2.2 Debian VM template

As shown in the topology map in Module 1, you’ll build multiple Debian-based virtual machines throughout this course. To make that process more efficient, you’ll first create a template that you can clone whenever you need a new Debian system. This will be a full graphical Debian installation, with only carefully selected pre-installed software and utilities.

2.2.1 Create Debian VM

1. Download the Debian 13 ISO (image type: DVD ISO) from the official website. In the course Debian version 13.4.0 is used.

   
   

2. Upload the ISO in PVE: Go to Datacenter ➜ pve ➜ local(pve) ➜ ISO Images, click Upload, select the Debian ISO and click Upload.

   
   

3. Create a new VM (click Create VM in the top-right) with the following specs (adjust as needed):

   • General ➜ VM ID: 900

   • General ➜ Name: Template-Debian

   • OS ➜ Storage: local

   • OS ➜ ISO image: (select the Debian ISO)

   • OS ➜ Type: Linux

   • System ➜ Graphic card: Default

   • System ➜ Machine: q35

   • System ➜ BIOS: SeaBIOS

   • System ➜ SCSI Controller: VirtlO SCSI single

   • Disk ➜ Bus/Device: SCSI

   • Disk ➜ Storage: local-lvm

   • Disk ➜ Disk size (GiB): 40 (we will later expend disk size if it's required)

   • Disk ➜ Cache: Write back

   • Disk ➜ Dicard: enable if you're using SSD/NVMe (reclaims unused blocks)

   • CPU ➜ Sockets:1

   • CPU ➜ Cores: 2

   • Memory ➜ Memory (MiB): 2048 (You can increase the memory later based on the VM’s role)

   • Network ➜ Bridge: vmbr0 (Temporarily set this bridge type to provide internet access)

   • Network ➜ Model: VirtIO (paravirtualized)

   • Network ➜ Firewall: enabled

   • Confirm ➜ Finish

   
   

4. It’s recommended to enable temporary copy/paste between your virtualization platform and your physical workstation. In Proxmox VE, go to Datacenter ➜ pve ➜ 900 Template-Debian ➜ Hardware ➜ Display, tick Advanced, and set Clipboard to VNC.

   When you open a console in PVE, the clipboard feature is now available from the side panel and can be used for copy/paste after the initial installation.

   
   

5. Start the VM and complete the Debian installation wizard (the defaults are usually fine). Pay attention to the following installation and configuration options:

   • Hostname: template-debian

   • Standard host user: rte (set strong password for this account - this will be the administrator account within the environment)

   • Select the following software to install:

     • Desktop environment: xfce

     • SSH server

     • Standard System utilities

2.2.2 Configure and create the Debian VM template

The baseline C2 design uses two account types with different privilege levels: operators and admins. These roles determine access to other systems in the environment, with access control enforced through the Guacamole gateway (covered later in this module).

Because this template will be used for most Debian-based systems—and you can assign effective privileges later via Guacamole group membership—a practical approach is to create user accounts for your team up front. You can use unique usernames or generic ones (e.g., rto-01, rto-02, …) and assign them to team members later. Or, if preferred, create only a few essential accounts now and add the rest later—or update the template when needed.

In Module 6, you’ll implement a simple user account management feature to add new users and change passwords for existing accounts.

As an example—and to keep the installation steps clear and privilege separation consistent—this course uses rte as the administrator/engineering account and rto as the operator account. Whatever naming scheme you choose, set strong initial passwords and store them in your password manager.

Important: If you use different account names than rte and rto, pay close attention in the upcoming steps and modules—those names are referenced throughout multiple installation steps.

1. After the installation wizard completes, log in as root.

   
   

2. While commenting out the CD-ROM repository is not strictly mandatory when running apt update manually, it becomes essential later in Module 6 when configuring automated deployment. Because the template you build in this section will also be used for that purpose, it is highly recommended to comment out or delete the entry now. This ensures that apt update always checks the internet directly for updates without stalling on a missing local disc interface.

   Open the /etc/apt/sources.list file and delete the first entry or place a # before the CD-ROM line so it becomes # deb cdrom:....

   nano /etc/apt/sources.list

   
   

3. Next make sure sudo is installed.

   apt install sudo

   
   

4. During the initial Debian installation wizard, you already created the rte account. Now add any additional user accounts you want to include in this template (store these account passwords in your password manager).

   sudo adduser rto

   
   

5. Add any administrative accounts (in this case, rte) to the sudo group.

   sudo usermod -aG sudo rte

   
   

6. Next step is to setup SSH for the root account.

   cd /root
   chmod 700 /root/.ssh
   cd /root/.ssh
   touch authorized_keys
   chown "root":"root" authorized_keys
   chmod 600 authorized_keys

   
   

7. Repeat this step for the rte user to set up SSH.

   su rte
   cd /home/rte
   mkdir .ssh
   chmod 700 /home/rte/.ssh
   cd /home/rte/.ssh
   touch authorized_keys
   chown "rte":"rte" authorized_keys
   chmod 600 authorized_keys

   
   

8. Generate a fresh SSH key pair (with a passphrase),

   ssh-keygen -t ed25519

   Then add the public key id_ed25519.pub to the ~/.ssh/authorized_keys file for both the root and rte users.

   Wherever you generate the key pair, do not leave the private key on this template VM—store it temporarily on your local machine, since you’ll need it in the next section.

   
   

9. Change the SSHD config to allow both pub key authentication and password authentication for non-root users. Edit /etc/ssh/sshd_config and uncomment following settings:

   PermitRootLogin prohibit-password
   PubkeyAuthentication yes
   PasswordAuthentication yes
   PermitEmptyPasswords no

   
   

10. Install at least the following software on the template. You can add additional packages as needed.

    sudo apt update
    sudo apt upgrade 
    sudo apt install curl -y
    sudo apt install lsof -y
    sudo apt install locate -y
    sudo apt install gnupg
    sudo apt install apt-transport-https
    sudo apt install python3-pip -y
    sudo apt install ufw -y
    sudo apt install net-tools -y
    sudo apt install tcpdump -y
    sudo apt install tmux -y
    sudo apt install whois -y
    sudo apt install git -y

    
    

11. Get the current python version and install the correct python venv module (modify 3.X for the correct version).

    sudo python3 --version
    sudo apt install python3.X-venv -y

    
    

12. When you’re satisfied with the Debian template, first change the bridge setting to its new default:

    • Change network bridge: Hardware ➜ Network Device (net0) ➜ Bridge: vmbr20

    Then convert the prepared VM into a template so you can scale later. First, power off the VM, then follow these steps in Proxmox: More (top right) ➜ Convert to Template.