Hands-on Lab·CompTIA Linux+

Linux+ lab: Ubuntu and AlmaLinux package families

XK0-006 is family-neutral, so a question may name apt or dnf, ufw or firewalld, AppArmor or SELinux. This guide introduces one machine of each kind and asks both the same four questions, so the pairs are learned together rather than twice.

Start Here Guide 2 of 28 Beginner

PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
Mandatory access controlAppArmor on Ubuntu, SELinux enforcing on Alma
Firewallufw / nftables 1.1.6
TimeAbout 14 min

Ubuntu 26.04 LTS and AlmaLinux 10.2. Both are current at the time of writing. The Ubuntu host's login shell is zsh, which matters exactly once - and this page is where it comes up.

Both package families, because XK0-006 does not tell you which one you will get. The hostnames are provisioning artefacts shared with the other Linux paths; the OS column is what matters.
Server Name	IP Address	OS	Roles	CPU	RAM	HDD
LPLUS-A01	192.168.0.73	Ubuntu 26.04 LTS	Debian-family host - apt, ufw, netplan, AppArmor	2 Core	4 GB	50 GB
LPLUS-B01	192.168.0.74	AlmaLinux 10.2	RPM-family host - dnf, firewalld, NetworkManager, SELinux	2 Core	4 GB	50 GB

This guide includes

Use this before the hands-on guides. This matters because a question may name apt or dnf, ufw or firewalld - four tools differ between the families, and either may be the one asked about.

meeting the two machines, one of each family
learning the four tools that differ between them
asking which package owns a file, and getting two different answers
finding the access control and the firewall each machine starts with

Before you start

guide 1 - the domains these machines are for.

The two machines
One of each family. Everything on this path runs on one or both.
bash Example session
```
$. /etc/os-release; echo "$PRETTY_NAME"; uname -r; hostnamectl | head -3Ubuntu 26.04 LTS7.0.0-30-generic  Static hostname: lplus-a01        Icon name: computer-vm          Chassis: vm 🖴$. /etc/os-release; echo "$PRETTY_NAME"; uname -r; hostnamectl | head -3AlmaLinux 10.2 (Lavender Lion)6.12.0-211.7.3.el10_2.x86_64     Static hostname: lplus-b01           Icon name: computer-vm             Chassis: vm 🖴
```
Note
The hostnames are provisioning artefacts. LFCS-A01 and RHCSA-UTIL01 are shared with the other Linux paths on this site - the lab is one lab. What matters is the OS column, and every page names the family it is showing.

Note the kernel versions. Ubuntu 26.04 is on a 7.x kernel; RHEL 10 is on 6.12 and will stay there for years, backporting fixes. "Newer kernel" and "newer distribution" are not the same claim, and an exam question about a kernel feature is really a question about which distribution ships it.

You do not need two machines to study. One of either family covers most of the path; the pages that genuinely need both say so. A VM or a container is enough for everything except the storage and boot pages.

/etc/os-release is the portable way to ask. lsb_release is not installed everywhere, /etc/redhat-release exists only on one family, and uname tells you the kernel rather than the distribution.

Expected resultUbuntu 26.04 LTS on kernel 7.0.0-30-generic; AlmaLinux 10.2 on 6.12.0-211.7.3.el10_2.x86_64.

Success conditionYou know which machine is which.
The four tools that differ
Package manager, firewall, access control, shell. Ask each host what it has.
bash Example session
```
$printf '%-14s %s\n' shell "$BASH_VERSION" pkg "$(command -v apt-get dpkg | tr '\n' ' ')" fw "$(command -v ufw | tr '\n' ' ')" mac "$(command -v aa-status apparmor_status 2>/dev/null | head -1)"shellpkg            /usr/bin/apt-get /usr/bin/dpkgfw             /usr/sbin/ufwmac            /usr/sbin/aa-status$printf '%-14s %s\n' shell "$BASH_VERSION" pkg "$(command -v dnf rpm | tr '\n' ' ')" fw "$(command -v firewall-cmd | tr '\n' ' ')" mac "$(command -v getenforce | tr '\n' ' ')"shellpkg            /usr/bin/dnf /usr/bin/rpmfw             /usr/bin/firewall-cmdmac            /usr/sbin/getenforce
```
Note
The blank shell field is the interesting one, and it is not a bug. $BASH_VERSION is only set when the shell you are running IS bash. The Ubuntu host's login shell is zsh, so the variable is empty - even though bash 5.3.9 is installed and is what every script on this path runs under.

Which is a Domain 4 lesson arriving early: the shebang decides the interpreter, not your login shell. A script starting #!/usr/bin/env bash runs under bash whatever you happen to be typing into. A script with no shebang is run by whatever executes it, and that is how a working script breaks when someone else runs it.

command -v is the portable existence test. which is an external program that is not installed everywhere and whose exit status is inconsistent; command -v is a shell builtin and part of POSIX. Use it in scripts.

