AIDE File Integrity
Focus: File-Integrity-Baseline und Review.
Purpose
This example is a controlled Ubuntu workshop lab. It is safe for local execution and does not change system configuration.
Documentation
Files
Run
./run.sh
The script writes temporary evidence below work/. The directory is ignored by Git.
Review Questions
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
- How does this example demonstrate
File-Integrity-Baseline und Reviewwith safe Ubuntu operations?
- How does this example demonstrate
Practice Appendix: Example AIDE File Integrity
This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with sample configuration, shell commands and a Git repository.
A001. File-Integrity-Baseline und Review
- Task: check release and support status and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A002. Ubuntu
- Task: evaluate package and repository risk and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A003. Operations
- Task: explain service status and logs and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A004. Security
- Task: document network assumption and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A005. File-Integrity-Baseline und Review
- Task: review user and sudo rule and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A006. Ubuntu
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A007. Operations
- Task: describe storage and backup path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A008. Security
- Task: record patch and reboot window and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A009. File-Integrity-Baseline und Review
- Task: mark security baseline and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A010. Ubuntu
- Task: name monitoring or alert rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A011. Operations
- Task: record rollback or recovery path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A012. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A013. File-Integrity-Baseline und Review
- Task: check release and support status and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A014. Ubuntu
- Task: evaluate package and repository risk and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A015. Operations
- Task: explain service status and logs and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A016. Security
- Task: document network assumption and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A017. File-Integrity-Baseline und Review
- Task: review user and sudo rule and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A018. Ubuntu
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A019. Operations
- Task: describe storage and backup path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A020. Security
- Task: record patch and reboot window and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A021. File-Integrity-Baseline und Review
- Task: mark security baseline and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A022. Ubuntu
- Task: name monitoring or alert rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A023. Operations
- Task: record rollback or recovery path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A024. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A025. File-Integrity-Baseline und Review
- Task: check release and support status and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A026. Ubuntu
- Task: evaluate package and repository risk and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A027. Operations
- Task: explain service status and logs and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A028. Security
- Task: document network assumption and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A029. File-Integrity-Baseline und Review
- Task: review user and sudo rule and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A030. Ubuntu
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A031. Operations
- Task: describe storage and backup path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A032. Security
- Task: record patch and reboot window and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A033. File-Integrity-Baseline und Review
- Task: mark security baseline and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A034. Ubuntu
- Task: name monitoring or alert rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A035. Operations
- Task: record rollback or recovery path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A036. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A037. File-Integrity-Baseline und Review
- Task: check release and support status and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A038. Ubuntu
- Task: evaluate package and repository risk and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A039. Operations
- Task: explain service status and logs and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A040. Security
- Task: document network assumption and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A041. File-Integrity-Baseline und Review
- Task: review user and sudo rule and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A042. Ubuntu
- Task: evaluate firewall rule and exposure and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A043. Operations
- Task: describe storage and backup path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A044. Security
- Task: record patch and reboot window and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A045. File-Integrity-Baseline und Review
- Task: mark security baseline and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A046. Ubuntu
- Task: name monitoring or alert rule and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A047. Operations
- Task: record rollback or recovery path and connect the observation explicitly to
Operations. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A048. Security
- Task: write team rule and connect the observation explicitly to
Security. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A049. File-Integrity-Baseline und Review
- Task: check release and support status and connect the observation explicitly to
File-Integrity-Baseline und Review. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.
A050. Ubuntu
- Task: evaluate package and repository risk and connect the observation explicitly to
Ubuntu. - Evidence: Record at least one Ubuntu-related command, expected output and a boundary of that evidence.
- Operations question: What would a wrong assumption cause in dev, staging, prod and CI?
- Security question: Which accounts, services, packages, ports, logs or secrets would be critical?
- Recovery: Describe whether rollback, restore, package downgrade, reboot, key rotation or manual correction would be needed.