Installing Debian 13 on a Fully Encrypted Disk

Jump to the Summary

This is the foundation for everything else in the series: a minimal Debian 13 ("Trixie") with no desktop, only an SSH server, and the whole system disk encrypted. If someone walks away with the server or just the disk, they get nothing without the passphrase – and a box that will hold mail, documents and passwords is worth protecting that way.

Every step has the same shape: Command – what you type, What it does – the explanation, and Check – how you know it worked. The names below are examples; use your own.

Example names used in this chapter:

1.1 Download the Installer

On debian.org download the small netinst image for amd64 (a file like debian-13.x.x-amd64-netinst.iso) and the file SHA256SUMS from the same folder. The netinst image contains just the installer; everything else is downloaded during the installation, so you end up with current packages.

Command (Windows, Command Prompt, in the download folder):

certutil -hashfile debian-13.x.x-amd64-netinst.iso SHA256

What it does: calculates the checksum of the downloaded file.

Check: the result must match the line for the same file in SHA256SUMS. If it doesn't, the download is broken or has been tampered with – download it again. On Linux the same check is sha256sum -c SHA256SUMS --ignore-missing.

1.2 The Installation USB Stick

With Rufus on Windows: choose the USB stick and the ISO, click Start, and when Rufus asks how to write the image, choose DD Image mode.

What it does: copies the image to the stick byte for byte. Debian's images are made to be written exactly like that, and DD mode is the most reliable way to get a stick the PC will boot from. Everything on the stick is erased.

On Linux you don't need an extra program. First find out which device the stick is:

Command:

lsblk -o NAME,SIZE,MODEL,TRAN

What it does: lists the disks. Run it once without the stick and once with it – the new line (for example sdb, about the size of the stick, with usb in the last column) is the stick.

Command (replace sdX with the stick – the whole device, not a partition like sdb1):

sudo umount /dev/sdX?*
sudo dd if=debian-13.x.x-amd64-netinst.iso of=/dev/sdX bs=4M status=progress oflag=sync

What it does: unmounts the stick if the desktop mounted it, then writes the image to it byte for byte – the same as Rufus's DD mode. status=progress shows how far it is, oflag=sync makes sure everything is really written before the command ends.

⚠️ dd doesn't ask twice. If of= points to the wrong disk, that disk is overwritten. Check the name with lsblk again right before you press Enter. If you prefer clicking, GNOME Disks can do the same: select the stick, open the menu and choose Restore Disk Image.

Check: when you start the PC with the boot menu key (F12 on a Lenovo ThinkCentre), the stick is listed as a boot device. A stick written on Linux works exactly the same.

1.3 BIOS Settings

Open the BIOS setup at startup (F1 on a Lenovo ThinkCentre) and set:

• Boot mode: UEFI.
• After Power Loss: Power On – after a power cut the server switches itself back on. The disk is then unlocked over SSH (chapter 2).

Then start from the USB stick through the boot menu (F12).

Check: unplug the power, plug it back in – the PC starts on its own.

1.4 The Installer – the Basics

Choose Install (the text installer) and answer:

Why an empty root password: the Debian installer then disables the root account, installs sudo and lets the first user use it. Nobody can log in as root with a password, and every administrative command goes through sudo, which leaves a trace in the logs.

1.5 Partitioning – Encrypted LVM

What it does: the installer creates three things on the disk:

• a small /boot/efi partition – not encrypted, the firmware needs it to start;
• a /boot partition – not encrypted, it holds the kernel and the initramfs that asks for the passphrase;
• an encrypted LUKS partition with LVM inside, holding root and swap.

Why LVM inside LUKS: one passphrase unlocks everything, including the swap – and swap can contain pieces of memory with passwords in them, so it must not stay unencrypted. More about how disk encryption works is in How Encryption Works.

⚠️ The encryption passphrase is the only key to the data. Lose it and the data is gone – there is no recovery. Keep it in the password manager and on paper in a drawer.

Check: before you confirm, the summary shows crypto and lvm on the NVMe disk, not on the USB stick.

