OK, the install cd ask me to change mirrors to download somethings but not changes security sources. Default source is http://security.debian.org/ that is slow very much, about 1kb/s on my area. Please change security sources when os changes main source or ban security while installing system.
Debootstrap aarch64 base system not includes haveged, It makes many errors for ssh. SSH only open after local user login.Please add haveged default.
If you set root password when you installs debian, then system will not install package sudo. But debian ban root login default. So install CD should install sudo whether user sets root password.