LFCA 8 🐧 First Boot and Initial Setup

The first boot after installing Linux is where the system becomes yours. Everything before this was preparation — the disk was written, the bootloader configured, the initial user created. Now the machine is running, and the first hour of use sets the tone for the system’s entire life. This chapter covers what happens on the first boot, what to check, what to configure immediately, and what to leave for later. The LFCA exam treats this as a distinct topic because a sysadmin’s first task on any new system is the same: verify it’s working, secure it, and make it usable.

Key point: The first boot is about verification and baseline configuration. Confirm the system booted correctly, then do the minimum to make it safe and usable — update, create users, configure the network, enable the firewall, set time and locale. Everything else can wait. Get these wrong and you’re either insecure or fighting configuration for weeks.

---

What happens on first boot

The system runs through a specific sequence before you can log in.

Boot sequence:

1. Firmware (BIOS/UEFI) runs POST — checks hardware
2. Bootloader (GRUB) loads the kernel and initramfs
3. Kernel initializes hardware, mounts the root filesystem
4. Init system (systemd) starts services
5. Display manager (Desktop) or getty (Server) presents a login
6. Login — user authenticates

On first boot specifically:

• Desktop: A first-run wizard may appear — theme, online accounts, privacy, Livepatch. These are optional. Skip or configure as you like.
• Server: A login prompt appears on the console. Log in with the user created during install.
• Cloud: SSH is the way in. The instance has an IP; you connect with your private key.
• Container: There’s no “first boot” — the container starts, runs its entrypoint, and stops.

What you’ll see:

Platform	First-login experience
Ubuntu Desktop	GUI login screen → desktop → first-run wizard
Ubuntu Server	TTY login prompt → shell
Cloud VM	SSH from another machine
Container	Its entrypoint runs; no interactive login unless specified

What to look for:

• Did it boot cleanly?
• Did the network come up?
• Can you log in?
• Does the display work (Desktop)?
• Any errors during boot?

Checking boot health:

# On the running system
systemctl --failed
dmesg | tail -30
journalctl -b -p err

If services failed, systemctl --failed lists them. Boot errors show in dmesg and journalctl.

Why the first boot matters: It’s the first chance to verify the install worked. Missing drivers, failed services, or misconfigured hardware all show up immediately. Catching problems here — while the system is fresh — is easier than discovering them weeks later.

---

Logging in for the first time

Login depends on the install type.

Desktop:

The display manager (usually GDM) shows a login screen. Enter the username and password from install. On first login, a wizard may appear:

• Ubuntu Pro / Livepatch — optional kernel patching service
• Online accounts — Google, Microsoft, etc.
• Privacy settings — error reporting, location services
• App suggestions — optional

You can skip most of these. The desktop is usable after login regardless.

Server:

The console shows a login prompt. Log in with the credentials created during install. You’re dropped into a shell.

Ubuntu 24.04 LTS myserver tty1

myserver login: alice
Password:
Welcome to Ubuntu 24.04 LTS ...
alice@myserver:~$

Cloud:

Connect via SSH with the key pair you created.

ssh -i ~/.ssh/mykey.pem ubuntu@1.2.3.4

The default user varies by AMI:

Provider	Default user
AWS Ubuntu	ubuntu
AWS Amazon Linux	ec2-user
AWS Debian	admin
Azure	User-defined
GCP	User-defined

Container:

Containers don’t have a login — you exec into a running container.

docker run -it ubuntu:24.04 bash
docker exec -it <container> bash

What to verify immediately:

• Hostname is correct
• Network works
• You can run sudo
• Kernel version matches expectations

If login fails:

• Wrong password — check Caps Lock, try again
• Account locked — rare on fresh installs; reset via recovery mode
• Display not starting (Desktop) — switch to TTY with Ctrl+Alt+F3
• SSH key rejected — check permissions on the private key (must be 600)

Why first login is different from later logins: Install created the account and set up the login mechanism. First login runs first-run wizards, applies initial user config, and generates home directory contents. After that, logins are just authentication.

---

Verifying the system

Before configuring anything, confirm the install was successful.

Check the distro and version:

lsb_release -a
# Distributor ID: Ubuntu
# Description:    Ubuntu 24.04 LTS
# Release:        24.04
# Codename:       noble

cat /etc/os-release
# NAME="Ubuntu"
# VERSION="24.04 LTS"
# ...

Check the kernel:

uname -r
# 6.8.0-45-generic

uname -a
# full system information

Check the hostname:

hostnamectl
# Static hostname: myserver
# Operating System: Ubuntu 24.04 LTS
# Kernel: Linux 6.8.0-45-generic
# ...

