Ubuntu

Turn "we need to run Ubuntu servers safely" into an actionable posture: stable release choices, minimal exposure, predictable patching, and operational discipline.

Workflow

1. Clarify system boundary and goals (host vs fleet, prod vs dev, RPO/RTO).
2. Choose release posture (LTS by default for production).
3. Decide deployment model (immutable images vs in-place upgrades).
4. Define access and identity posture (users, sudo, SSH, MFA, break-glass).
5. Reduce exposed services and ports.
6. Set patching and reboot policy.
7. Apply host hardening (AppArmor, systemd sandboxing).
8. Configure logging, backups, and monitoring.
9. Plan upgrades with staging/canary steps.