Installation Walkthrough¶

Step-by-step guide through the Ubuntu Server 24.04 LTS installer with security-focused choices.

Boot from Installation Media¶

Initial Boot¶

Insert USB boot media
Power on and enter boot menu (F12, F8, or manufacturer-specific)
Select USB device (UEFI mode if available)

Select from the boot menu:

Try or Install Ubuntu Server - Proceed with installation
Check disc for defects - Verify installation media (recommended first time)
Boot from first hard disk - Skip if you want to abort

Verify Media First

If you haven't verified the boot media, select "Check disc for defects" to ensure data integrity.

Language and Keyboard¶

Language Selection¶

Select your preferred language for the installation process:

Use arrow keys to navigate
Press Enter to select
English is recommended for server environments (better documentation coverage)

Keyboard Layout¶

Select "Layout" and choose your keyboard layout
Optionally select a variant
Test the layout by typing in the test field
Select "Done" when satisfied

Installation Type¶

Choose Installation Source¶

Options:

Ubuntu Server - Standard installation from media
Ubuntu Server (minimized) - Smaller footprint, fewer packages

Minimized Installation

The minimized variant excludes documentation, locales, and some utilities. Consider this for containers or highly constrained environments.

Network Installation¶

If your system has network access, you may be offered:

Install from local media - Use the ISO on the USB
Install from network - Download packages during install

Select local media for offline installation or network for latest packages.

Network Configuration¶

Interface Detection¶

The installer auto-detects network interfaces:

enp5s0: eth (not connected)
enp6s0: eth
  DHCPv4: 192.168.1.50/24
  Gateway: 192.168.1.1

DHCP vs Static¶

DHCP (Recommended for installation):

Accept the auto-configured address
Configure static IP post-installation via Netplan
Ensures connectivity for package downloads

Static IP during installation:

Select the interface
Choose "Edit IPv4"
Select "Manual"
Enter:
Subnet: 192.168.1.0/24
Address: 192.168.1.100
Gateway: 192.168.1.1
Name servers: 1.1.1.1,8.8.8.8
Search domains: (optional)

Proxy Configuration¶

If your network requires a proxy:

http://proxy.example.com:3128

Leave blank if no proxy is needed.

Mirror Selection¶

The default archive mirror is typically appropriate. Change only if:

You have a local mirror
Geographic mirrors are faster
Corporate policy requires specific mirrors

Storage Configuration¶

Layout Selection¶

When prompted, select Custom storage layout for security-focused partitioning.

Automatic Layout Limitations

The automatic options don't separate /tmp, /var, and /home, limiting your ability to apply security mount options.

Create Partitions¶

Follow the layout from Disk Partitioning:

EFI System Partition:

Select free space on target disk
"Add GPT Partition"
Size: 512M
Format: fat32
Mount: /boot/efi

Boot Partition:

Select remaining free space
"Add GPT Partition"
Size: 1G
Format: ext4
Mount: /boot

LUKS Encrypted Volume:

Select remaining free space
"Add GPT Partition"
Size: (remaining space or specific amount)
Format: Leave unformatted
Don't set mount point yet

After creating the partition:

Select the new partition
Choose "Create encrypted volume"
Enter a strong passphrase (minimum 20 characters recommended)
Confirm the passphrase

Create Volume Group:

Select the encrypted volume (shows as dm-crypt)
Choose "Create LVM volume group"
Name: vg-system (or your preferred name)

Create Logical Volumes:

For each volume needed:

Select the volume group
"Create logical volume"
Configure:

Name	Size	Format	Mount
lv-root	25G	ext4	/
lv-home	50G	ext4	/home
lv-var	50G	ext4	/var
lv-tmp	5G	ext4	/tmp
lv-swap	8G	swap	swap

Review and Confirm¶

The storage summary should show:

DEVICE                    TYPE      SIZE  MOUNT
nvme0n1                   disk      500G
  nvme0n1p1               part      512M  /boot/efi (fat32)
  nvme0n1p2               part        1G  /boot (ext4)
  nvme0n1p3               part      498G
    cryptroot             crypt     498G
      vg-system-lv-root   lvm        25G  / (ext4)
      vg-system-lv-home   lvm        50G  /home (ext4)
      vg-system-lv-var    lvm        50G  /var (ext4)
      vg-system-lv-tmp    lvm         5G  /tmp (ext4)
      vg-system-lv-swap   lvm         8G  swap
      (free space)                  360G

Destructive Action

Proceeding will erase the target disk. Verify you're installing to the correct device.

