The quickest way to install Debian 13 on a VPS is to select the provider’s current Debian 13 (Trixie) image, inject an SSH public key during creation, connect with the provider’s documented initial username, and complete a short security checklist. A full ISO installation is necessary only when your VPS host does not offer a Debian 13 or GenericCloud image but does provide virtual media, a serial/VNC console, or network boot.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Debian 13, code-named trixie, was released on 2025-08-09. The Debian Project says it has a five-year support horizon through the combined Debian Security and Long Term Support teams. Point releases continue during that period; Debian 13.7 was published on 2026-09-12. Image contents and point-release numbers can change, so choose the provider’s current Trixie image when you deploy.
As an Amazon Associate I earn from qualifying purchases.
What you need before creating the VPS
Have these items ready before opening the provider’s deployment form:
- A VPS plan with enough virtual CPU, memory, disk, and transfer for the workload you intend to run.
- The correct CPU architecture: normally
amd64(x86-64) orarm64. - An SSH key pair created on your own workstation. You will upload only the public key.
- A plan for a public IPv4 address, IPv6, or both. Some providers make IPv4 optional or bill it separately.
- Access to the provider’s web console, serial console, VNC console, or rescue mode. Keep that recovery path available while changing SSH or firewall settings.
- A backup or snapshot option. A snapshot is useful for rollback, but it is not a replacement for application-consistent database backups.
Debian 13 architecture choices
Debian officially supports amd64, arm64, armel, armhf, ppc64el, riscv64, and s390x for Trixie. Most VPS panels expose only amd64 and arm64. Select the image that matches the plan’s actual CPU architecture; an image for one architecture will not run correctly on another. Debian 13 no longer treats i386 as a regular supported architecture.
#1 Best Overall
Choose the right installation method
Provider Debian 13 image
Use this route whenever the control panel offers Debian 13 or Trixie directly. The provider normally handles virtual disk layout, bootloader installation, virtual hardware, initial networking, and console integration. Before clicking Create, check the image’s architecture, initial username, SSH-key field, IPv4 and IPv6 behavior, default firewall rules, and whether cloud-init must finish before the first login.
Debian GenericCloud or marketplace image
Debian GenericCloud images are designed for virtualized environments. They include cloud-oriented kernel and GRUB settings and automation hooks such as cloud-init. Providers may expose these images through an image marketplace or an image-import workflow. Follow the host’s required disk format and metadata settings, and verify a checksum or signature if the host publishes one.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do not assume the first account is root. For example, Debian’s EC2 instructions use the account admin for the initial SSH connection, followed by sudo -i for a root shell. Your provider may use another username.
Custom ISO, netboot, or console installation
Choose a custom installer only when no suitable Debian 13 image is available. Attach the Debian 13 installer ISO, use the provider’s serial or VNC console, or select its network-boot installer. The installer path requires you to choose media, verify integrity where possible, partition the virtual disk, install the base system and bootloader, configure networking, and select an SSH server. Leave the console session open until you have tested remote SSH access.
Deploy Debian 13 from a provider image
- Select a region and plan. Choose a region close to your users or dependent services to reduce latency. Check vCPU, RAM, storage type and size, transfer allowance, backup pricing, and whether IPv4 is included.
- Match the architecture. Select amd64 or arm64 to match the plan. If the panel separates images by architecture, do not rely on the image name alone; confirm the architecture label.
- Create your SSH key locally. On a Linux or macOS workstation, run
ssh-keygen -t ed25519 -a 100. Accept a protected location and set a passphrase. On Windows, create an Ed25519 key with OpenSSH in PowerShell or use the provider’s documented key-generation method. Never upload the private-key file. - Record connection details. Save the new instance’s public IPv4 and IPv6 addresses, the initial username, the SSH port if it is not 22, and the provider’s console link.
- Choose the current Trixie image. Prefer the provider’s official Debian 13 image. If importing GenericCloud, provide the cloud-init metadata or SSH key exactly as the provider documents. A Debian 12 image is not Debian 13; do not relabel it.
- Wait for provisioning to finish. Cloud-init may still be creating the account, installing keys, resizing the filesystem, or configuring networking. Use the panel’s status indicators and provider console rather than repeatedly retrying SSH while initialization is active.
