š„ļø InstalaĆ§Ć£o do Ubuntu Server 24.04.3 LTS - DMZ
Guia de instalaĆ§Ć£o e configuraĆ§Ć£o inicial do sistema operativo para o Webserver DMZ
š Ćndice
- Requisitos de Sistema
- InformaĆ§Ć£o da MĆ”quina Virtual
- Processo de InstalaĆ§Ć£o
- ConfiguraĆ§Ć£o de Rede DMZ
- ConfiguraĆ§Ć£o de Timezone e NTP
- InstalaĆ§Ć£o de Pacotes Base
- ConfiguraƧƵes de SeguranƧa
- VerificaĆ§Ć£o PĆ³s-InstalaĆ§Ć£o
- ReferĆŖncias
š» Requisitos de Sistema
Hardware
| Recurso | Valor | DescriĆ§Ć£o |
|---|---|---|
| RAM | 794 MB | MemĆ³ria mĆnima para Nginx |
| Disco | 24 GB | Sistema + logs |
| Rede | 1 NIC | Interface na rede DMZ |
Software
| Componente | VersĆ£o | DescriĆ§Ć£o |
|---|---|---|
| Sistema Operativo | Ubuntu Server 24.04.3 LTS | Noble Numbat |
| Kernel | 6.8.0-generic | Kernel Linux |
| Hypervisor | Proxmox VE 8.x | VirtualizaĆ§Ć£o KVM |
š„ļø InformaĆ§Ć£o da MĆ”quina Virtual
ConfiguraĆ§Ć£o no Proxmox
# CriaĆ§Ć£o da VM no Proxmox
qm create 102 \
--name webserver \
--memory 800 \
--cores 2 \
--sockets 1 \
--net0 virtio,bridge=vmbr2 \
--scsihw virtio-scsi-pci \
--scsi0 local-lvm:24 \
--ide2 local:iso/ubuntu-24.04.3-live-server-amd64.iso,media=cdrom \
--boot order=scsi0;ide2
ParĆ¢metros da VM
| ParĆ¢metro | Valor |
|---|---|
| VM ID | 102 |
| Nome | webserver |
| Bridge | vmbr2 (DMZ) |
| Tipo de Disco | VirtIO SCSI |
| Tipo de Rede | VirtIO |
š§ Processo de InstalaĆ§Ć£o
1. Boot e SeleĆ§Ć£o de Idioma
- Iniciar a VM com a ISO do Ubuntu Server
- Selecionar idioma: PortuguĆŖs (Portugal)
- Selecionar layout de teclado: Portuguese
2. Tipo de InstalaĆ§Ć£o
- Selecionar Ubuntu Server (minimized)
- Configurar instalaĆ§Ć£o de SSH durante o setup
3. ConfiguraĆ§Ć£o de Disco
MĆ©todo: Use entire disk
Disco: /dev/sda (24 GB)
LVM: Sim
EncriptaĆ§Ć£o: NĆ£o
Layout de PartiƧƵes:
| PartiĆ§Ć£o | Tamanho | Ponto de Montagem | Filesystem |
|---|---|---|---|
| /dev/sda1 | 1 GB | /boot/efi | FAT32 (EFI) |
| /dev/sda2 | 2 GB | /boot | ext4 |
| /dev/sda3 | ~21 GB | LVM (ubuntu-vg) | - |
| /dev/mapper/ubuntuāvg-root | ~21 GB | / | ext4 |
4. ConfiguraĆ§Ć£o de Utilizador
Nome: Webserver Admin
Username: webadmin
Password: [Strong Password]
5. ConfiguraĆ§Ć£o de Rede (durante instalaĆ§Ć£o)
Interface: enp6s18
DHCP: NĆ£o (IP estĆ”tico)
IP: 10.0.0.30/24
Gateway: 10.0.0.1
DNS: 192.168.1.10, 1.1.1.1
š ConfiguraĆ§Ć£o de Rede DMZ
Netplan Configuration
Editar /etc/netplan/00-installer-config.yaml:
network:
version: 2
renderer: networkd
ethernets:
enp6s18:
addresses:
- 10.0.0.30/24
routes:
- to: default
via: 10.0.0.1
# Rota para LAN (via pfSense)
- to: 192.168.1.0/24
via: 10.0.0.1
nameservers:
addresses:
- 192.168.1.10
- 1.1.1.1
search:
- fsociety.pt
Aplicar configuraĆ§Ć£o:
sudo netplan apply
Configurar Hostname
# Definir hostname
sudo hostnamectl set-hostname webserver.fsociety.pt
# Editar /etc/hosts
sudo nano /etc/hosts
ConteĆŗdo de /etc/hosts:
127.0.0.1 localhost
127.0.1.1 webserver.fsociety.pt webserver
10.0.0.30 webserver.fsociety.pt webserver
# Servidores da infraestrutura
10.0.0.1 pfsense.fsociety.pt pfsense
10.0.0.20 mail.fsociety.pt mail
192.168.1.10 dc.fsociety.pt dc
192.168.1.40 files.fsociety.pt files
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
Verificar Conectividade
# Testar conectividade DMZ
ping -c 4 10.0.0.1 # Gateway pfSense
ping -c 4 10.0.0.20 # Mail server
ping -c 4 1.1.1.1 # Internet
# Testar conectividade LAN (via routing)
ping -c 4 192.168.1.10 # Domain Controller
ping -c 4 192.168.1.40 # File Server
# Verificar DNS
nslookup dc.fsociety.pt
nslookup fsociety.pt
ā° ConfiguraĆ§Ć£o de Timezone e NTP