1.6 Software Selection

Untick everything except:

• ✅ SSH server
• ✅ standard system utilities

What it does: no desktop and no services you don't need. Fewer programs mean fewer updates and less to attack.

1.7 First Boot – Unlocking the Disk

At startup the screen shows:

Please unlock disk nvme0n1p3_crypt:

Type the encryption passphrase (nothing is shown while you type) and press Enter.

What it does: the initramfs opens the LUKS partition, then the system starts.

Check: the login prompt homeserver login: appears. After chapter 2 this is done over SSH instead of at the screen.

1.8 First Login and Updates

Log in as username – at the screen, or from another computer with ssh username@<address>.

Command:

sudo apt update && sudo apt full-upgrade -y

What it does: refreshes the package lists and installs all updates.

Check:

cat /etc/debian_version

prints a version starting with 13.

Command:

sudo -l

What it does: lists what the user may run with sudo.

Check: the output contains (ALL : ALL) ALL.

1.9 Check the Encryption

Command:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT

What it does: shows the disks, partitions and what is mounted where.

Check: under the NVMe disk you see crypto_LUKS → crypt (nvme0n1p3_crypt) → lvm, with homeserver--vg-root on / and homeserver--vg-swap_1 as [SWAP]. The double dash is not a typo – that's how the device mapper writes a dash inside a name.

Command:

sudo cryptsetup luksDump /dev/nvme0n1p3 | grep -E 'Version|Keyslots' -A3

What it does: shows the header of the encrypted partition.

Check: Version: 2 (LUKS2) and an occupied key slot 0:.

1.10 Time Zone and Clock

Command:

sudo timedatectl set-timezone Europe/Berlin
timedatectl

What it does: sets the time zone (use your own – timedatectl list-timezones lists them) and shows the state of the clock.

Check: the right Time zone and System clock synchronized: yes.

Why it matters: certificates, two-factor codes (TOTP) and logs all depend on the correct time.

1.11 A Fixed Address

The server stays on DHCP, and the router always gives it the same address. On a UniFi gateway: open the device under Client Devices, enable Fixed IP Address (for example 192.168.40.20) and add a Local DNS Record such as homeserver.lan.example.net. Other routers call this a DHCP reservation.

Command (on the server, to find the network card and its MAC address):

ip -br link
ip -br addr

What it does: lists the network interfaces (for example eno1), their MAC addresses and the current addresses.

Why on the router: all addresses are managed in one place, and the server needs no changes if the network is ever rebuilt.

Check (after sudo reboot and unlocking the disk):

ip -br addr show eno1

shows 192.168.40.20/24.

1.12 Automatic Security Updates

Command:

sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

Answer Yes.

What it does: installs Debian's security updates automatically every day.

Check:

systemctl status unattended-upgrades --no-pager | head -3
cat /etc/apt/apt.conf.d/20auto-upgrades

The file contains Update-Package-Lists "1" and Unattended-Upgrade "1". What was installed is logged in /var/log/unattended-upgrades/unattended-upgrades.log.

1.13 zram – Compressed Memory as Swap

Command:

sudo apt install -y zram-tools
echo -e "ALGO=zstd\nPERCENT=50" | sudo tee /etc/default/zramswap
sudo systemctl restart zramswap

What it does: uses part of the RAM as compressed swap. When memory runs low, the system first uses the fast zram and only then the swap on the disk.

Check:

swapon --show

lists /dev/zram0 with a higher priority, and the swap from LVM.

1.14 Basic Tools

Command:

sudo apt install -y curl wget git htop tmux rsync smartmontools

What it does: installs the tools you will keep reaching for: downloads, version control, a process viewer, terminal sessions that survive a dropped connection, copying, and disk health.

Check:

sudo smartctl -H /dev/nvme0n1

prints PASSED. More about what the disk's SMART data tells you is in How Storage Works.

Summary

Next: Chapter 2 – Unlocking the encrypted disk over SSH, so the server can live without a monitor and keyboard. For the security side of the whole setup see Security Considerations.