Connect over SSH and verify the installation
From a trusted workstation, connect with the provider’s username and your private key. Replace the placeholders with your actual values:
ssh -i ~/.ssh/your_key [email protected]
For an IPv6 address, use brackets when a tool requires a host-and-port form, for example ssh -i ~/.ssh/your_key username@[2001:db8::10]. If the provider uses a custom port, add -p PORT.
Recommended Free Tools
Keep the provider console open in a second session. After login, verify the release, architecture, hostname, addresses, and clock:
cat /etc/os-release
uname -m
hostnamectl
ip address
ip route
timedatectl/etc/os-release should identify Debian GNU/Linux 13 (trixie). uname -m should correspond to the plan: commonly x86_64 for amd64 or aarch64 for arm64. Check that the expected public address and default route are present and that the clock is synchronized or actively synchronizing.
Update Debian before installing applications
Do not deploy a web server, database, container runtime, or control panel on an unpatched image. Refresh package metadata and install all available updates:
sudo apt update
sudo apt full-upgradeReview the package list before confirming. If the upgrade installs a new kernel or restarts core services, reboot during a planned maintenance window:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchessudo rebootReconnect after the VPS returns, then verify the release and network again:
cat /etc/os-release
uname -r
systemctl --failedA point release such as Debian 13.7 changes the image and package baseline without changing the major release name. Continue to use the current Debian 13 repositories and provider image rather than pinning an old point-release image.
Create a named administrator and test recovery
Use a personal, named account for routine administration instead of sharing a root login. The exact commands below create an account named adminuser; substitute your preferred name.
- Create the account and set a password for console recovery:
sudo adduser adminuser - Grant sudo access:
sudo usermod -aG sudo adminuser - Install the user’s public key:
sudo install -d -m 700 -o adminuser -g adminuser /home/adminuser/.sshsudo nano /home/adminuser/.ssh/authorized_keys
Paste one complete public key on one line, save it, then run:sudo chown adminuser:adminuser /home/adminuser/.ssh/authorized_keyssudo chmod 600 /home/adminuser/.ssh/authorized_keys - Test a second session before changing SSH:
ssh -i ~/.ssh/your_key [email protected]
Inside that session, test elevation withsudo -vand, when needed,sudo -i.
Do not remove or disable the provider’s initial account until the new account, key, sudo access, and console recovery method have all been tested.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Control network exposure
Use two layers when available: the provider’s network firewall or security group and a host firewall on Debian. The provider layer can block traffic before it reaches the VPS; the host layer protects the machine if provider rules are changed or bypassed internally.
Provider firewall rules
Start with a deny-by-default inbound policy. Permit SSH only from your administration network if its address is stable. Permit 80/tcp and 443/tcp only when you are ready to publish a web service. Add database, monitoring, mail, or custom application ports only when the workload requires them. Keep outbound access restricted only if you understand the application’s update and dependency needs.
Host firewall with nftables or UFW
Debian supports nftables directly. If you prefer a simpler command interface, install UFW and establish the SSH rule before enabling it:
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 198.51.100.0/24 to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseReplace 198.51.100.0/24 with your real administration range. If your address changes frequently, use another controlled access method rather than opening SSH to the entire internet. Add IPv6 rules deliberately; an IPv4-only rule does not necessarily protect the IPv6 interface.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteTest access from a separate connection before ending the original session. If you lock yourself out, use the provider console or rescue mode to revert the last firewall change.
Harden SSH without losing access
Only change SSH policy after key-based login works in a new session. Back up the configuration and validate syntax before reloading:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
sudo sshd -tEdit the configuration with your preferred editor:
sudo nano /etc/ssh/sshd_configSet the policy appropriate to your recovery plan:
PasswordAuthentication no
PermitRootLogin noSome installations use drop-in files under /etc/ssh/sshd_config.d/; check those files if an existing setting overrides the main file. Validate again and reload:
sudo sshd -t
sudo systemctl reload sshOpen and test another SSH session immediately. Keep the console available until you have confirmed the new account, key, firewall, and SSH policy from an independent connection. Do not disable every recovery route at once.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Configure time, logs, updates, and backups
Time synchronization
Run timedatectl status and confirm the system is using the intended time zone and synchronized clock. Correct time is important for TLS certificates, authentication, scheduled jobs, and log correlation. Use Debian’s maintained time-synchronization service rather than setting the clock manually.
