02-系统安装与初始化

传统 BIOS → UEFI → 安全启动 (Secure Boot)

/       - 根分区，包含所有数据
swap    - 交换分区（可选，或使用交换文件）

/boot       - 500MB-1GB，存放引导文件
/           - 根分区，操作系统和应用程序
/home       - 用户数据（可选，视需求而定）
/var        - 日志和可变数据
/tmp        - 临时文件（可选，可挂载为 tmpfs）
swap        - 交换分区（或交换文件）

/boot       - 1GB，引导分区
/           - 20-50GB，系统文件
/var        - 单独分区，日志隔离
/var/log    - 日志分区，防止日志占满根分区
/var/tmp    - 临时文件，重启不清除
/tmp        - 临时文件，重启清除（tmpfs）
/home       - 用户数据
/opt        - 第三方软件
/usr/local  - 本地安装软件
swap        - 交换分区

ifconfig/route → ip 命令 → NetworkManager/systemd-networkd

base:
  timezone: Asia/Shanghai
  ntp_servers: [ntp1.company.local, ntp2.company.local]
  ssh_password_login: false
  monitoring: enabled

env:
  dev:
    dns: [192.168.10.10]
    backup_policy: none
  prod:
    dns: [192.168.20.10, 192.168.20.11]
    backup_policy: daily
    firewall_policy: strict

# 从官方镜像站下载
wget https://releases.ubuntu.com/22.04/ubuntu-22.04.3-live-server-amd64.iso

# 或使用国内镜像加速
wget https://mirrors.aliyun.com/ubuntu-releases/22.04/ubuntu-22.04.3-live-server-amd64.iso

# 下载校验文件
wget https://releases.ubuntu.com/22.04/SHA256SUMS
wget https://releases.ubuntu.com/22.04/SHA256SUMS.gpg

# 验证签名（可选，但推荐）
gpg --verify SHA256SUMS.gpg SHA256SUMS

# 校验镜像
sha256sum -c SHA256SUMS 2>&1 | grep ubuntu-22.04.3-live-server-amd64.iso

# 插入 USB 设备，确认设备名（如 /dev/sdb，注意不是分区如 /dev/sdb1）
lsblk

# 卸载设备（如果已挂载）
sudo umount /dev/sdb*

# 写入镜像（危险操作，请确认设备名正确！）
sudo dd if=ubuntu-22.04.3-live-server-amd64.iso of=/dev/sdb bs=4M status=progress

# 同步缓存
sudo sync

# 创建磁盘镜像
qemu-img create -f qcow2 /var/lib/libvirt/images/test-vm.qcow2 40G

# 使用 virt-install 创建虚拟机
virt-install \
  --name test-vm \
  --ram 4096 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/test-vm.qcow2,format=qcow2 \
  --cdrom /path/to/ubuntu-22.04.3-live-server-amd64.iso \
  --network bridge=br0 \
  --graphics vnc \
  --noautoconsole

Language: English / 中文(简体)
Keyboard layout: US / Chinese

Network configuration:
- DHCP 自动获取（默认）
- 或手动配置静态 IP

Example static configuration:
  Subnet: 192.168.1.0/24
  Address: 192.168.1.100
  Gateway: 192.168.1.1
  Name servers: 8.8.8.8, 114.114.114.114

Hostname: server01

Proxy address: http://proxy.company.com:8080

Mirror: http://mirrors.aliyun.com/ubuntu
# 或
Mirror: http://mirrors.tuna.tsinghua.edu.cn/ubuntu

Storage configuration:
- Use an entire disk
- 选择目标磁盘
- 确认分区方案

Profile setup:
  Your name: Admin User
  Your server's name: server01
  Username: admin
  Password: ********
  Confirm password: ********

SSH Setup:
- [x] Install OpenSSH server
- [ ] Import SSH identity (可选)

Featured Server Snaps:
- [ ] docker
- [ ] microk8s
- [ ] kubectl
- [ ] ...

