Concepts·Linux Foundation Certified System Administrator

Ubuntu and AlmaLinux differences that matter

LFCS lets you choose the distribution at the start of the exam, which means the syllabus is really two syllabuses that overlap. This guide runs the same probe on Ubuntu and on RHEL and prints what each one has: four commands that differ, four that are identical, and one - the login shell - that is not what a Linux guide usually assumes.

Start Here Guide 3 of 38 Beginner

PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
LVM2.03.31 (Ubuntu) / 2.03.36 (AlmaLinux)
nftables1.1.6 (Ubuntu) / 1.1.5 (AlmaLinux)
TimeAbout 16 min

Captured on Ubuntu 26.04 and RHEL 10.0. The specific versions differ between them in every row of the table below, which is the point.

Firewallufw 0.36.2 enabled but reporting inactive / firewalld active
Network confignetplan + systemd-networkd / NetworkManager 1.56.0

Both distributions, because the commands on this page differ between them. Every output is captured on the host it belongs to.
Server Name	IP Address	OS	Roles	CPU	RAM	HDD
LFCS-A01	192.168.0.70	Ubuntu 26.04 LTS	Primary host - most guides run only here	2 Core	4 GB	50 GB
LFCS-C01	192.168.0.72	AlmaLinux 10.2	The other distribution - dnf, firewalld and NetworkManager	2 Core	4 GB	50 GB

This guide includes

Use this before choosing your exam distribution. This matters because you pick the family at the start of the exam - and the differences that decide anything are four questions deep, not the long list people expect.

looking up which of ten commands each family has at all
asking the same four questions on both, and getting two different answers
finding what is identical underneath the two firewall front ends
asking which firewall is actually running, three ways, on each family
finding that the login shell is not bash, which almost every Linux guide assumes

Before you start

guide 2 - the two machines this compares.

Which tools each one has at all
The same list of ten commands, looked up on both machines.
bash Example session
```
$for c in apt dnf ufw firewall-cmd nft netplan nmcli networkctl systemctl journalctl; do printf '%-14s %s\n' "$c" "$(command -v $c || echo '-')"; doneapt            /usr/bin/aptdnfufw            /usr/sbin/ufwfirewall-cmdnft            /usr/sbin/nftnetplan        /usr/sbin/netplannmclinetworkctl     /usr/bin/networkctlsystemctl      /usr/bin/systemctljournalctl     /usr/bin/journalctl$for c in apt dnf ufw firewall-cmd nft netplan nmcli networkctl systemctl journalctl; do printf '%-14s %s\n' "$c" "$(command -v $c || echo '-')"; doneapt            /usr/bin/aptdnfufw            /usr/sbin/ufwfirewall-cmdnft            /usr/sbin/nftnetplan        /usr/sbin/netplannmclinetworkctl     /usr/bin/networkctlsystemctl      /usr/bin/systemctljournalctl     /usr/bin/journalctl
```
Note
command -v is the portable test, and it is the honest way to write a script that must run on both: check for the tool rather than parsing /etc/os-release and hoping.

Four differ and three are shared. The shared three are the important ones - systemctl, journalctl and nft are the same tools on both, which is most of Domain 2 and the substrate under all the firewall commands.

Neither has the other's tools at all, not even as an alias. There is no apt on RHEL to fall back on, so a command you learned on one family is simply absent on the other.

Expected resultUbuntu has apt, ufw, netplan, networkctl. RHEL has dnf, firewall-cmd, nmcli. Both have nft, systemctl, journalctl.

Success conditionYou can tell which family a machine belongs to in one command.
The same four questions, two different answers
Package manager, init system, firewall front end, network configuration - asked the same way on both.
bash Example session
```
$printf '%-18s %s\n' "package manager" "$(command -v apt-get >/dev/null && echo apt || echo dnf)" "init system" "$(ps -p 1 -o comm=)" "firewall front end" "$(command -v ufw >/dev/null && echo ufw || echo firewall-cmd)" "network config" "$(command -v netplan >/dev/null && echo 'netplan + systemd-networkd' || echo NetworkManager)"package manager    aptinit system        systemdfirewall front end ufwnetwork config     netplan + systemd-networkd$printf '%-18s %s\n' "package manager" "$(command -v apt-get >/dev/null && echo apt || echo dnf)" "init system" "$(ps -p 1 -o comm=)" "firewall front end" "$(command -v ufw >/dev/null && echo ufw || echo firewall-cmd)" "network config" "$(command -v netplan >/dev/null && echo 'netplan + systemd-networkd' || echo NetworkManager)"package manager    aptinit system        systemdfirewall front end ufwnetwork config     netplan + systemd-networkd
```
Note
Three of the four differ and one does not. systemd is the init system on both, which is why Domain 2 is largely distribution-neutral and Domain 4 is not.