Check the network:

ip addr
# shows interfaces and addresses

ip route
# shows default gateway

ping -c 3 8.8.8.8
# tests connectivity

ping -c 3 ubuntu.com
# tests DNS + connectivity

Check disk usage:

df -h
# shows mounted filesystems and usage

lsblk
# shows block devices

Check for failed services:

systemctl --failed
# returns units that failed to start

systemctl status <service>
# check a specific service

Check the boot log:

journalctl -b
# full log for the current boot

journalctl -b -p err
# errors only

Check CPU and memory:

lscpu
free -h

Why verification matters: Assumptions cause problems. A system that “looks fine” might have a failed service, misconfigured network, or missing driver. Running these commands takes seconds and catches issues early. It’s also what the exam expects: “How would you verify X?” starts with these checks.

Why this is the first task after login: Verification is the baseline. Before you configure anything, you need to know the system is in the expected state. A failed install, a driver issue, or a wrong hostname should be caught now — before you build on top of it.

---

Setting the hostname

The hostname identifies the machine on the network. It’s set during install but can be changed.

Check the current hostname:

hostname
hostnamectl

Set a new hostname:

sudo hostnamectl set-hostname myserver

The change is immediate and persists across reboots.

Verify:

hostnamectl
# Static hostname: myserver

Update /etc/hosts (optional but clean):

127.0.0.1    localhost
127.0.1.1    myserver

The 127.0.1.1 entry lets the system resolve its own hostname.

Naming conventions:

• Lowercase letters, numbers, hyphens
• No spaces or underscores
• FQDN (e.g., web01.example.com) for domains
• Descriptive names (web01, db01) help at scale

Why hostname matters: It appears in logs, shell prompts, SSH connections, and monitoring. A good hostname makes systems identifiable. Changing it after installing services is harder — so set it early.

Why 127.0.1.1 is special: Some applications resolve the hostname via /etc/hosts. The 127.0.1.1 entry ensures the hostname resolves to the machine itself, which many services expect. It’s a small detail that prevents odd errors.

---

Configuring time zone and locale

Time zone and locale affect timestamps, logs, and formatting.

Check current settings:

timedatectl
# Local time: ...
# Time zone: ...
# NTP service: active

localectl
# System Locale: LANG=en_US.UTF-8
# Keyboard Layout: us

Set the time zone:

sudo timedatectl set-timezone Europe/Oslo
sudo timedatectl set-timezone America/New_York
sudo timedatectl set-timezone UTC

List available time zones:

timedatectl list-timezones | grep Europe

Enable NTP (usually on by default):

sudo timedatectl set-ntp true

NTP keeps the clock accurate by syncing with time servers.

Set the locale:

sudo locale-gen en_US.UTF-8
sudo update-locale LANG=en_US.UTF-8

For servers, use UTC:

sudo timedatectl set-timezone UTC

UTC is the standard for servers. Logs across systems match, and there’s no DST jump.

For desktops, use local time:

Set the time zone to your location so clock apps and calendars show correct local time.

Why time zone matters: Timestamps in logs, emails, certificates, and databases depend on the clock. A wrong time zone makes logs confusing and can break TLS or scheduled tasks. Servers should use UTC; desktops use local time.

Why UTC for servers: Servers talk to each other, log centrally, and often run scheduled jobs. UTC makes all timestamps comparable. Local time on a server means DST changes twice a year and confusion when correlating logs across regions.

---

Creating users and managing sudo

The install creates one user with sudo access. Additional users may be needed.

The install user:

On Ubuntu, the first user is added to the sudo group automatically.

groups
# alice adm cdrom sudo dip plugdev ...

Create a new user:

sudo adduser bob
# prompts for password and info

adduser is the friendly command. It creates the home directory, sets up defaults, and prompts for a password. (useradd is the low-level command — avoid it unless you need precise control.)

Add to sudo group:

sudo usermod -aG sudo bob

The -aG means “append to group.” Without -a, usermod -G replaces the user’s groups — a common mistake.

Verify:

groups bob
# bob : bob sudo

Set or change a password:

sudo passwd bob

Delete a user:

sudo deluser bob
# keep home dir
sudo deluser --remove-home bob
# remove home dir

Sudo configuration:

The sudoers file is /etc/sudoers. Never edit it with a normal editor — a syntax error locks you out of sudo.

Use visudo:

sudo visudo

Common sudo patterns:

# Full sudo
alice ALL=(ALL:ALL) ALL

# No password
bob ALL=(ALL) NOPASSWD: ALL

# Specific commands only
carol ALL=(ALL) /usr/bin/systemctl restart nginx

Why sudo matters: Working as root is dangerous. sudo gives temporary elevated privileges for specific commands, logging who did what. Every user with admin needs should use their own account with sudo, not root directly.