Four pairs to keep straight: apt/dnf, ufw/firewalld, AppArmor/SELinux, and /etc/apt/sources.list.d/ against /etc/yum.repos.d/. That is most of what "family-neutral" costs you.

Expected resultUbuntu: apt-get/dpkg, ufw, aa-status - and shell is blank. RHEL: dnf/rpm, firewall-cmd, getenforce, shell 5.2.26.

Success conditionYou can identify a machine's family from its tooling in one command.
The same question, two answers
Which package owns a file - the most useful query in Domain 1.
bash Example session
```
$echo "which package owns /usr/bin/ssh?"; dpkg -S /usr/bin/sshwhich package owns /usr/bin/ssh?openssh-client: /usr/bin/ssh$echo "which package owns /usr/bin/ssh?"; rpm -qf /usr/bin/sshwhich package owns /usr/bin/ssh?openssh-clients-9.9p1-23.el10_2.alma.1.x86_64
```
Note
Even the package NAME differs - openssh-client singular on Debian, openssh-clients plural on Red Hat. Package names are not portable even when the commands inside them are identical, which is exactly why an exam question names the *command* and asks which package provides it.

dpkg -S searches, rpm -qf queries the file. The reverse direction is dpkg -L and rpm -ql. Four flags, and mixing them up is the most common fumble in this domain.

rpm answers with the full NEVRA - name, version, release, architecture - so 9.9p1-7.el10_0.x86_64 tells you it is RHEL 10's build. dpkg answers with just the name and needs dpkg -s for the version.

Both search installed packages only. For a file you do not have yet, dnf provides is built in and apt needs apt-file.

Expected resultopenssh-client: /usr/bin/ssh on Ubuntu; openssh-clients-9.9p1-7.el10_0.x86_64 on RHEL.

Success conditionYou can go from a file to its package on either family.
Access control and firewall, as found
Both machines have a mandatory access control layer and a firewall. Neither pair is configured the same.
bash Example session
```
$echo "is the mandatory access control layer on?"; aa-status --enabled 2>/dev/null && echo "AppArmor: enabled" || sudo aa-status 2>&1 | head -2is the mandatory access control layer on?sudo: aa-status: command not found$echo "is the mandatory access control layer on?"; getenforce; sestatus 2>/dev/null | head -3is the mandatory access control layer on?EnforcingSELinux status:                 enabledSELinuxfs mount:                /sys/fs/selinuxSELinux root directory:         /etc/selinux$echo "what is the firewall doing?"; sudo ufw status | head -2what is the firewall doing?sudo: ufw: command not found$echo "what is the firewall doing?"; sudo firewall-cmd --state; sudo firewall-cmd --get-default-zonewhat is the firewall doing?runningpublic
```
Note
A default Ubuntu server has NO firewall rules. ufw is installed and inactive. RHEL ships firewalld running and filtering. That is a genuine difference in security posture, and it is the correct answer to "what is blocking this port" surprisingly often.

Both have mandatory access control enforcing by default, which people assume is a Red Hat thing. AppArmor confines by *path*, SELinux by *label* - which is why relabelling (restorecon) is a SELinux concept with no AppArmor equivalent.

The two are not equally weighted in practice - SELinux is the more commonly examined and by far the more complex. Learn SELinux properly and know what AppArmor is; that is the efficient allocation for this exam even though it is not the even-handed one.

getenforce has three answers: Enforcing, Permissive, Disabled. Permissive logs violations without blocking them and is the right first step when diagnosing.

Expected resultAppArmor: enabled on Ubuntu; Enforcing and SELinux status: enabled on RHEL. Firewall: Status: inactive on Ubuntu, running in zone public on RHEL.

Success conditionYou know the default posture of each family.

Troubleshooting

$BASH_VERSION is empty.

Why: The current shell is not bash - zsh, dash or something else.

Fix:Nothing is wrong. Use a shebang in scripts; check with ps -p $$ -o comm=.
which behaves differently between hosts.

Why: It is an external program, packaged differently, and not always installed.

Fix:Use command -v - a POSIX shell builtin.
lsb_release: command not found.

Why: Not installed on a minimal system of either family.

Fix:. /etc/os-release and use $PRETTY_NAME or $ID.
A port is open on one host and blocked on the other.

Why: Ubuntu's ufw ships inactive; RHEL's firewalld ships running.

Fix:ufw status or firewall-cmd --list-all. Check before blaming the service.
A package name from a guide does not exist.

Why: Package names differ between families - openssh-client against -clients.

Fix:Search by the command: dnf provides */ssh or apt-file search bin/ssh.

Official sources

← All Linux+ guides

Linux+ lab: Ubuntu and AlmaLinux package families

This guide includes

Before you start

The two machines

The four tools that differ

The same question, two answers

Access control and firewall, as found

Troubleshooting

Official sources