Lesson 0 — Lab Setup

Pre-class~5 min

You need an Ubuntu 24.04 LTS sandbox you can break, fix, and reset. Pick the path that fits your environment. Don't use Docker — see why below.

Recommended

1. Multipass

Canonical's free tool — one command, full Ubuntu VM, snapshot/restore built in.

# macOS:    brew install --cask multipass
# Windows:  winget install Canonical.Multipass
# Linux:    sudo snap install multipass

multipass launch 24.04 --name cis-lab
multipass shell cis-lab
# inside the VM:
sudo apt update && sudo apt -y install ufw libpam-pwquality

# snapshot a clean state to roll back to
multipass stop cis-lab
multipass snapshot cis-lab --name clean
multipass start cis-lab

To roll back: multipass restore cis-lab.clean. Cleanup: multipass delete cis-lab && multipass purge.

2. Bring your own

Already have an Ubuntu 24.04 box? Use it. Minimums:

  • Ubuntu Server or Desktop 24.04 LTS
  • sudo access
  • You can break it without consequences (don't use prod)
  • Cloud (AWS/Azure/GCP), bare metal, or pre-existing VM all fine

WSL2 works for most lessons but skip the UFW lesson — Windows Defender Firewall handles inbound.

3. Class lab

Doing this as part of a class? Your instructor's slides have the join URL, credentials, and any class-specific setup notes.

If you can't find them, ask in the class chat or open uname -a on your handout's lab box and verify it's Ubuntu 24.04.

✅ Verify your lab

Whichever path you chose, run these and confirm the output:

uname -a
# Linux ... 6.8.0-... #... Ubuntu ... aarch64/x86_64 GNU/Linux

lsb_release -a
# Distributor ID: Ubuntu
# Description:    Ubuntu 24.04 LTS
# Release:        24.04
# Codename:       noble

If anything looks off, fix it before moving on — every following lesson assumes a working Ubuntu 24.04 LTS shell with sudo.

Why not Docker?
Containers share the host kernel. Many CIS controls — kernel sysctls, mount options, AppArmor profiles, auditd rules, partition layout — either don't apply or behave very differently inside a container. You'd be teaching yourself habits that don't transfer to real servers. Use a real VM.