Why usermod -aG and not usermod -G: The -a flag appends. Without it, -G replaces all supplementary groups — removing the user from others. Always use -aG to add a group.

---

Configuring the network

Most installs configure the network automatically via DHCP. Verify and adjust if needed.

Check the network:

ip addr
# interfaces and IPs

ip route
# routing table

cat /etc/resolv.conf
# DNS servers

Ubuntu 18.04+ uses Netplan:

ls /etc/netplan/
# 00-installer-config.yaml

cat /etc/netplan/00-installer-config.yaml

Typical DHCP config:

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: true

Static IP config:

network:
  version: 2
  ethernets:
    enp3s0:
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

Apply changes:

sudo netplan apply

Wi-Fi on Desktop: Usually configured via the GUI. On Server, netplan handles it too, or nmcli if NetworkManager is installed.

Testing:

ping -c 3 8.8.8.8        # connectivity
ping -c 3 ubuntu.com     # DNS
curl https://ubuntu.com  # HTTP

Why network config matters: Servers need stable, predictable addresses. Static IPs for servers; DHCP for clients. Getting this wrong means the machine can’t be reached — a problem when you’re managing it remotely.

Why Netplan: Ubuntu introduced Netplan to unify network configuration across backends (NetworkManager, systemd-networkd). The YAML file describes the desired state; Netplan translates it to the backend. Simple, declarative, and consistent.

---

Enabling the firewall

A fresh install has no firewall active by default. Enable one before connecting to networks.

UFW — Uncomplicated Firewall:

sudo ufw status
# Status: inactive

sudo ufw default deny incoming
sudo ufw default allow outgoing

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw enable

What this does:

• Denies all incoming by default
• Allows all outgoing by default
• Opens specific ports (SSH, HTTP, HTTPS)
• Enables the firewall

Verify:

sudo ufw status verbose
# Status: active
# Default: deny (incoming), allow (outgoing)
# To                         Action      From
# --                         ------      ----
# OpenSSH                    ALLOW       Anywhere
# 80/tcp                     ALLOW       Anywhere
# 443/tcp                    ALLOW       Anywhere

Basic commands:

Command	Purpose
ufw status	Show status
ufw enable	Turn on
ufw disable	Turn off
ufw allow PORT	Open a port
ufw deny PORT	Close a port
ufw delete RULE	Remove a rule
ufw reset	Reset all rules

Alternative — firewalld on Red Hat family:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Why firewall matters: Any open port is an attack surface. A default-deny policy blocks everything except what you explicitly allow. On servers exposed to the internet, the firewall is the first line of defense — before user authentication, before application-level checks.

Why UFW is the Ubuntu default: UFW is a friendly wrapper around iptables (and nftables on modern systems). It provides a simple syntax for common rules and integrates with the installer. Advanced users can still use iptables directly; UFW handles 90% of cases.

---

Updating the system

Fresh installs ship with whatever was on the ISO. Update before doing anything else.

Debian/Ubuntu:

sudo apt update
sudo apt upgrade -y
sudo apt full-upgrade -y   # handles dependency changes

Red Hat family:

sudo dnf upgrade --refresh -y

SUSE:

sudo zypper refresh
sudo zypper update -y

Arch:

sudo pacman -Syu

Why this is urgent: Security patches are released continuously. An ISO from a few months ago has known vulnerabilities. The first apt upgrade may pull hundreds of packages.

Automatic updates (optional):

For servers, enable unattended upgrades:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

This configures automatic security updates. For desktop systems, the GUI usually handles this.

Reboot if needed:

# Check if reboot is required
[ -f /var/run/reboot-required ] && echo "reboot needed"

sudo reboot

Kernel updates require a reboot to take effect.

Verify the update:

apt list --upgradable
# should show few or none

Why update first: Every task after this — installing packages, configuring services, joining a domain — assumes an up-to-date system. Updates also refresh the package cache, which is needed to install anything. Skipping this leads to version mismatches and security gaps.

Why full-upgrade vs upgrade: apt upgrade upgrades packages without removing any. apt full-upgrade (or dist-upgrade in older versions) can remove packages to resolve dependencies — needed when major updates change structure. On fresh installs, either works; full-upgrade is safer after major changes.

---

Installing essential tools

A fresh minimal install lacks tools you’ll want daily.

Common installs:

sudo apt install -y \
  curl \
  wget \
  git \
  vim \
  htop \
  tree \
  unzip \
  build-essential \
  net-tools

What each does:

Tool	Purpose
curl	HTTP client
wget	File downloader
git	Version control
vim	Text editor
htop	Process viewer
tree	Directory tree
unzip	ZIP extraction
build-essential	Compilers and build tools
net-tools	Legacy networking (ifconfig)

On Desktop: Most are pre-installed. Add build-essential, vim, and a few others.

