Free tools Windows power users keep installed
One-click scans. No signup required.
Install Debian 13 on a VPS by selecting the provider’s current Trixie image, matching its architecture to your plan, injecting an SSH key, and completing the first-boot security work before you deploy anything. Debian 13.0 was released on 2025-08-09, and the Debian Project says Trixie has a five-year support horizon. The project recorded point release 13.7 on 2026-09-12, so image menus and package levels can differ by provider.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Debian 13 means for a VPS
Debian 13 is the stable release codenamed “trixie.” On a VPS, you normally do not boot a physical DVD or manually partition a virtual disk. The provider creates the virtual machine, attaches storage and networking, and boots a prepared Debian image. That image may be a provider-maintained Trixie template, a Debian GenericCloud image, or an installer exposed through a virtual CD, serial console, or network boot.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Debian says Trixie will be supported for the next five years through the combined work of its Security and Long Term Support teams. That does not mean every provider keeps an image current automatically: a marketplace template can lag behind Debian point releases, and a provider may continue to offer Debian 12 after Debian 13 is available. Check the image label and the build date shown in your control panel rather than relying on a generic “Debian” option.
Choose the right installation route
Provider Debian 13 image
Use this route when the VPS control panel explicitly offers Debian 13 or Trixie. It is usually the safest and fastest option because the provider has already handled the disk layout, bootloader, virtual hardware drivers, initial networking, and console integration. Before clicking Deploy, verify the image architecture, initial username, SSH-key field, IPv4 and IPv6 behavior, firewall defaults, and whether cloud-init must finish before you edit system files.
#1 Best Overall
Debian GenericCloud or marketplace image
Debian GenericCloud images are designed for virtualized environments. Cloud images include automation hooks such as cloud-init and cloud-oriented kernel and GRUB settings. They are appropriate when a provider supports image import or publishes a Debian marketplace image but does not maintain a custom template. Follow the provider’s required image format and metadata process. If a checksum or signature is supplied, verify it before importing the image.
Custom ISO, netboot, or console installation
Choose a full installer only when the provider does not offer a usable Debian 13 image and exposes a virtual CD, ISO upload, serial console, or network-boot path. Use Debian’s Debian 13 Installation Guide for media selection, integrity checks, partitioning, base-system installation, bootloader setup, and SSH selection. Keep the provider’s console open until you have completed a successful SSH login from a second session; the console is your recovery path if the network or SSH configuration is wrong.
Check the VPS plan before creating it
| Check | What to confirm | Why it matters |
|---|---|---|
| Architecture | The plan and image are both amd64 or both arm64, unless your provider documents another supported combination. | A mismatched image may not boot or may require a complete redeployment. |
| Resources | vCPU, RAM, storage type and capacity, and monthly transfer are sufficient for your workload. | Game servers, databases, and build jobs can exhaust small plans even when Debian itself runs comfortably. |
| Region | The data-center location has acceptable latency for administrators and players. | Region changes usually require a new instance or a migration. |
| Access | SSH-key injection, public IPv4 or IPv6, a web or serial console, and rescue mode are available. | You need at least one tested recovery method before changing SSH or firewall rules. |
| Network controls | Provider firewall or security-group rules can restrict inbound traffic and allow the ports your applications need. | Filtering at the provider edge reduces exposure before packets reach the VPS. |
| Recovery | Snapshots, image backups, and documented restore procedures are offered. | A failed update or configuration change should be reversible. |
Debian 13 officially supports amd64, arm64, armel, armhf, ppc64el, riscv64, and s390x. Most VPS menus expose only amd64 and arm64. Debian 13 no longer treats i386 as a regular supported architecture, so do not select an old 32-bit template expecting the same support level.
Install Debian 13 step by step
1. Create an SSH key on your workstation
Generate the key on a trusted computer, not on the new server. Ed25519 is a practical default for current OpenSSH clients:
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/debian13_vpsEnter a strong passphrase. The file ending in .pub is the public key; the file without that suffix is private and must remain on your workstation. Never paste the private key into a provider form, ticket, shell command, or chat. Restrict its local permissions if your operating system does not do so automatically:
chmod 600 ~/.ssh/debian13_vps
cat ~/.ssh/debian13_vps.pubCopy the complete single-line output from the second command. You will add only that public key during VPS creation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Deploy the current Trixie image
Select the provider’s current Debian 13/Trixie image and the architecture that matches the plan. Enter the public key in the provider’s SSH-key field. Record the instance’s public IPv4 address, any public IPv6 address, the region, and the provider’s documented initial username.
Do not assume the initial account is root. Cloud images choose their own account conventions. For example, Debian’s EC2 documentation instructs users to connect as admin with the SSH key and then run sudo -i for root access. Other providers may use debian, root, or a username shown only after deployment.
