💻Ubuntu インストールと初期設定

サブネット 192.168.100.0/24
アドレス 192.168.100.xxx
ゲートウェイ 192.168.100.1
ネームサーバー 8.8.8.8,8.8.4.4

sudo passwd root

adduser USER
sudo gpasswd -a $USER sudo

# rootで実行
su

usermod -aG wheel [USER]
EDITOR=vim visudo

# アンコメント
%wheel ALL=(ALL) ALL

sudo apt update && sudo apt upgrade -y

sudo c set-timezone Asia/Tokyo

# コメントアウトする
sudo vim /etc/update-motd.d/10-help-text
sudo vim /etc/update-motd.d/50-motd-news

# またはすべて無効化 > /etc/motd のみ表示
sudo chmod -x /etc/update-motd.d/*

# ログイン時一切表示しない
touch ~/.hushlogin

sudo vim /etc/ssh/sshd_config

# motdを非表示
PrintMotd no

# 最後のログインを非表示
PrintLastLog no

sudo vim /etc/motd

┬ ┬┌─┐┬─┐┌┬┐╔═╗╦═╗╔═╗╔═╗╔═╗
││││ │├┬┘ ││╠═╝╠╦╝║╣ ╚═╗╚═╗
└┴┘└─┘┴└──┴┘╩  ╩╚═╚═╝╚═╝╚═╝

sudo echo ホスト名 > /etc/hostname

# または
sudo vim /etc/hostname

sudo vim /etc/hosts

127.0.0.1 localhost SolarPi

echo 'Acquire::ForceIPv4 "true";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4

sudo vim /etc/netplan/00-installer-config.yaml

network:
  ethernets:
    ens160:
      addresses:
        - 192.168.100.XX/24
      gateway4: 192.168.100.1
      nameservers:
        addresses:
          - 8.8.8.8
        search: []
  version: 2

sudo netplan apply

sudo vim /etc/ssh/sshd_config

PermitRootLogin no

ssh-keygen -t rsa -b 4096

# ユーザー名とホスト名を記述しない
ssh-keygen -t rsa -b 4096 -C ""

パスワードなし

mv ~/.ssh/id_rsa.pub ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# 秘密鍵確認
cd ~/.ssh
cat id_rsa

mkdir -p ~/.ssh && cd $_

cat authorized_keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7o4HLMvoz5rE2jx8BILBApOQNF/f+iHvMCr1d3uIfGdoFKfiJ4Ps3M8Q/sVhNb+tT+d2aF46pdpn+qtWJLb5PzaghGudL6JbStPWL84ytd5dJDz8j34AlnnNYZLEqW6MI+cPFKeZa0J31ALFKFvuecLvWmqc4u773TgY+P3mNDPdreKV9G92RrdXZabb8SbyM4RvdpUqzf2S0NHn28aHqkQSKKliT01+8mQMPOmVrqxcT5keOykhZ/+TLVanQID10St/271CJJLERkXsYIeN1sBhi8WW4hUD9dgBtHSOBwkTVpg4u/I9vmtFg1FguJWIeYaW3Kq2vmXJBeKes5sS/....

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

sudo vim /etc/ssh/sshd_config

# アンコメント
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
ChallengeResponseAuthentication no

sudo sed -i "s/^#\?PasswordAuthentication.*/PasswordAuthentication no/" /etc/ssh/sshd_config
sudo sed -i "s/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/" /etc/ssh/sshd_config
sudo sed -i "s/^#\?PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config

Host [エイリアス１]
  HostName リモートのホスト名
  User リモートユーザー
  IdentityFile /home/[user名]/.ssh/[秘密鍵]

