• Install GUI in Ubuntu
• Create a user
• Create SSH keys
• Formatting the disk
• Mounting the disk
• Install Docker
• Install Portainer CE
• Changing SSH port
• Install UFW
  • fix docker security -Install SSHFS
• Install Tailscale
• NFS Mount
  • Build the NFS server
  • Install nfs in client
  • Install SMB
• Install Handbrake
• Install MakeMKV

Install GUI in Ubuntu

**Install Minimal GUI (XFCE Core Only)**

   # Update base system
sudo apt update && sudo apt upgrade -y

# Install XRDP + Xorg backend
sudo apt install -y xrdp xorgxrdp dbus-x11

# Install ultra-light MATE (no extras)
sudo apt install -y mate-core mate-session-manager

# Optional: basic utilities (recommended but still light)
sudo apt install -y mate-terminal caja marco

# Set MATE as default session for XRDP
echo "mate-session" > ~/.xsession
chmod +x ~/.xsession

# Allow XRDP user access to SSL cert
sudo adduser xrdp ssl-cert

# Ensure XRDP uses Xorg
sudo sed -i 's/^test -x/#test -x/' /etc/xrdp/startwm.sh
sudo sed -i 's/^exec .*/exec mate-session/' /etc/xrdp/startwm.sh

# Enable and restart XRDP
sudo systemctl enable xrdp
sudo systemctl restart xrdp

# Open RDP port (if firewall is enabled)
sudo ufw allow 3389/tcp

# Reboot recommended
sudo reboot

To Remote GUI Access from Windows

sudo apt install xrdp -y
sudo systemctl enable --now xrdp

Creating a user

sudo addsuer myuser
sudo usermod -aG sudo myuser

Deleting a user

sudo deluser username #or
sudo deluser --remove-home username

Creating SSH keys

Generate the key

ssh-keygen -t ed25519 -C "your_email@example.com"  #ed25519 is the newest encryption

Edit the config file

Go to ~/.ssh/config and open it. (if not present, then create it)

Host github.com
        User git
        Hostname github.com
        PreferredAuthentications publickey
        IdentityFile ~/.ssh/github

Host anyname
        User root
        Hostname your_host_name
        PreferredAuthentications publickey
        IdentityFile ~/.ssh/your_private_key

Copy the id to to remote:

 ssh-copy-id -i ~/.ssh/key user@remote

1. Formatting the disk

check the drive location by: fdisk -l

It will show the hard disk as

/dev/sda
/dev/sdb

Now format the disk after noting.

sudo mkfs -t ext4 /dev/sdb1

2. Mounting the disk

2.1: Create the mount point:

sudo mkdir /hdd

2.2: Edit /etc/fstab:

Open /etc/fstab file with root permissions:

sudo nano /etc/fstab

And add the following to the end of the file:

/dev/sdb1    /hdd    ext4    defaults    0    0

2.3 Mount partition:

sudo mount /hdd

source

2.4 For mounting existing drive:

sudo lsblk -f #take a note of the UUID
sudo nano /etc/fstab
#add this line in fstab
UUID=abcd1234-5678-9ef0-1122-334455667788  /mnt/data  ext4  defaults  0  0 #change the UUID
sudo mount -a

No errors = success ✅

3.1 Install docker on ubuntu 24.04:

for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove $pkg; done

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

# Install docker
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

To test:

sudo docker run hello-world

3.2 Install docker on debian 13:

🧰 Step 1 – Remove old versions (if any)

sudo apt remove docker docker-engine docker.io containerd runc -y

📦 Step 2 – Update system and install dependencies

sudo apt update
sudo apt install -y ca-certificates curl gnupg lsb-release

🔑 Step 3 – Add Docker’s official GPG key

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

🧭 Step 4 – Set up the repository for Debian 13 (Trixie)

(Official Docker repo supports trixie as of 2024)

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/debian trixie stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Then update:

sudo apt update

⚙️ Step 5 – Install Docker Engine + CLI + Compose plugin

sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

🚀 Step 6 – Enable and start Docker

sudo systemctl enable docker --now
sudo systemctl status docker

🧪 Step 7 – Test your installation

sudo docker run hello-world

If you see:

“Hello from Docker!”

🎉 You’re done!