Select "Done" and confirm when prompted.

Profile Setup¶

Server Identity¶

Field	Recommendation
Your name	Full name (for GECOS field)
Your server's name	Hostname (e.g., `srv-ubuntu-01`)
Pick a username	Lowercase, no spaces (e.g., `admin`)
Choose a password	Strong password, different from LUKS
Confirm password	Re-enter password

Hostname Guidelines:

Use lowercase letters, numbers, hyphens
No underscores or spaces
Follow your organization's naming convention
Examples: web01, srv-ubuntu-prod, ms-s1-max

Ubuntu Pro¶

Ubuntu Pro offers additional security features:

Extended Security Maintenance - 10 years of security updates
Kernel Livepatch - Kernel updates without reboot
FIPS compliance - For regulated environments
CIS hardening tools - Compliance automation

For personal use, Ubuntu Pro is free for up to 5 machines. Register at ubuntu.com/pro.

If you have a token, enter it. Otherwise, select "Skip for now" or "Continue without Ubuntu Pro".

SSH Setup¶

Enable OpenSSH Server¶

Select Install OpenSSH server - this is essential for remote management.

SSH Key Import¶

Options for importing your public SSH key:

Import SSH identity: from GitHub
Enter your GitHub username
Your public keys from GitHub are imported
Convenient and secure
Import SSH identity: from Launchpad
Enter your Launchpad username
No - Add keys manually post-installation

GitHub Key Import

Importing from GitHub is the easiest secure option. Ensure your GitHub account has your current SSH public keys.

If you import keys, password authentication can be disabled by default.

Featured Server Snaps¶

The installer offers additional software via Snap packages:

Snap	Description
docker	Container runtime
nextcloud	Personal cloud
kubernetes	Container orchestration

Recommendation: Skip all

Install software post-installation for better control
Snaps have auto-update behavior that may not suit servers
Package versions may differ from what you want

Select "Done" without checking any boxes.

Installation Progress¶

The installer now:

Partitions the disk
Formats filesystems
Installs the base system
Configures the bootloader
Installs selected packages
Configures SSH with your keys

This takes 5-15 minutes depending on hardware.

Monitor Progress¶

The installation log shows detailed progress:

Package installation
Configuration steps
Any warnings or errors

Watch for red text indicating problems.

Installation Complete¶

When finished:

Remove the USB installation media
Select "Reboot Now"

First Boot¶

LUKS Passphrase Entry¶

After BIOS/UEFI:

GRUB bootloader appears
System prompts for LUKS passphrase
Enter your disk encryption passphrase
System continues booting

After boot completes:

Ubuntu 24.04 LTS srv-ubuntu-01 tty1

srv-ubuntu-01 login: _

Log in with the username and password you created.

Verify SSH Access¶

From another machine:

# Using password
ssh admin@192.168.1.100

# Using key (if imported during install)
ssh admin@192.168.1.100
# Should not prompt for password

Post-Installation Verification¶

Run these checks after first login:

# Check Ubuntu version
lsb_release -a

# Verify disk layout
lsblk

# Check encryption status
sudo cryptsetup status cryptroot

# Verify LVM
sudo lvs

# Check network
ip addr show
ip route show

# Verify SSH service
systemctl status ssh

# Check for updates
sudo apt update
sudo apt list --upgradable

Troubleshooting Installation¶

Installer Crashes¶

Try "Safe graphics" mode from boot menu
Check hardware compatibility
Verify ISO integrity

Network Not Detected¶

Check cable connection
Verify interface is supported
May need firmware packages post-installation

LUKS Won't Unlock¶

Ensure correct passphrase (check caps lock)
Try typing passphrase in a text field to verify

Boot from USB and verify LUKS header:

sudo cryptsetup luksDump /dev/nvme0n1p3

Bootloader Not Installed¶

Re-run installer, select "Install bootloader"

Or manually install from live USB:

sudo chroot /target
grub-install /dev/nvme0n1
update-grub

Next Step¶

Continue to Post-Install Checklist to complete initial system hardening.