  Port 443

ssh エイリアス1

PermitRootLogin no

sudo service ssh restart

# 不要
# sudo time apt install nodejs npm -y%%

sudo apt install neovim -y

mkdir -p ~/.config/nvim

vim ~/.config/nvim/init.vim

runtime! color.vim
runtime! keymap.vim
runtime! option.vim

set nowritebackup
set nobackup
set virtualedit=block
set backspace=indent,eol,start
set ambiwidth=double
set wildmenu
set ignorecase
set smartcase
set wrapscan
set incsearch
set hlsearch
set noerrorbells
set shellslash
set showmatch matchtime=1
set cinoptions+=:0
set cmdheight=2
set laststatus=2
set showcmd
set display=lastline
set list
" set listchars=tab:»-,trail:-,eol:↲,extends:»,precedes:«,nbsp:%
set history=10000
set expandtab
set encoding=utf-8
scriptencoding utf-8
set shiftwidth=4
set softtabstop=4
set tabstop=4
set guioptions-=T
set guioptions+=a
set guioptions-=m
set guioptions+=R
set showmatch
set smartindent
set noswapfile
set nofoldenable
set title
set number
nnoremap <Esc><Esc> :nohlsearch<CR><ESC>
syntax on
set nrformats=
set whichwrap=b,s,h,l,<,>,[,],~
" set mouse=a
hi Comment ctermfg=246
set clipboard+=unnamedplus

augroup source-vimrc
  autocmd!
  autocmd BufWritePost *vimrc source $MYVIMRC | set foldmethod=marker
  autocmd BufWritePost *gvimrc if has('gui_running') source $MYGVIMRC
augroup END

augroup auto_comment_off
  autocmd!
  autocmd BufEnter * setlocal formatoptions-=r
  autocmd BufEnter * setlocal formatoptions-=o
augroup END

augroup MyXML
  autocmd!
  autocmd Filetype xml inoremap <buffer> </ </<C-x><C-o>
  autocmd Filetype html inoremap <buffer> </ </<C-x><C-o>
augroup END

if has("autocmd")
  augroup redhat
    " In text files, always limit the width of text to 78 characters
    autocmd BufRead *.txt set tw=78
    " When editing a file, always jump to the last cursor position
    autocmd BufReadPost *
    \ if line("'\"") > 0 && line ("'\"") <= line("$") |
    \   exe "normal! g'\"" |
    \ endif
  augroup END
endif

vim ~/.config/nvim/keymap.vim

let mapleader = "\<Space>"

inoremap <silent> jj <Esc>:<C-u>w<CR>
inoremap jk <Esc>
inoremap <silent> っｊ <Esc>:<C-u>w<CR>

nmap <silent> <Esc><Esc> :nohlsearch<CR>

nnoremap <silent> <Leader>v :vs<CR>
nnoremap <silent> <Leader>s :sp<CR>
nnoremap <silent> <Leader>h <C-w>h
nnoremap <silent> <Leader>j <C-w>j
nnoremap <silent> <Leader>k <C-w>k
nnoremap <silent> <Leader>l <C-w>l
nnoremap <silent> <Leader>ｈ <C-w>h
nnoremap <silent> <Leader>ｊ <C-w>j
nnoremap <silent> <Leader>ｋ <C-w>k
nnoremap <silent> <Leader>ｌ <C-w>l

nnoremap j gj
nnoremap k gk
vnoremap j gj
vnoremap k gk
inoremap <C-j> <Down>
inoremap <C-k> <Up>
inoremap <C-h> <Left>
inoremap <C-l> <Right>

inoremap <expr><TAB> pumvisible() ? "\<C-n>" : "\<TAB>"
inoremap <expr><S-TAB> pumvisible() ? "\<C-p>" : "\<S-TAB>"

vim ~/.config/nvim/color.vim

set cursorline
hi clear CursorLine
hi Normal ctermbg=235 ctermfg=255
hi lineNR ctermbg=237 ctermfg=255
hi cursorlineNR ctermbg=27 ctermfg=255
hi CursorLine ctermbg=237
hi Search ctermbg=197 ctermfg=255

sh -c 'curl -fLo "${XDG_DATA_HOME:-$HOME/.local/share}"/nvim/site/autoload/plug.vim --create-dirs \
https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim'

mkdir -p ~/.config/nvim/plugged

vim ~/.config/nvim/option.vim

call plug#begin('~/.config/nvim/plugged')

