$ systemctl is-system-running --wait
[rc=0]
running

$ systemctl --failed --no-legend
[rc=0]

$ systemctl is-enabled aidecheck.timer dailyaidecheck.timer 2>&1; systemctl list-timers --all --no-legend 2>/dev/null | grep -i aide
[rc=1]
not-found
not-found

$ systemctl is-active ttn-firstboot.service; sudo test -f /var/lib/ttn/firstboot.done && echo firstboot.done
[rc=0]
active
firstboot.done

$ sudo test -s /boot/grub2/user.cfg && echo user.cfg-OK; sudo grep -c '^\s*set superusers=' /boot/grub2/grub.cfg
[rc=0]
user.cfg-OK
1

$ findmnt /tmp
[rc=0]
TARGET SOURCE FSTYPE OPTIONS
/tmp   tmpfs  tmpfs  rw,nosuid,nodev,noexec,relatime,seclabel,inode64

$ getenforce
[rc=0]
Enforcing

$ sudo firewall-cmd --state; sudo firewall-cmd --list-all
[rc=0]
running
public (default, active)
  target: default
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

$ id ec2-user
[rc=0]
uid=1000(ec2-user) gid=1000(ec2-user) groups=1000(ec2-user),4(adm),190(systemd-journal),1002(sshusers)

$ sudo sshd -T | grep -Ei '^(permitrootlogin|passwordauthentication|allowgroups)'
[rc=0]
permitrootlogin no
passwordauthentication no
allowgroups sshusers

$ sudo passwd -S root; sudo chage -l root | head -3
[rc=0]
root P 2026-11-02 0 365 7 -1
Last password change					: Nov 02, 2026
Password expires					: Nov 02, 2027
Password inactive					: never

$ systemctl is-active rsyslog; journalctl --disk-usage
[rc=0]
inactive
Archived and active journals take up 16M in the file system.

$ sudo ls /etc/ssh/ssh_host_*_key.pub
[rc=0]
/etc/ssh/ssh_host_ecdsa_key.pub
/etc/ssh/ssh_host_ed25519_key.pub
/etc/ssh/ssh_host_rsa_key.pub

$ cat /etc/machine-id
[rc=0]
ec2e23913cbb428fdebb858a405de771

$ sudo test -x /usr/local/sbin/ttn-cis-audit && echo ttn-cis-audit-OK || echo ttn-cis-audit-LIPSA
[rc=0]
ttn-cis-audit-OK