Complete Debian
Installation Walkthrough
A screen-by-screen companion to the existing Debian Installation & Partitioning project document. This walkthrough is based on the Debian 13 trixie amd64 installer for normal 64-bit Intel/AMD PC-class systems.
About this Walthrough
Use this document for the installation workflow: what to click or select, what each installer question means, and which answer is normally right for a server, desktop, VM, laptop, offline install, or dual-boot machine. Use the original partitioning guide when the installer reaches Partition disks and you need detailed storage design.
This companion is an amd64 walkthrough. It assumes the Debian 13 trixie installer for 64-bit Intel/AMD PCs, laptops, servers, and VMs. Other Debian architectures may use different boot media, firmware paths, kernel packages, device support, or installer details, so those installs should be checked against their own Debian architecture manual.
Official Debian Documentation Baseline
The baseline for this guide is the official Debian GNU/Linux Installation Guide for the
current stable release on amd64. At the time of this revision, the Debian stable installation
manual identifies the target system as Debian GNU/Linux 13, codename
trixie, for the 64-bit PC / amd64 architecture. The manual
build referenced during review was 20250803+deb13u1.
| Official Area | Used For | Project Decision |
|---|---|---|
| 2.1 Supported Hardware | Architecture, CPU, graphics, NIC, wireless, peripheral support | Keep amd64 as the normal PC/server target; explain firmware and wireless caveats. |
| 2.4 Installation Media | USB, DVD, network, hard disk, and Unix/GNU-system install paths | Recommend USB netinst for normal installs, DVD-1 for offline installs, PXE for managed fleets. |
| 4 Obtaining Installation Media | Official images, USB preparation, checksum verification | Keep direct-image USB writing and checksum verification as mandatory preparation steps. |
| 5 Booting the Installation System | Boot menu behavior, graphical/text installer, boot parameters, rescue/expert options | Explain Graphical install vs Install, Advanced options, and BIOS/UEFI boot-mode impact. |
| 6 Using the Debian Installer | The actual screen flow from localization through partitioning, APT, tasksel, GRUB, and finish | Use as the main sequence for this companion guide. |
| 7 Booting Into the New System | First boot, GRUB, encrypted-volume prompt, login | Include the first-boot checks and encrypted-volume expectations. |
| 8 Next Steps | Debian packaging orientation and immediate post-install care | Include APT, documentation, update, and system sanity checks. |
For a controlled installation guide, use the release codename trixie in examples instead of the moving alias stable. This avoids silent behavior changes after a future Debian stable release transition.
The Debian Install in One Timeline
Debian Installer is modular. Not every module appears in every installation, but a normal netinst or DVD-1 install follows the same broad structure. Treat this as the mental map before going screen by screen.
Installer Choices Beginners Commonly Misread
The normal text installer is linear, but several screens ask questions whose consequences are larger than they first appear. Treat the following as the plain-English map for the screens between hardware detection and task selection.
| Installer Screen | Beginner Meaning | Safe Default |
|---|---|---|
| Configure the network | DHCP is easiest. Static addressing belongs to servers, labs, and networks where you already know IP, gateway, DNS, and domain policy. | Use DHCP unless you have a written network assignment. |
| Configure the package manager | A network mirror lets netinst download the desktop, server packages, updates, and security fixes during installation. | Use a nearby Debian mirror or deb.debian.org when the machine has internet access. |
| Partition disks | Guided - use entire disk is simple but destructive. Separate /home keeps user data on its own filesystem, but it is not a backup and does not protect against disk failure. | Use guided partitioning for throwaway VMs; review disk names carefully on real hardware. |
| Software selection | tasksel installs broad roles such as a desktop environment, SSH server, or standard utilities; it is not a hardware-driver wizard. | For servers, keep the desktop unchecked and select SSH only when remote login is needed. |
Hardware and Planning Requirements
For modern PC-class systems, choose the amd64 installer. That is the correct Debian architecture for normal 64-bit Intel and AMD desktops, laptops, servers, and VMs. The official Debian manual also lists other release architectures, but they are not the target of this amd64 walkthrough.
Use amd64 when choosing Debian installation images, reading Debian mirror directories, writing APT architecture filters, or checking dpkg --print-architecture. Terms such as x86-64, x64, and 64-bit Intel/AMD are useful hardware descriptions, but Debian's native architecture string for normal 64-bit PC-class installs is amd64.