Plug 'vim-airline/vim-airline'
Plug 'vim-airline/vim-airline-themes'
Plug 'tpope/vim-commentary'
Plug 'preservim/nerdtree'

call plug#end()

nnoremap <silent><C-e> :NERDTreeToggle<CR>

:PlugInstall

:NERDTreeToggle

または
Ctrl + e

~/.config/nvim/colors

vim ~/.config/nvim/init.vim

colorscheme XXX

vim ~/.vimrc

# root、sudo の場合
su
vim ~/.vimrc

source ~/.vimrc

# root の場合
su
source ~/.vimrc

set nowritebackup
set nobackup
set virtualedit=block
set backspace=indent,eol,start
set ambiwidth=double
set wildmenu
set ignorecase
set smartcase
set wrapscan
set incsearch
set hlsearch
set noerrorbells
set shellslash
set showmatch matchtime=1
set cinoptions+=:0
set cmdheight=2
set laststatus=2
set showcmd
set display=lastline
set list
set listchars=tab:^\ ,trail:~
set history=10000
set expandtab
set shiftwidth=4
set softtabstop=4
set tabstop=4
set guioptions-=T
set guioptions+=a
set guioptions-=m
set guioptions+=R
set showmatch
set smartindent
set noswapfile
set nofoldenable
set title
set number
set clipboard=unnamed,autoselect
nnoremap <Esc><Esc> :nohlsearch<CR><ESC>
syntax on
set nrformats=
set whichwrap=b,s,h,l,<,>,[,],~
set mouse=a

augroup source-vimrc
  autocmd!
  autocmd BufWritePost *vimrc source $MYVIMRC | set foldmethod=marker
  autocmd BufWritePost *gvimrc if has('gui_running') source $MYGVIMRC
augroup END

augroup auto_comment_off
  autocmd!
  autocmd BufEnter * setlocal formatoptions-=r
  autocmd BufEnter * setlocal formatoptions-=o
augroup END

augroup MyXML
  autocmd!
  autocmd Filetype xml inoremap <buffer> </ </<C-x><C-o>
  autocmd Filetype html inoremap <buffer> </ </<C-x><C-o>
augroup END

if has("autocmd")
  augroup redhat
    " In text files, always limit the width of text to 78 characters
    autocmd BufRead *.txt set tw=78
    " When editing a file, always jump to the last cursor position
    autocmd BufReadPost *
    \ if line("'\"") > 0 && line ("'\"") <= line("$") |
    \   exe "normal! g'\"" |
    \ endif
  augroup END
endif

hi

Normal：一般的な文字の背景。背景をNONEにすることで全体の80%程度は透過
LineNr ：Vimの左にある行数を表す数字
VertSplit：vimを縦に分割した時の分割線
Special：&などの記号
Identifier：vimrcとかでよくあるのような予約語。
Comment：コメント

# 通常テキスト
highlight Normal ctermbg=233 ctermfg=grey

# 行番号
set cursorline
hi clear CursorLine
highlight lineNR ctermbg=255 ctermfg=235
highlight cursorlineNR ctermbg=255 ctermfg=4

sudo apt remove vim -y &&
sudo apt install vim-gtk -y

set clipboard=unnamedplus

sudo apt install nginx -y

sudo chown $USER:www-data -R /var/www/html

id

find /var/www/html -type d -exec chmod 755 {} +
find /var/www/html -type f -exec chmod 644 {} +

sudo vim /etc/nginx/sites-available/default

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        root /var/www/html;
        index index.php index.html /_h5ai/public/index.php;

        server_name _;
        server_tokens off;

        client_max_body_size 100M;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
                # fastcgi_pass 127.0.0.1:9000;
                include fastcgi_params;
        }
}

mkcert wp wp.com 192.168.100.XXX

sudo mkdir /etc/nginx/ssl

# それぞれ鍵を作成 > パーミッション指定は特にいらない
sudo vim /etc/nginx/ssl/php.pem
sudo vim /etc/nginx/ssl/php-key.pem

    listen 8090 ssl http2;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/XXX.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/XXX.com/privkey.pem;

server {
        listen 443 ssl http2;
        root /var/www/html;
        index index.php index.html /_h5ai/public/index.php;

        server_name _;
        server_tokens off;
        client_max_body_size 100M;

        ssl on;
        ssl_certificate /etc/nginx/ssl/php.pem;
        ssl_certificate_key /etc/nginx/ssl/php-key.pem;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
                include fastcgi_params;
        }
}

server {
        listen 80;
        server_name _;
        return 301 https://$host$request_uri;
}

sudo ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default

# 解除
sudo unlink /etc/nginx/sites-enabled/default

    error_page 403 404 500 503 = /apache_404.html;
    location = /apache_404.html {
        return 404 "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p>The requested URL $request_uri was not found on this server.</p>\n<hr>\n<address>Apache/2.2.31 Server at $host Port $server_port</address>\n</body></html>";
        internal;
    }