On Server: Many are missing. Install them.

Shell preferences:

• bash — the default, pre-installed
• zsh — popular replacement
• fish — friendly, less POSIX

sudo apt install -y zsh
chsh -s $(which zsh)

For servers, keep it minimal: Install only what you need. Every package is a potential vulnerability.

Why these tools: They’re the baseline for real work. curl for APIs, git for code, vim for editing configs, htop for monitoring. Minimal installs drop them to save space — you add them back during setup.

Why build-essential matters on servers: Many packages, Python modules, and tools compile from source. Without a compiler and basic build tools, you can’t install them. build-essential is the standard package for this on Debian/Ubuntu.

---

A full example

A complete first-boot setup session.

# ============================================
# PART 1: LOG IN AND VERIFY
# ============================================

# (Login prompt)
# myserver login: alice
# Password: ****

# Check what we're running
lsb_release -a
# [ Distributor ID: Ubuntu ]
# [ Description:    Ubuntu 24.04 LTS ]
# [ Release:        24.04 ]
# [ Codename:       noble ]

uname -r
# [ 6.8.0-45-generic ]

hostnamectl
# [ Static hostname: myserver ]
# [ ... ]

# Check for failed services
systemctl --failed
# [ 0 loaded units listed. ]

# ============================================
# PART 2: SET HOSTNAME AND TIME
# ============================================

sudo hostnamectl set-hostname web01

sudo timedatectl set-timezone UTC
sudo timedatectl set-ntp true

timedatectl
# [ Local time: ... UTC ]
# [ Time zone: UTC (UTC, +0000) ]
# [ NTP service: active ]

# ============================================
# PART 3: CREATE ADDITIONAL USERS
# ============================================

# The install user (alice) already has sudo
groups alice
# [ alice : alice adm cdrom sudo dip plugdev ... ]

# Add a second user
sudo adduser bob
# [ prompts for password and info ]

# Grant sudo
sudo usermod -aG sudo bob

# Verify
groups bob
# [ bob : bob sudo ]

# ============================================
# PART 4: CONFIGURE NETWORK
# ============================================

ip addr
# [ enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> ... ]
# [     inet 192.168.1.50/24 ... ]

ip route
# [ default via 192.168.1.1 dev enp3s0 ]

ping -c 3 ubuntu.com
# [ 3 packets transmitted, 3 received ]

# ============================================
# PART 5: ENABLE FIREWALL
# ============================================

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

sudo ufw status verbose
# [ Status: active ]
# [ Default: deny (incoming), allow (outgoing) ]
# [ To        Action      From ]
# [ --        ------      ---- ]
# [ OpenSSH   ALLOW       Anywhere ]

# ============================================
# PART 6: UPDATE THE SYSTEM
# ============================================

sudo apt update
sudo apt upgrade -y
sudo apt full-upgrade -y

# Check if reboot is needed
[ -f /var/run/reboot-required ] && echo "reboot needed"

# ============================================
# PART 7: INSTALL ESSENTIAL TOOLS
# ============================================

sudo apt install -y \
  curl \
  wget \
  git \
  vim \
  htop \
  tree \
  unzip \
  build-essential

# ============================================
# PART 8: ENABLE SSH (if not already)
# ============================================

sudo systemctl status ssh
# [ active (running) ]

# If not running:
# sudo systemctl enable --now ssh

# ============================================
# PART 9: AUTOMATIC SECURITY UPDATES
# ============================================

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

# ============================================
# PART 10: FINAL VERIFICATION
# ============================================

echo "=== System ==="
hostnamectl | head -5

echo "=== Network ==="
ip -br addr

echo "=== Firewall ==="
sudo ufw status | head -3

echo "=== Updates ==="
apt list --upgradable 2>/dev/null | head -5

echo "=== Services ==="
systemctl --failed

Each part corresponds to a concept: verify, set hostname and time, manage users, configure network, enable firewall, update, install tools, enable SSH, set up automatic updates, verify.

Why this shape: It’s a real first-boot workflow. In 15–20 minutes, you go from a fresh install to a baseline-configured system — verified, secure, updated, and usable. That’s the goal of the entire chapter.