Other Debian 13 architectures you may encounter
This walkthrough remains intentionally amd64-focused, but Debian 13 trixie is not limited to PC-class Intel/AMD hardware. Use this table to recognize when the amd64 instructions are the wrong starting point and the architecture-specific Debian manual should be checked instead.
| Architecture | Common Where | Install Note |
|---|---|---|
amd64 | 64-bit Intel/AMD PCs, laptops, servers, and most VMs | The target of this companion walkthrough. |
arm64 | 64-bit ARM servers, cloud ARM, many SBCs, Apple Silicon VMs, and modern ARM development boards | Use the arm64 installation manual and arm64 media; boot firmware and device-tree/UEFI behavior can differ from amd64. |
armhf | Older 32-bit ARMv7 devices with hardware floating-point support | Use only for genuinely 32-bit ARMv7 hardware; prefer arm64 when the hardware supports it. |
ppc64el | IBM POWER little-endian systems | Enterprise/server architecture; installer and boot details are architecture-specific. |
s390x | IBM Z and LinuxONE | Mainframe/server architecture with its own installation path. |
riscv64 | 64-bit little-endian RISC-V systems | Official Debian 13 release architecture; hardware support is advancing but should be validated against the RISC-V installation notes. |
i386 | Legacy 32-bit x86 userland compatibility on amd64 | Not a normal fresh Debian 13 PC install target; use amd64 for real PC installations where possible. |
armel | Legacy ARM EABI systems | Upgrade/legacy path rather than a normal new-install target in Debian 13. |
| Install Type | Debian Manual Minimum | Practical Admin Recommendation | Notes |
|---|---|---|---|
| No desktop | 512 MB RAM minimum, 1 GB recommended, 4 GB disk | 2 GB RAM, 20+ GB disk for a useful server | The installer can work lower with swap, but updates and logs need headroom. |
| Desktop | 1 GB RAM minimum, 2 GB recommended, 10 GB disk | 4-8 GB RAM, 40+ GB disk | GNOME and KDE Plasma are heavier; Xfce is better on low-end systems. |
| Graphical installer | Needs more memory than text installer | Use text installer below roughly 1 GB RAM | The text installer reaches the same result with lower memory use. |
| Encrypted LVM | Same base requirements | Add time for disk erase and CPU crypto overhead | Slow disks and large SSDs can make the erase step lengthy. |
| Offline DVD | Enough disk for selected tasks | DVD-1 plus a plan for updates after network is available | Without a mirror, selected tasks must exist on the scanned media. |
Information to collect before booting
- 1Target disk identity: model, size, serial number, and whether it appears as
/dev/sda,/dev/vda, or/dev/nvme0n1. - 2Boot mode: native UEFI is preferred for modern systems; avoid accidental CSM/legacy boot on a UEFI machine.
- 3Network settings: DHCP is simplest; for static IP collect address, prefix/netmask, gateway, DNS, hostname, and domain.
- 4Mirror policy: internet installs should normally use
deb.debian.org; air-gapped installs need DVD/package planning. - 5Account policy: decide whether to enable root login directly or leave root disabled and use sudo through the first user.
- 6Partition plan: simple root, LVM, encrypted LVM, RAID, or dual boot. Do not improvise destructive disk layout decisions.
Before installing on a disk that contains existing data, back up the data and verify the backup can be restored. Debian Installer asks for confirmation before destructive writes, but confirmation does not protect against choosing the wrong disk.
Firmware and Network Preparation
Most Ethernet adapters supported by the Linux kernel are usable in the installer. Wireless is supported in many cases, but it remains more fragile than wired Ethernet because firmware, authentication, and chipset support matter before the full installed system exists.
- Most reliable with netinst
- Minimal authentication complexity
- Mirror setup usually succeeds automatically
- Best for servers and VMs
- May require firmware
- WPA/WPA2 personal networks are the practical target
- Captive portals and enterprise Wi-Fi are poor fits
- DVD-1 can avoid network dependency
Firmware handling in Debian 13
Starting with the Debian 12-era firmware policy and continuing in Debian 13, official Debian
installer images can include packages from the non-free-firmware archive component.
During installation, debian-installer detects firmware requested by drivers and can
install matching firmware packages when they are present on the installation medium. This means
the normal official Debian 13 netinst or DVD-1 image is the correct first choice for most systems;
a separate emergency firmware USB is only a fallback for firmware that is still not available on
the installer media, for netboot/minimal paths without firmware packages, or for unusual hardware.
# Recommended emergency firmware USB layout
# FAT-formatted USB stick:
/firmware/
firmware-package.deb
or-loose-firmware-file.bin
# The installer also scans the root of the removable medium.If a driver requests firmware that is missing, the installer offers to scan available media. If a firmware package is loaded, it can be copied into the installed system and the APT source can be configured so firmware updates are available later.
