How To Configure Headless Debian Server (Post-Installation)

Welcome to Part 2! Now that we have a clean Headless Debian server installation running, it’s time to configure it for real-world server use.

In this part, we’ll walk through essential post-installation tweaks to refine and secure your system. We’ll cover console font adjustments for easier viewing, disabling the installation CD/DVD repository, and enabling sudo privileges for non-root users. To wrap up remote access and server management, we’ll configure SSH security, implement a basic firewall, and set up power management to manage display timeouts and keep laptop servers running when the lid is closed.

Part 2: Headless Debian Server: Post-Installation & Configuration

4. Post-Installation Configuration

Log in locally with your root account to perform initial server setup (or a regular user account if you did not allow root login).

With the root account, you don't need to use sudo to run commands; with a regular user account, you will need to add sudo.

Console Font Adjustment (Optional)

If you want to make the console font bigger, run this command:

dpkg-reconfigure console-setup

Or use sudo if you are a regular user:

sudo dpkg-reconfigure console-setup

Disable Installation CD/DVD Repository (If Needed, For Example, Virtual Machine Installation)

To stop apt from asking for the installation CD/DVD whenever you try to install software, disable the cdrom repository line in your sources list.

Edit the file using nano:

nano /etc/apt/sources.list

Or use sudo if you are a regular user:

sudo nano /etc/apt/sources.list

Find the line near the top that says:

deb cdrom:[Debian GNU/Linux ...]/ trixie main

Add a # at the very beginning of that line to comment it out:

# deb cdrom:[Debian GNU/Linux ...]/ trixie main

Save and exit using Control + O, Enter, then Control + X (or Control + X, Y, then Enter).

Update your package cache:

apt update

Or use sudo:

sudo apt update

Enable Sudo Privileges for Regular User (If You Allowed Login as Root)

By default, standard users in Debian do not have sudo access.

Switch to the root account (if needed):

su -

# Root's password

# Fails if root account has no password set

Or:

sudo -i

# Your user's password

# Works even if root account is locked/disabled

Install sudo:

apt install sudo

Add user to sudo group:

usermod -aG sudo username

Check user groups to verify:

groups username

Reboot or log out of both root and your regular user account, then log back in as your regular user to apply the changes.

exit
exit

Configure SSH Security

To manage your server securely over your local network using SSH.

If you did not install ssh server during setup, install it now with:

sudo apt install openssh-server

Start SSH Service

sudo systemctl start ssh

Enable SSH at Boot

sudo systemctl enable ssh

Open the SSH Daemon Configuration File

sudo nano /etc/ssh/sshd_config

Adjust the following settings if needed:

Change Default Port (Optional)

Change Port 22 to a custom non-standard port (for example, Port 2222).

Disable Direct Root Login (Recommended)

Set:

PermitRootLogin no

(if you do not want to allow log in directly as root via SSH).

Enable Direct Root Login

Set:

PermitRootLogin yes

(if you want to allow log in directly as root via SSH).

Note: prohibit-password option means root cannot log in using a password over SSH, but root is allowed to log in using an SSH key (public key authentication).

Note: If a setting line is commented out with a #, remove the # to enable it.

Save the file and exit (Control + X, Y, then Enter).

Then restart the SSH service:

sudo systemctl restart ssh

Set Up Basic UFW Firewall

Install Uncomplicated Firewall (UFW) to lock down unnecessary ports:

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh # Or if port was changed: sudo ufw allow 2222/tcp
sudo ufw enable
sudo ufw status

Power Management (Ignore Lid Close & Display Timeout)

If your server is running on a laptop, closing the lid by default puts Linux to sleep, and the built-in screen will stay on indefinitely.

1. Ignore Lid Close (Laptop Only)

Edit the systemd logind configuration:

sudo nano /etc/systemd/logind.conf

Uncomment (remove #) or add the following lines:

HandleLidSwitch=ignore
HandleLidSwitchExternalPower=ignore
HandleLidSwitchDocked=ignore

Save, exit, and apply changes:

sudo systemctl restart systemd-logind

2. Configure GRUB to Turn Off Display (Screen Blanking)

This applies to laptop and desktop devices.

Pass kernel parameters through GRUB to force the console display to turn off after a set period of inactivity (for example, 180 seconds = 3 minutes):

sudo nano /etc/default/grub

Find the line starting with:

GRUB_CMDLINE_LINUX_DEFAULT

Add consoleblank=180 inside the quotes:

GRUB_CMDLINE_LINUX_DEFAULT="quiet consoleblank=180"

Adjust the consoleblank time in seconds as needed.

Save and exit the file. Update GRUB and reboot:

sudo update-grub
sudo reboot

5. Remote Access & Server Management

Now that everything is configured, disconnect the external keyboard and screen (if using one). The server only needs a power cable and Ethernet cable.

Connect to the Server Using SSH

From another machine on the same local network (Windows Terminal, PowerShell, or macOS/Linux Terminal) type:

ssh username@server-ip-address
ssh root@server-ip-address

Example:

ssh asm@192.168.1.150

If you changed the SSH port:

ssh -p <port> username@server-ip-address
ssh -p <port> root@server-ip-address

Example:

ssh -p 2222 asm@192.168.1.150

Enter your password.

Note: Use your regular user account or root account to access the server via SSH, depending on your configuration and needs.

Essential Server Operation Commands

Update & Upgrade System Packages and Clean Up Unused Packages

sudo apt update
sudo apt upgrade
sudo apt autoremove

Check Uptime & System Load

uptime

Check Memory (RAM) Usage

free -h

Check Disk Space

df -h
lsblk

Check Network IP Address

ip a

Monitor Real-Time Resources

top

(Press q to exit).

Manage Background Services

Start, Stop, Restart, Reload a service:

sudo systemctl start <service_name>
sudo systemctl stop <service_name>
sudo systemctl restart <service_name>
sudo systemctl reload <service_name>

Enable, Disable a service to start at boot:

sudo systemctl enable <service_name>
sudo systemctl disable <service_name>

Service Status, currently running, starts at boot, failed to start:

sudo systemctl status <service_name>
sudo systemctl is-active <service_name>
sudo systemctl is-enabled <service_name>
sudo systemctl is-failed <service_name>

Check Active Ports & Services

ss -tulpn

Reboot Server

sudo reboot

Shutdown Server

sudo shutdown -h now

Your headless Debian server is now secure, optimized, and fully accessible over your local network!

You can disconnect your external monitors and keyboards if using a desktop and manage everything remotely via SSH.