When importing a GenericCloud image, supply the provider’s required cloud-init metadata, hostname, network data, and SSH key. An image can boot successfully while still lacking the metadata needed to configure its interface or user account.
3. Make the first SSH connection
From your workstation, use the username and address supplied by the provider. The -i option selects the private key you created:
ssh -i ~/.ssh/debian13_vps INITIAL_USER@PUBLIC_IPOn the first connection, verify the host-key prompt through the provider’s documented fingerprint process when one is available. Keep a second terminal or browser tab connected to the provider console. Do not close it while you are changing access controls.
4. Verify the operating system, architecture, network, and clock
Before installing services, confirm that the machine is really the image and architecture you ordered:
cat /etc/os-release
uname -m
hostnamectl
ip -br addr
ip route
timedatectl/etc/os-release should identify Debian GNU/Linux 13 (Trixie). uname -m should agree with the plan, such as x86_64 for amd64 or aarch64 for arm64. Check that the expected public address is assigned, a default route exists, and the system clock is synchronized or in the process of synchronizing. If any of these checks fail on an imported image, stop and inspect cloud-init and the provider’s metadata requirements before proceeding.
5. Apply updates immediately
Refresh package metadata and install all currently available updates before exposing an application:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo apt update
sudo apt full-upgrade -yIf the upgrade replaces the kernel or core services, reboot during a planned maintenance window:
sudo rebootWait for the VPS to return, reconnect with SSH, and rerun cat /etc/os-release, uname -m, ip route, and timedatectl. A reboot is also a useful test that the image boots without relying on a temporary installer state.
6. Create a named sudo administrator
Keep the provider’s initial account until the replacement account works. Create a named administrator, add it to Debian’s sudo group, and install its public key:
sudo adduser opsadmin
sudo usermod -aG sudo opsadmin
sudo install -d -m 700 -o opsadmin -g opsadmin /home/opsadmin/.ssh
sudo sh -c 'echo "PASTE_OPSADMIN_PUBLIC_KEY" > /home/opsadmin/.ssh/authorized_keys'
sudo chown opsadmin:opsadmin /home/opsadmin/.ssh/authorized_keys
sudo chmod 600 /home/opsadmin/.ssh/authorized_keysReplace PASTE_OPSADMIN_PUBLIC_KEY with the public key for the administrator account. The command must contain the complete key on one line. Open a new terminal and test it before changing the original account:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →ssh -i ~/.ssh/debian13_vps opsadmin@PUBLIC_IP
sudo -v
sudo idThe last command should show effective user ID 0. If the new session fails, use the original SSH session or provider console to correct ownership, permissions, username, or the key contents.
7. Restrict inbound traffic at the provider edge
Start with the provider firewall or security group. Allow SSH only from the administration network when possible, and allow only the application ports you intend to publish. Keep IPv4 and IPv6 rules aligned; an overlooked IPv6 rule can expose a service that appears closed over IPv4.
Do not delete the provider’s emergency-console or rescue access. Console access is separate from SSH and may be the only way to repair a bad firewall rule.
8. Add a host firewall carefully
A host firewall provides a second control layer. Debian can use nftables directly. Install and enable it only after deciding which addresses and ports must remain reachable:
sudo apt install nftables
sudo systemctl enable --now nftablesCreate /etc/nftables.conf with a policy appropriate to your server. This example allows loopback traffic, established connections, SSH from one administration CIDR, and web traffic; replace ADMIN_CIDR and remove ports you do not use:
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
iifname "lo" accept
ct state established,related accept
ip protocol icmp accept
ip6 nexthdr icmpv6 accept
ip saddr ADMIN_CIDR tcp dport 22 accept
tcp dport { 80, 443 } accept
}
}Load and inspect the rules while your existing console or SSH session remains available:
sudo nft -c -f /etc/nftables.conf
sudo nft -f /etc/nftables.conf
sudo nft list rulesetAdd an IPv6 administration rule if you administer over IPv6. Test a new SSH connection and each intended application port from a separate network before logging out of the original session. If you run a game server, open only its documented game and query ports rather than exposing every listening service.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches9. Harden SSH after key login works
Once the named administrator has completed a successful second login, create a drop-in configuration:
sudo tee /etc/ssh/sshd_config.d/10-hardening.conf >/dev/null <<'EOF'
PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin no
EOFValidate the syntax before reloading SSH:
sudo sshd -t
sudo systemctl reload sshOpen another SSH session immediately. Keep the provider console available until the new policy is confirmed. If the initial provider account is required for rescue or cloud automation, follow that provider’s documented account policy rather than deleting it blindly. The goal is to remove password guessing and direct root login without removing your only recovery method.
