simultaneous processes, the $12/month (2 GiB RAM, 1 vCPU, 50 GB SSD, 2,000 GiB transfer) or $24/month (4 GiB RAM, 2 vCPU, 80 GB SSD, 4,000 GiB transfer) plans are more comfortable. (Pricing as of July 2026 — verify current rates on the provider's website.) Under Authentication, always choose SSH Key over Password (covered in the next section). If you don't have a key yet, you can add one later. A recommended option to enable at creation time is Monitoring (free, no additional cost), which logs CPU/RAM/Disk/Bandwidth metrics retroactively without requiring separate installation later. Set a meaningful hostname such as debian-web-01, then click Create Droplet. Provisioning typically takes about 1 minute. Billing accrues per-second with a 60-second minimum or $0.01 per session, whichever is higher. Once your Droplet reaches Active status, you receive an IPv4 address and can SSH in immediately. New DigitalOcean users can sign up via this referral link to receive $200 Free Credit, valid for 60 days (requires a credit card or PayPal), allowing you to follow this guide at no cost during the trial period.

• Choose Region sgp1 (Singapore) for Thailand users, or blr1 (Bangalore) as secondary
• Starting plan: $6/month (1 GiB RAM/1 vCPU/25 GB SSD) for testing; $12-24/month for production
• Enable free Monitoring at creation time to retain historical metrics automatically
• Billing is per-second with a 60-second minimum or $0.01

Configure SSH Key and Disable Password Login

Setting up SSH keys should be done before or immediately after creating the Droplet, since password authentication is the most frequently brute-forced attack vector. Start by generating a key pair on your local machine with ssh-keygen -t ed25519 -C "[email protected]". The system will ask for a file location (defaults are fine) and a passphrase, which is recommended for an additional security layer. If you didn't attach your public key during Droplet creation, copy it with ssh-copy-id root@YOUR_DROPLET_IP, or paste the contents of ~/.ssh/id_ed25519.pub into the DigitalOcean Control Panel under Settings > Security > SSH Keys. Next, SSH into the Droplet for the first time with ssh root@YOUR_DROPLET_IP to verify the key works before disabling password authentication. Once confirmed, edit /etc/ssh/sshd_config and set PasswordAuthentication no. If you've already created a non-root user with sudo privileges (next section), also set PermitRootLogin no to disable direct root login entirely. A key difference from RHEL/CentOS-based systems: on Debian, the SSH daemon service is named ssh, not sshd. Therefore, the restart command must be systemctl restart ssh. Typing systemctl restart sshd out of habit from other systems will immediately return "Unit sshd.service not found". Before every restart, run sshd -t to syntax-check the configuration file, preventing a scenario where a typo breaks the service and locks you out via SSH. Finally, always open a new SSH session to test key login before closing the original window where you remain logged in — this safeguard lets you fix any misconfiguration without losing access.

• Generate a key with ssh-keygen -t ed25519 and attach the public key during Droplet creation or via Security > SSH Keys
• Disable password login by setting PasswordAuthentication no in /etc/ssh/sshd_config
• Debian uses service name ssh, not sshd, when restarting
• Always validate syntax with sshd -t before restarting to avoid lockout

Create a Non-root User with sudo

This is where Debian differs most starkly from Ubuntu during initial setup. Ubuntu Droplets come with the sudo package pre-installed, but Debian base images do not. If you log in as root and immediately type sudo apt update, you will encounter -bash: sudo: command not found. You must install it first, while logged in as root, with apt update && apt install sudo -y. Once that's done, create a new user with adduser deploy (replace "deploy" with your preferred username). This command differs from useradd in that it's an interactive Debian wizard asking for a password and additional details (Full Name, Room Number, etc. — all optional), automatically creating the home directory and default configuration. It's far simpler than useradd -m with manual setup. Next, add the user to the sudo group with usermod -aG sudo deploy to grant administrative privileges. The often-forgotten step is copying the SSH key from root to the new user, since authorized_keys is per-user in the home directory. Do this with rsync --archive --chown=deploy:deploy /root/.ssh /home/deploy, or manually create the directory and copy the file with correct permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys, as SSH rejects keys with overly permissive file modes. Test login with ssh deploy@YOUR_DROPLET_IP and verify sudo works with sudo whoami — it should return "root" after prompting for the deploy user's password (not root's). If you want sudo to stop asking for a password, you can add a file under /etc/sudoers.d/, but this is not recommended for production, as it weakens security. Only after confirming the new user works completely with both SSH key and sudo should you return to the previous section and disable PermitRootLogin.

• Debian has no sudo pre-installed; run apt install sudo -y as root first
• Use interactive adduser instead of useradd to auto-create the home directory
• Add user to sudo with usermod -aG sudo username
• Copy authorized_keys from /root/.ssh to the new user's home, setting chmod 700/600 correctly

Set Up Firewall with ufw

Like sudo, ufw (Uncomplicated Firewall) does not come pre-installed on Debian base images and must be installed first with sudo apt install ufw -y. The most critical precaution is to allow SSH port before enabling the firewall; otherwise, you will be locked out immediately when the firewall starts, as your current SSH session will be cut and new connections will be blocked. The safe sequence is sudo ufw allow OpenSSH (works because Debian pre-registers the openssh-server profile), or if you've changed SSH to a different port, use sudo ufw allow 2222/tcp with your actual port number. For a web server, add sudo ufw allow 80/tcp and sudo ufw allow 443/tcp, or use sudo ufw allow "Nginx Full" if Nginx is already installed and has registered its profile. Once rules are complete, enable the firewall with sudo ufw enable. The system will ask for confirmation because it may interrupt your session — you can safely answer "y" if you've already allowed SSH. Check status and all rules with sudo ufw status verbose, which should show SSH, port 80, and 443 as ALLOW. Beyond the OS-level ufw, DigitalOcean also provides a free Cloud Firewall with no extra charge, operating at the network layer before traffic reaches the Droplet. The advantage is defense-in-depth: even if ufw is misconfigured, the Cloud Firewall protects you. For any publicly-facing Droplet, it's highly recommended to configure both ufw and Cloud Firewall rules in parallel, rather than relying on one alone.