        error_page 404      /error.php?id=404;
        error_page 403      /error.php?id=403;
        error_page 401      /error.php?id=401;

        error_page 403      /error.php?id=500;
        error_page 401      /error.php?id=502;
        error_page 401      /error.php?id=503;

        location = /error.php?id=404 {
            root /var/www/html;
        }
        location = /error.php?id=403 {
            root /var/www/html;
        }
        location = /error.php?id=401 {
            root /var/www/html;
        }
        location = /error.php?id=500 {
            root /var/www/html;
        }
        location = /error.php?id=502 {
            root /var/www/html;
        }
        location = /error.php?id=503 {
            root /var/www/html;
        }

sudo sh -c 'echo 127.0.1.1 $(hostname) >> /etc/hosts'

sudo vim /etc/hosts

192.168.100.xxx	php.com

sudo apt install software-properties-common
sudo add-apt-repository ppa:ondrej/php

sudo apt update
sudo apt install php7.4-fpm php7.4-common php7.4-mysql php7.4-xml php7.4-xmlrpc php7.4-curl php7.4-gd php7.4-imagick php7.4-cli php7.4-dev php7.4-imap php7.4-mbstring php7.4-opcache php7.4-soap php7.4-zip unzip -y

sudo apt install -y lsb-release ca-certificates apt-transport-https software-properties-common gnupg2

echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/sury-php.list

curl -fsSL  https://packages.sury.org/php/apt.gpg| sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/sury-keyring.gpg

sudo apt update

sudo apt install php8.1-fpm php8.1-common php8.1-mysql php8.1-xml php8.1-xmlrpc php8.1-curl php8.1-gd php8.1-imagick php8.1-cli php8.1-dev php8.1-imap php8.1-mbstring php8.1-opcache php8.1-soap php8.1-zip unzip -y

sudo apt install mariadb-server mariadb-client -y

sudo systemctl stop mysql.service
sudo systemctl start mysql.service
sudo systemctl enable mysql.service

sudo mysql_secure_installation

- - -
Enter current password for root (enter for none): Enterをおす
Set root password? [Y/n]: Y
New password: Enter password
Re-enter new password: Repeat password
Remove anonymous users? [Y/n]: Y
Disallow root login remotely? [Y/n]: Y
Remove test database and access to it? [Y/n]:  Y
Reload privilege tables now? [Y/n]:  Y
----

sudo systemctl restart mysql.service

sudo mysql -u root -p

root パスワード入力

CREATE DATABASE nextcloud;

# ユーザー作成
CREATE USER 'user'@'localhost' IDENTIFIED BY 'PASSWORD';

# データベースの権限
GRANT ALL ON nextcloud.* TO 'user'@'localhost' IDENTIFIED BY 'PASSWORD' WITH GRANT OPTION;

FLUSH PRIVILEGES;
EXIT;

GRANT ALL ON **.* TO 'user'@'localhost' IDENTIFIED BY 'PASSWORD' WITH GRANT OPTION;

CREATE USER 'user'@'localhost' IDENTIFIED BY 'PASSWORD';
FLUSH PRIVILEGES;
EXIT;

grant all privileges on *.* to root@localhost identified by 'PASSWORD' with grant option;

FLUSH PRIVILEGES;
EXIT;

sudo apt install php7.4-sqlite3

# rootで実行
adduser ユーザー名

# rootで実行
gpasswd -a ユーザー名 sudo

cat /etc/group | grep ユーザー名

sudo usermod -aG sudo ユーザー名

sudo apt install ufw -y

sudo ufw enable

sudo ufw reload

sudo ufw allow XXX

# 範囲指定
ufw  allow 1111:2222/tcp

sudo ufw allow 21/udp
sudo ufw allow 6100:6105/tcp

sudo ufw delete ルール番号

sudo ufw status

sudo view /var/log/ufw.log

# SSH22 をローカルのみ
sudo ufw allow from 192.168.100.0/24 to any port 22

sudo apt install ufw

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# sudo ufw allow 873/tcp

sudo ufw allow from 192.168.100.0/24 to any port 22/tcp
sudo ufw allow from 10.0.0.0/24 to any port 22/tcp