Confirm destructive action:
- Continue

Installation complete!
- Reboot Now

# 使用安装时创建的用户登录
ssh admin@192.168.1.100

# 或使用本地控制台登录

# 查看系统版本
cat /etc/os-release

# 查看内核版本
uname -a

# 查看磁盘使用情况
df -h

# 查看内存使用情况
free -h

# 查看 IP 地址
ip addr

# 或传统命令（如已安装）
ifconfig

# 查看路由表
ip route

# 测试网络连通性
ping -c 4 8.8.8.8
ping -c 4 www.baidu.com

# 编辑网络配置文件
sudo nano /etc/netplan/00-installer-config.yaml

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: no
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 114.114.114.114
        search:
          - company.local

sudo netplan apply

sudo apt update

sudo apt upgrade -y

sudo apt install -y \
  vim \
  curl \
  wget \
  net-tools \
  htop \
  tree \
  unzip \
  software-properties-common \
  apt-transport-https \
  ca-certificates \
  gnupg \
  lsb-release

# 查看当前时区
timedatectl

# 列出可用时区
timedatectl list-timezones | grep Shanghai

# 设置时区为上海（中国标准时间）
sudo timedatectl set-timezone Asia/Shanghai

# 检查时间同步状态
timedatectl status

# 启用 NTP 同步
sudo timedatectl set-ntp true

# 编辑 NTP 配置（可选，使用国内 NTP 服务器）
sudo nano /etc/systemd/timesyncd.conf

[Time]
NTP=ntp.aliyun.com ntp.tencent.com
FallbackNTP=time1.cloud.tencent.com time2.cloud.tencent.com

sudo systemctl restart systemd-timesyncd

# 检查 UFW 状态
sudo ufw status

# 默认拒绝所有传入连接
sudo ufw default deny incoming

# 默认允许所有传出连接
sudo ufw default allow outgoing

# 允许 SSH 连接（重要！避免自己被锁定）
sudo ufw allow ssh
# 或指定端口
sudo ufw allow 22/tcp

# 启用防火墙
sudo ufw enable

# 查看状态
sudo ufw status verbose

# 允许 HTTP/HTTPS
sudo ufw allow http
sudo ufw allow https

# 允许特定端口
sudo ufw allow 8080/tcp

# 允许特定 IP
sudo ufw allow from 192.168.1.0/24

# 允许特定 IP 访问特定端口
sudo ufw allow from 192.168.1.10 to any port 3306

sudo nano /etc/ssh/sshd_config

# 禁用 root 登录
PermitRootLogin no

# 仅允许密钥认证（如果使用密钥）
# PasswordAuthentication no
# PubkeyAuthentication yes

# 更改默认端口（可选，增加安全性）
# Port 2222

# 限制允许登录的用户
AllowUsers admin

# 禁用空密码
PermitEmptyPasswords no

# 设置空闲超时
ClientAliveInterval 300
ClientAliveCountMax 2

sudo systemctl restart sshd

sudo apt install -y unattended-upgrades

sudo dpkg-reconfigure -plow unattended-upgrades
# 选择 "Yes" 启用自动更新

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

// 自动移除无用的依赖
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// 自动重启（如果需要）
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

// 发送邮件通知（需要配置邮件）
// Unattended-Upgrade::Mail "admin@company.com";

# 查看当前日志轮转配置
ls /etc/logrotate.d/

# 自定义日志轮转（如需要）
sudo nano /etc/logrotate.d/custom

# 创建日志目录
sudo mkdir -p /var/log/journal

# 编辑配置
sudo nano /etc/systemd/journald.conf

[Journal]
Storage=persistent
SystemMaxUse=500M
SystemMaxFileSize=50M
MaxFileSec=1week