Network configuration is the widest gap. netplan is a YAML front end that renders to systemd-networkd (or to NetworkManager); nmcli talks to NetworkManager directly. They are not different spellings of one idea - the file you edit, the service you restart and the command that shows you the result are all different.

ps -p 1 -o comm= is the init check, and it is worth knowing because a container often answers something else entirely.

Expected resultapt / systemd / ufw / netplan + systemd-networkd against dnf / systemd / firewall-cmd / NetworkManager.

Success conditionYou know the four decisions the distribution makes for you.
And what is identical underneath
Both firewall front ends are front ends. This asks what is actually loaded.
bash Example session
```
$sudo nft list tables 2>/dev/null | head -4; echo "---"; systemctl --version | head -1table inet firewalld---systemd 257 (257-23.el10_2.1.alma.1-gb23e1c8)$sudo nft list tables 2>/dev/null | head -4; echo "---"; systemctl --version | head -1table inet firewalld---systemd 257 (257-23.el10_2.1.alma.1-gb23e1c8)
```
Note
Ubuntu has no nftables tables at all. Not an empty table - none. ufw is installed and has not been enabled, so nothing has been programmed into the kernel, and every packet is accepted by the default policy.

RHEL has table inet firewalld, which is firewalld having translated its zones into nftables rules. Both front ends generate nftables; only one of them has done so here.

So "they both use nftables" is true and useless on its own. What matters operationally is which front end owns the ruleset, because editing nftables directly under a running firewalld gets your rules overwritten the next firewall-cmd --reload.

systemd 259 against 257 is the same tool two versions apart - close enough that every systemctl command in Domain 2 behaves identically, far enough that a very new unit option may not exist on the older one.

Expected resultUbuntu prints nothing at all; RHEL prints table inet firewalld. systemd 259 against systemd 257.

Success conditionYou know what the firewall commands are really talking to.
Which firewall is actually running
Three commands that look like they ask the same question, and give three different answers.
bash Example session
```
$ufw version 2>/dev/null | head -2; echo "---"; sudo ufw status | head -3; echo "---"; systemctl is-enabled ufw 2>&1; systemctl is-active ufw 2>&1ufw 0.36.2Copyright 2008-2023 Canonical Ltd.---Status: inactive---enabledactive$sudo nft list ruleset | wc -l; echo "nft ruleset lines above"; nft --version170nft ruleset lines abovenftables v1.1.6 (Commodore Bullmoose #7)
```
Note
Read those three answers again. systemctl is-enabled ufw says enabled, systemctl is-active ufw says active, and ufw status says inactive. All three are correct: the unit exists and has run, and the firewall itself has not been switched on.

systemctl tells you about the unit; the tool tells you about the function. That distinction costs people marks and outages - a service can be active and unconfigured, or inactive and still have rules loaded from a previous run.

The 0-line ruleset is the ground truth. When two tools disagree about whether a firewall is on, ask the kernel: nft list ruleset. Empty means nothing is being filtered, whatever any front end says.

ufw enable is what would change it, and it warns that it may disrupt existing SSH connections - which on a remote machine is not a hypothetical. Domain 4 does this properly, with the SSH rule added first.

Expected resultufw 0.36.2, Status: inactive, and yet is-enabled enabled and is-active active - with a 0-line nft ruleset.