Choosing the Correct Installation Media
Debian supports several installation paths. For a normal administrator workflow, the realistic choices are netinst USB, DVD-1 USB/DVD, live desktop media, PXE/netboot, or a debootstrap-style install from an existing Unix/Linux system.
| Method | Network Need | Best For | Practical Recommendation |
|---|---|---|---|
| netinst ISO on USB | Required for normal package selection | Servers, VMs, most desktops with internet | Default choice for clean installs. |
| DVD-1 ISO | Optional but recommended | Offline/slow internet installs | Use when the installer cannot reach a mirror. |
| Live desktop ISO | Optional | Hardware testing and desktop preview | Good for testing; the Calamares installer is simpler but less flexible than d-i. |
| PXE / netboot | Required | Fleet, rack, lab, automated deployment | Use when DHCP/TFTP/provisioning infrastructure already exists. |
| Hard-disk boot | Depends | Special rescue or no-removable-media cases | Use only when USB/DVD/PXE are unavailable. |
| From existing Unix/Linux system | Depends | Advanced debootstrap installs | For experienced admins; outside normal d-i flow. |
Use the Debian 13 amd64 netinst ISO for normal installs with internet access. Use DVD-1 when you need the installer to succeed without a network mirror. Use PXE only when deploying multiple systems or installing remotely through managed infrastructure.
Automation: Preseed, PXE, and FAI
The screen-by-screen path in this guide is the right mental model for a first installation or a
one-off server. Fleet installation is different: the answers are moved out of the keyboard-driven
installer session and into version-controlled infrastructure. Debian's native installer automation
method is preseeding, where a preseed.cfg file supplies debconf
answers for localization, networking, users, mirror selection, partitioning, package selection,
bootloader installation, and late commands. Larger environments may instead use FAI
(Fully Automatic Installation), which treats host classes, disk recipes, package lists, scripts,
and post-install policy as deployment infrastructure.
| Approach | How It Changes the Install | Best Fit |
|---|---|---|
preseed.cfg | Debian Installer still runs, but many or all questions are answered from a file supplied by initrd, kernel parameter, USB media, HTTP, or PXE. | Repeatable installs, lab systems, VM templates, and controlled server builds. |
| PXE / netboot + preseed | Firmware starts the installer from the network; the preseed file and packages come from provisioning services and mirrors. | Racks, remote sites, and environments where USB media is undesirable. |
| FAI | Uses class-based configuration, disk layout recipes, package sets, hooks, and scripts to build systems with minimal manual intervention. | Large fleets, teaching labs, reproducible bare-metal deployments, and sites with mature provisioning infrastructure. |
# Typical boot parameter pattern for a network preseed file
auto=true priority=critical url=http://provisioning.example.net/debian/trixie/preseed.cfg
# Common preseed areas to keep under version control
locale, keyboard, network, mirror, account policy, partitioning recipe, tasksel, bootloader, late_commandAutomated partitioning is intentionally dangerous if the wrong host receives the wrong recipe. Use stable host identity, explicit disk targeting where possible, tested backups, and a non-production rehearsal before enabling unattended destructive disk writes.
Keep the boot media, installer kernel/initrd, mirror suite, package architecture, and preseed file aligned. A boot line such as auto=true priority=critical url=... can delay many questions until the preseed is read, but it cannot repair a mismatched architecture, wrong suite path, unreachable file, malformed directive, or recipe intended for a different disk layout. Those mistakes commonly make the installer fall back to interactive questions or repeat failed automated steps.
Verify the ISO and Write the USB Correctly
The Debian image should be verified before it is written. After that, write the image to the
whole USB device, not to a partition. On Linux, Debian documents the simple
cp debian.iso /dev/sdX method for hybrid images; many administrators prefer
dd because it provides progress reporting.
# 1. Identify the USB device before and after insertion
lsblk -o NAME,SIZE,MODEL,TYPE,MOUNTPOINTS
# 2. Verify checksum file signature if you downloaded SHA512SUMS.sign
gpg --verify SHA512SUMS.sign SHA512SUMS
# 3. Verify the ISO hash against Debian's checksum list
sha512sum -c SHA512SUMS --ignore-missing
# 4A. Debian documented direct-copy style. Replace sdX with the whole USB device.
sudo cp debian-13.x.x-amd64-netinst.iso /dev/sdX
sync
# 4B. Progress-reporting variant many admins prefer.
sudo dd if=debian-13.x.x-amd64-netinst.iso of=/dev/sdX bs=4M status=progress conv=fsyncDebian ISOs are complete disk images containing their own partition table and bootloader. Write the ISO to the entire USB device (for example, /dev/sdb), not to an individual partition such as /dev/sdb1. Before running cp or dd, use lsblk to confirm that you have selected the correct USB drive by checking its model and size. Writing to the wrong device (such as your internal SSD) will overwrite its contents.
Debian hybrid images are designed to be written directly. Avoid tools that unpack, rewrite, or modify the image unless you have a specific tested reason.