---

Complete Example Session

# ============================================
# PART 1: POST-INSTALL VERIFICATION
# ============================================

lsb_release -a | head -4
# [ Distributor ID: Ubuntu ]
# [ Description:    Ubuntu 24.04 LTS ]
# [ Release:        24.04 ]
# [ Codename:       noble ]

uname -r
# [ 6.8.0-45-generic ]

hostnamectl | head -6
# [ Static hostname: myserver ]
# [ ... ]

systemctl --failed
# [ 0 loaded units listed. ]

journalctl -b -p err --no-pager | tail -5
# [ (no errors) ]

# ============================================
# PART 2: HOSTNAME
# ============================================

sudo hostnamectl set-hostname web01
hostname
# [ web01 ]

# ============================================
# PART 3: TIME AND LOCALE
# ============================================

sudo timedatectl set-timezone UTC
sudo timedatectl set-ntp true

timedatectl
# [ Local time: ... UTC ]
# [ Time zone: UTC (UTC, +0000) ]
# [ System clock synchronized: yes ]
# [ NTP service: active ]

localectl
# [ System Locale: LANG=en_US.UTF-8 ]
# [ VC Keymap: us ]

# ============================================
# PART 4: USERS
# ============================================

sudo adduser bob
# [ Adding user `bob' ... ]

sudo usermod -aG sudo bob
groups bob
# [ bob : bob sudo ]

# ============================================
# PART 5: NETWORK
# ============================================

ip -br addr
# [ lo    UNKNOWN  127.0.0.1/8 ::1/128 ]
# [ enp3s0 UP       192.168.1.50/24 ]

ip route | head -3
# [ default via 192.168.1.1 dev enp3s0 ]

cat /etc/resolv.conf | grep nameserver
# [ nameserver 127.0.0.53 ]

ping -c 2 1.1.1.1
# [ 2 packets transmitted, 2 received ]

ping -c 2 ubuntu.com
# [ 2 packets transmitted, 2 received ]

# ============================================
# PART 6: FIREWALL
# ============================================

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
# [ Firewall is active and enabled on system startup ]

sudo ufw status
# [ Status: active ]
# [ To        Action      From ]
# [ --        ------      ---- ]
# [ OpenSSH   ALLOW       Anywhere ]

# ============================================
# PART 7: UPDATE
# ============================================

sudo apt update
# [ Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease ]
# [ ... ]

sudo apt upgrade -y
# [ ... 47 upgraded, 0 newly installed ]

sudo apt full-upgrade -y

# ============================================
# PART 8: ESSENTIAL TOOLS
# ============================================

sudo apt install -y curl wget git vim htop tree unzip build-essential
# [ ... Setting up ... ]

which curl git vim htop
# [ /usr/bin/curl ]
# [ /usr/bin/git ]
# [ /usr/bin/vim ]
# [ /usr/bin/htop ]

# ============================================
# PART 9: SSH
# ============================================

sudo systemctl status ssh | head -4
# [ ● ssh.service - OpenBSD Secure Shell server ]
# [    Loaded: loaded ]
# [    Active: active (running) ]

# ============================================
# PART 10: AUTOMATIC UPDATES
# ============================================

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
# [ Automatic updates: enabled ]

# ============================================
# PART 11: FINAL CHECK
# ============================================

echo "=== Hostname ==="
hostname

echo "=== Network ==="
ip -br addr | grep -v lo

echo "=== Firewall ==="
sudo ufw status | grep Status

echo "=== Updates ==="
apt list --upgradable 2>/dev/null | wc -l

echo "=== Failed services ==="
systemctl --failed --no-legend

The session covers every first-boot task — verification, hostname, time, users, network, firewall, updates, tools, SSH, auto-updates, final check.

Why this exercise is comprehensive: It mirrors the workflow a sysadmin runs on every new system. In 15–20 minutes, the system is verified, named, secured, updated, and usable. The exam tests these concepts — knowing the order and the commands is the practical skill.

---

Quick Reference

First-Boot Sequence

Stage	What happens
Firmware	POST, hardware check
Bootloader	Loads kernel + initramfs
Kernel	Initializes hardware
systemd	Starts services
Login	Auth prompt
First login	Wizard or shell

Verification Commands

Check	Command
Distro	lsb_release -a
Kernel	uname -r
Hostname	hostnamectl
Network	ip addr / ip route
Failed services	systemctl --failed
Boot errors	journalctl -b -p err
Disk	df -h / lsblk
CPU	lscpu
Memory	free -h

Hostname

Command	Purpose
hostname	Show current hostname
hostnamectl	Show detailed info
sudo hostnamectl set-hostname NAME	Change it

Time and Locale

Command	Purpose
timedatectl	Show time settings
sudo timedatectl set-timezone ZONE	Set time zone
sudo timedatectl set-ntp true	Enable NTP
localectl	Show locale and keyboard
sudo update-locale LANG=...	Set locale