Success conditionYou will not be fooled by a service that is running and doing nothing.
The other one, for comparison
The same three questions on RHEL, where the firewall is genuinely running.
bash Example session
```
$firewall-cmd --version; echo "---"; sudo firewall-cmd --state; systemctl is-enabled firewalld; systemctl is-active firewalldAuthorization failed.    Make sure polkit agent is running or run the application as superuser.---runningenabledactive$sudo nft list ruleset | wc -l; echo "nft ruleset lines above"; nft --version365nft ruleset lines abovenftables v1.1.5 (Commodore Bullmoose #6)
```
Note
367 lines is what a default firewalld zone looks like once translated. That is the contrast with Ubuntu's zero: same kernel subsystem, one of them programmed.

firewall-cmd --version needed privileges and said Authorization failed. Make sure polkit agent is running or run the application as superuser - which is a surprise for a command that only prints a version. firewalld talks over D-Bus and polkit gates it, so even trivial subcommands can need sudo in a non-interactive session. ufw has no equivalent because it is a script.

--state is the one to script against, because it exits non-zero when firewalld is not running rather than making you parse text.

Expected resultrunning, enabled, active - and a 367-line nftables ruleset. Plus firewall-cmd --version failing with Authorization failed.

Success conditionYou can tell a configured firewall from an idle one.
The login shell is not bash
The assumption almost every Linux guide makes, checked.
zsh Example session
```
$echo "SHELL=$SHELL"; echo "BASH_VERSION=[$BASH_VERSION]"; echo "ZSH_VERSION=[$ZSH_VERSION]"; getent passwd sysadmin | cut -d: -f7SHELL=/bin/zshBASH_VERSION=[]ZSH_VERSION=[5.9]/bin/zsh$echo "SHELL=$SHELL"; echo "BASH_VERSION=[$BASH_VERSION]"; getent passwd sysadmin | cut -d: -f7SHELL=/bin/zshBASH_VERSION=[]/bin/zsh$bash -c 'echo "under bash -c: BASH_VERSION=$BASH_VERSION"'under bash -c: BASH_VERSION=5.2.26(1)-release
```
Note
BASH_VERSION is empty on a machine that has bash. The login shell is zsh, so a .bashrc written there is never read, $BASH_VERSION tests fail, and a bash-only construct in an interactive session errors. This is the lab's own configuration rather than an Ubuntu default - but it is exactly the kind of thing a real machine does to you, and a 20% Essential Commands domain has to cope with it.

And the bash it does have is newer than RHEL's. 5.3.9 under bash -c against RHEL's login bash 5.2.26 - so "Ubuntu has an older bash" would have been exactly backwards.

Which is why scripts declare their shell. #!/usr/bin/env bash and not #!/bin/sh, because /bin/sh is dash on Debian and Ubuntu and does not have arrays, [[ ]], or local in the same way. Guides on this path that need bash say bash -c and say why.

Check with getent passwd $USER | cut -d: -f7, which reads the account's configured shell rather than whatever the current process happens to be.

Expected resultUbuntu: SHELL=/usr/bin/zsh, empty BASH_VERSION, ZSH_VERSION=5.9. RHEL: bash 5.2.26. And bash -c on Ubuntu gets bash 5.3.9.

Success conditionYou know which shell your commands are actually running in.

Troubleshooting

A command from a tutorial does not exist on your machine.

Why: It belongs to the other distribution family.

Fix:command -v the tool. apt/dnf, ufw/firewall-cmd, netplan/nmcli are the four pairs.
systemctl is-active says a firewall is running but nothing is filtered.

Why: The unit is active and the firewall itself is not enabled.

Fix:Ask the tool (ufw status, firewall-cmd --state) and then the kernel (nft list ruleset).
nftables rules disappear after a reload.

Why: A front end owns the ruleset and regenerated it.

Fix:Add rules through the front end, or turn it off and manage nftables directly - not both.
firewall-cmd says Authorization failed for a harmless query.

Why: firewalld is gated by polkit over D-Bus, and there is no agent in a non-interactive session.

Fix:Run it with sudo.
A .bashrc change has no effect.

Why: The login shell is not bash.

Fix:getent passwd $USER | cut -d: -f7. Edit the right rc file, or chsh.
A script works interactively and fails from cron or a unit.

Why: #!/bin/sh is dash on Debian and Ubuntu, and a different shell ran it.

Fix:#!/usr/bin/env bash, and test with the interpreter the shebang names.

Official sources

← All LFCS guides

Ubuntu and AlmaLinux differences that matter

This guide includes

Before you start

Which tools each one has at all

The same four questions, two different answers

And what is identical underneath

Which firewall is actually running

The other one, for comparison

The login shell is not bash

Troubleshooting

Official sources