Target State

You should not treat Ubuntu as a mere Linux shell, but as an operating-system platform with release lifecycle, package sources, systemd, networking, storage, security baseline, monitoring, backup and incident response. Traceable baselines, safe changes and reliable recovery paths are critical.

Focus

• apt
• dpkg
• systemctl
• journalctl
• ip
• ss
• ufw
• cloud-init

Core Terms

Reference Commands

# System und Release
lsb_release -a
cat /etc/os-release
uname -a

# Pakete und Updates
apt policy
apt list --upgradable
apt-cache policy openssh-server
dpkg -l | sed -n '1,20p'

# Dienste und Logs
systemctl status ssh --no-pager
systemctl list-units --failed
journalctl -u ssh --since today

# Netzwerk, Storage und Security
ip address
ss -tulpn
ufw status verbose
findmnt
lsblk
sudo aa-status

Working Model

1. Define host role, release, support status, package sources and operational ownership.
2. Review users, permissions, sudo, SSH, firewall, services and open ports.
3. Review APT/Snap sources, patch state, reboot need and change window.
4. Support changes with configuration diffs, logs, service status and restore evidence.
5. Evaluate backups, monitoring, AppArmor, auditd, AIDE, USG and incident-response paths.
6. Document recovery: rollback, restore, package downgrade, reboot, lockout recovery or rebuild.

Typical Decisions

Diagrams and Models

The diagrams are text-based on purpose so they remain reviewable without extra tooling.

Firmware -> Bootloader -> Kernel -> initramfs -> systemd -> targets -> services

APT sources -> apt update -> package candidates -> upgrade plan -> service impact -> reboot decision

cloud-init -> users/packages/files -> systemd units -> network config -> post-deploy validation

Incident
  detect -> isolate -> collect logs -> preserve evidence -> recover -> patch -> postmortem

Operations Notes

• Ubuntu 24.04 LTS has standard security maintenance until May 2029, Ubuntu Pro until May 2034 and Legacy add-on until May 2039 according to the release cycle page; re-check these dates after later changes.
• Ubuntu Pro includes additional security and support capabilities; usage, cost and compliance impact are organizational decisions.
• USG can support CIS and DISA-STIG audits, but does not replace review and exception processes.
• Netplan, cloud-init and systemd change system state; production use needs change windows and rollback.
• Backups are trustworthy only after restore testing.

Sources and References

• Ubuntu Server Documentation
• Ubuntu Release Cycle
• Ubuntu Pro
• Ubuntu Security Documentation
• Ubuntu Security Guide
• Canonical Academy
• Netplan Documentation
• cloud-init Documentation
• systemd Manuals
• Debian APT User Manual

Review Checklist for Commands

• 01. check release and support status: Record the affected host, package, service, configuration and risk.
• 02. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 03. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 04. document network assumption: Record the affected host, package, service, configuration and risk.
• 05. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 06. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 07. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 08. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 09. mark security baseline: Record the affected host, package, service, configuration and risk.
• 10. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 11. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 12. write team rule: Record the affected host, package, service, configuration and risk.
• 13. check release and support status: Record the affected host, package, service, configuration and risk.
• 14. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 15. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 16. document network assumption: Record the affected host, package, service, configuration and risk.
• 17. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 18. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 19. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 20. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 21. mark security baseline: Record the affected host, package, service, configuration and risk.
• 22. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 23. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 24. write team rule: Record the affected host, package, service, configuration and risk.
• 25. check release and support status: Record the affected host, package, service, configuration and risk.
• 26. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 27. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 28. document network assumption: Record the affected host, package, service, configuration and risk.
• 29. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 30. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 31. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 32. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 33. mark security baseline: Record the affected host, package, service, configuration and risk.
• 34. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 35. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 36. write team rule: Record the affected host, package, service, configuration and risk.
• 37. check release and support status: Record the affected host, package, service, configuration and risk.
• 38. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 39. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 40. document network assumption: Record the affected host, package, service, configuration and risk.
• 41. review user and sudo rule: Record the affected host, package, service, configuration and risk.
• 42. evaluate firewall rule and exposure: Record the affected host, package, service, configuration and risk.
• 43. describe storage and backup path: Record the affected host, package, service, configuration and risk.
• 44. record patch and reboot window: Record the affected host, package, service, configuration and risk.
• 45. mark security baseline: Record the affected host, package, service, configuration and risk.
• 46. name monitoring or alert rule: Record the affected host, package, service, configuration and risk.
• 47. record rollback or recovery path: Record the affected host, package, service, configuration and risk.
• 48. write team rule: Record the affected host, package, service, configuration and risk.
• 49. check release and support status: Record the affected host, package, service, configuration and risk.
• 50. evaluate package and repository risk: Record the affected host, package, service, configuration and risk.
• 51. explain service status and logs: Record the affected host, package, service, configuration and risk.
• 52. document network assumption: Record the affected host, package, service, configuration and risk.

Practice Appendix: Commands

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.

