Cài đặt ban đầu máy chủ Ubuntu: 9 bước bắt đầu trên máy chủ Ubuntu mới cài đặt

export DEBIAN_FRONTEND=noninteractive

apt-get update

Hit:1 http://mirrors.digitalocean.com/ubuntu noble InRelease
Hit:2 http://mirrors.digitalocean.com/ubuntu noble-updates InRelease
Hit:3 http://mirrors.digitalocean.com/ubuntu noble-backports InRelease
Hit:4 https://repos-droplet.digitalocean.com/apt/droplet-agent main InRelease
Hit:5 http://security.ubuntu.com/ubuntu noble-security InRelease
Reading package lists...

apt-get -s upgrade

Calculating upgrade...
The following upgrades have been deferred due to phasing:
  libsqlite3-0
The following packages will be upgraded:
  apt apt-transport-https apt-utils bind9-dnsutils bind9-host bind9-libs
  cloud-init distro-info-data gir1.2-glib-2.0 git git-man libapt-pkg6.0t64
  libbrotli1 libglib2.0-0t64 libglib2.0-bin libglib2.0-data liblzma5
  libmspack0t64 libpcre2-8-0 python3-jwt python3-twisted tmux
  ubuntu-pro-client ubuntu-pro-client-l10n xz-utils zlib1g
26 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

apt-get -y upgrade

26 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
Need to get 15.4 MB of archives.
After this operation, 398 kB of additional disk space will be used.

Running kernel seems to be up-to-date.

Restarting services...
 /etc/needrestart/restart.d/systemd-manager
 systemctl restart cron.service fwupd.service multipathd.service packagekit.service polkit.service ssh.service systemd-journald.service systemd-networkd.service systemd-resolved.service systemd-timesyncd.service systemd-udevd.service udisks2.service

Service restarts being deferred:
 systemctl restart ModemManager.service
 /etc/needrestart/restart.d/dbus.service
 systemctl restart systemd-logind.service
 systemctl restart unattended-upgrades.service

adduser deploy

info: Adding user `deploy' ...
info: Selecting UID/GID from range 1000 to 59999 ...
info: Adding new group `deploy' (1000) ...
info: Adding new user `deploy' (1000) with group `deploy (1000)' ...
info: Creating home directory `/home/deploy' ...
info: Copying files from `/etc/skel' ...
New password: 
Retype new password: 
passwd: password updated successfully
Changing the user information for deploy
Enter the new value, or press ENTER for the default
	Full Name []: 
	Room Number []: 
	Work Phone []: 
	Home Phone []: 
	Other []: 
Is the information correct? [Y/n] Y
info: Adding new user `deploy' to supplemental / extra groups `users' ...
info: Adding user `deploy' to group `users' ...

usermod -aG sudo deploy

groups deploy

deploy : deploy sudo users

su - deploy

To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

whoami

deploy

sudo whoami

[sudo] password for deploy: 
root

exit

install -d -m 700 -o deploy -g deploy /home/deploy/.ssh

install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys

ls -la /home/deploy/.ssh

total 12
drwx------ 2 deploy deploy 4096 Nov  5 11:48 .
drwxr-x--- 3 deploy deploy 4096 Nov  5 11:48 ..
-rw------- 1 deploy deploy  100 Nov  5 11:48 authorized_keys

ssh deploy@203.0.113.10

whoami

deploy

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '

permitrootlogin yes
passwordauthentication no

sudo grep -rn 'PasswordAuthentication' /etc/ssh/sshd_config.d/

/etc/ssh/sshd_config.d/60-cloudimg-settings.conf:1:PasswordAuthentication no
/etc/ssh/sshd_config.d/50-cloud-init.conf:1:PasswordAuthentication no

sudo grep -n '^PermitRootLogin' /etc/ssh/sshd_config

42:PermitRootLogin yes

sudo sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

sudo grep -n '^PermitRootLogin' /etc/ssh/sshd_config

42:PermitRootLogin no

sudo sshd -t

sudo systemctl reload ssh

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '

permitrootlogin no
passwordauthentication no

ssh root@203.0.113.10

root@203.0.113.10: Permission denied (publickey).