BIOS / UEFI Setup Before Booting the Installer
On modern machines, boot in native UEFI mode unless you have a specific legacy requirement. The installer detects whether it was started in BIOS/legacy mode or native UEFI mode and installs the corresponding bootloader path. Accidentally booting the USB in the wrong mode is a common cause of post-install boot confusion.
| Setting | Recommended For New Installs | Reason |
|---|---|---|
| Boot mode | Native UEFI | Uses ESP + GPT and matches modern firmware behavior. |
| CSM / Legacy mode | Disable unless needed | Prevents BIOS-mode GRUB from being installed accidentally on a UEFI machine. |
| Secure Boot | Can remain enabled | Debian includes the signed shim path needed for Secure Boot on typical PCs. |
| Boot menu | Use one-time boot menu when possible | Usually F12, F11, F8, Esc, or vendor-specific key; avoids changing permanent boot order. |
| Windows Fast Startup | Disable for dual boot | Prevents Windows hibernation-style shutdown from leaving filesystems in an unsafe state. |
# After booting the installer shell or installed system:
# UEFI mode if this directory exists:
ls /sys/firmware/efi
# In the installed system, this should show UEFI boot entries:
efibootmgr -vIf Secure Boot is enabled, Debian's signed shim, GRUB, and kernel path works for the normal boot chain, but locally built kernel modules are a separate trust problem. DKMS modules and custom modules must be signed by a key enrolled through MOK before the kernel will load them. Keep the private key protected, document where it lives, and re-sign rebuilt modules after kernel or DKMS rebuilds if your DKMS package does not automate signing.
# Check Secure Boot and enrolled Machine Owner Keys
mokutil --sb-state
mokutil --list-enrolled
# Create and enroll a local module-signing key
openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -out MOK.der \
-outform DER -days 36500 -nodes -subj "/CN=Local module signing key/"
sudo mokutil --import MOK.der
# Reboot → MOK Manager → enroll the key → reboot again
# Sign a rebuilt module manually when needed
SIGN_FILE=$(find /usr/lib/linux-kbuild-* -path '*/scripts/sign-file' | sort -V | tail -1)
sudo "$SIGN_FILE" sha256 MOK.priv MOK.der /path/to/module.ko
modinfo -F signer /path/to/module.koLanguage, Location, Locale, and Keyboard
The first installer screens set language, country/location, locale, and keyboard. These choices control the installer interface and become defaults in the installed system. Choose carefully, especially before entering encryption passphrases later.
Before entering a LUKS passphrase, be certain the keyboard layout is correct. A passphrase typed with a different layout at boot can become effectively unusable.
Network Configuration, Hostname, and Domain
Netinst depends on a working network for a normal server or desktop install. The installer normally attempts automatic configuration first. If that fails, use manual network setup or switch to DVD-1/offline installation strategy.
| Screen | Normal Answer | When To Override |
|---|---|---|
| Select primary network interface | Wired Ethernet interface | Multiple NIC systems, VLAN/pre-provisioning, Wi-Fi-only laptops. |
| Configure network automatically | Yes, DHCP | Static server IP, no DHCP, isolated lab, provisioning network. |
| Manual IP details | IP, netmask/prefix, gateway, DNS | Only if DHCP fails or static addressing is required. |
| Hostname | Short machine name, e.g. deb-srv01 | Follow site naming convention. |
| Domain name | Blank for home/lab or your real internal domain | Managed networks, AD/DNS environments, server fleets. |
| Wireless ESSID and passphrase | Use WPA/WPA2 personal if needed | Avoid captive portal and enterprise Wi-Fi installs where possible. |
If the installer asks for an HTTP proxy and your network does not require one, leave it blank. In corporate networks, use the proxy URL supplied by the network team, for example http://proxy.example.com:8080/.
When network setup or mirror access fails mid-install
A netinst installation can usually be recovered without abandoning the whole install. Before rebooting, use the installer menus to retry network configuration, choose another mirror, enter or clear the proxy value, or continue with only the packages available on scanned installation media when that is acceptable.
| Failure Point | Recovery Path | Practical Note |
|---|---|---|
| DHCP fails | Retry DHCP, switch cable/NIC, or enter static IP, gateway, DNS, and prefix manually. | For servers, confirm the switch port/VLAN before blaming Debian. |
| Wi-Fi cannot associate | Use wired Ethernet, provide missing firmware from USB, or switch to DVD-1/offline media. | Captive portals and enterprise Wi-Fi are poor installer targets. |
| Mirror test fails | Use deb.debian.org, choose another country mirror, verify DNS/gateway, or correct the proxy. | A bad local mirror does not imply the install is broken. |
| TLS/proxy problem | Re-enter proxy details or choose a mirror/protocol combination that works with site policy. | Corporate SSL interception and unauthenticated proxies commonly break installer downloads. |
| Packages unavailable from mirror | Go back to mirror selection, scan DVD-1/USB media, or install a minimal system and fix APT after first boot. | Do not select large desktop tasks on an unreliable link unless you have local media. |
Users, Passwords, Clock, and Time Zone
Debian Installer can either enable a root password or leave root login disabled and grant sudo access to the first normal user. For most administrator-friendly modern installs, the sudo model is convenient; for controlled server environments, a root password may still be deliberate policy.