Time Zone Choices

System	Recommended
Server	UTC
Desktop	Local time
Cloud	UTC
Distributed system	UTC

User Commands

Command	Purpose
adduser NAME	Create user (interactive)
usermod -aG sudo NAME	Grant sudo
passwd NAME	Set password
deluser NAME	Delete user
deluser --remove-home NAME	Delete with home
groups NAME	Show groups
visudo	Edit sudoers safely

Network Configuration

Command	Purpose
ip addr	Show interfaces
ip route	Show routes
cat /etc/resolv.conf	DNS
ping HOST	Connectivity
netplan apply	Apply config
nmcli	NetworkManager CLI

Firewall (UFW)

Command	Purpose
ufw status	Show rules
ufw enable	Enable
ufw disable	Disable
ufw allow PORT	Open port
ufw allow OpenSSH	Open SSH
ufw deny PORT	Block port
ufw delete RULE	Remove rule
ufw reset	Reset all

Update Commands by Distro

Distro	Update
Debian/Ubuntu	sudo apt update && sudo apt upgrade
Red Hat	sudo dnf upgrade
SUSE	sudo zypper update
Arch	sudo pacman -Syu
Alpine	sudo apk update && apk upgrade

Essential Tools

Tool	Purpose
curl	HTTP client
wget	Download
git	Version control
vim	Text editor
htop	Process viewer
tree	Directory tree
unzip	ZIP extraction
build-essential	Compilers
net-tools	Legacy network

SSH

Command	Purpose
systemctl status ssh	Check status
systemctl enable --now ssh	Enable
ufw allow OpenSSH	Open firewall
ssh -i KEY user@host	Connect

Automatic Updates

Task	Command
Install	sudo apt install unattended-upgrades
Configure	sudo dpkg-reconfigure --priority=low unattended-upgrades
Check logs	cat /var/log/unattended-upgrades/*.log

Cloud-Specific

Task	Note
Default user	ubuntu, ec2-user, admin
SSH key	Required, permissions 600
Cloud-init	Runs on first boot
Metadata	Instance info via 169.254.169.254

First-Boot Checklist

Step	Action
1	Log in
2	Verify system (lsb_release, uname)
3	Check failed services
4	Set hostname
5	Set time zone and NTP
6	Create users
7	Configure network
8	Enable firewall
9	Update packages
10	Install essential tools
11	Enable SSH
12	Enable unattended upgrades
13	Verify final state

Common Issues

Issue	Cause	Fix
Can’t log in	Wrong password	Reset via recovery
No network	Wrong interface	Check ip addr
No DNS	Resolv config	Check /etc/resolv.conf
Locked out of sudo	Bad sudoers	Use recovery mode
Firewall blocks SSH	Rule missing	ufw allow OpenSSH
Disk full	Small install	df -h, resize
Service failed	Misconfig	journalctl -u SERVICE

---

Best Practices

✅ Do This:

# Verify the system first
lsb_release -a
uname -r
systemctl --failed                                    # ✅

# Set the hostname early
sudo hostnamectl set-hostname myserver                # ✅

# Use UTC on servers
sudo timedatectl set-timezone UTC                     # ✅

# Enable NTP
sudo timedatectl set-ntp true                         # ✅

# Create users (don't work as root)
sudo adduser alice
sudo usermod -aG sudo alice                           # ✅

# Use visudo to edit sudoers
sudo visudo                                           # ✅

# Enable the firewall before connecting
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable                                       # ✅

# Update immediately
sudo apt update && sudo apt upgrade -y                # ✅

# Install essential tools
sudo apt install -y curl git vim htop                 # ✅

# Enable unattended upgrades on servers
sudo apt install unattended-upgrades                  # ✅

# Verify SSH works before disconnecting
ssh user@host                                         # ✅

# Document what you set up
# Keep notes for the next admin                       # ✅

❌ Don’t Do This:

