Ubuntu Server Pro

Section 1: What's New in Ubuntu 26.04 LTS for Administrators

• Changes since 24.04 LTS: Linux kernel 7.0, systemd 259, sudo-rs, rust-coreutils, Chrony, OpenSSH 10.2, cgroup v2 only and dracut

• The LTS lifecycle: 5 years of standard support, and ESM through Ubuntu Pro for up to 10 years

• Impact on existing systems: SysV init scripts (26.04 is the last release to support them) and rust-coreutils compatibility

• Checking readiness before adopting 26.04 for new or existing systems

Section 2: Lab: Automated Installation with Autoinstall and cloud-init

• Installing with Subiquity and laying out disks with LVM

• Writing an Autoinstall (YAML) file so every machine installs identically

• Using cloud-init to set the hostname, users, SSH keys and initial packages

• Lab: install a VM with Autoinstall and check the result with cloud-init status and the logs

Section 3: systemd Deep Dive: Boot Process, Units and journald

• The boot sequence from firmware, GRUB and the initramfs (dracut) to systemd targets

• Service, socket, timer, mount and path units, and the Requires, Wants and After relationships

• Writing services with restart policies and drop-in overrides, and converting SysV scripts to systemd units

• Persistent journald, filtering with journalctl by unit, priority, time and boot ID, and forwarding to rsyslog

• Lab: replace cron with systemd timers and analyse boot time with systemd-analyze

Section 4: Users, Groups, sudo-rs and Access Control

• Managing users, groups, service accounts and password policies

• sudo-rs and sudoers: how it differs from traditional sudo, and least-privilege rules

• Advanced permissions: SUID, SGID, the sticky bit, umask and ACLs (setfacl, getfacl)

• Lab: give a service account limited sudo rights

Section 5: Modern Package Management: APT 3, deb822 and Snap

• deb822 repositories (.sources) and adding third-party repositories safely

• Pinning, holds and controlling package versions

• Configuring unattended-upgrades for security updates

• The role of Snap on servers, and when to use APT or Snap

Section 6: Workshop: Laying the Foundations of NovaMart Infrastructure

• Install nova-web, nova-db and nova-ops with Autoinstall and cloud-init

• Create service accounts with limited sudo rights on every machine

• Write a systemd service and timer for an hourly system health check

• Workshop: configure unattended-upgrades on every machine and check the results with journalctl

Section 7: Lab: Storage Management with LVM

• PVs, VGs and LVs, and planning space for different kinds of server

• Growing logical volumes and filesystems online without stopping services

• LVM snapshots for backups and for testing before changes

• Lab: mount by UUID in /etc/fstab and manage swap

Section 8: Software RAID and Filesystems

• Building RAID 1 and RAID 5 with mdadm, simulating a failed disk and rebuilding

• Comparing ext4, XFS and ZFS: strengths, limits and suitable workloads

• An overview of ZFS on Ubuntu: pools, datasets, snapshots and compression

• Checking disk and filesystem health with fsck, xfs_repair and SMART

Section 9: Lab: Networking with Netplan 1.2

• Netplan file structure and the systemd-networkd backend on servers

• Static IPs, multiple routes (replacing the deprecated gateway4), DNS and search domains

• Bonding and VLANs for servers with several network interfaces

• Lab: test changes safely with netplan try, netplan status and networkctl

Section 10: DNS, Time Sync and Network Troubleshooting

• systemd-resolved and analysing name resolution with resolvectl

• Chrony with NTS (Network Time Security), and why accurate time matters for logs, TLS and databases

• ip, ss, ping, mtr and tcpdump, and working through problems layer by layer

• Lab: find out why machines cannot reach each other from simulated symptoms

Section 11: Resource Control with cgroup v2 and Performance Tuning

• The cgroup v2 unified hierarchy, systemd slices, and CPUQuota, MemoryMax, IOWeight and TasksMax

• nice, renice, ulimit and signals for managing processes

• The USE method with htop, vmstat, iostat, sar and sysstat history

• Tuning the kernel with sysctl on sound principles, and analysing the OOM killer and memory pressure

• Lab: watch and limit resources with systemd-cgtop and systemd-run

Section 12: Workshop: Storage, Network and Resource Limits for NovaMart

• Add a data disk to nova-db with LVM, grow it online and take a snapshot

• Set static IPs and DNS on all three machines with Netplan and configure Chrony

• Set resource limits on key services with cgroup v2

• Workshop: generate a simulated load and find the bottleneck with sar and iostat