| Installer Question | Recommended Answer | Effect |
|---|---|---|
| Root password | Leave blank for sudo model, or set deliberately for root-login model | If blank, root account is disabled for direct password login and the first user gets sudo. |
| Full name for new user | Human-readable owner/admin name | GECOS/comment field; not the login name. |
| Username | Lowercase login, e.g. debadmin or admin | The account used after first boot. |
| User password | Strong unique password | Needed for login and sudo if sudo model is used. |
| Clock/time zone | Use detected location unless server policy says UTC | Can be changed later with dpkg-reconfigure tzdata. |
| Hardware clock UTC/local | UTC for Linux-only systems; local time for Windows dual boot if prompted | Prevents time drift/confusion with Windows dual-boot systems. |
# Post-install corrections if needed
sudo dpkg-reconfigure tzdata
sudo dpkg-reconfigure locales
sudo dpkg-reconfigure keyboard-configurationChoosing the Right Partitioning Path
This is the most consequential installer phase. The installer supports guided partitioning, guided LVM, guided encrypted LVM, and manual partitioning. The original project document should be used for deep storage design; this section tells you which path to choose.
| Installer Choice | What It Does | Choose It For | Avoid When |
|---|---|---|---|
| Guided - use entire disk | Creates a direct partition layout on the selected disk | Simple VMs, labs, disposable systems | Servers needing future resizing or encryption. |
| Guided - entire disk with LVM | Creates boot partitions plus LVM for main Linux filesystems | Most general servers and VMs | Strict minimal appliances where LVM is unnecessary. |
| Guided - encrypted LVM | Creates LUKS encryption containing LVM | Laptops, portable systems, sensitive data | Systems needing unattended boot unless you design TPM/keyfile unlock separately. |
| Manual | Full control over partitions, filesystems, mount points, RAID, LVM, LUKS | Production servers, RAID, dual boot, custom layouts | Novice installs without a written partition plan. |
Guided partitioning scheme choices
| Scheme | Created Layout | Practical Use |
|---|---|---|
| All files in one partition | / plus swap | Simplest; good for small VMs and learning systems. |
Separate /home | /, /home, swap | Desktop/laptop user-data separation. |
Separate /home, /var, /tmp | More mount points | Servers where log/cache/temp growth should not fill root. |
| Server-oriented scheme | Separate service/data areas depending on recipe | Useful only if it matches the workload. |
Nothing is actually formatted until you approve the final write. On the final summary screen, check every line marked for formatting. The wrong disk, wrong mount point, or wrong format flag is the mistake to catch before continuing.
If the installer was booted in EFI mode, an EFI System Partition is required. If you forget to create and format one in manual partitioning, partman blocks continuation until you fix it.
Base System, APT Mirror, and tasksel
After partitioning is committed, Debian Installer installs the base system and kernel. It then configures APT package sources and asks which software tasks to install. This stage is where a minimal server, full desktop, SSH-enabled VM, or web server diverges.
Base system installation
During base installation, package unpacking and setup messages are available on another virtual console and are written to installer logs. On a normal installation, you usually let this stage complete without intervention.
APT mirror choice
| Scenario | Use Network Mirror? | Reason |
|---|---|---|
| netinst install | Yes | Without a mirror, you get only a very minimal system. |
| DVD-1 install with internet | Yes | Gets newer security/stable-updates packages and packages not present on DVD-1. |
| DVD-1 true offline install | No | Use packages on the DVD; expect limited task availability. |
| Corporate proxy network | Yes, with proxy | Enter proxy only if required by the network. |
| IPv6-only network | Maybe manual mirror | Default country mirror may not be reachable over IPv6. |
If a mirror fails during package retrieval, go back to mirror selection before rebooting. Try deb.debian.org, another country mirror, correct proxy details, or a DVD-1/local-media path. A netinst ISO can install a minimal base from its own media, but desktop tasks, SSH server, and many standard utilities normally require a working mirror unless they are present on scanned installation media.
tasksel choices
tasksel installs predefined collections of packages. Use the space bar to toggle tasks in the text installer. Do not select large tasks casually on slow links, because once package installation starts there is no simple cancel button.
| Task | Installs | Recommendation |
|---|---|---|
| Debian desktop environment | Graphical desktop; GNOME by default unless another DE is selected | Select for desktop/laptop systems only. |
| GNOME / KDE / Xfce / others | Specific desktop environment | Use Xfce for lower-resource systems; use GNOME/KDE for full desktop experience. |
| SSH server | openssh-server | Select for servers, VMs, and remote administration. |
| Web server | Common web server task, including Apache path | Select only when the host should immediately act as a web server. |
| Standard system utilities | Priority-standard admin/userland tools | Leave selected unless building an intentionally minimal system. |
| Debian Pure Blends | Specialized package collections | Use only when you intentionally need a Blend profile. |
Display Manager Choices After tasksel
A desktop environment is not the same thing as the display manager that presents the graphical
login screen. tasksel normally pulls a suitable display manager through package
dependencies, but mixed desktop installs, minimal Xfce/LXQt installs, legacy GPUs, and Wayland
failures can leave users at a black screen or text login even though the desktop packages are
present.