sudo apt install -y fail2ban

sudo fail2ban-client status sshd

sudo fail2ban-client restart

sudo fail2ban-client set sshd unbanip XXX.XXX.XXX

sudo vim /etc/fail2ban/jail.local

[sshd]
enabled = true
bantime  = 3600
findtime  = 20
maxretry = 3

sudo vim /etc/fail2ban/filter.d/ufw.conf

[INCLUDES]
before = common.conf

[Definition]
failregex = UFW BLOCK.* SRC=<HOST> DST
ignoreregex =

sudo vim /etc/fail2ban/jail.local

[ufw]
enabled  = true
filter   = ufw
action   = ufw
logpath  = /var/log/ufw.log

bantime  = -1
findtime = 3d
maxretry = 1
ignoreip = 127.0.0.0/8 ::1

server {
  listen 80;
  server_name 127.0.0.1;

  location / {
    root /var/www/html;
    index index.php index.html;
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ \.php$ {
    root /var/www/html;
    fastcgi_pass unix:/run/php/php8.1-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location ~ /\.ht {
    deny all;
  }
}

# 必要
sudo gpasswd -a user www-data
sudo chown -R $USER:www-data /var/www/html

sudo vim /etc/nginx/nginx.conf

sudo find /var/www/html -type f -exec chmod 664 {} \;
sudo find /var/www/html -type d -exec chmod 775 {} \;

sudo apt install samba -y

sudo vim /etc/samba/smb.conf

[StoragePi]
    comment = Storage
    path = /mnt
    guest ok = no
    read only = no
    browsable = yes

sudo systemctl restart smbd

sudo smbpasswd -a user

sudo apt -y install vsftpd

sudo vim /etc/vsftpd.conf

# スタンドアロンで起動
LESTEN=YES

# run two copies of vsftpd for IPv4 and IPv6 エラーがdたら
listen_ipv6=NO

# 31行目：コメント解除 (書き込み許可)
write_enable=YES

# パーミッション ディレクトリ=755、ファイル=644
local_umask=022

# 99,100行目：コメント解除 (アスキーモード転送許可)
ascii_upload_enable=YES
ascii_download_enable=YES

# 122行目：コメント解除 (chroot 有効)
chroot_local_user=YES

# 123行目：コメント解除 (chroot リスト有効)
chroot_list_enable=YES

# 125行目：コメント解除 (chrootリスト指定)
chroot_list_file=/etc/vsftpd.chroot_list

# 131行目：コメント解除 (ディレクトリごと一括での転送有効)
ls_recurse_enable=YES

# 最終行へ追記：chroot のルートディレクトリ指定。必要なら
local_root=/var/www/html

# パッシブモードでの接続を設定する場合 (不要)
pasv_enable=YES
pasv_promiscuous=NO
pasv_min_port=6100
pasv_max_port=6105

# 待受時間 変更不要 (初期値300)
idle_session_timeout=300
data_connection_timeout=300

# seccomp filter をオフ (ログインできない場合追加:基本不要)
seccomp_sandbox=NO

# ポートを変更する場合追記 (外部接続できない可能性)
listen_port=10991

# 最後の方にあるので、一番下だけYESに
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=YES

sudo vim /etc/vsftpd.chroot_list

# ユーザーを追加
storage
user

sudo systemctl restart vsftpd

sudo passwd user

sudo ufw allow 10991/tcp

sudo /usr/sbin/vsftpd /etc/vsftpd.conf

sudo service vsftpd status

telnet localhost 21

# 他のローカルサーバーから
telnet 192.168.100.2 21

# Ctrl + ] 、q で抜ける

pam_service_name=ftp

netstat -pan|grep :21;

sudo apt install -y avahi-daemon
sudo systemctl start avahi-daemon
sudo systemctl enable avahi-daemon

sudo apt install python3-pip -y

pip install wsgidav cheroot python-pam lxml

wsgidav --host=0.0.0.0 --port=8080 --root=/home/user --auth=anonymous
wsgidav --host=0.0.0.0 --port=8080 --root=/home/user --auth=pam-login

nohup wsgidav --host=0.0.0.0 --port=8080 --root=/home/user --auth=pam-login  > /dev/null 2>&1 &