sudo systemctl restart systemd-journald

# 创建交换文件（例如 4GB）
sudo fallocate -l 4G /swapfile
# 或
sudo dd if=/dev/zero of=/swapfile bs=1G count=4

# 设置权限
sudo chmod 600 /swapfile

# 设置为交换空间
sudo mkswap /swapfile

# 启用交换
sudo swapon /swapfile

# 验证
sudo swapon --show
free -h

sudo nano /etc/fstab

/swapfile none swap sw 0 0

# 临时设置（立即生效，重启后失效）
sudo hostname server01

# 永久设置
sudo hostnamectl set-hostname server01

sudo nano /etc/hosts

127.0.0.1       localhost
127.0.1.1       server01.company.local server01

# 内部服务器
192.168.1.10    db-server
192.168.1.11    web-server
192.168.1.12    app-server

#!/bin/bash
# Ubuntu Server 初始化脚本
# 适用于 Ubuntu 20.04/22.04 LTS

set -e

# 配置变量
HOSTNAME="server01"
TIMEZONE="Asia/Shanghai"
NTP_SERVER="ntp.aliyun.com"
ADMIN_USER="admin"
SSH_PORT="22"

# 颜色输出
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo -e "${GREEN}=== Ubuntu Server 初始化脚本 ===${NC}"

# 1. 更新系统
echo -e "${YELLOW}[1/10] 更新系统...${NC}"
sudo apt update
sudo apt upgrade -y
sudo apt autoremove -y

# 2. 设置主机名
echo -e "${YELLOW}[2/10] 设置主机名...${NC}"
sudo hostnamectl set-hostname "$HOSTNAME"

# 3. 配置时区
echo -e "${YELLOW}[3/10] 配置时区...${NC}"
sudo timedatectl set-timezone "$TIMEZONE"
sudo timedatectl set-ntp true

# 4. 安装常用工具
echo -e "${YELLOW}[4/10] 安装常用工具...${NC}"
sudo apt install -y \
    vim \
    curl \
    wget \
    net-tools \
    htop \
    tree \
    unzip \
    git \
    software-properties-common \
    apt-transport-https \
    ca-certificates \
    gnupg \
    lsb-release

# 5. 配置防火墙
echo -e "${YELLOW}[5/10] 配置防火墙...${NC}"
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow "$SSH_PORT/tcp"
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
echo "y" | sudo ufw enable

# 6. 配置 SSH
echo -e "${YELLOW}[6/10] 配置 SSH...${NC}"
sudo sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/' /etc/ssh/sshd_config
sudo sed -i 's/#ClientAliveInterval 0/ClientAliveInterval 300/' /etc/ssh/sshd_config
sudo sed -i 's/#ClientAliveCountMax 3/ClientAliveCountMax 2/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# 7. 配置自动更新
echo -e "${YELLOW}[7/10] 配置自动更新...${NC}"
sudo apt install -y unattended-upgrades
sudo bash -c 'cat > /etc/apt/apt.conf.d/20auto-upgrades << EOF
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
EOF'

# 8. 配置日志持久化
echo -e "${YELLOW}[8/10] 配置日志持久化...${NC}"
sudo mkdir -p /var/log/journal
sudo bash -c 'cat >> /etc/systemd/journald.conf << EOF

[Journal]
Storage=persistent
SystemMaxUse=500M
SystemMaxFileSize=50M
MaxFileSec=1week
EOF'
sudo systemctl restart systemd-journald

# 9. 禁用不必要的服务
echo -e "${YELLOW}[9/10] 禁用不必要的服务...${NC}"
sudo systemctl disable bluetooth 2>/dev/null || true
sudo systemctl stop bluetooth 2>/dev/null || true

# 10. 清理
echo -e "${YELLOW}[10/10] 清理...${NC}"
sudo apt autoremove -y
sudo apt autoclean

echo -e "${GREEN}=== 初始化完成！===${NC}"
echo "请检查以下配置："
echo "- 主机名: $(hostname)"
echo "- 时区: $(timedatectl | grep 'Time zone')"
echo "- 防火墙状态:"
sudo ufw status

#cloud-config
hostname: server01
fqdn: server01.company.local
manage_etc_hosts: true

timezone: Asia/Shanghai

users:
  - name: admin
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    ssh_authorized_keys:
      - ssh-rsa AAAAB3NzaC1... your-key

package_update: true
package_upgrade: true

packages:
  - vim
  - curl
  - wget
  - htop
  - tree
  - git
  - ufw

runcmd:
  # 配置防火墙
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow 22/tcp
  - ufw allow 80/tcp
  - ufw allow 443/tcp
  - echo "y" | ufw enable