10. Confirm time, logs, and the update process
Accurate time is required for useful logs, TLS validation, scheduled jobs, and many multiplayer services. Check synchronization and review the current boot and SSH messages:
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
timedatectl
systemctl status systemd-timesyncd --no-pager
sudo journalctl -p warning -b
sudo journalctl -u ssh --since todayUse the time-synchronization service already configured by the image unless your workload requires a different, documented choice. Establish a regular process for security updates. Automatic package installation can be appropriate for a disposable or tightly managed server, but unattended reboots should not be enabled on a production machine unless maintenance, monitoring, and rollback have been planned.
11. Take a recovery point before deploying applications
Create a provider snapshot or image backup after the base system is updated and access has been tested. Name it with the date, Debian release, architecture, and purpose. Restore a small file or launch a disposable instance from the backup to verify that it is usable; a successful snapshot operation alone does not prove restoration works.
Snapshots are not a replacement for application-consistent backups. Databases and other stateful services need their own backup procedure, retention policy, encryption plan, and restore test. Schedule those backups before deploying a production game server, control panel, or database.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Provider-specific deployment notes
| Provider path | What is documented | Actions you still need to take |
|---|---|---|
| Amazon EC2 | Debian documents Trixie AMIs for amd64 and arm64. Its instructions say to connect as admin with the SSH key and then run sudo -i. Current AMI parameters are discoverable through AWS Systems Manager under the Debian release path. |
Filter by region and architecture; an AMI ID is not universal. Configure the security group, verify the public address, and complete the common update, user, firewall, SSH, and backup steps. |
| Microsoft Azure | Debian documents Trixie marketplace syndication and Azure availability. | Use Azure’s image, NIC, network-security-group, and SSH-key workflow. Confirm the effective inbound rules and then perform the common post-install sequence. |
| Other VPS hosts | Availability, image freshness, console features, storage, transfer, and backup choices vary by vendor. | Prefer a current Debian 13 or GenericCloud image. If only Debian 12 is offered, do not label it Debian 13; wait for a Trixie image or use the vendor’s supported custom-image or upgrade procedure and document the choice. |
Pricing, image IDs, partner terms, region coverage, and support response are volatile. Compare the provider’s current page for total monthly cost, storage and transfer limits, IPv4 and IPv6 charges, console or rescue access, firewall capabilities, snapshot retention, and latency from your intended players or administrators.
Troubleshoot the first connection and boot
SSH times out
- Confirm that the instance is running and that you are using its current public address.
- Check the provider firewall or security group for TCP port 22 and verify that your source network is allowed.
- Check the host firewall, default route, interface address, and whether the VPS actually has a public route.
- Use the provider console to inspect services and revert the last network change.
“Permission denied (publickey)” appears
- Recheck the username; a Debian cloud image may not permit
rootor may require a provider-specific account. - Specify the correct private-key file with
-iand verify its local permissions. - Confirm that the matching public key was injected during creation and that
authorized_keysis owned by the target user with mode 600. - Inspect the SSH log through the console. Do not enable password authentication as an untested workaround.
The imported image has no network
- Run
ip -br addrandip routefrom the console. - Check interface naming, DHCP status, cloud-init completion, and the provider’s required metadata or network-data format.
- Compare the image’s cloud-kernel and boot configuration with the provider’s supported import instructions.
The architecture is wrong
Compare uname -m with the architecture selected for the plan. Redeploy a matching image instead of forcing packages or binaries built for another architecture. This is usually faster and safer than trying to repair a fundamentally mismatched template.
You are locked out after an SSH or firewall change
Open the provider’s serial or VNC console, or boot rescue mode if that is the documented recovery path. Revert the last SSH or firewall change, validate the configuration, reload the service, and test from a second network before applying the restriction again. Keep one console session open during every future access-control change.
Debian 13 VPS readiness checklist
- The image explicitly says Debian 13 or Trixie, and its architecture matches the VPS plan.
- The provider’s current image build or point-release information has been checked.
- An encrypted, passphrase-protected SSH private key remains only on your workstation.
- The provider username, public addresses, region, and console URL are recorded.
/etc/os-release,uname -m, routes, addresses, and time synchronization have been verified.- APT metadata and all available updates have been installed, with a reboot completed when required.
- A named sudo administrator has a tested key-based login in a second session.
- Provider and host firewalls allow only administration and application ports that are needed.
- Password SSH login and direct root login are disabled only after recovery access is proven.
- Logs, time synchronization, security updates, snapshots, and application-consistent backups have an owner and a schedule.
At this point the VPS is a maintained Debian 13 base rather than an unverified image. Deploy applications only after the access, network, update, and recovery checks above pass.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