Configurar Timezone
# Ver timezone atual
timedatectl
# Configurar timezone para Lisboa
sudo timedatectl set-timezone Europe/Lisbon
# Verificar
timedatectl
Configurar NTP
# Instalar chrony
sudo apt update
sudo apt install -y chrony
# Editar configuraĆ§Ć£o
sudo nano /etc/chrony/chrony.conf
Adicionar servidores NTP:
# Usar Domain Controller como servidor primƔrio
server 192.168.1.10 iburst prefer
# Servidores pĆŗblicos como backup
server 0.pt.pool.ntp.org iburst
server 1.pt.pool.ntp.org iburst
Reiniciar e verificar:
sudo systemctl restart chrony
sudo systemctl status chrony
chronyc sources
š¦ InstalaĆ§Ć£o de Pacotes Base
Atualizar Sistema
sudo apt update
sudo apt upgrade -y
sudo apt dist-upgrade -y
Pacotes Essenciais
# Ferramentas bƔsicas
sudo apt install -y \
curl \
wget \
git \
vim \
nano \
htop \
net-tools \
dnsutils \
traceroute \
tcpdump \
iotop \
iftop \
sysstat \
unzip \
zip \
software-properties-common \
apt-transport-https \
ca-certificates \
gnupg \
lsb-release
# Build essentials
sudo apt install -y \
build-essential \
make \
gcc \
g++
š ConfiguraƧƵes de SeguranƧa
Configurar UFW (Firewall Local)
# Permitir SSH
sudo ufw allow 22/tcp
# Permitir HTTP/HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Ativar UFW
sudo ufw --force enable
# Status
sudo ufw status verbose
Configurar Limites de Sistema
Editar /etc/security/limits.conf:
sudo nano /etc/security/limits.conf
Adicionar:
# Limites para Nginx
www-data soft nofile 65536
www-data hard nofile 65536
# Limites globais
* soft nofile 8192
* hard nofile 16384
Configurar Sysctl
Editar /etc/sysctl.conf:
sudo nano /etc/sysctl.conf
Adicionar:
# OtimizaƧƵes de rede
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
# ProteĆ§Ć£o contra SYN flood
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 2
# Aumentar limites de conexƵes
net.core.somaxconn = 2048
net.core.netdev_max_backlog = 5000
# File handles
fs.file-max = 131072
# ProteĆ§Ć£o contra IP spoofing
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
# Desativar ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
Aplicar:
sudo sysctl -p
Fail2ban (serĆ” configurado depois)
# Instalar Fail2ban
sudo apt install -y fail2ban
# NĆ£o ativar ainda (serĆ” configurado com Nginx)
sudo systemctl disable fail2ban
ā VerificaĆ§Ć£o PĆ³s-InstalaĆ§Ć£o
Sistema Operativo
# VersĆ£o do OS
lsb_release -a
# Kernel
uname -r
# Uptime
uptime
# MemĆ³ria
free -h
# Disco
df -h
Rede DMZ
# Interfaces
ip addr show
# Rotas
ip route show
# DNS
cat /etc/resolv.conf
# Hostname
hostname -f
# Testar roteamento para LAN
traceroute 192.168.1.40
ServiƧos
# Verificar serviƧos essenciais
sudo systemctl status ssh
sudo systemctl status chrony
sudo systemctl status systemd-networkd
Firewall
# Status UFW
sudo ufw status numbered
# iptables
sudo iptables -L -n -v
š Checklist PĆ³s-InstalaĆ§Ć£o
- Sistema operativo instalado e atualizado
- Rede DMZ configurada com IP estƔtico (10.0.0.30)
- Hostname definido (webserver.fsociety.pt)
- Rota para LAN configurada
- Timezone configurado (Europe/Lisbon)
- NTP sincronizado
- Pacotes base instalados
- Limites de sistema configurados
- Sysctl otimizado
- UFW configurado (SSH, HTTP, HTTPS)
- Conectividade testada (DMZ, LAN, Internet, DNS)
š PrĆ³ximos Passos
No prĆ³ximo documento, configuraremos:
- Nginx 1.24.0
- Security headers globais
- Rate limiting
- SSL/TLS
š ReferĆŖncias
**[ā¬
ļø Voltar ao README](/fsociety-infrastructure/06-webserver/)** | **[PrĆ³ximo: Nginx Config ā”ļø](/fsociety-infrastructure/06-webserver/02-nginx-config.html)**
Ćltima atualizaĆ§Ć£o: Dezembro 2025