  # 配置 SSH
  - sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
  - systemctl restart sshd

  # 配置自动更新
  - apt install -y unattended-upgrades

  # 重启以应用所有更改
  - reboot

---
- name: Linux Server Initialization
  hosts: all
  become: yes

  vars:
    timezone: "Asia/Shanghai"
    admin_user: "admin"

  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Upgrade all packages
      apt:
        upgrade: yes
        autoremove: yes

    - name: Set timezone
      timezone:
        name: "{{ timezone }}"

    - name: Install common packages
      apt:
        name:
          - vim
          - curl
          - wget
          - htop
          - tree
          - git
          - ufw
          - unattended-upgrades
        state: present

    - name: Configure UFW
      ufw:
        state: enabled
        policy: deny

    - name: Allow SSH through UFW
      ufw:
        rule: allow
        port: "22"
        proto: tcp

    - name: Configure SSH
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
      with_items:
        - { regexp: "^#?PermitRootLogin", line: "PermitRootLogin no" }
        - { regexp: "^#?PermitEmptyPasswords", line: "PermitEmptyPasswords no" }
        - { regexp: "^#?ClientAliveInterval", line: "ClientAliveInterval 300" }
      notify: restart sshd

    - name: Enable automatic updates
      copy:
        content: |
          APT::Periodic::Update-Package-Lists "1";
          APT::Periodic::Unattended-Upgrade "1";
          APT::Periodic::AutocleanInterval "7";
        dest: /etc/apt/apt.conf.d/20auto-upgrades

  handlers:
    - name: restart sshd
      service:
        name: sshd
        state: restarted

# 检查操作系统版本
cat /etc/os-release

# 预期输出包含：
# NAME="Ubuntu"
# VERSION_ID="22.04"
# VERSION="22.04.3 LTS"

# 检查内核版本
uname -r
# 预期输出：5.15.0-XX-generic 或更高

# 检查 IP 地址
ip addr show

# 检查路由
ip route | grep default

# 测试网络连通性
ping -c 4 8.8.8.8
ping -c 4 www.baidu.com

# 检查 DNS 解析
nslookup www.baidu.com

# 检查分区挂载
df -h

# 检查分区表
lsblk

# 检查文件系统类型
findmnt

# 检查时区
timedatectl | grep "Time zone"
# 预期输出：Time zone: Asia/Shanghai

# 检查时间同步状态
timedatectl | grep "NTP enabled"
# 预期输出：NTP enabled: yes

# 检查当前时间
date

# 检查防火墙状态
sudo ufw status verbose

# 预期输出包含：
# Status: active
# Default: deny (incoming), allow (outgoing)
# 22/tcp  ALLOW IN  Anywhere

# 测试端口监听
sudo ss -tlnp | grep :22

# 检查 SSH 服务状态
sudo systemctl status sshd

# 验证 SSH 配置
sudo sshd -t
# 预期输出：无错误信息

# 测试 SSH 连接（从另一台机器）
ssh admin@server-ip

# 检查 unattended-upgrades 状态
sudo systemctl status unattended-upgrades

# 检查自动更新配置
cat /etc/apt/apt.conf.d/20auto-upgrades

# 手动测试更新检查
sudo apt update
sudo apt list --upgradable

#!/bin/bash
# 系统初始化验证脚本

ERRORS=0

check_command() {
    if eval "$2" > /dev/null 2>&1; then
        echo "✅ $1"
    else
        echo "❌ $1"
        ERRORS=$((ERRORS + 1))
    fi
}

echo "=== 系统初始化验证 ==="