A001. apt

• Task: check release and support status and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A002. dpkg

• Task: evaluate package and repository risk and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A003. systemctl

• Task: explain service status and logs and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A004. journalctl

• Task: document network assumption and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A005. ip

• Task: review user and sudo rule and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A006. ss

• Task: evaluate firewall rule and exposure and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A007. ufw

• Task: describe storage and backup path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A008. cloud-init

• Task: record patch and reboot window and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A009. apt

• Task: mark security baseline and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A010. dpkg

• Task: name monitoring or alert rule and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A011. systemctl

• Task: record rollback or recovery path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A012. journalctl

• Task: write team rule and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A013. ip

• Task: check release and support status and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A014. ss

• Task: evaluate package and repository risk and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A015. ufw

• Task: explain service status and logs and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A016. cloud-init

• Task: document network assumption and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A017. apt

• Task: review user and sudo rule and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A018. dpkg

• Task: evaluate firewall rule and exposure and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A019. systemctl

• Task: describe storage and backup path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A020. journalctl

• Task: record patch and reboot window and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A021. ip

• Task: mark security baseline and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A022. ss

• Task: name monitoring or alert rule and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A023. ufw

• Task: record rollback or recovery path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A024. cloud-init

• Task: write team rule and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A025. apt

• Task: check release and support status and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A026. dpkg

• Task: evaluate package and repository risk and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A027. systemctl

• Task: explain service status and logs and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A028. journalctl

• Task: document network assumption and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A029. ip

• Task: review user and sudo rule and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A030. ss

• Task: evaluate firewall rule and exposure and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A031. ufw

• Task: describe storage and backup path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A032. cloud-init

• Task: record patch and reboot window and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A033. apt

• Task: mark security baseline and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A034. dpkg

• Task: name monitoring or alert rule and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A035. systemctl

• Task: record rollback or recovery path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A036. journalctl

• Task: write team rule and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A037. ip

• Task: check release and support status and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A038. ss

• Task: evaluate package and repository risk and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A039. ufw

• Task: explain service status and logs and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A040. cloud-init

• Task: document network assumption and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A041. apt

• Task: review user and sudo rule and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A042. dpkg

• Task: evaluate firewall rule and exposure and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A043. systemctl

• Task: describe storage and backup path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A044. journalctl

• Task: record patch and reboot window and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A045. ip

• Task: mark security baseline and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A046. ss

• Task: name monitoring or alert rule and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A047. ufw

• Task: record rollback or recovery path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A048. cloud-init

• Task: write team rule and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A049. apt

• Task: check release and support status and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A050. dpkg

• Task: evaluate package and repository risk and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A051. systemctl

• Task: explain service status and logs and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A052. journalctl

• Task: document network assumption and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A053. ip

• Task: review user and sudo rule and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A054. ss

• Task: evaluate firewall rule and exposure and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A055. ufw

• Task: describe storage and backup path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A056. cloud-init

• Task: record patch and reboot window and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A057. apt

• Task: mark security baseline and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A058. dpkg

• Task: name monitoring or alert rule and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A059. systemctl

• Task: record rollback or recovery path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A060. journalctl

• Task: write team rule and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A061. ip

• Task: check release and support status and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A062. ss

• Task: evaluate package and repository risk and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A063. ufw

• Task: explain service status and logs and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A064. cloud-init

• Task: document network assumption and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A065. apt

• Task: review user and sudo rule and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A066. dpkg

• Task: evaluate firewall rule and exposure and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A067. systemctl

• Task: describe storage and backup path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A068. journalctl

• Task: record patch and reboot window and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A069. ip

• Task: mark security baseline and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A070. ss

• Task: name monitoring or alert rule and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A071. ufw

• Task: record rollback or recovery path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A072. cloud-init

• Task: write team rule and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A073. apt

• Task: check release and support status and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A074. dpkg

• Task: evaluate package and repository risk and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A075. systemctl

• Task: explain service status and logs and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A076. journalctl

• Task: document network assumption and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A077. ip

• Task: review user and sudo rule and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A078. ss

• Task: evaluate firewall rule and exposure and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A079. ufw

• Task: describe storage and backup path and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A080. cloud-init

• Task: record patch and reboot window and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A081. apt

• Task: mark security baseline and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A082. dpkg

• Task: name monitoring or alert rule and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A083. systemctl

• Task: record rollback or recovery path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A084. journalctl

• Task: write team rule and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A085. ip

• Task: check release and support status and connect the observation explicitly to ip.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A086. ss

• Task: evaluate package and repository risk and connect the observation explicitly to ss.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A087. ufw

• Task: explain service status and logs and connect the observation explicitly to ufw.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A088. cloud-init

• Task: document network assumption and connect the observation explicitly to cloud-init.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A089. apt

• Task: review user and sudo rule and connect the observation explicitly to apt.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A090. dpkg

• Task: evaluate firewall rule and exposure and connect the observation explicitly to dpkg.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A091. systemctl

• Task: describe storage and backup path and connect the observation explicitly to systemctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.

A092. journalctl

• Task: record patch and reboot window and connect the observation explicitly to journalctl.
• Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
• Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
• Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
• Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.