First steps on Debian and FreeBSD servers

How these systems differ

Debian is close to Ubuntu: it uses apt, systemd and the same file layout, but a minimal install may not include sudo. FreeBSD is a different operating system with its own tools: pkg for packages, rc.conf for services, a separate base system updated with freebsd-update, and the pf firewall. Commands on the other guides need translating for FreeBSD.

Debian: update and install sudo

Log in as root or with the account you were given, update the package lists and install updates, and install sudo if it is missing. Then create a regular user and give it sudo rights.

apt update
apt upgrade
apt install sudo
adduser deploy
usermod -aG sudo deploy

ssh deploy@YOUR_SERVER
sudo -v

Debian: SSH keys and firewall

Add your public key to the new user and test a key login, then turn on a firewall. Debian does not include UFW by default, so install it, and allow SSH before enabling.

If SSH uses a custom port, allow that actual port before enabling UFW; 22 is only the default. Confirm the listener from your working session.

ssh-copy-id deploy@YOUR_SERVER

sudo apt install ufw
SSH_PORT=$(echo "$SSH_CONNECTION" | awk '{print $4}')
sudo ufw allow "$SSH_PORT/tcp"
sudo ufw enable
sudo ufw status verbose

Debian: automatic security updates

Install unattended-upgrades to apply security fixes automatically. Debian enables security updates in its default configuration once the package is installed.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
systemctl list-timers apt-daily*.timer

FreeBSD: update the system and packages

FreeBSD updates the base system and the third-party packages separately. Fetch and install base system patches with freebsd-update, then bootstrap and update pkg. Restart if the update asks you to, especially after a kernel update.

freebsd-update fetch install
pkg update
pkg upgrade
freebsd-version -kru

FreeBSD: create a user and install sudo

Create a user with the pw command or the adduser script and add it to the wheel group, which is the group allowed to become root. Install sudo, or the simpler doas, and allow the wheel group to use it.

adduser
# answer the prompts, and invite the user into the wheel group
pkg install sudo
visudo
# remove the # before the line: %wheel ALL=(ALL:ALL) ALL

FreeBSD: SSH keys and the service

Copy your key to the new user, test the login, then make sure the SSH service is enabled at boot with sysrc. Services in FreeBSD are controlled with the service command and the settings in /etc/rc.conf.

ssh-copy-id deploy@YOUR_SERVER

sysrc sshd_enable="YES"
service sshd status
sysrc -a | head -n 20

FreeBSD: enable the pf firewall

pf is FreeBSD's packet filter. This minimal ruleset blocks incoming connections by default and allows SSH and, if you serve a website, ports 80 and 443. Replace vtnet0 with your interface from ifconfig. Load it carefully, because a wrong rule can cut your connection, so keep the console available.

Replace 22 in tcp_services when SSH uses a different port. Starting pf can interrupt a connection established before its state table existed. Keep the provider console available and open a fresh SSH connection after starting it; confirm access before leaving the console.

ifconfig -l
cat > /etc/pf.conf <<'EOF'
ext_if = "vtnet0"
tcp_services = "{ 22, 80, 443 }"
set skip on lo0
block in all
pass out all keep state
pass in on $ext_if proto tcp to port $tcp_services keep state
pass in inet proto icmp all icmp-type echoreq
EOF
pfctl -nf /etc/pf.conf

sysrc pf_enable="YES"
service pf start
pfctl -sr

FreeBSD: everyday commands

These are the equivalents of commands you may know from Linux guides: installing and removing packages, listing services, reading logs and checking resources.

pkg install nginx
pkg search nginx
sysrc nginx_enable="YES"
service nginx start
service -e
tail -n 50 /var/log/messages
top -b | head -n 12
df -h