• ufw is not pre-installed; run apt install ufw -y before using it
• Always allow SSH port before enabling the firewall, or you will lock yourself out immediately
• Add sudo ufw allow 80/tcp and 443/tcp for a web server

Update the System with apt

Run your first system update immediately after basic security setup is complete. Start with sudo apt update to refresh the package index from repositories (this does not update software, only the list). Follow with sudo apt full-upgrade -y instead of plain apt upgrade. The difference is that full-upgrade handles dependency changes more thoroughly and can remove conflicting old packages to complete the update, whereas regular upgrade skips packages with complex dependencies, potentially leaving security patches incomplete. If the kernel was updated in this cycle, check for /var/run/reboot-required or install needrestart to see which services require restart or if a full reboot is needed. Reboot with sudo reboot at a convenient time to activate the new kernel. A key Debian distinction: Debian Droplets do not include snapd and it is not recommended to install it unless truly necessary, as snap is Ubuntu-centric and consumes resources unnecessarily on small servers. If you need packages not in the standard apt repository, Debian alternatives include the backports repository (opt-in via sources.list) or compiling from source. For long-term security, install sudo apt install unattended-upgrades -y and configure it with sudo dpkg-reconfigure --priority=low unattended-upgrades to have security patches install automatically without manual intervention each week. Finally, verify timezone with timedatectl, as new Droplets default to UTC. If needed, set it to sudo timedatectl set-timezone Asia/Bangkok to match your actual location, ensuring logs and future cron jobs use the correct time.

• Use apt full-upgrade rather than apt upgrade to handle dependencies completely
• Check /var/run/reboot-required or needrestart after updating to see if a reboot is needed
• Debian has no snapd included; use backports repository or flatpak if you need packages not in apt
• Install unattended-upgrades for automatic security patching

Common Mistakes and Troubleshooting

A point users often miss: the number-one mistake Debian beginners make is forgetting that sudo is not pre-installed, then becoming confused by "command not found" when they try a familiar Ubuntu command on the very first line. The fix is to always log in as root first during initial setup and manually install sudo. The second, more severe mistake is running ufw enable before allowing SSH port, which instantly locks you out and prevents SSH login. If this happens, access the Droplet via the DigitalOcean Console (available from the Control Panel without SSH) and run ufw allow OpenSSH or temporarily ufw disable to regain access. Another common error is typing systemctl restart sshd out of habit from RHEL-based systems, then seeing "Unit sshd.service not found" and mistakenly believing the configuration change did not take effect — when in fact, the service name on Debian is simply ssh. A dangerous pitfall is disabling both PasswordAuthentication and PermitRootLogin in one edit before testing SSH key login for the new user, leaving no way back in if the key fails. The prevention is incremental testing: open a new session to verify each change before applying the next. Another frequent issue is running apt install without apt update first, resulting in "package not found" errors even though the package exists in the repository — the local index is simply outdated. Finally, a subtle oversight is failing to notice that Droplets default to UTC timezone, causing time discrepancies in logs and cron jobs that go unnoticed until much later. This should be checked and corrected at initial setup, not debugged retroactively.

• sudo: command not found → Log in as root and install it first with apt install sudo -y
• ufw enable before allowing SSH → Locked out; fix via DigitalOcean Console, then allow or disable ufw
• systemctl restart sshd fails → Debian's service is named ssh, not sshd
• Disable both PasswordAuthentication and PermitRootLogin before testing new user key → No way back in
• apt install without apt update first → Package not found errors even when it exists

Best Practices

After completing initial setup, adopt several practices to keep your Debian Droplet secure and maintainable long-term. First, enforce SSH keys only: disable both password authentication and direct root login entirely, using a sudo-capable non-root user as your primary operational account. Restrict true root use to emergencies via sudo alone. Second, operate ufw and DigitalOcean Cloud Firewall in tandem on any public-facing Droplet, since they work at different layers (OS and network) and give you defense-in-depth. Third, enable DigitalOcean's free Monitoring from the start and configure Alert Policies for abnormal CPU/RAM/Disk spikes so you hear about problems before users complain. Fourth, once basic configuration is complete and SSH/sudo are verified working, create a Droplet Snapshot to serve as a baseline image, allowing rapid recovery or cloning to new Droplets without re-running setup each time. Fifth, do enable unattended-upgrades for automatic security patching, but for major version upgrades of Debian itself (e.g., jumping from version 12 to the next release in the future), always test on a staging Droplet first rather than allowing unattended-upgrades to perform major upgrades automatically, as there is genuine risk to running services. Sixth, tag Droplets from creation (e.g., env:production or role:web) to simplify Cloud Firewall and billing management as your Droplet count grows. Finally, document your initial setup as a reusable script or cloud-init configuration, ensuring every new Droplet achieves the same security baseline without manual steps each time.

• Use SSH keys only; disable password auth and direct root login entirely
• Combine ufw and DigitalOcean Cloud Firewall always on public Droplets for layered defense
• Enable free Monitoring and set Alert Policies from the start
• Create a Droplet Snapshot after setup is verified, before deploying the application

Get $200 Free Credit →