4. Portainer CE Installation:

First, create the volume that Portainer Server will use to store its database:

docker volume create portainer_data

Then, download and install the Portainer Server container:

docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:lts

Portainer Server has now been installed. You can check to see whether the Portainer Server container has started by running docker ps:

root@server:~# docker ps
CONTAINER ID   IMAGE                          COMMAND                  CREATED       STATUS      PORTS                                                                                  NAMES             
de5b28eb2fa9   portainer/portainer-ce:lts     "/portainer"             2 weeks ago   Up 9 days   0.0.0.0:8000->8000/tcp, :::8000->8000/tcp, 0.0.0.0:9443->9443/tcp, :::9443->9443/tcp   portainer

Changing SSH Port

1. Backup the Configuration File. Before making any changes, it’s always a good practice to back up your SSH configuration file.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

2. Edit the SSH Configuration File. Open the SSHD configuration file with your preferred text editor. For this example, we’ll use nano.

sudo nano /etc/ssh/sshd_config

3. Locate the Port Directive. Find the line that starts with Port. It should say Port 22 by default.

4. Change the Port Number. Edit the line to reflect your desired port number, preferably above 1024 to avoid conflicts with other standard services. For instance, to change it to port 2222, the line would look like:

Port 2222

5. Save and Close the File. If you’re using nano, press CTRL + O to write the changes, then press Enter, and CTRL + X to exit.

6. Adjust Firewall Rules. If you have a firewall enabled (like UFW or Firewalld), you’ll need to update its rules to allow connections on the new SSH port.

7. Restart the SSH Service. Apply the changes by restarting the SSH daemon.

# on ubuntu 20.04 or 22.04
service sshd restart

# or on ubuntu 24.04
systemctl daemon-reload
systemctl restart ssh.socket

8. Test the New SSH Port. Before logging out of your current session, open a new terminal or SSH client and try connecting to the server using the new port to ensure everything works correctly:

ssh username@your_server_ip -p 2222

If you’re sure about your changes and the new port is working, and if you have a firewall enabled, consider closing the default port (22) to enhance security. Always be cautious when changing SSH settings, especially if you’re connecting remotely. Mistakes might lock you out of your server. Once you’re done, your Linux server will now accept SSH connections on the new port, enhancing its security against potential threats targeting the default port.

source

UFW

Step 1: Making sure IPv6 is enabled:

sudo nano /etc/default/ufw

IPV6=yes

make sure of above.

Step 2: Setting up default policies

sudo ufw default deny incoming

Output Default incoming policy changed to 'deny' (be sure to update your rules accordingly)

Step 4: Allowing specific ip address to a port:

sudo ufw allow from 203.0.113.4 to any port 22

Output Rule added

source

To Fix The Docker and UFW Security Flaw Without Disabling Iptables

Step 1: Modify the UFW configuration file

Modify the UFW configuration file/etc/ufw/after.rules and add the following rules at the end of the file:

# BEGIN UFW AND DOCKER
*filter
:ufw-user-forward - [0:0]
:ufw-docker-logging-deny - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j ufw-user-forward

-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16

-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN

-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12

-A DOCKER-USER -j RETURN

-A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] "
-A ufw-docker-logging-deny -j DROP

COMMIT
# END UFW AND DOCKER

Step 2: Restart the firewall:

Restart the firewall by

sudo systemctl restart ufw

#or 
sudo ufw reload

Now the public network can't access any published docker ports, the container and the private network can visit each other normally, and the containers can also access the external network from inside. There may be some unknown reasons cause the UFW rules will not take effect after restart UFW, please reboot servers.

Step 3: Add the rules:

ufw route allow proto tcp from any to any port 80

For details, check the source

SSHFS configuration

In Ubuntu and Debian:

sudo apt update
sudo apt install sshfs

To verify the installation, type:

sshfs --version

Basic Usage:

Syntax:

sshfs [user@]hostname:[remote_directory] [local_mount_point] [options] 

Mounting a remote directory:

Step 1: In the local machine, create a folder.

mkdir ~/remote_mount 

Step 2: Mount the remote directory

 sshfs username@example.com:/var/www ~/remote_mount 

If you have set up SSH key-based authentication, you won’t need to enter a password. Otherwise, the system will prompt you to enter the SSH password.