| Display Manager | Common Pairing | Operational Note |
|---|---|---|
gdm3 | GNOME | Full-featured default for GNOME; may default to Wayland where supported. |
sddm | KDE Plasma | Natural fit for Plasma sessions. |
lightdm | Xfce, MATE, lighter desktops | Often simpler on older hardware and lightweight desktop builds. |
# Inspect and reconfigure the active display manager
systemctl status display-manager
cat /etc/X11/default-display-manager
sudo dpkg-reconfigure gdm3 # or lightdm / sddm
# Disable Wayland in GDM when legacy graphics require Xorg
sudoedit /etc/gdm3/daemon.conf
# Set: WaylandEnable=falseIf graphical login fails after installation, first switch to a virtual console with Ctrl+Alt+F2, log in, update the system, verify firmware, and inspect journalctl -b. Do not reinstall Debian just because the display manager failed; the base system may be healthy.
GRUB Installation, Final Cleanup, and Reboot
On amd64, GRUB is the normal Debian bootloader path. In UEFI mode it installs to the EFI System Partition; in BIOS mode it installs to the BIOS boot path/boot record depending on the disk layout. The installer can also detect other operating systems, but multi-boot detection is not a substitute for a tested backup and recovery plan.
| Boot Mode | GRUB Target | What To Check |
|---|---|---|
| UEFI | EFI System Partition, usually mounted at /boot/efi | ESP exists, FAT32, boot entry created, Secure Boot path works if enabled. |
| Legacy BIOS + MBR | Disk boot record | Correct disk selected, not a partition. |
| Legacy BIOS + GPT | BIOS Boot Partition plus GRUB install | Tiny BIOS boot partition exists and has no filesystem. |
| RAID boot | Usually each bootable disk needs attention | Test degraded boot and ESP synchronization if using multiple ESPs. |
At the end, Debian Installer prompts you to remove the USB/DVD installation media and reboots into the newly installed system. If the first boot fails, use rescue mode before assuming the installation must be repeated.
Profile: Minimal Server
This is the clean default for a Debian server, VM, or hypervisor guest. It avoids unnecessary desktop packages and gives you SSH plus standard administrative tools.
| Stage | Choice | Reason |
|---|---|---|
| Image | amd64 netinst | Small, current packages from mirror, clean package set. |
| Network | Wired DHCP or static IP | Reliable mirror and SSH access. |
| Partitioning | Guided LVM or Manual LVM | Future resizing for /, /var, data volumes. |
| tasksel | SSH server + Standard system utilities | Remote administration without desktop bloat. |
| Post-install | Update, harden SSH, configure firewall/monitoring/backups | Make it production-ready. |
# First server checks after login
cat /etc/debian_version
ip addr
systemctl status ssh
sudo apt update
sudo apt full-upgradeProfile: Desktop or Laptop
A desktop install differs mainly at tasksel and hardware validation. You may prefer a live image first to test graphics, Wi-Fi, touchpad, suspend/resume, audio, and external displays, then install using netinst or DVD-1.
| Decision | Recommendation | Notes |
|---|---|---|
| Installer frontend | Graphical install | Same backend as text installer, easier for desktop users. |
| Desktop task | Select Debian desktop + chosen DE | GNOME default; KDE Plasma and Xfce are common alternatives. |
| Firmware | Use official Debian 13 image; keep firmware USB available | Especially important for Wi-Fi and graphics. |
| Partitioning | Encrypted LVM for laptops | Protects user data if the device is lost. |
| Swap | Plan hibernation before install | Hibernation is simpler with swap sized appropriately during install. |
Profile: Encrypted Laptop or Sensitive Server
Guided encrypted LVM is the fastest safe path for most laptops. Debian Installer creates an unencrypted boot path plus a LUKS encrypted area that contains LVM volumes for the main system.
- 1Choose Guided - use entire disk and set up encrypted LVM when the whole target disk can be erased.
- 2Use a long passphrase and verify keyboard layout before typing it.
- 3Allow disk erase/randomization when your threat model includes old data remnants; expect it to take time.
- 4Keep
/bootunencrypted in the normal Debian Installer workflow. Fully encrypted/bootrequires a manual design outside the standard path. - 5Store recovery notes: LUKS passphrase policy, disk layout, hostname, user account, and backup method.
On reboot, you will be asked for the LUKS passphrase before the root filesystem is mounted. No asterisks may be shown while typing; that is normal.