# Don't skip updates
# Vulnerabilities remain unpatched                    # ❌

# Don't use `usermod -G` without `-a`
sudo usermod -G sudo bob  # replaces other groups     # ❌

# Don't edit sudoers directly
sudo nano /etc/sudoers  # use visudo instead          # ❌

# Don't work as root
sudo su -  # not needed; use sudo per command         # ⚠️

# Don't disable the firewall
sudo ufw disable  # unless debugging                  # ⚠️

# Don't use a wrong time zone
# Set explicitly, verify with timedatectl             # ❌

# Don't leave hostname as default
# `ubuntu`, `localhost` are ambiguous                  # ❌

# Don't skip setting up SSH before closing the console
# You may lose remote access                          # ❌

# Don't forget to enable services on boot
sudo systemctl enable --now ssh                       # ✅

# Don't skip verification after changes
# Always check the result                            # ✅

---

Common Pitfalls

Pitfall	Problem	Solution
Wrong time zone	Misleading logs	Set explicitly
Skipping updates	Vulnerabilities	apt upgrade first
usermod -G without -a	Removes other groups	Use -aG
Editing sudoers directly	Can lock out	Use visudo
Firewall off	Exposed	Enable before network
Wrong hostname	Ambiguity at scale	Set early
Not installing tools	Missing utilities	Install baseline
Not enabling SSH	Can’t reconnect	systemctl enable ssh
No auto-updates on server	Security drift	unattended-upgrades
Root as primary user	Audit problems	Use sudo
Losing key file	Locked out	Back up SSH keys
Not verifying network	Silent failures	ping, curl
Locale mismatch	Character issues	update-locale
Forgetting NTP	Clock drift	timedatectl set-ntp true

---

Real-World Examples

1. Verify distro

lsb_release -a

2. Verify kernel

uname -r

3. Check failed services

systemctl --failed

4. Set hostname

sudo hostnamectl set-hostname web01

5. Set time zone

sudo timedatectl set-timezone UTC

6. Enable NTP

sudo timedatectl set-ntp true

7. Create user

sudo adduser bob

8. Grant sudo

sudo usermod -aG sudo bob

9. Check network

ip -br addr

10. Check route

ip route

11. Test connectivity

ping -c 3 1.1.1.1

12. Test DNS

ping -c 3 ubuntu.com

13. Enable firewall

sudo ufw enable

14. Allow SSH

sudo ufw allow OpenSSH

15. Update

sudo apt update && sudo apt upgrade -y

16. Install tools

sudo apt install -y curl git vim htop

17. Enable SSH

sudo systemctl enable --now ssh

18. Auto-updates

sudo apt install unattended-upgrades

19. Check disk

df -h

20. Reboot if needed

[ -f /var/run/reboot-required ] && sudo reboot

---

Visual: First Boot Flow

┌──────────────────────────────────────────────┐
│  Power on                                    │
│       │                                      │
│       ▼                                      │
│  Firmware (BIOS/UEFI)                        │
│       │                                      │
│       ▼                                      │
│  Bootloader (GRUB)                           │
│       │                                      │
│       ▼                                      │
│  Kernel                                      │
│       │                                      │
│       ▼                                      │
│  systemd                                     │
│       │                                      │
│       ▼                                      │
│  Login prompt                                │
│       │                                      │
│       ▼                                      │
│  User shell                                  │
│                                              │
└──────────────────────────────────────────────┘

Visual: First-Boot Tasks

┌──────────────────────────────────────────────┐
│  1. Log in                                   │
│       │                                      │
│       ▼                                      │
│  2. Verify system                            │
│       │                                      │
│       ▼                                      │
│  3. Set hostname                             │
│       │                                      │
│       ▼                                      │
│  4. Set time zone + NTP                      │
│       │                                      │
│       ▼                                      │
│  5. Create users                             │
│       │                                      │
│       ▼                                      │
│  6. Configure network                        │
│       │                                      │
│       ▼                                      │
│  7. Enable firewall                          │
│       │                                      │
│       ▼                                      │
│  8. Update system                            │
│       │                                      │
│       ▼                                      │
│  9. Install tools                            │
│       │                                      │
│       ▼                                      │
│ 10. Enable SSH + auto-updates                │
│                                              │
└──────────────────────────────────────────────┘

Visual: Verification Commands

┌──────────────────────────────────────────────┐
│  What am I running?                          │
│  ── lsb_release -a                           │
│  ── uname -r                                 │
│  ── hostnamectl                              │
│                                              │
│  Is it healthy?                              │
│  ── systemctl --failed                       │
│  ── journalctl -b -p err                     │
│                                              │
│  Is it connected?                            │
│  ── ip addr                                  │
│  ── ping                                      │
│                                              │
│  Is it up to date?                           │
│  ── apt list --upgradable                    │
│                                              │
└──────────────────────────────────────────────┘

Visual: Time Zone Choice

┌──────────────────────────────────────────────┐
│  Server                                      │
│  ── UTC                                      │
│  ── Consistent across regions                │
│  ── No DST surprises                         │
│                                              │
└──────────────────────────────────────────────┘

┌──────────────────────────────────────────────┐
│  Desktop                                     │
│  ── Local time zone                          │
│  ── Clock apps show correct local time       │
│  ── User-facing                            │
│                                              │
└──────────────────────────────────────────────┘

┌──────────────────────────────────────────────┐
│  Distributed system                          │
│  ── UTC everywhere                           │
│  ── Logs correlate                           │
│  ── Analytics work                           │
│                                              │
└──────────────────────────────────────────────┘