sudo ufw status verbose

Status: inactive

sudo ufw app list

Available applications:
  OpenSSH

sudo ufw allow OpenSSH

Rules updated
Rules updated (v6)

sudo ufw allow 80/tcp

Rules updated
Rules updated (v6)

sudo ufw allow 443/tcp

Rules updated
Rules updated (v6)

sudo ufw show added

Added user rules (see 'ufw status' for running firewall):
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp

sudo ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)             
80/tcp (v6)                ALLOW IN    Anywhere (v6)             
443/tcp (v6)               ALLOW IN    Anywhere (v6)             

sudo ufw status numbered

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] OpenSSH                    ALLOW IN    Anywhere                  
[ 2] 80/tcp                     ALLOW IN    Anywhere                  
[ 3] 443/tcp                    ALLOW IN    Anywhere                  
[ 4] OpenSSH (v6)               ALLOW IN    Anywhere (v6)             
[ 5] 80/tcp (v6)                ALLOW IN    Anywhere (v6)             
[ 6] 443/tcp (v6)               ALLOW IN    Anywhere (v6)             

timedatectl

               Local time: Thu 2026-11-05 12:00:31 UTC
           Universal time: Thu 2026-11-05 12:00:31 UTC
                 RTC time: Thu 2026-11-05 12:00:31
                Time zone: Etc/UTC (UTC, +0000)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

timedatectl list-timezones | grep Singapore

Asia/Singapore

sudo timedatectl set-timezone Asia/Singapore

timedatectl

               Local time: Thu 2026-11-05 20:00:32 +08
           Universal time: Thu 2026-11-05 12:00:32 UTC
                 RTC time: Thu 2026-11-05 12:00:32
                Time zone: Asia/Singapore (+08, +0800)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

dpkg-query -W unattended-upgrades

unattended-upgrades	2.9.1+nmu4ubuntu1

systemctl is-enabled unattended-upgrades apt-daily.timer apt-daily-upgrade.timer

enabled
enabled
enabled

cat /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

grep -vE '^[[:space:]]*(//|$)' /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
	"${distro_id}:${distro_codename}";
	"${distro_id}:${distro_codename}-security";
	"${distro_id}ESMApps:${distro_codename}-apps-security";
	"${distro_id}ESM:${distro_codename}-infra-security";
};
Unattended-Upgrade::Package-Blacklist {
};
Unattended-Upgrade::DevRelease "auto";

sudo unattended-upgrade --dry-run --debug

Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=noble, o=Ubuntu,a=noble-security, o=UbuntuESMApps,a=noble-apps-security, o=UbuntuESM,a=noble-infra-security

No packages found that can be upgraded unattended and no pending auto-removals
The list of kept packages can't be calculated in dry-run mode.

sudo ls -l /var/log/unattended-upgrades/

total 32
-rw-r--r-- 1 root root     0 Nov  5 20:00 unattended-upgrades-dpkg.log
-rw-r--r-- 1 root root     0 Nov  5 17:34 unattended-upgrades-shutdown.log
-rw-r--r-- 1 root root 29093 Nov  5 20:04 unattended-upgrades.log

free -h

               total        used        free      shared  buff/cache   available
Mem:           961Mi       328Mi       161Mi       4.0Mi       631Mi       633Mi
Swap:             0B          0B          0B

df -h /

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        24G  2.0G   22G   9% /

sudo fallocate -l 2G /swapfile

sudo chmod 600 /swapfile

ls -lh /swapfile

-rw------- 1 root root 2.0G Nov  5 20:04 /swapfile

sudo mkswap /swapfile

Setting up swapspace version 1, size = 2 GiB (2147479552 bytes)
no label, UUID=0b43ccd8-5b4a-4048-9b84-eee12667b387

sudo swapon /swapfile

swapon --show

NAME      TYPE SIZE USED PRIO
/swapfile file   2G   0B   -2

free -h

               total        used        free      shared  buff/cache   available
Mem:           961Mi       328Mi       160Mi       4.0Mi       632Mi       632Mi
Swap:          2.0Gi          0B       2.0Gi

echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

/swapfile none swap sw 0 0

sudo systemctl reboot

uptime -p

up 2 minutes

swapon --show

NAME      TYPE SIZE USED PRIO
/swapfile file   2G   0B   -2

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '

permitrootlogin no
passwordauthentication no

sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)             
80/tcp (v6)                ALLOW IN    Anywhere (v6)             
443/tcp (v6)               ALLOW IN    Anywhere (v6)             

timedatectl | head -n 4

               Local time: Thu 2026-11-05 20:06:35 +08
           Universal time: Thu 2026-11-05 12:06:35 UTC
                 RTC time: Thu 2026-11-05 12:06:35
                Time zone: Asia/Singapore (+08, +0800)

systemctl is-active unattended-upgrades ssh.socket

active
active