Logs and failed services
Review the boot and authentication journals after the first update:
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
sudo journalctl -b -p warning
sudo journalctl -u ssh --since today
sudo systemctl --failedSet a retention policy that matches the VPS disk size and your incident-response needs. Forward important logs off the VPS if losing the instance would also lose the evidence.
Free tools Windows power users keep installed
One-click scans. No signup required.
Security updates
Enable a maintained process for Debian security updates that fits the workload. Automatic package downloads can reduce exposure, but automatic reboots can interrupt production services. If you do not plan controlled reboots, monitor pending kernel and service restarts and schedule them explicitly.
Snapshots and application backups
Take a provider snapshot or image backup after the base system is updated and access is tested. Before deploying a database or other stateful service, configure application-consistent backups and test restoring a small file or disposable instance. A snapshot captures a disk state; it does not guarantee a transactionally consistent database backup.
Provider-specific deployment notes
| Environment | What to verify | Initial access detail |
|---|---|---|
| Amazon EC2 | Select a Trixie AMI matching the region and amd64 or arm64 architecture. AMI identifiers are not universal; discover current parameters through the Debian release path in AWS Systems Manager. | Debian documents connecting as admin with the SSH key, then running sudo -i. |
| Microsoft Azure | Use the current Debian 13 marketplace image, then verify the virtual NIC, network security group, public address, and SSH key. | Follow the image and SSH-key workflow for the selected region, then complete the common update and hardening steps. |
| Other VPS hosts | Prefer a current Debian 13 or GenericCloud image. Check console or rescue access, key injection, IPv4/IPv6 support, firewall controls, snapshots, storage, transfer limits, region latency, and support terms. | The initial username varies. Read the provider’s image notes instead of assuming root. |
Prices, image IDs, partner terms, storage limits, and transfer allowances change by provider and geography. Check the provider’s current page when ordering rather than relying on an old plan comparison.
Troubleshoot the first connection
SSH times out
- Confirm the VPS is running and that you are using its current public address.
- Check the provider firewall or security group for the SSH port and source address.
- Check the host firewall from the provider console.
- Verify that the instance has a public route and that you are using IPv4 or IPv6 intentionally.
- Use the console to inspect
ip route, interface state, and the SSH service.
Permission denied (publickey)
- Confirm the username from the image documentation.
- Specify the matching private key explicitly with
-i. - On Unix-like workstations, protect the key with
chmod 600 ~/.ssh/your_key. - Check that the corresponding public key was injected and that
authorized_keysownership and permissions are correct. - Use verbose client output,
ssh -vvv, to see which key the client offers.
Do not enable password authentication as a blind workaround; use the provider console to correct the account or key.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →No network after importing an image
Inspect the interface name, DHCP state, default route, cloud-init status, and provider metadata requirements. GenericCloud images depend on the host supplying the expected metadata and virtual hardware. Compare the provider’s required image format and network configuration with the imported image documentation.
Wrong architecture or image
Compare uname -m with the VPS plan and image architecture. Redeploy a matching image instead of forcing packages or binaries built for another architecture. If the host supplied Debian 12 only, either wait for its supported Trixie image or use its documented custom-image or upgrade procedure and record that choice accurately.
Locked out after SSH or firewall changes
Open the provider’s serial or VNC console, rescue environment, or recovery shell. Revert the last SSH or firewall change, run sshd -t where applicable, reload the service, and test from a second SSH session before making further changes.
Quick Recap
Final Debian 13 VPS checklist
- The image says Debian GNU/Linux 13 (trixie), and its architecture matches the VPS plan.
- You have a tested SSH key, the correct initial username, and a working console or rescue path.
- APT is fully updated, and any required reboot is complete.
- A named sudo administrator works in a second SSH session.
- Provider and host firewalls expose only required ports, including deliberate IPv6 rules.
- Password authentication and direct root login are disabled only after key access is verified.
- Time synchronization, SSH logs, failed services, and security-update handling are configured.
- Snapshots or image backups exist, and application-consistent backups have been tested before production deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