Section 13: SSH Hardening, Bastion Host and Firewall

• SSH key authentication, and disabling password authentication and root login

• OpenSSH 10.2: post-quantum key exchange, the removal of DSA and the effect on older clients

• AllowUsers, AllowGroups and access through a bastion host with ProxyJump, plus Fail2ban

• UFW and nftables: default deny, opening ports by server role, rate limiting and pitfalls with Docker

• Lab: read and write nftables rulesets directly for advanced cases

Section 14: AppArmor, auditd and Security Compliance

• How AppArmor works, enforce and complain modes, and adjusting profiles

• Recording access to important files and commands with auditd

• An overview of the Ubuntu Security Guide (USG) and auditing against CIS Benchmarks

• Lab: scan for risks with Lynis before and after hardening

Section 15: Ubuntu Pro, Livepatch and Patch Management

• Enabling Ubuntu Pro with pro attach, and the ESM Infra and ESM Apps services

• Canonical Livepatch: fixing kernel vulnerabilities without an immediate reboot

• Patch strategy: maintenance windows, testing first and rollback

• Tracking vulnerabilities with pro fix and Ubuntu Security Notices

Section 16: Lab: Web Server and Reverse Proxy with Nginx

• Nginx configuration layout (sites, snippets, upstream)

• Reverse proxying, basic load balancing and security headers

• TLS with an internal CA for the lab, and using Let's Encrypt (certbot) on real systems

• Tightening services with systemd sandboxing such as ProtectSystem and PrivateTmp

Section 17: Database and Container Services

• Installing PostgreSQL, user privileges and secure remote access with pg_hba.conf

• Installing Docker Engine and how it works with cgroup v2

• Running applications as containers managed by systemd or Docker Compose

• Separating machine roles and networks between web and database

Section 18: Workshop: Hardening NovaMart and Serving It over HTTPS

• Make nova-ops the only bastion host that can reach the other machines

• Set UFW rules by role and enable Fail2ban, AppArmor, auditd and Ubuntu Pro (Livepatch)

• Compare Lynis scan results before and after hardening

• Workshop: PostgreSQL on nova-db, and Nginx with the application container on nova-web, serving the sample shop over HTTPS

Section 19: Production-grade Bash Scripting

• Robust scripts: set -euo pipefail, trap, exit codes and logging

• Parameters, functions and pre-flight checks

• Testing compatibility with rust-coreutils and checking quality with ShellCheck

• Lab: run a script from a systemd timer with an alert on failure

Section 20: Lab: Configuration Management with Ansible

• Idempotency, inventory, playbooks and roles

• Common modules: apt, deb822_repository, user, template, service and ufw

• Managing secrets with Ansible Vault

• Lab: turn the Day 3 hardening steps into a repeatable playbook

Section 21: Monitoring and Centralised Logging

• Installing Prometheus and node_exporter to collect metrics from every machine

• Building dashboards in Grafana

• Basic alerts for CPU, memory, disk and service down

• Centralising logs with rsyslog forwarding

Section 22: Backup and Disaster Recovery

• The 3-2-1 rule, RPO and RTO for backup planning

• Incremental, encrypted file backups with restic

• Backing up PostgreSQL with pg_dump together with LVM snapshots

• Lab: a restore drill with data verification

Section 23: Release Upgrade, Troubleshooting and Incident Response

• Upgrading 24.04 LTS to 26.04 LTS with do-release-upgrade, which normally opens after the first point release

• Pre-upgrade checklist: PPAs, held packages, scripts that rely on sudo or coreutils, remaining SysV services, and the rebuild-and-migrate option

• A troubleshooting method: gather symptoms, form a hypothesis, test, fix and record

• Using rescue and emergency mode to repair a system that will not boot, plus full disks, exhausted inodes, wrong DNS and clock drift

• Writing runbooks and post-incident reviews

Section 24: Master Workshop: Running and Recovering NovaMart Infrastructure

• Write an Ansible playbook that manages the configuration of all three machines

• Install Prometheus and Grafana on nova-ops and set up backups with restic and pg_dump

• Handle a chain of simulated incidents such as a full database disk, a failed service, a network outage and a system that will not boot

• Workshop: detect issues through monitoring, fix them, restore from backup and write up the NovaMart runbook