check_command "操作系统版本" "grep 'VERSION_ID=\"22.04\"' /etc/os-release"
check_command "主机名配置" "hostname | grep -q 'server'"
check_command "网络连通性" "ping -c 1 8.8.8.8"
check_command "DNS 解析" "nslookup www.baidu.com"
check_command "时区配置" "timedatectl | grep -q 'Asia/Shanghai'"
check_command "NTP 同步" "timedatectl | grep -q 'NTP enabled: yes'"
check_command "防火墙启用" "ufw status | grep -q 'Status: active'"
check_command "SSH 服务运行" "systemctl is-active sshd"
check_command "Root 登录已禁用" "grep -q 'PermitRootLogin no' /etc/ssh/sshd_config"

echo ""
if [ $ERRORS -eq 0 ]; then
    echo "✅ 所有检查通过！"
    exit 0
else
    echo "❌ 发现 $ERRORS 个问题，请检查配置"
    exit 1
fi

# 1. 检查网络接口状态
ip link

# 2. 检查 IP 地址配置
ip addr

# 3. 检查路由表
ip route

# 4. 测试本地回环
ping 127.0.0.1

# 5. 测试网关
ping <gateway-ip>

# 6. 检查 DNS 配置
cat /etc/resolv.conf

sudo nano /etc/netplan/00-installer-config.yaml
sudo netplan apply

# 在服务器上检查
sudo systemctl status sshd
sudo ss -tlnp | grep :22
sudo cat /var/log/auth.log | grep ssh

# 检查磁盘使用情况
df -h

# 检查大文件
sudo du -sh /* 2>/dev/null | sort -hr | head -20

sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# 扩展逻辑卷
sudo lvextend -L +10G /dev/ubuntu-vg/ubuntu-lv

# 扩展文件系统
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
# 或 XFS
sudo xfs_growfs /

# 创建 user-data 脚本
cat > user-data.txt << 'EOF'
#!/bin/bash
apt update
apt install -y nginx
systemctl enable nginx
EOF

# 启动实例时指定
eaws ec2 run-instances \
  --image-id ami-xxxxx \
  --user-data file://user-data.txt \
  ...

# 在控制台创建实例时，在"高级选项"中粘贴 cloud-init 配置
# 或使用 API 指定 UserData

# 创建快照（只读）
sudo lvcreate -L 10G -s -n root-snapshot /dev/vg0/root

# 恢复快照
sudo umount /dev/vg0/root
sudo lvconvert --merge /dev/vg0/root-snapshot

# 使用 tar 备份关键配置
tar czvf /backup/config-$(date +%Y%m%d).tar.gz \
  /etc/ssh/sshd_config \
  /etc/netplan/ \
  /etc/ufw/ \
  /etc/hosts

# 使用 rsync 同步
rsync -avz /etc/ user@backup-server:/backups/server01/etc/

# 查看 cloud-init 日志（云平台）
cat /var/log/cloud-init.log
cat /var/log/cloud-init-output.log

# 查看系统日志
cat /var/log/syslog | grep cloud-init

# 运行前面提供的验证脚本
./verify-init.sh

# 检查各项配置是否生效
timedatectl status
ufw status
systemctl status sshd
cat /etc/ssh/sshd_config | grep PermitRootLogin

# Ansible 检查模式
ansible-playbook --check init-playbook.yml

# 测试执行
ansible-playbook init-playbook.yml

# 更新系统
sudo yum update -y

# 安装常用工具
sudo yum install -y vim curl wget net-tools htop

# 配置 firewalld
sudo systemctl enable firewalld
sudo systemctl start firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

# 配置自动更新
sudo yum install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

# 服务器初始化检查清单

## 基础信息
- [ ] 主机名：_____________
- [ ] IP 地址：_____________
- [ ] 操作系统：_____________
- [ ] 初始化日期：_____________

## 网络配置
- [ ] 静态 IP 配置正确
- [ ] DNS 解析正常
- [ ] 网关可达
- [ ] 防火墙规则配置

## 安全配置
- [ ] Root 登录已禁用
- [ ] SSH 密钥已配置
- [ ] 自动更新已启用
- [ ] 不必要的服务已禁用

## 签名
初始化人员：_____________ 日期：_____________
审核人员：_____________ 日期：_____________