Verify the mount:

 ls ~/remote_mount 

To unmount:

 fusermount -u ~/remote_mount 

Advanced SSH options:

sshfs example_host:/mnt/storage /mnt/remote_mount -o compression=yes,
    ServerAliveInterval=15,cache=yes,cache_timeout=115200,port=2222,
    allow_other,default_permissions

here example_host is configured in ~/.ssh host file

Host example_host
    HostName  1.1.2.2
    User root
    PubKeyAuthentication yes
    Port 8015
    IdentityFile ~/.ssh/authentication_key

In order to mount for streaming, one may use the following options:

sshfs user@host:/mnt/remote_path /mnt/mount_dir -o compression=no,ServerAliveInterval=15,cache=yes,cache_timeout=115200,port=8015,allow_other,default_permissions,kernel_cache,Ciphers=aes128-gcm@openssh.com,reconnect

Tailscale

Step 1: SSH in to your server

ssh <username>@<server host ip>

Step 2:Install tailscale

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Step 3: SSH over tailscale

ssh <username>@<copied 100.x.y.z address>

Step 4: Enable ufw

sudo ufw enable

Step 5: Restrict all traffic

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow in on tailscale0

Step 6: Restart ufw and ssh

sudo ufw reload
sudo service ssh restart

Source

NFS mount

Build the server

Install the nfs server

sudo apt update
sudo apt install nfs-kernel-server -y

Create or choose the folder to share

sudo mkdir -p /srv/data
sudo chown nobody:nogroup /srv/data      # or set appropriate user/group
sudo chmod 755 /srv/data

Edit the exports file:

Open it. sudo nano /etc/exports

Add the line below with necessary replacement:

/srv/data   192.168.1.0/24(rw,sync,no_subtree_check)

Apply the export:

sudo exportfs -ra       # re-read /etc/exports
sudo exportfs -v        # verify shares

Adjust firewall

sudo ufw allow from 192.168.1.0/24 to any port nfs

Start/Enable NFS Services

sudo systemctl enable --now nfs-server

Install NFS on Client PC

sudo apt update && sudo apt install nfs-common -y

Create a local mount point

sudo mkdir -p /mnt/nfs_share

Mount the remote NFS export

sudo mount -t nfs -o vers=4.2,rsize=1048576,wsize=1048576,noatime,nodiratime,async,tcp 192.168.1.100:/srv/data /mnt/nfs_share

For persistent mount: add to /etc/fstab

Add a line like below:

192.168.1.100:/srv/data  /mnt/nfs_share  nfs  vers=4.2,rsize=1048576,wsize=1048576,noatime,nodiratime,async,tcp  0 0

Then,

sudo mount -a

Install SMB

Install Required Tools

Installs the SMB file system utilities and the caching daemon to reduce re-downloading data.

sudo apt update
sudo apt install cifs-utils cachefilesd

Enable "FS-Cache" (Disk Caching)

Essential for buffering. I

• Edit the config: sudo nano /etc/default/cachefilesd

• Uncomment (remove #) the line: RUN=yes

• Start the service:

  sudo systemctl enable --now cachefilesd

Enable BBR (Latency Killer)

Forces Linux to ignore ping latency and utilize the full bandwidth of the pipe.

Run these 3 commands (You don't need to reboot):

echo "net.core.default_qdisc=fq" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Create Secure Credential File

Prevents your password from being visible in system files.

nano ~/.smbcredentials

Paste your details:

username=emby
password=YourRealPassword
domain=WORKGROUP

Lock the file permissions (Security):

chmod 600 ~/.smbcredentials

The Fstab Entry (The Master Config)

Add this single line to /etc/fstab

Variables to Replace:

• //source-ip/ShareName: Your source.

• /path/to/.smbcredentials: Location of file from Step 4.

• uid=1000: Your Emby container's PUID.

• gid=100: Your Emby container's PGID..

Verify & Mount

sudo systemctl daemon-reload
sudo mount -a
ls -ln /mnt/media_smb

Install handbrake

via flatpak

sudo apt install flatpak -y
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak install flathub fr.handbrake.ghb

Then run

flatpak run fr.handbrake.ghb

Install Makemkv

Step 1: Install the depdencies:

sudo apt-get install build-essential pkg-config libc6-dev libssl-dev libexpat1-dev libavcodec-dev libgl1-mesa-dev qtbase5-dev zlib1g-dev

Step 2: Download the tar files:

BIN Package

Extract it:

tar -xvzf makemkv-bin-1.18.2.tar.gz
make
sudo make install

Then extract the source package:

Source Package

./configure
make
sudo make install

Done.