Visual: Firewall Before Network

┌──────────────────────────────────────────────┐
│  ❌ Wrong order                              │
│                                              │
│  Connect to internet ──► enable firewall     │
│                                              │
│  Exposed during window                       │
│                                              │
└──────────────────────────────────────────────┘

┌──────────────────────────────────────────────┐
│  ✅ Right order                              │
│                                              │
│  Enable firewall ──► connect to internet     │
│                                              │
│  Protected from the start                    │
│                                              │
└──────────────────────────────────────────────┘

Visual: sudo Group Workflow

┌──────────────────────────────────────────────┐
│  Install creates user                        │
│       │                                      │
│       ▼                                      │
│  Added to `sudo` group automatically         │
│                                              │
│  Additional users:                           │
│       │                                      │
│       ▼                                      │
│  adduser bob                                 │
│       │                                      │
│       ▼                                      │
│  usermod -aG sudo bob                        │
│       │                                      │
│       ▼                                      │
│  Bob can now use sudo                        │
│                                              │
└──────────────────────────────────────────────┘

Visual: Update Before Install

┌──────────────────────────────────────────────┐
│  1. apt update                               │
│     └── refresh package index                │
│                                              │
│  2. apt upgrade                              │
│     └── install newer versions               │
│                                              │
│  3. apt full-upgrade                         │
│     └── handle dependency changes            │
│                                              │
│  4. Install new packages                     │
│     └── now uses current versions            │
│                                              │
└──────────────────────────────────────────────┘

Visual: Essential Tools

┌──────────────────────────────────────────────┐
│  Networking    →  curl, wget, net-tools      │
│  Version ctrl  →  git                        │
│  Editor        →  vim, nano                  │
│  Monitoring    →  htop, top                  │
│  Files         →  tree, unzip                │
│  Build         →  build-essential            │
│                                              │
└──────────────────────────────────────────────┘

Visual: Post-First-Boot System

┌──────────────────────────────────────────────┐
│  Hostname set         ──► web01              │
│  Time zone            ──► UTC                │
│  NTP                  ──► active             │
│  Users                ──► alice, bob (sudo)  │
│  Network              ──► configured         │
│  Firewall             ──► enabled            │
│  Updates              ──► current            │
│  Tools                ──► installed          │
│  SSH                  ──► enabled            │
│  Auto-updates         ──► configured         │
│                                              │
│  → Baseline-configured system                │
│                                              │
└──────────────────────────────────────────────┘

Visual: Secure Boot Order

┌──────────────────────────────────────────────┐
│  1. Boot system                              │
│                                              │
│  2. Log in as install user                   │
│                                              │
│  3. Update packages                          │
│                                              │
│  4. Enable firewall BEFORE network           │
│                                              │
│  5. Configure network                        │
│                                              │
│  6. Create users with sudo                   │
│                                              │
│  7. Enable SSH                               │
│                                              │
│  8. Install tools                            │
│                                              │
│  9. Auto-updates                             │
│                                              │
│  Result: hardened, usable system             │
│                                              │
└──────────────────────────────────────────────┘

---

Summary

Concept	Meaning
First boot	System comes up for the first time
Verification	Check system is healthy
Hostname	Machine identifier
Time zone	UTC for servers, local for desktops
Users	Sudo access via group
Network	DHCP or static via Netplan
Firewall	UFW default-deny
Updates	Before anything else
Essential tools	Curl, git, vim, htop, etc.
Auto-updates	Unattended-upgrades on servers

Key takeaways:

• The first boot boots the kernel, starts services, presents a login
• Desktop, Server, and Cloud have different first-login experiences
• Verify the system first — distro, kernel, hostname, network, failed services
• Set the hostname early — it appears in logs, SSH, and monitoring
• Use UTC on servers, local time on desktops
• Enable NTP to keep the clock accurate
• Create users with adduser and grant sudo with usermod -aG sudo
• Use visudo, never edit /etc/sudoers directly
• Configure the network with ip addr, ip route, and Netplan
• Enable the firewall before connecting to networks — ufw default-deny
• Update the system immediately — security patches come first
• Install essential tools — curl, git, vim, htop, and build tools
• Enable SSH before disconnecting remote sessions
• Set up unattended-upgrades on servers for security patches
• Verify at the end — everything should be configured and running

Remember: First boot is about getting the system from “installed” to “usable and safe.” Verify it works, name it, secure it, update it, and make it comfortable to use. Everything after this — installing applications, joining domains, deploying services — assumes these basics are done. Do them in the first 15 minutes and the system is ready for anything.

---

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!