Profile: Offline or DVD-1 Installation
Use DVD-1 when the installer cannot reach Debian mirrors. It contains the installer plus many common packages. It is not a full mirror, and it may not contain every package needed for every selected task.
| Question | Offline Answer | Later Action |
|---|---|---|
| Use a network mirror? | No, if truly offline | Configure APT when network becomes available. |
| Scan additional media? | Yes, only if you have matching extra media | Keep media from the same release/image set. |
| Select desktop task? | Only if the packages exist on media | Install missing packages later from a mirror. |
| Security updates? | Not available offline | Run apt update and apt full-upgrade immediately when connected. |
A system installed offline may boot successfully but still be missing firmware, updates, localization packages, desktop packages, or drivers. Plan a controlled post-install update path.
Profile: Windows Dual-Boot
Dual boot is mainly a firmware, partitioning, and Windows-state problem. Debian can coexist with Windows, but both operating systems must agree on boot mode and the Windows filesystem must be cleanly shut down.
- 1Back up Windows and create Windows recovery media before resizing partitions.
- 2Disable Windows Fast Startup/Fast Boot before installing Debian.
- 3Boot the Debian installer in the same mode Windows uses, normally native UEFI on modern systems.
- 4Do not format the existing Windows ESP. Reuse it as the ESP mount point only if you understand the layout.
- 5If Windows is not detected in GRUB, finish Debian first, then troubleshoot boot entries with
efibootmgr,os-proberpolicy, and firmware boot menu.
First Boot Checklist
After the installer reboots, do not assume the system is production-ready merely because login succeeds. Validate boot mode, mounts, APT, network, time, firmware, and logs.
# Identity and release
cat /etc/os-release
cat /etc/debian_version
uname -a
# Boot mode
[ -d /sys/firmware/efi ] && echo UEFI || echo BIOS
# Storage and mounts
lsblk -o NAME,SIZE,TYPE,FSTYPE,UUID,MOUNTPOINTS
findmnt
findmnt --verify --verbose # fstab parsing/usability check, not a block-device audit
swapon --show
# Network and package manager
ip addr
ip route
sudo apt update
sudo apt full-upgrade
# Logs
journalctl -p warning..alert -b
ls /var/log/installer/| Check | Good Result | Problem Indicated |
|---|---|---|
| GRUB menu | Debian boots without USB media | Bootloader installed to wrong disk/mode. |
| LUKS prompt | Passphrase unlocks and boot continues | Keyboard layout, passphrase, crypttab, or initramfs issue. |
apt update | Repository metadata downloads cleanly | Network, DNS, mirror, proxy, or sources issue. |
findmnt | Expected mount points present | fstab/mount-point/LVM/crypto issue. |
findmnt --verify | /etc/fstab is parsable and appears usable | Syntax, mount-point, option, or currently resolvable source problem. Still confirm device identity with lsblk, blkid, and a real mount test after editing fstab. |
journalctl | No critical boot failures | Driver, firmware, filesystem, service, or boot warning to address. |
NetworkManager, ifupdown, and systemd-networkd
Debian can manage networking through more than one stack. Desktop installs commonly use
NetworkManager, while minimal/server installs may leave interfaces under classic
ifupdown and networking.service depending on installer choices and
installed packages. systemd-networkd is also available, but it is a deliberate
administrator choice rather than a magic fallback.
| Stack | Typical Debian Use | Admin Caution |
|---|---|---|
ifupdown | Minimal/server-style static or DHCP interfaces via /etc/network/interfaces. | Reliable and simple for wired servers; not a comfortable Wi-Fi roaming tool. |
| NetworkManager | Desktop/laptop networking, Wi-Fi, VPNs, roaming, nmcli. | Install and enable it intentionally on servers that need Wi-Fi or NM-managed profiles. |
systemd-networkd | Declarative server networking, containers, simple bridges/VLANs. | Do not mix managers on the same interface; migrate cleanly and document ownership. |
# Identify which network manager is actually active
systemctl status networking NetworkManager systemd-networkd
cat /etc/network/interfaces
nmcli device status
networkctl status
# Typical conversion direction when a minimal install later needs NetworkManager
sudo apt install network-manager
sudo systemctl enable --now NetworkManagerA post-reboot network loss is often caused by assuming the desktop networking stack exists on a no-desktop server, or by configuring the same interface in multiple places. Before editing, identify whether the interface is owned by /etc/network/interfaces, NetworkManager profiles, or systemd-networkd units.
APT Sources for Debian 13 trixie
Debian 13 systems may use Deb822-style source files under /etc/apt/sources.list.d/.
The exact file generated by the installer depends on the installation method and answers given.
The model below is a clean post-install reference, not something to paste blindly over a working
site policy.
# Example: /etc/apt/sources.list.d/debian.sources
Types: deb
URIs: https://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main contrib non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main contrib non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpgAdd non-free only when you intentionally need packages from Debian's non-free component. non-free-firmware is commonly needed for firmware updates on real hardware.
Deb822 .sources files and legacy .list/sources.list entries can coexist, but do not define the same Debian repository target twice across both formats. If the same URI, suite, component, architecture, and package type are active in both places, apt update will warn that targets such as Packages or DEP-11 are configured multiple times. Disable or remove the duplicate entry instead of keeping parallel definitions for the same repository.
