$ systemctl is-system-running --wait
[rc=0]
running

$ systemctl --failed --no-legend
[rc=0]

$ systemctl is-enabled aidecheck.timer dailyaidecheck.timer 2>&1; systemctl list-timers --all --no-legend 2>/dev/null | grep -i aide
[rc=0]
enabled
masked
Tue 2026-11-03 05:00:00 UTC       6h -                           - aidecheck.timer              aidecheck.service

$ systemctl is-active ttn-firstboot.service; sudo test -f /var/lib/ttn/firstboot.done && echo firstboot.done
[rc=0]
active
firstboot.done

$ sudo grep -c '^\s*set superusers=' /boot/grub/grub.cfg; sudo grep -c -- '--unrestricted' /boot/grub/grub.cfg
[rc=0]
1
5

$ findmnt /tmp
[rc=0]
TARGET SOURCE FSTYPE OPTIONS
/tmp   tmpfs  tmpfs  rw,nosuid,nodev,noexec,relatime,nr_inodes=1048576,inode64

$ sudo ufw status verbose
[rc=0]
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere                  
25 on lo                   ALLOW IN    Anywhere                   # ttn: loopback-only listener
323 on lo                  ALLOW IN    Anywhere                   # ttn: loopback-only listener
53 on lo                   ALLOW IN    Anywhere                   # ttn: loopback-only listener
68/udp                     ALLOW IN    67/udp                     # ttn: DHCP client (already allowed by before.rules)
22/tcp (v6)                ALLOW IN    Anywhere (v6)             
25 (v6) on lo              ALLOW IN    Anywhere (v6)              # ttn: loopback-only listener
323 (v6) on lo             ALLOW IN    Anywhere (v6)              # ttn: loopback-only listener
53 (v6) on lo              ALLOW IN    Anywhere (v6)              # ttn: loopback-only listener
68/udp (v6)                ALLOW IN    67/udp (v6)                # ttn: DHCP client (already allowed by before.rules)


$ systemctl is-active chrony; chronyc -n sources | head -5
[rc=0]
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 23.186.168.131                2   6    37    40   +253us[ +242us] +/-   56ms
^- 104.232.0.123                 2   6    37    41   -147us[ -177us] +/-   33ms
^- 172.234.25.10                 2   6    37    40   -329us[ -340us] +/-   70ms

$ sudo aa-status --enabled && echo apparmor-enabled; sudo aa-status | grep -E 'profiles are|processes are'
[rc=0]
apparmor-enabled
107 profiles are loaded.
8 profiles are in enforce mode.
99 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
2 processes are in enforce mode.
0 processes are in complain mode.
0 processes are in prompt mode.
0 processes are in kill mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.

$ sudo aa-status --json | python3 -c "import json,sys; d=json.load(sys.stdin)['profiles']; print([k for k,v in d.items() if v not in ('enforce','complain')])"
[rc=0]
[]

$ id admin
[rc=0]
uid=1000(admin) gid=1000(admin) groups=1000(admin),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),1001(sshusers)

$ sudo sshd -T | grep -Ei '^(permitrootlogin|passwordauthentication|allowgroups)'
[rc=0]
permitrootlogin no
passwordauthentication no
allowgroups sshusers

$ sudo passwd -S root
[rc=0]
root L 2026-10-26 0 99999 7 -1

$ journalctl --disk-usage
[rc=0]
Archived and active journals take up 16M in the file system.

$ sudo ls /etc/ssh/ssh_host_*_key.pub
[rc=0]
/etc/ssh/ssh_host_ecdsa_key.pub
/etc/ssh/ssh_host_ed25519_key.pub
/etc/ssh/ssh_host_rsa_key.pub

$ cat /etc/machine-id
[rc=0]
ec279c2c74ca88b81f093e13d3cb887f