# Find active Debian source definitions before editing
grep -RhsE '^(deb|Types:|URIs:|Suites:|Components:)' /etc/apt/sources.list /etc/apt/sources.list.d
sudo apt updateDebian 13 separates redistributable firmware into non-free-firmware. When firmware is needed and enabled during installation, the installer can carry that policy into the installed system's APT sources. tasksel then installs selected roles from enabled repositories; it does not silently convert a system into a proprietary graphics-driver configuration. Add non-free only when a site policy or hardware requirement explicitly calls for packages from that component.
# Validate package sources after editing
sudo apt update
apt-cache policy
# Common first packages on a server
sudo apt install sudo vim curl ca-certificates openssh-server systemd-timesyncdInstaller Troubleshooting Reference
Debian Installer keeps useful logs and exposes rescue/debug paths. Use them before restarting from scratch. Many installer failures are mirror, firmware, boot-mode, partition, or tasksel issues rather than unrecoverable installation failures.
| Problem | Likely Cause | Action |
|---|---|---|
| No network with netinst | DHCP failure, missing firmware, unsupported Wi-Fi, proxy issue | Use wired Ethernet, manual network config, firmware USB, DVD-1, or PXE with correct drivers. |
| Mirror selection fails | DNS, gateway, proxy, TLS, captive portal, bad mirror | Test network, use deb.debian.org, enter proxy correctly, or install from DVD-1. |
| Disk not visible | Storage mode, controller driver, firmware, VM disk presentation | Check firmware settings, controller mode, VM storage controller, and installer logs. |
| Partitioner will not continue | No root mount point, no ESP in UEFI mode, invalid storage layer | Ensure / exists, ESP exists for UEFI, and LVM/RAID/LUKS layers are completed. |
| Desktop task downloads too much | netinst + desktop task + slow mirror | Use DVD-1/live media, choose Xfce, or install minimal first and add desktop later. |
| Black screen after install | Graphics firmware or mode-setting issue | Try nomodeset, switch VT with Ctrl+Alt+F2, install firmware package after login. |
| LUKS passphrase rejected | Keyboard layout mismatch or typo | Verify layout, use recovery key/passphrase if configured, boot rescue mode if needed. |
| System boots only with USB inserted | GRUB installed to wrong target or firmware boot entry issue | Use rescue mode, chroot, reinstall GRUB to correct disk/ESP, check efibootmgr. |
Installer logs and shell
# During installation, switch consoles on most PCs:
# Left Alt+F2: shell
# Left Alt+F4: package/setup messages
# Left Alt+F1: installer UI
# Logs during installer session:
ls /var/log
nano /var/log/syslog
# Logs after successful installation:
ls /var/log/installer/The installer shell is for diagnostics and recovery. Manual changes from the shell can confuse the installer state. For partitioning, swap activation, LVM, RAID, and encryption, prefer the installer menus unless you intentionally know why you are overriding them.
Official Source Trace Used for This Companion
This section records the official Debian pages used to build and verify the content. The URLs are kept visible so the document can be revalidated during future Debian point releases or the next stable transition.
| Area | Official URL | Used For |
|---|---|---|
| Installation Guide index | https://www.debian.org/releases/stable/amd64/index.en.html | Release, architecture, table of contents, chapter scope. |
| Supported hardware | https://www.debian.org/releases/stable/amd64/ch02s01.en.html | amd64 support, supported architectures, graphics, NIC, wireless notes. |
| Installation media | https://www.debian.org/releases/stable/amd64/ch02s04.en.html | USB, optical, network, hard disk, Unix/GNU-system install methods. |
| Obtaining media | https://www.debian.org/releases/stable/amd64/ch04.en.html | Official images, USB preparation, TFTP/netboot, verification topics. |
| USB preparation | https://www.debian.org/releases/stable/amd64/ch04s03.en.html | Hybrid image writing, whole-device warning. |
| Integrity verification | https://www.debian.org/releases/stable/amd64/ch04s07.en.html | SHA256/SHA512 checksum workflow. |
| Booting the installer | https://www.debian.org/releases/stable/amd64/ch05s01.en.html | Boot menu, graphical installer, expert/rescue options, boot parameters. |
| Using d-i components | https://www.debian.org/releases/stable/amd64/ch06s03.en.html | Localization, network, accounts, partitioning, base install, APT, tasksel, GRUB, logs. |
| Missing firmware | https://www.debian.org/releases/stable/amd64/ch06s04.en.html | Firmware prompts, FAT USB firmware directory, installed-system firmware behavior. |
| Preseeding appendix | https://www.debian.org/releases/stable/amd64/apb.en.html | Automated installation, preconfiguration files, boot parameters, and example preseed syntax. |
| First boot | https://www.debian.org/releases/stable/amd64/ch07.en.html | GRUB first boot, encrypted volume prompts, login. |
No comments:
Post a Comment